From 9c272c85c66e7cc934fc8517a91f069c35ad605b Mon Sep 17 00:00:00 2001
From: Talor Itzhak <titzhak@redhat.com>
Date: Tue, 18 May 2021 15:05:18 +0300
Subject: [PATCH] Get Topology Manager policy from configz-endpoint

This patch allows nfd-master to pull the config from the Kubernetes configz endpoint.
This update introduces --obtain-kubelet-config=<option> as it provides the option to obtain Kubelet config from configz-endpoint in addition to the already existing way of obtaining kubelet-config-file.

Co-authored-by: Killian Muldoon <killian.muldoon@intel.com>
Signed-off-by: Killian Muldoon <killian.muldoon@intel.com>
Signed-off-by: Talor Itzhak <titzhak@redhat.com>
---
 cmd/nfd-topology-updater/main.go              | 87 +++++++++++--------
 cmd/nfd-topology-updater/main_test.go         |  3 +
 go.mod                                        |  2 +-
 go.sum                                        |  2 -
 .../nfd-daemonset-combined.yaml.template      |  1 +
 ...nset-master-topology-updater.yaml.template |  2 +
 manifests/nfd-master.yaml.template            |  1 +
 ...d-topology-updater-daemonset.yaml.template |  1 +
 .../nfd-topology-updater-job.yaml.template    |  1 +
 pkg/apihelper/apihelpers.go                   |  4 +
 pkg/apihelper/k8shelpers.go                   | 45 ++++++++++
 pkg/nfd-master/nfd-master.go                  | 22 +++++
 pkg/resourcemonitor/types.go                  | 11 +--
 test/e2e/topology_updater.go                  | 25 +++++-
 test/e2e/utils/rbac.go                        | 12 ++-
 15 files changed, 172 insertions(+), 47 deletions(-)

diff --git a/cmd/nfd-topology-updater/main.go b/cmd/nfd-topology-updater/main.go
index cd6bbf5994..69ef7a2d1e 100644
--- a/cmd/nfd-topology-updater/main.go
+++ b/cmd/nfd-topology-updater/main.go
@@ -36,6 +36,12 @@ const (
 	ProgramName = "nfd-topology-updater"
 )
 
+// Options to obtain Kubelet config file
+const (
+	KubeletFile = "kubelet-config-file"
+	Configz     = "configz-endpoint"
+)
+
 func main() {
 	// Assert that the version is known
 	if version.Undefined() {
@@ -47,12 +53,15 @@ func main() {
 		log.Fatalf("failed to parse command line: %v", err)
 	}
 
-	klConfig, err := kubeconf.GetKubeletConfigFromLocalFile(resourcemonitorArgs.KubeletConfigFile)
-	if err != nil {
-		log.Fatalf("error getting topology Manager Policy: %v", err)
-	}
-	tmPolicy := klConfig.TopologyManagerPolicy
-	log.Printf("Detected kubelet Topology Manager policy %q", tmPolicy)
+	var tmPolicy string
+	if resourcemonitorArgs.KubeletConfigObtainOpt == KubeletFile {
+		klConfig, err := kubeconf.GetKubeletConfigFromLocalFile(resourcemonitorArgs.KubeletConfigFile)
+		if err != nil {
+			log.Fatalf("error getting topology Manager Policy: %v", err)
+		}
+		tmPolicy = klConfig.TopologyManagerPolicy
+		log.Printf("Detected kubelet Topology Manager policy %q", tmPolicy)
+	} // Otherwise get TopologyManagerPolicy from configz-endpoint
 
 	podResClient, err := podres.GetPodResClient(resourcemonitorArgs.PodResourceSocketPath)
 	if err != nil {
@@ -125,38 +134,41 @@ func argsParse(argv []string) (topology.Args, resourcemonitor.Args, error) {
   %s [--no-publish] [--oneshot | --sleep-interval=<seconds>] [--server=<server>]
 	   [--server-name-override=<name>] [--ca-file=<path>] [--cert-file=<path>]
 		 [--key-file=<path>] [--container-runtime=<runtime>] [--podresources-socket=<path>]
-		 [--watch-namespace=<namespace>] [--sysfs=<mountpoint>] [--kubelet-config-file=<path>]
+		 [--watch-namespace=<namespace>] [--sysfs=<mountpoint>] [--obtain-kubelet-config=<option>] [--kubelet-config-file=<path>]
 
   %s -h | --help
   %s --version
 
   Options:
-  -h --help                       Show this screen.
-  --version                       Output version and exit.
-  --ca-file=<path>                Root certificate for verifying connections
-                                  [Default: ]
-  --cert-file=<path>              Certificate used for authenticating connections
-                                  [Default: ]
-  --key-file=<path>               Private key matching --cert-file
-                                  [Default: ]
-  --server=<server>               NFD server address to connect to.
-                                  [Default: localhost:8080]
-  --server-name-override=<name>   Name (CN) expect from server certificate, useful
-                                  in testing
-                                  [Default: ]
-  --no-publish                    Do not publish discovered features to the
-                                  cluster-local Kubernetes API server.
-  --oneshot                       Update once and exit.
-  --sleep-interval=<seconds>      Time to sleep between re-labeling. Non-positive
-                                  value implies no re-labeling (i.e. infinite
-                                  sleep). [Default: 60s]
-  --watch-namespace=<namespace>   Namespace to watch pods for. Use "" for all namespaces.
-  --sysfs=<mountpoint>            Mount point of the sysfs.
-                                  [Default: /host]
-  --kubelet-config-file=<path>    Kubelet config file path.
-                                  [Default: /podresources/config.yaml]
-  --podresources-socket=<path>    Pod Resource Socket path to use.
-                                  [Default: /podresources/kubelet.sock] `,
+  -h --help                        Show this screen.
+  --version                        Output version and exit.
+  --ca-file=<path>                 Root certificate for verifying connections
+                                   [Default: ]
+  --cert-file=<path>               Certificate used for authenticating connections
+                                   [Default: ]
+  --key-file=<path>                Private key matching --cert-file
+                                   [Default: ]
+  --server=<server>                NFD server address to connect to.
+                                   [Default: localhost:8080]
+  --server-name-override=<name>    Name (CN) expect from server certificate, useful
+                                   in testing
+                                   [Default: ]
+  --no-publish                     Do not publish discovered features to the
+                                   cluster-local Kubernetes API server.
+  --oneshot                        Update once and exit.
+  --sleep-interval=<seconds>       Time to sleep between re-labeling. Non-positive
+                                   value implies no re-labeling (i.e. infinite
+                                   sleep). [Default: 60s]
+  --watch-namespace=<namespace>    Namespace to watch pods for. Use "" for all namespaces.
+  --sysfs=<mountpoint>             Mount point of the sysfs.
+								   [Default: /host]
+  --obtain-kubelet-config=<option> Options to obtain Kubelet config file
+								   [Possible arguments: kubelet-config-file/configz-endpoint]
+								   [Default: kubelet-config-file]
+  --kubelet-config-file=<path>     Kubelet config file path.
+                                   [Default: /podresources/config.yaml]
+  --podresources-socket=<path>     Pod Resource Socket path to use.
+                                   [Default: /podresources/kubelet.sock] `,
 
 		ProgramName,
 		ProgramName,
@@ -183,8 +195,13 @@ func argsParse(argv []string) (topology.Args, resourcemonitor.Args, error) {
 	if ns, ok := arguments["--watch-namespace"].(string); ok {
 		resourcemonitorArgs.Namespace = ns
 	}
-	if kubeletConfigPath, ok := arguments["--kubelet-config-file"].(string); ok {
-		resourcemonitorArgs.KubeletConfigFile = kubeletConfigPath
+	if obtainOpt, ok := arguments["--obtain-kubelet-config"].(string); ok {
+		resourcemonitorArgs.KubeletConfigObtainOpt = obtainOpt
+	}
+	if resourcemonitorArgs.KubeletConfigObtainOpt == KubeletFile {
+		if kubeletConfigPath, ok := arguments["--kubelet-config-file"].(string); ok {
+			resourcemonitorArgs.KubeletConfigFile = kubeletConfigPath
+		}
 	}
 	resourcemonitorArgs.SysfsRoot = arguments["--sysfs"].(string)
 	if path, ok := arguments["--podresources-socket"].(string); ok {
diff --git a/cmd/nfd-topology-updater/main_test.go b/cmd/nfd-topology-updater/main_test.go
index a8ea6dde16..8d27da1853 100644
--- a/cmd/nfd-topology-updater/main_test.go
+++ b/cmd/nfd-topology-updater/main_test.go
@@ -33,6 +33,7 @@ func TestArgsParse(t *testing.T) {
 				So(args.Oneshot, ShouldBeTrue)
 				So(finderArgs.SleepInterval, ShouldEqual, 60*time.Second)
 				So(finderArgs.SysfsRoot, ShouldEqual, "/host")
+				So(finderArgs.KubeletConfigObtainOpt, ShouldEqual, KubeletFile)
 				So(finderArgs.KubeletConfigFile, ShouldEqual, "/podresources/config.yaml")
 				So(finderArgs.PodResourceSocketPath, ShouldEqual, "/podresources/kubelet.sock")
 				So(err, ShouldBeNil)
@@ -61,6 +62,7 @@ func TestArgsParse(t *testing.T) {
 				So(args.Oneshot, ShouldBeFalse)
 				So(finderArgs.SleepInterval, ShouldEqual, 30*time.Second)
 				So(finderArgs.SysfsRoot, ShouldEqual, "/host")
+				So(finderArgs.KubeletConfigObtainOpt, ShouldEqual, KubeletFile)
 				So(finderArgs.KubeletConfigFile, ShouldEqual, "/podresources/config.yaml")
 				So(finderArgs.PodResourceSocketPath, ShouldEqual, "/path/testkubelet.sock")
 				So(err, ShouldBeNil)
@@ -74,6 +76,7 @@ func TestArgsParse(t *testing.T) {
 				So(args.Oneshot, ShouldBeFalse)
 				So(finderArgs.SleepInterval, ShouldEqual, 30*time.Second)
 				So(finderArgs.SysfsRoot, ShouldEqual, "/host/sysfs-root")
+				So(finderArgs.KubeletConfigObtainOpt, ShouldEqual, KubeletFile)
 				So(finderArgs.KubeletConfigFile, ShouldEqual, "/podresources/config.yaml")
 				So(finderArgs.PodResourceSocketPath, ShouldEqual, "/podresources/kubelet.sock")
 				So(err, ShouldBeNil)
diff --git a/go.mod b/go.mod
index b623a977a6..aeb1d66fc3 100644
--- a/go.mod
+++ b/go.mod
@@ -8,12 +8,12 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/golang/protobuf v1.4.3
 	github.com/google/go-cmp v0.5.2
-	github.com/gorilla/context v1.1.1 // indirect
 	github.com/jaypipes/ghw v0.8.0
 	github.com/k8stopologyawareschedwg/noderesourcetopology-api v0.0.8
 	github.com/klauspost/cpuid/v2 v2.0.6
 	github.com/onsi/ginkgo v1.11.0
 	github.com/onsi/gomega v1.7.0
+	github.com/pkg/errors v0.9.1
 	github.com/smartystreets/assertions v1.2.0
 	github.com/smartystreets/goconvey v1.6.4
 	github.com/stretchr/testify v1.6.1
diff --git a/go.sum b/go.sum
index d5ae45d585..83b5562789 100644
--- a/go.sum
+++ b/go.sum
@@ -362,8 +362,6 @@ github.com/gophercloud/gophercloud v0.1.0 h1:P/nh25+rzXouhytV2pUHBb65fnds26Ghl8/
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
-github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
diff --git a/manifests/nfd-daemonset-combined.yaml.template b/manifests/nfd-daemonset-combined.yaml.template
index 8adc61c50f..c31c97c4d9 100644
--- a/manifests/nfd-daemonset-combined.yaml.template
+++ b/manifests/nfd-daemonset-combined.yaml.template
@@ -134,6 +134,7 @@ spec:
           command:
             - "nfd-topology-updater"
           args:
+            - "--obtain-kubelet-config=kubelet-config-file"
             - "--kubelet-config-file=/podresources/config.yaml"
             - "--podresources-socket=/podresources/kubelet.sock"
             - "--sleep-interval=3s"
diff --git a/manifests/nfd-daemonset-master-topology-updater.yaml.template b/manifests/nfd-daemonset-master-topology-updater.yaml.template
index f18fc71089..47b89b1ccf 100644
--- a/manifests/nfd-daemonset-master-topology-updater.yaml.template
+++ b/manifests/nfd-daemonset-master-topology-updater.yaml.template
@@ -21,6 +21,7 @@ rules:
       - ""
     resources:
       - nodes
+      - nodes/proxy
     # when using command line flag --resource-labels to create extended resources
     # you will need to uncomment "- nodes/status"
     # - nodes/status
@@ -103,6 +104,7 @@ spec:
           command:
             - "nfd-topology-updater"
           args:
+            - "--obtain-kubelet-config=kubelet-config-file"
             - "--kubelet-config-file=/podresources/config.yaml"
             - "--podresources-socket=/podresources/kubelet.sock"
             - "--sleep-interval=3s"
diff --git a/manifests/nfd-master.yaml.template b/manifests/nfd-master.yaml.template
index 9dafb4c614..34f2e8041d 100644
--- a/manifests/nfd-master.yaml.template
+++ b/manifests/nfd-master.yaml.template
@@ -20,6 +20,7 @@ rules:
   - ""
   resources:
   - nodes
+  - nodes/proxy
 # when using command line flag --resource-labels to create extended resources
 # you will need to uncomment "- nodes/status"
 # - nodes/status
diff --git a/manifests/nfd-topology-updater-daemonset.yaml.template b/manifests/nfd-topology-updater-daemonset.yaml.template
index 467ce5dd62..19785fb539 100644
--- a/manifests/nfd-topology-updater-daemonset.yaml.template
+++ b/manifests/nfd-topology-updater-daemonset.yaml.template
@@ -32,6 +32,7 @@ spec:
           command:
             - "nfd-topology-updater"
           args:
+            - "--obtain-kubelet-config=kubelet-config-file"
             - "--kubelet-config-file=/podresources/config.yaml"
             - "--podresources-socket=/podresources/kubelet.sock"
             - "--sleep-interval=3s"
diff --git a/manifests/nfd-topology-updater-job.yaml.template b/manifests/nfd-topology-updater-job.yaml.template
index 56ee160397..376f04bd4c 100644
--- a/manifests/nfd-topology-updater-job.yaml.template
+++ b/manifests/nfd-topology-updater-job.yaml.template
@@ -41,6 +41,7 @@ spec:
           command:
             - "nfd-topology-updater"
           args:
+            - "--obtain-kubelet-config=kubelet-config-file"
             - "--kubelet-config-file=/podresources/config.yaml"
             - "--podresources-socket=/podresources/kubelet.sock"
             - "--oneshot"
diff --git a/pkg/apihelper/apihelpers.go b/pkg/apihelper/apihelpers.go
index 4603597368..26f6c57c33 100644
--- a/pkg/apihelper/apihelpers.go
+++ b/pkg/apihelper/apihelpers.go
@@ -20,6 +20,7 @@ import (
 	topologyclientset "github.com/k8stopologyawareschedwg/noderesourcetopology-api/pkg/generated/clientset/versioned"
 	api "k8s.io/api/core/v1"
 	k8sclient "k8s.io/client-go/kubernetes"
+	kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config"
 )
 
 // APIHelpers represents a set of API helpers for Kubernetes
@@ -44,4 +45,7 @@ type APIHelpers interface {
 
 	// GetTopologyClient returns a topologyclientset
 	GetTopologyClient() (*topologyclientset.Clientset, error)
+
+	// GetKubeletConfigs returns node's kubelet config file
+	GetKubeletConfig(c *k8sclient.Clientset, nodeName string) (*kubeletconfig.KubeletConfiguration, error)
 }
diff --git a/pkg/apihelper/k8shelpers.go b/pkg/apihelper/k8shelpers.go
index 415f9a5ad6..32682c71e4 100644
--- a/pkg/apihelper/k8shelpers.go
+++ b/pkg/apihelper/k8shelpers.go
@@ -21,12 +21,18 @@ import (
 	"encoding/json"
 
 	topologyclientset "github.com/k8stopologyawareschedwg/noderesourcetopology-api/pkg/generated/clientset/versioned"
+	"github.com/pkg/errors"
+
 	api "k8s.io/api/core/v1"
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	k8sclient "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
 	restclient "k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
+	kubeletconfigv1beta1 "k8s.io/kubelet/config/v1beta1"
+	kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config"
+	kubeletconfigscheme "k8s.io/kubernetes/pkg/kubelet/apis/config/scheme"
 )
 
 // Implements APIHelpers
@@ -122,3 +128,42 @@ func (h K8sHelpers) PatchNodeStatus(c *k8sclient.Clientset, nodeName string, pat
 	return nil
 
 }
+
+func (h K8sHelpers) GetKubeletConfig(c *k8sclient.Clientset, nodeName string) (*kubeletconfig.KubeletConfiguration, error) {
+	//request here is the same as: curl https://$APISERVER:6443/api/v1/nodes/$NODE_NAME/proxy/configz
+	res := c.CoreV1().RESTClient().Get().Resource("nodes").Name(nodeName).SubResource("proxy").Suffix("configz").Do(context.TODO())
+	return decodeConfigz(&res)
+}
+
+// Decodes the rest result from /configz and returns a kubeletconfig.KubeletConfiguration (internal type).
+func decodeConfigz(res *rest.Result) (*kubeletconfig.KubeletConfiguration, error) {
+	// This hack because /configz reports the following structure:
+	// {"kubeletconfig": {the JSON representation of kubeletconfigv1beta1.KubeletConfiguration}}
+	type configzWrapper struct {
+		ComponentConfig kubeletconfigv1beta1.KubeletConfiguration `json:"kubeletconfig"`
+	}
+
+	configz := configzWrapper{}
+	kubeCfg := kubeletconfig.KubeletConfiguration{}
+
+	contentsBytes, err := res.Raw()
+	if err != nil {
+		return nil, err
+	}
+
+	err = json.Unmarshal(contentsBytes, &configz)
+	if err != nil {
+		return nil, errors.Wrap(err, string(contentsBytes))
+	}
+
+	scheme, _, err := kubeletconfigscheme.NewSchemeAndCodecs()
+	if err != nil {
+		return nil, err
+	}
+	err = scheme.Convert(&configz.ComponentConfig, &kubeCfg, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return &kubeCfg, nil
+}
diff --git a/pkg/nfd-master/nfd-master.go b/pkg/nfd-master/nfd-master.go
index 8bfc6c1f3c..deb00beb7d 100644
--- a/pkg/nfd-master/nfd-master.go
+++ b/pkg/nfd-master/nfd-master.go
@@ -462,6 +462,28 @@ func (m *nfdMaster) UpdateNodeTopology(c context.Context, r *topologypb.NodeTopo
 			return &topologypb.NodeTopologyResponse{}, fmt.Errorf("request authorization failed: cert valid for '%s', requested node name '%s'", cn, r.NodeName)
 		}
 	}
+
+	// We expect the data to be found on r.TopologyPolicies[0] or not to be found at all
+	for idx, policy := range r.TopologyPolicies {
+		if len(policy) != 0 && idx != 0 {
+			return &topologypb.NodeTopologyResponse{}, fmt.Errorf("Topology Policy error: policy %v not expected to be found at index %v", policy, idx)
+		}
+	}
+	if len(r.TopologyPolicies[0]) == 0 {
+		stdoutLogger.Printf("Warning: Using configz-endpoint in order to get Kubelet configuration, consider to be unstable")
+		cli, err := m.apihelper.GetClient()
+		if err != nil {
+			stderrLogger.Printf("%s", err.Error())
+			return &topologypb.NodeTopologyResponse{}, err
+		}
+		kc, err := m.apihelper.GetKubeletConfig(cli, r.NodeName)
+		if err != nil {
+			stderrLogger.Printf("failed to get Kubelet config: %s", err.Error())
+			return &topologypb.NodeTopologyResponse{}, err
+		}
+		r.TopologyPolicies[0] = kc.TopologyManagerPolicy
+	}
+
 	stdoutLogger.Printf("REQUEST Node: %s NFD-version: %s Topology Policy: %s Zones: %v", r.NodeName, r.NfdVersion, r.TopologyPolicies, dumpobject.DumpObject(r.Zones))
 
 	if !m.args.NoPublish {
diff --git a/pkg/resourcemonitor/types.go b/pkg/resourcemonitor/types.go
index af0c6ad7b3..9e224e6a29 100644
--- a/pkg/resourcemonitor/types.go
+++ b/pkg/resourcemonitor/types.go
@@ -25,11 +25,12 @@ import (
 )
 
 type Args struct {
-	PodResourceSocketPath string
-	SleepInterval         time.Duration
-	Namespace             string
-	SysfsRoot             string
-	KubeletConfigFile     string
+	PodResourceSocketPath  string
+	SleepInterval          time.Duration
+	Namespace              string
+	SysfsRoot              string
+	KubeletConfigObtainOpt string
+	KubeletConfigFile      string
 }
 
 type ResourceInfo struct {
diff --git a/test/e2e/topology_updater.go b/test/e2e/topology_updater.go
index 4e4f246693..3dd94b4620 100644
--- a/test/e2e/topology_updater.go
+++ b/test/e2e/topology_updater.go
@@ -47,6 +47,7 @@ var _ = ginkgo.Describe("[NFD] Node topology updater", func() {
 		crd                 *apiextensionsv1.CustomResourceDefinition
 		topologyUpdaterNode *v1.Node
 		kubeletConfig       *kubeletconfig.KubeletConfiguration
+		obtainKubeletOpt    string
 	)
 
 	f := framework.NewDefaultFramework("node-topology-updater")
@@ -80,10 +81,13 @@ var _ = ginkgo.Describe("[NFD] Node topology updater", func() {
 
 		ginkgo.By("Waiting for the nfd-master service to be up")
 		gomega.Expect(e2enetwork.WaitForService(f.ClientSet, f.Namespace.Name, masterService.Name, true, time.Second, 10*time.Second)).NotTo(gomega.HaveOccurred())
+		obtainKubeletOpt = "--obtain-kubelet-config=kubelet-config-file"
+	})
 
+	ginkgo.JustBeforeEach(func() {
 		ginkgo.By("Creating nfd-topology-updater daemonset")
-		topologyUpdaterDaemonSet := testutils.NFDTopologyUpdaterDaemonSet(fmt.Sprintf("%s:%s", *dockerRepo, *dockerTag), []string{})
-		topologyUpdaterDaemonSet, err = f.ClientSet.AppsV1().DaemonSets(f.Namespace.Name).Create(context.TODO(), topologyUpdaterDaemonSet, metav1.CreateOptions{})
+		topologyUpdaterDaemonSet := testutils.NFDTopologyUpdaterDaemonSet(fmt.Sprintf("%s:%s", *dockerRepo, *dockerTag), []string{obtainKubeletOpt})
+		topologyUpdaterDaemonSet, err := f.ClientSet.AppsV1().DaemonSets(f.Namespace.Name).Create(context.TODO(), topologyUpdaterDaemonSet, metav1.CreateOptions{})
 		gomega.Expect(err).NotTo(gomega.HaveOccurred())
 
 		ginkgo.By("Waiting for daemonset pods to be ready")
@@ -99,9 +103,10 @@ var _ = ginkgo.Describe("[NFD] Node topology updater", func() {
 
 		kubeletConfig, err = e2ekubelet.GetCurrentKubeletConfig(topologyUpdaterNode.Name, "", true)
 		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+
 	})
 
-	ginkgo.Context("with single nfd-master pod", func() {
+	validateTopologyManagerPolicy := func() {
 		ginkgo.It("should fill the node resource topologies CR with the data", func() {
 			gomega.Eventually(func() bool {
 				// TODO: we should avoid to use hardcoded namespace name
@@ -117,6 +122,9 @@ var _ = ginkgo.Describe("[NFD] Node topology updater", func() {
 				}
 
 				if nodeTopology.TopologyPolicies[0] != (*kubeletConfig).TopologyManagerPolicy {
+					framework.Logf("topology policy is different than expected. current: %v, expected: %v",
+						nodeTopology.TopologyPolicies[0],
+						(*kubeletConfig).TopologyManagerPolicy)
 					return false
 				}
 
@@ -125,6 +133,17 @@ var _ = ginkgo.Describe("[NFD] Node topology updater", func() {
 				return true
 			}, time.Minute, 5*time.Second).Should(gomega.BeTrue())
 		})
+	}
+
+	ginkgo.Context("with single nfd-master pod and default arguments", func() {
+		validateTopologyManagerPolicy()
+	})
+
+	ginkgo.Context("with single nfd-master pod and --obtain-kubelet-config=configz-endpoint argument", func() {
+		ginkgo.BeforeEach(func() {
+			obtainKubeletOpt = "--obtain-kubelet-config=configz-endpoint"
+		})
+		validateTopologyManagerPolicy()
 	})
 
 	ginkgo.JustAfterEach(func() {
diff --git a/test/e2e/utils/rbac.go b/test/e2e/utils/rbac.go
index 157e5600ff..c07f7e1aba 100644
--- a/test/e2e/utils/rbac.go
+++ b/test/e2e/utils/rbac.go
@@ -88,7 +88,10 @@ func createClusterRole(cs clientset.Interface) (*rbacv1.ClusterRole, error) {
 			{
 				APIGroups: []string{""},
 				Resources: []string{"nodes"},
-				Verbs:     []string{"get", "patch", "update"},
+				Verbs: []string{
+					"get",
+					"patch",
+					"update"},
 			},
 			{
 				APIGroups: []string{"topology.node.k8s.io"},
@@ -99,6 +102,13 @@ func createClusterRole(cs clientset.Interface) (*rbacv1.ClusterRole, error) {
 					"update",
 				},
 			},
+			{
+				APIGroups: []string{""},
+				Resources: []string{"nodes/proxy"},
+				Verbs: []string{
+					"get",
+				},
+			},
 		},
 	}
 	if *openShift {