NCP-AIN · Domain 4 of 6

NCP-AIN Domain 4: Kubernetes Integration

This domain covers bringing NVIDIA networking into Kubernetes: deploying the NVIDIA Network Operator to manage RDMA interfaces and InfiniBand networks for pods, and verifying that drivers, device plugins and secondary networks work.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~4
Suggested study time estimate
5–8 hrs

About 9 min read Reviewed October 2026

Overview

Domain 4 has two official objectives. The first is deploying the NVIDIA Network Operator, usually with Helm, so it can install the DOCA driver container on nodes, run RDMA shared device or SR-IOV device plugins, deploy Multus and secondary network plugins, and manage IP address assignment for those networks. The operator is driven by a NicClusterPolicy custom resource, while network resources such as MacvlanNetwork, HostDeviceNetwork and IPoIBNetwork attach pods to the fabric.

The second objective is verifying that the operator works: checking pod status in its namespace, confirming that nodes advertise RDMA resources, and running a test workload that exchanges RDMA traffic. At 5% this domain yields only a few questions, but it ties the fabric to the platforms where AI jobs actually run, often alongside the NVIDIA GPU Operator for GPUDirect RDMA.

How it's tested

Questions in this domain present a Kubernetes cluster that needs RDMA or InfiniBand access for pods, or an operator deployment that is not working. You pick the component, custom resource or verification step. Expect references to Helm, NicClusterPolicy, Multus, device plugins and node resources such as rdma/rdma_shared_device_a.

  • Choose the component

    A requirement such as a dedicated virtual function per pod or shared RDMA access is described, and you pick the plugin or network type.

  • Find the config object

    A deployment detail must change, and you identify whether it belongs in NicClusterPolicy or in a network custom resource.

  • Verify the result

    An operator has been installed, and you choose the command or test that proves pods can use RDMA.

Reasoning it through

Pods in a training job fail to schedule with an insufficient rdma/rdma_shared_device_a message. The resource name shows the job expects the RDMA shared device plugin. Checking the NicClusterPolicy and the plugin pods, then running kubectl describe node to see whether the resource is advertised, identifies whether the plugin is missing or misconfigured.

Objectives 2

Official objectives from the NVIDIA outline, in outline order.

4.1 Deploy the NVIDIA Network Operator to manage RDMA interfaces and InfiniBand networks within Kubernetes clustersInstalling the operator and its networking components.
What it means
The NVIDIA Network Operator automates the networking stack that RDMA workloads need in Kubernetes. Installed with a Helm chart, it uses a NicClusterPolicy to deploy the DOCA driver container, device plugins, Multus, container network plugins and IPAM on selected nodes.
What to understand
Choose the RDMA shared device plugin when many pods share a NIC, or the SR-IOV network device plugin with virtual functions when pods need dedicated interfaces. Secondary networks are defined with MacvlanNetwork, HostDeviceNetwork or IPoIBNetwork resources, and ib-kubernetes can apply InfiniBand PKeys to pods. The GPU Operator is commonly deployed too, for GPUDirect RDMA.
How it shows up
A cluster requirement is described, and you choose the operator component, plugin or network resource to deploy.
Common confusion
Expecting the default pod network to carry RDMA; RDMA uses a secondary network through Multus.
4.2 Verify NVIDIA Network Operator functionalityConfirming drivers, plugins and RDMA connectivity in pods.
What it means
Verification shows that the operator has deployed everything and that pods can actually use RDMA. It covers operator and component pod health, the status of the NicClusterPolicy, node resource advertisement and an end-to-end traffic test.
What to understand
Check that pods in the nvidia-network-operator namespace are Running and the NicClusterPolicy reports ready. Use kubectl describe node to confirm RDMA or SR-IOV resources appear under capacity and allocatable. Launch two test pods on the secondary network, confirm the interface with ip addr or ibv_devices, and run ib_write_bw between them.
How it shows up
An installation is complete, and you pick the check or test that proves RDMA works for pods.
Common confusion
Assuming Running pods prove RDMA works; only a traffic test between pods confirms the data path.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • NVIDIA Network Operator

    Kubernetes operator that deploys the RDMA networking stack.

    Remember
    Installed with Helm.
    Tested as
    Deployment questions.
    Trap
    Confusing it with the GPU Operator.

  • NicClusterPolicy

    Custom resource that defines which operator components run.

    Remember
    Holds driver, plugin and secondary network settings.
    Tested as
    Configuration questions.
    Trap
    Editing node files manually instead.

  • DOCA driver container

    Containerized host driver deployed by the operator.

    Remember
    Replaces a manually installed driver on nodes.
    Tested as
    Driver questions.
    Trap
    Installing conflicting host drivers.

  • RDMA shared device plugin

    Lets many pods share an RDMA NIC.

    Remember
    Advertises resources like rdma/rdma_shared_device_a.
    Tested as
    Plugin choice.
    Trap
    Expecting per-pod isolation.

  • SR-IOV network device plugin

    Gives pods dedicated virtual functions.

    Remember
    Better isolation and performance per pod.
    Tested as
    Plugin choice.
    Trap
    Forgetting to enable VFs on the NIC.

  • Multus

    CNI meta-plugin that attaches multiple networks to a pod.

    Remember
    Required for the secondary RDMA network.
    Tested as
    Network attachment questions.
    Trap
    Using only the default CNI.

  • IPoIBNetwork

    Network resource for IP over InfiniBand interfaces in pods.

    Remember
    Used on InfiniBand fabrics.
    Tested as
    Network type questions.
    Trap
    Using MacvlanNetwork on InfiniBand.

  • ib-kubernetes

    Component that applies InfiniBand PKeys to pod interfaces.

    Remember
    Works with UFM partitions.
    Tested as
    InfiniBand tenancy in Kubernetes.
    Trap
    Assuming namespaces isolate the fabric.

  • GPU Operator pairing

    GPU Operator enables GPUDirect RDMA alongside the Network Operator.

    Remember
    Both are needed for GPU-to-NIC data paths.
    Tested as
    Integration questions.
    Trap
    Expecting the Network Operator to manage GPUs.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Device plugin options

ConceptMeaningKey differenceCommon trap
RDMA shared device plugin Many pods share one NIC Simple, less isolation Assuming dedicated bandwidth
SR-IOV network device plugin Each pod gets a virtual function Stronger isolation Not configuring VFs first
Host device network Passes a host interface into a pod Exclusive use of the device Using it for many pods

Network Operator vs. GPU Operator

ConceptMeaningKey differenceCommon trap
Network Operator NIC drivers, RDMA plugins, secondary networks Networking stack Expecting GPU driver install
GPU Operator GPU drivers, toolkit, device plugin GPU stack and peer memory Expecting RDMA network setup

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Default CNI carries RDMA

    What candidates pick
    Attach RDMA workloads only to the cluster's default network.
    Why it looks right
    Every pod already has a network.
    Why it's wrong
    The default CNI does not expose RDMA devices; a secondary network through Multus is required.

    Clue to watch for Pods need RDMA or InfiniBand access.

  2. GPU Operator does networking

    What candidates pick
    Use the GPU Operator to deploy RDMA plugins.
    Why it looks right
    Both are NVIDIA operators.
    Why it's wrong
    The GPU Operator manages GPU software; the Network Operator deploys NIC drivers, RDMA plugins and secondary networks.

    Clue to watch for Requirement is about NIC or RDMA resources.

  3. Running means working

    What candidates pick
    Declare success when operator pods are Running.
    Why it looks right
    Running status looks healthy.
    Why it's wrong
    Pods can run while resources are not advertised or the data path fails; node resources and a traffic test confirm it.

    Clue to watch for The question asks how to verify functionality.

  4. Shared plugin isolates

    What candidates pick
    Choose the RDMA shared device plugin for strict per-pod isolation.
    Why it looks right
    It is the simplest plugin.
    Why it's wrong
    Shared devices are used by many pods; SR-IOV virtual functions give each pod its own interface.

    Clue to watch for Requirement mentions dedicated or isolated interfaces.

  5. Namespaces isolate InfiniBand

    What candidates pick
    Rely on Kubernetes namespaces to separate tenants on the fabric.
    Why it looks right
    Namespaces separate Kubernetes objects.
    Why it's wrong
    Namespaces do not affect fabric traffic; InfiniBand isolation requires PKeys applied through ib-kubernetes.

    Clue to watch for Tenants share an InfiniBand fabric.

Answer framework

Apply these steps to Kubernetes networking questions about RDMA and InfiniBand.

  1. Confirm the requirement is about networking, which points to the Network Operator, rather than GPU software handled by the GPU Operator.
  2. Choose the device plugin based on whether pods share a NIC or need dedicated SR-IOV virtual functions; the RDMA shared device plugin suits sharing, while the SR-IOV device plugin hands each pod its own VF.
  3. Select the secondary network resource that matches the fabric, such as IPoIBNetwork for InfiniBand or MacvlanNetwork for Ethernet RoCE.
  4. Place cluster-wide component settings in the NicClusterPolicy and network-specific settings in the network custom resources, which Multus then attaches to pods as secondary interfaces through annotations.
  5. Verify with operator pod status, node allocatable resources and an RDMA bandwidth test between two pods on the secondary network.

Practice question

After installing the NVIDIA Network Operator with Helm, an engineer wants to confirm that nodes can schedule pods requesting RDMA resources. Which check most directly shows this?

Want more like this? The NCP-AIN practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain is small, so aim for focused, practical coverage rather than deep Kubernetes theory. Begin with the NVIDIA Network Operator documentation and its deployment guide for Kubernetes. Read a sample NicClusterPolicy and label each section: driver, device plugin, secondary network and IPAM. Make sure you can say what each part deploys.

Next, compare the RDMA shared device plugin and the SR-IOV network device plugin, and learn which network custom resource fits InfiniBand versus RoCE. Note how ib-kubernetes and UFM extend partition keys into pods, since that links back to Domain 3.

If you have a small cluster or a lab environment, install the operator with Helm and run two test pods that exchange ib_write_bw traffic. If not, read the verification sections of the guide and write out the commands you would run. Finally, skim the GPU Operator material on GPUDirect RDMA so you can separate the two operators' responsibilities when questions mix them.

FAQ

How much of NCP-AIN is Kubernetes Integration?

Kubernetes Integration is 5% of the exam, a few questions, covering two official objectives on deploying and verifying the Network Operator.

What does the NVIDIA Network Operator do?

It deploys and manages the NIC driver container, RDMA or SR-IOV device plugins, Multus, secondary network plugins and IPAM so pods can use RDMA.

What is a NicClusterPolicy?

The custom resource that tells the Network Operator which components to deploy and how to configure them across the cluster.

Why do RDMA pods need Multus?

The default pod network does not provide RDMA devices. Multus attaches a secondary network interface backed by the RDMA-capable NIC.

How do I verify the operator works?

Check operator pods and policy status, confirm RDMA resources on nodes, then run an RDMA test such as ib_write_bw between two pods.

Do I need the GPU Operator too?

For GPUDirect RDMA, usually yes. The GPU Operator provides GPU drivers and peer memory support, while the Network Operator handles networking.

Other Artificial Intelligence & Machine Learning certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered deploying the NVIDIA Network Operator and verifying RDMA for pods. Test whether you can pick the right component and check under exam timing.

Take the NCP-AIN practice test Check your NCP-AIN readiness

Keep going