// Module included in the following assemblies:
//
// * hardware_enablement/kmm-kernel-module-management.adoc

:_mod-docs-content-type: PROCEDURE
[id="kmm-configuring-kmmo_{context}"]
= Configuring the Kernel Module Management Operator

[role="_abstract"]
To adapt the Kernel Module Management (KMM) Operator to your {product-title} environment, you can create a `ConfigMap` with custom settings and restart the controller.

.Procedure

* To modify any setting, create a `ConfigMap` with the name `kmm-operator-manager-config` in the Operator namespace with the relevant data and restart the controller using the following command:
+
[source,terminal]
----
$ oc rollout restart -n "$namespace" deployment/kmm-operator-controller
----
+
The value of `$namespace` depends on your installation method. For example:
+
[source,yaml]
----
apiVersion: v1
data:
  controller_config.yaml: |
    worker:
      firmwareHostPath: /example/different/firmware/path
kind: ConfigMap
metadata:
  name: kmm-operator-manager-config
  namespace: openshift-kmm
----
+
[NOTE]
====
If you want to configure `KMM Hub`, create the `ConfigMap` using the name `kmm-operator-hub-manager-config` in the KMM Hub controller's namespace.
====
+
.Operator configuration parameters
[cols="2,8",options="header"]
|===
|Parameter |Description

| `healthProbeBindAddress`
| Defines the address on which the Operator monitors for kubelet health probes. The recommended value is `:8081`.

|`job.gcDelay`
|Defines the duration for which successful build pods should be preserved before they are deleted. For information about the valid values for this setting, see link:https://pkg.go.dev/time#ParseDuration[ParseDuration]. The default value is `0s`.

|`leaderElection.enabled`
|Determines whether leader election is used to ensure that only one replica of the KMM Operator is running at any time. For more information, see https://kubernetes.io/docs/concepts/architecture/leases/[Leases]. The default value is `true`.

|`leaderElection.resourceID`
|Determines the name of the resource that leader election uses for holding the leader lock. The default value for KMM is `kmm.sigs.x-k8s.io`. The default value for KMM-hub is `kmm-hub.sigs.x-k8s.io`.

|`metrics.bindAddress`
|Determines the bind address for the metrics server. Set this to "0" to disable the metrics server. The default value is `0.0.0.0:8443`.

|`metrics.disableHTTP2`
|If `true`, disables HTTP/2 for the metrics server as a mitigation for https://access.redhat.com/security/cve/cve-2023-44487[CVE-2023-44487]. The default value is `true`.

|`metrics.enableAuthnAuthz`
a|Determines if metrics are authenticated using `TokenReviews` and authorized using `SubjectAccessReviews` with the kube-apiserver.

For authentication and authorization, the controller needs a `ClusterRole` with the following rules:

* `apiGroups: authentication.k8s.io, resources: tokenreviews, verbs: create`

* `apiGroups: authorization.k8s.io, resources: subjectaccessreviews, verbs: create`

To scrape metrics, for example, using Prometheus, the client needs a `ClusterRole` with the following rule:

* `nonResourceURLs: "/metrics", verbs: get`

The default value is `true`.

|`metrics.secureServing`
|Determines whether the metrics are served over HTTPS instead of HTTP. The default value is `true`.

|`webhook.disableHTTP2`
|If `true`, disables HTTP/2 for the webhook server, as a mitigation for link:https://access.redhat.com/security/cve/cve-2023-44487[CVE-2023-44487]. The default value is `true`.

|`webhook.port`
|Defines the port on which the Operator monitors webhook requests. The default value is `9443`.

|`worker.runAsUser`
|Determines the value of the `runAsUser` field of the worker container's security context. For more information, see link:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/[SecurityContext]. The default value is `9443`.

|`worker.seLinuxType`
|Determines the value of the `seLinuxOptions.type` field of the worker container's security context. For more information, see link:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/[SecurityContext]. The default value is `spc_t`.

|`worker.firmwareHostPath`
|If set, the value of this field is written by the worker container into the /sys/module/firmware_class/parameters/path file on the node. For more information see link:https://openshift-kmm.netlify.app/documentation/firmwares/#setting-the-kernels-firmware-search-path[Setting the kernel's firmware search path]. The default value is `/var/lib/firmware`.
|===
