fix: hash NicNodePolicy DaemonSet names

[almaslennikov]

Summary

• use one deterministic policy-name hash suffix for NicNodePolicy-owned OFED, RDMA shared device plugin, and SR-IOV device plugin DaemonSets
• preserve all existing NicClusterPolicy DaemonSet names
• render NNP DaemonSets as:
  • mofed-<os>-<kernel-hash>-<policy-name-hash>-ds
  • rdma-shared-dp-ds-<policy-name-hash>
  • network-operator-sriov-device-plugin-<policy-name-hash>
• use the hashed OFED identity consistently in DaemonSet metadata, selectors, and pod labels
• preserve readable ds-owner values, policy-specific ConfigMap names, and the RDMA app selector used by SOS report discovery
• centralize the shared hashed suffix helper and update focused render tests and heterogeneous-cluster documentation

This is a follow-up to #3019 and replaces direct policy-name suffixes in NicNodePolicy-owned DaemonSet names.

Verification

• CGO_ENABLED=0 go build ./...
• CGO_ENABLED=0 go test ./pkg/state/... -count=1
• CGO_ENABLED=0 make lint
• bash -n scripts/sosreport/generate-maps.sh scripts/sosreport/kubectl-netop_sosreport scripts/sosreport/test-sosreport.sh
• verified the OFED SOS component selector remains nvidia.com/ofed-driver=
• verified the RDMA SOS component key remains rdma-shared-dp-ds with selector app=rdma-shared-dp__NAME_SUFFIX__

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Summary

The PR centralizes the existing deterministic hash helper and uses hashed NicNodePolicy identities for OFED, RDMA shared-device-plugin, and SR-IOV device-plugin DaemonSet names while preserving NicClusterPolicy names.

• Keeps readable policy suffixes for policy-specific ConfigMaps and the RDMA diagnostic selector.
• Updates runtime templates, focused rendering tests, and heterogeneous-cluster documentation.
• No new follow-up-eligible blocking issue was identified.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the scope of the prior review thread.

No blocking failure remains.

Important Files Changed

Filename	Overview
pkg/state/state_skel.go	Centralizes the deterministic FNV-based hash helper and introduces the shared hashed NicNodePolicy suffix.
pkg/state/state_ofed.go	Switches NicNodePolicy-owned OFED DaemonSet names and selector labels to the shared hashed suffix while preserving NicClusterPolicy naming.
pkg/state/state_rdma_shared_device_plugin.go	Separates the hashed DaemonSet-name suffix from the readable suffix retained for selectors and ConfigMaps.
pkg/state/state_sriov_dp.go	Replaces readable NicNodePolicy SR-IOV DaemonSet suffixes with the shared deterministic hash.
manifests/state-ofed-driver/0050_ofed-driver-ds.yaml	Applies the dedicated DaemonSet suffix consistently to OFED identity and selector labels.
manifests/state-rdma-shared-device-plugin/0060_rdma-shared-dev-plugin-ds.yaml	Uses the hashed suffix only for DaemonSet identity while retaining the readable app selector.
docs/heterogeneous-cluster-support.md	Documents hashed NicNodePolicy DaemonSet naming and the readable identities intentionally retained elsewhere.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  NCP[NicClusterPolicy] --> Existing[Existing DaemonSet names]
  NNP[NicNodePolicy name] --> Hash[Deterministic policy-name hash]
  Hash --> OFED[OFED DaemonSet suffix]
  Hash --> RDMA[RDMA DaemonSet suffix]
  Hash --> SRIOV[SR-IOV DaemonSet suffix]
  NNP --> Readable[Readable policy suffix]
  Readable --> ConfigMaps[Policy-specific ConfigMaps]
  Readable --> Selector[RDMA app selector]

Loading

_{Reviews (3): Last reviewed commit: "fix: hash NicNodePolicy DaemonSet names" | Re-trigger Greptile}

[greptile-apps]

32-bit policy-name hash collisions

The 32-bit FNV hash makes distinct policy names capable of resolving to the same DaemonSet name. Such policies then reconcile one Kubernetes object and overwrite its specification and ds-owner label, preventing both device-plugin configurations from being deployed reliably; use a collision-resistant policy identity instead.

Knowledge Base Used: NicClusterPolicy Reconcile Flow

[almaslennikov]

This intentionally reuses the existing OFED getStringHash mechanism, so the policy-name suffix has the same collision profile as current OFED DaemonSet naming. The amended change centralizes that existing helper and applies it consistently to both SR-IOV and RDMA shared device plugin DaemonSets. Replacing the algorithm itself would also rename existing OFED DaemonSets and needs separate migration semantics, so it is outside this targeted follow-up.

[greptile-apps]

Fair point — the collision risk here is no worse than what already exists for OFED DaemonSet names, and this PR's goal is consistency rather than algorithm improvement. Fixing the underlying hash is a separate concern that warrants its own migration story.

Shall I remember this as a rule: "do not flag getStringHash collision risk on SR-IOV or RDMA DaemonSet names — the algorithm intentionally matches the existing OFED naming scheme and changing it requires separate migration semantics"?

[almaslennikov]

Expanded the change in amended commit c661295e:

1. RDMA shared device plugin: NicNodePolicy DaemonSets now use rdma-shared-dp-ds-<policy-name-hash>; the readable app label and ConfigMap suffix remain unchanged.
2. Shared implementation: moved the existing OFED hash helper into common state code and use one hashed-suffix helper for both device plugins.
3. 32-bit collision feedback: retained the existing OFED algorithm intentionally for naming consistency; changing that algorithm would rename OFED DaemonSets and requires a separate migration design.

Verified with CGO_ENABLED=0 go build ./..., CGO_ENABLED=0 go test ./pkg/state/... -count=1, CGO_ENABLED=0 make lint, Bash syntax checks, and the generated RDMA SOS selector invariant.

[almaslennikov]

Unified all three naming paths in amended commit 45bedbf5:

1. OFED: NicNodePolicy DaemonSet names and matching app labels now use the shared policy-name hash instead of the full policy name.
2. RDMA and SR-IOV: retain the same hashed suffix introduced earlier, now backed by the common helper used by OFED.
3. Readable identity: ds-owner, policy-specific ConfigMaps, and the RDMA app label continue to retain the policy name where length is safe and operationally useful.
4. Compatibility: NicClusterPolicy DaemonSet names remain unchanged, and SOS collection continues to use stable component labels.

Verified with CGO_ENABLED=0 go build ./..., CGO_ENABLED=0 go test ./pkg/state/... -count=1, CGO_ENABLED=0 make lint, Bash syntax checks, and focused SOS selector invariants.

[almaslennikov]

/retest-nic_operator_helm