CNF-23818: machineconfigpools: avoid RTE pods duplication when single node matching multiple MCPs

bundle/manifests/numaresources-operator.clusterserviceversion.yaml

@@ -66,7 +66,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2026-05-13T12:16:00Z"
+    createdAt: "2026-06-02T08:17:10Z"
     features.operators.openshift.io/cnf: "true"
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"
@@ -394,7 +394,9 @@ spec:
           resources:
           - nodes
           verbs:
+          - get
           - list
+          - patch
           - watch
         - apiGroups:
           - ""
@@ -463,10 +465,10 @@ spec:
           - nodetopology.openshift.io
           resources:
           - numaresourcesoperators
-          - numaresourcesschedulers
           verbs:
           - get
           - list
+          - update
           - watch
         - apiGroups:
           - nodetopology.openshift.io
@@ -484,6 +486,14 @@ spec:
           - get
           - patch
           - update
+        - apiGroups:
+          - nodetopology.openshift.io
+          resources:
+          - numaresourcesschedulers
+          verbs:
+          - get
+          - list
+          - watch
         - apiGroups:
           - rbac.authorization.k8s.io
           resources:

config/rbac/role.yaml

@@ -23,7 +23,9 @@ rules:
   resources:
   - nodes
   verbs:
+  - get
   - list
+  - patch
   - watch
 - apiGroups:
   - ""
@@ -92,10 +94,10 @@ rules:
   - nodetopology.openshift.io
   resources:
   - numaresourcesoperators
-  - numaresourcesschedulers
   verbs:
   - get
   - list
+  - update
   - watch
 - apiGroups:
   - nodetopology.openshift.io
@@ -113,6 +115,14 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - nodetopology.openshift.io
+  resources:
+  - numaresourcesschedulers
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:

internal/api/labels/labels.go

@@ -0,0 +1,29 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+const (
+	// NodePrimaryPool is set on each node managed by NRO to indicate
+	// its primary pool (MCP on OpenShift, node-pool on HyperShift).
+	// Using this exclusive label as DaemonSet NodeSelector prevents duplicate
+	// pods when a node's labels match multiple pools.
+	NodePrimaryPool = "numa-operator.openshift.io/primary-pool"
+
+	// NodeFinalizer is set on the NUMAResourcesOperator CR to ensure
+	// node labels are cleaned up when the CR is deleted.
+	NodeFinalizer = "numa-operator.openshift.io/node-labels"
+)

internal/controller/numaresourcesoperator_controller.go

@@ -57,7 +57,9 @@ import (
 	"github.com/openshift-kni/numaresources-operator/api/v1/helper/namespacedname"
 	nodegroupv1 "github.com/openshift-kni/numaresources-operator/api/v1/helper/nodegroup"
 	"github.com/openshift-kni/numaresources-operator/internal/api/annotations"
+	nrolabels "github.com/openshift-kni/numaresources-operator/internal/api/labels"
 	"github.com/openshift-kni/numaresources-operator/internal/dangling"
+	"github.com/openshift-kni/numaresources-operator/internal/nodes"
 	intreconcile "github.com/openshift-kni/numaresources-operator/internal/reconcile"
 	"github.com/openshift-kni/numaresources-operator/internal/relatedobjects"
 	"github.com/openshift-kni/numaresources-operator/pkg/apply"
@@ -119,8 +121,8 @@ type NUMAResourcesOperatorReconciler struct {
 //+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=*
 //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=*
 //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
-//+kubebuilder:rbac:groups="",resources=nodes,verbs=list
-//+kubebuilder:rbac:groups=nodetopology.openshift.io,resources=numaresourcesoperators,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=nodes,verbs=get;list;watch;patch
+//+kubebuilder:rbac:groups=nodetopology.openshift.io,resources=numaresourcesoperators,verbs=get;list;watch;update
 //+kubebuilder:rbac:groups=nodetopology.openshift.io,resources=numaresourcesoperators/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=nodetopology.openshift.io,resources=numaresourcesoperators/finalizers,verbs=update
 
@@ -146,6 +148,26 @@ func (r *NUMAResourcesOperatorReconciler) Reconcile(ctx context.Context, req ctr
 		return ctrl.Result{}, err
 	}
 
+	if !instance.DeletionTimestamp.IsZero() {
+		if controllerutil.ContainsFinalizer(instance, nrolabels.NodeFinalizer) {
+			if err := nodes.RemoveAllLabels(ctx, r.Client); err != nil {
+				return ctrl.Result{}, fmt.Errorf("failed to clean up node labels: %w", err)
+			}
+			controllerutil.RemoveFinalizer(instance, nrolabels.NodeFinalizer)
+			if err := r.Update(ctx, instance); err != nil {
+				return ctrl.Result{}, err
+			}
+		}
+		return ctrl.Result{}, nil
+	}
+
+	if !controllerutil.ContainsFinalizer(instance, nrolabels.NodeFinalizer) {
+		controllerutil.AddFinalizer(instance, nrolabels.NodeFinalizer)
+		if err := r.Update(ctx, instance); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
 	initialInstance := instance.DeepCopy()
 	if len(initialInstance.Status.Conditions) == 0 {
 		instance.Status.Conditions = status.NewNUMAResourcesOperatorConditions()
@@ -298,6 +320,10 @@ func (r *NUMAResourcesOperatorReconciler) reconcileResource(ctx context.Context,
 		}
 	}
 
+	if err := nodes.LabelForTrees(ctx, r.Client, r.Platform, trees); err != nil {
+		return intreconcile.StepFailed(fmt.Errorf("failed to label nodes for primary pools: %w", err))
+	}
+
 	dsPerPool, step := r.reconcileResourceDaemonSet(ctx, instance, existing, trees)
 	if step.EarlyStop() {
 		return step
@@ -618,12 +644,29 @@ func (r *NUMAResourcesOperatorReconciler) SetupWithManager(mgr ctrl.Manager) err
 		return ok
 	})
 
+	nodePredicates := predicate.Funcs{
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			if !validateUpdateEvent(&e) {
+				return false
+			}
+			_, oldHas := e.ObjectOld.GetLabels()[nrolabels.NodePrimaryPool]
+			_, newHas := e.ObjectNew.GetLabels()[nrolabels.NodePrimaryPool]
+			if oldHas || newHas {
+				return true
+			}
+			return !apiequality.Semantic.DeepEqual(e.ObjectOld.GetLabels(), e.ObjectNew.GetLabels())
+		},
+	}
+
 	b := ctrl.NewControllerManagedBy(mgr).For(&nropv1.NUMAResourcesOperator{})
 	if r.Platform == platform.OpenShift {
 		b.Watches(
 			&machineconfigv1.MachineConfigPool{},
 			handler.EnqueueRequestsFromMapFunc(r.mcpToNUMAResourceOperator),
 			builder.WithPredicates(mcpPredicates)).
+			Watches(&corev1.Node{},
+				handler.EnqueueRequestsFromMapFunc(r.nodeToNUMAResourceOperator),
+				builder.WithPredicates(nodePredicates)).
 			Owns(&securityv1.SecurityContextConstraints{}).
 			Owns(&machineconfigv1.MachineConfig{}, builder.WithPredicates(p))
 	}
@@ -676,6 +719,14 @@ func (r *NUMAResourcesOperatorReconciler) mcpToNUMAResourceOperator(ctx context.
 	return requests
 }
 
+func (r *NUMAResourcesOperatorReconciler) nodeToNUMAResourceOperator(ctx context.Context, nodeObj client.Object) []reconcile.Request {
+	return []reconcile.Request{{
+		NamespacedName: client.ObjectKey{
+			Name: objectnames.DefaultNUMAResourcesOperatorCrName,
+		},
+	}}
+}
+
 func nodeGroupMatchesMCP(nodeGroup nropv1.NodeGroup, mcpName string, mcpLabels labels.Set) bool {
 	if nodeGroup.PoolName != nil {
 		return mcpName == *nodeGroup.PoolName