anchor.diff:  network-resources-injector-lktz5          1/1     Running   0          10m
   ----
   
  -Follow this procedure to disable it.
  +[id="about-sr-iov-operator-admission-control-webhook_{context}"]
  +== About the SR-IOV Operator admission controller webhook
   
  -.Prerequisites
  +The SR-IOV Operator Admission Controller webook is a Kubernetes Dynamic
  +Admission Controller application. It provides the following capabilities:
   
  -* Install the OpenShift Command-line Interface (CLI), commonly known as `oc`.
  -* Log in as a user with `cluster-admin` privileges.
  -* You must have installed the SR-IOV Operator.
  +* Validation of the `SriovNetworkNodePolicy` CR when it is created or updated.
  +* Mutation of the `SriovNetworkNodePolicy` CR by setting the default value for the `priority` and `deviceType` fields when the CR is created or updated.
   
  -.Procedure
  -. Update the default SriovOperatorConfig Custom Resource
  -+
  -----
  -$ oc patch sriovoperatorconfig default --patch '{ "spec": { "enableInjector": false}}' --type=merge -n openshift-sriov-network-operator
  -----
  -
  -. To re-enable Network Resources Injector
  -+
  -----
  -$ oc patch sriovoperatorconfig default --patch '{ "spec": { "enableInjector": true}}' --type=merge -n openshift-sriov-network-operator
  -----
  -
  -[id="disabling-sr-iov-operator-admission-control-webhook_{context}"]
  -== Disabling SR-IOV Operator admission controller webhook
  -The SRIOV Operator Admission Controller Webhook is a Kubernetes Dynamic
  -Admission Controller application that:
  -
  -* Validating the `SriovNetworkNodePolicy` Custom Resource when it being created
  -or updated.
  -* Mutating the `SriovNetworkNodePolicy` Custom Resource by setting the default
  -value to `priority` and `deviceType` when it being created or updated.
  -
  -By default the SR-IOV Operator Admission Controller Webhook will be enabled by
  -the operator and runs as a Kubernetes DaemonSet on all master nodes. Below is
  -an example of Operator Admission Controller Webhook pods running in a cluster
  -with three master nodes:
  +By default the SR-IOV Operator Admission Controller webook is enabled by the operator and runs as a DaemonSet on all master nodes.
  +The following is an example of the Operator Admission Controller webook Pods running in a cluster with three master nodes:
   
   ----
   $ oc get pods -n openshift-sriov-network-operator
  
positive.code: operator-webhook-rpfrl                    1/1     Running   0          16m
  ----
  
  Follow this procedure to disable it.
  
  .Prerequisites
  
  
negative.code: * You must have installed the SR-IOV Operator.
  
  .Procedure
  
  - Set the `enableInjector` field. Replace `<value>` with `false` to disable the feature or `true` to enable the feature.
  +
  ----
  $ oc patch sriovoperatorconfig default \
    --type=merge -n openshift-sriov-network-operator \
    --patch '{ "spec": { "enableInjector": <value> } }'
  ----
  
  [id="disable-enable-sr-iov-operator-admission-control-webhook_{context}"]
  == Disabling or enabling the SR-IOV Operator admission controller webhook
  
  To disable or enable the admission controller webhook, which is enabled by default, complete the following procedure.
  
  .Prerequisites
  
  * Install the OpenShift Command-line Interface (CLI), commonly known as `oc`.
  * Log in as a user with `cluster-admin` privileges.
  * You must have installed the SR-IOV Operator.
  
  .Procedure
  
  - Set the `enableOperatorWebhook` field. Replace `<value>` with `false` to disable the feature or `true` to enable it:
  +
  ----
  $ oc patch sriovoperatorconfig default --type=merge \
    -n openshift-sriov-network-operator \
    --patch '{ "spec": { "enableOperatorWebhook": <value> } }'
  ----
  
  [id="configuring-custom-nodeselector_{context}"]
  == Configuring a custom NodeSelector for the SR-IOV Network Config daemon
  
  The SR-IOV Network Config daemon discovers and configures the SR-IOV network devices on cluster nodes. By default, it is deployed to all the `worker` nodes in the cluster. You can use node labels to specify on which nodes the SR-IOV Network Config daemon runs.
  
  To specify the nodes where the SR-IOV Network Config daemon is deployed, complete the following procedure.
  
  [IMPORTANT]
  =====
  When you update the `configDaemonNodeSelector` field, the SR-IOV Network Config daemon is recreated on each selected node.
  While the daemon is recreated, cluster users are unable to apply any new SR-IOV Network node policy or create new SR-IOV pods.
  =====
  
  .Procedure
  
  - To update the node selector for the operator, enter the following command:
  +
  ----
  $ oc patch sriovoperatorconfig default --type=json \
    -n openshift-sriov-network-operator \
    --patch '[{
        "op": "replace",
        "path": "/spec/configDaemonNodeSelector",
        "value": {<node-label>}
      }]'
  ----
  +
  Replace `<node-label>` with a label to apply as in the following example:
  `"node-role.kubernetes.io/worker": ""`.
  