Prerequisites

Before deploying Fleet Command, initial configuration is required in the following areas: the physical edge site, the Fleet Command user interface, and the NGC account. The following sections cover each of these areas in detail.

In addition to Fleet Command security features, users are also responsible for the physical and network security at the facility where the systems are deployed. Security recommendations include

• The system is physically protected from unauthorized access.

• The BMC interface is currently not required for Fleet Command operation; this interface may stay disconnected. If BMC is desired, you should connect the BMC interface to a secure management network.

• The system is hosted on a secure network. All internet originating connections should be blocked.

Follow the steps below to prepare your edge sites when deploying Fleet Command on a system.

• Ensure outbound connections are allowed via TLS 443.

  • You can perform this test from any device on the target network by visiting WebSockets. Verify that the web sockets tests pass, and the “HTTP Proxy” value is “No” in your environment.

• Ensure that each system is assigned and reserved an IP that does not change during operation. This requirement applies to locations version 1.0.7 or below.

• Ensure the system has access to a DNS server.

• If you have multiple network interfaces, you have an option to choose the right network interface.

• If you plan to add a Proxy to the edge system, you will need to add an HTTP Proxy address.

• Ensure the system has access to one or more NTP servers.

  • time1.google.com

  • time2.google.com

  • time3.google.com

  • time4.google.com

  • time.cloudflare.com

• Locations that have interconnected systems must be on the same network.

• Ensure the system has access to the following servers:

  • Fleet Command Provisioning Service (EPS): https://eps.egx.nvidia.com

  • Fleet Command Manager Service (EMS): https://egxdefault.egx.nvidia.com (<customer_name>.egx.nvidia.com)

  • Fleet Command Token Service (ETS): https://ets.egxdefault.egx.nvidia.com (ets.<customer_name>.egx.nvidia.com)

  • NGC Registry: https://nvcr.io

  • NGC: https://*.ngc.nvidia.com

  The servers listed above is not an exhaustive list. You may need to add servers such as those routed to CDNs (cloudfront.net, weave.works).

Fleet Command requires the use of NVIDIA-Certified Systems at edge sites. A comprehensive list of all NVIDIA-Certified Systems is available in the Qualified Systems Catalog. Select the appropriate Category, Workload, System Class and NVIDIA-Certified type for your use case.

The requirements for using NVIDIA-Certified Systems with Fleet Command are:

• The systems must be from the Data Center, Industrial Edge, Enterprise Edge, or NVIDIA AI Enterprise Compatible categories.

• The systems must include TPM 2.0, SHA-256, and support Secure Boot.

Refer to the NVIDIA-Certified Configuration Guide for detailed system specifications separate from the above requirements.

Once you have an NVIDIA-Certified System, follow the BIOS setup recommendations listed below.

• TPM 2.0 with SHA-256 : Enabled

  Important

  The TPM module should be cleared and unowned before provisioning the system. Reset the TPM module if a prior operating system has been installed.

  
  

• Secure Boot : Enabled

• For some GPUs and workloads, additional configuration settings such as the values below may be required. For more information, refer to the system configuration recommendations for your NVIDIA-Certified System.

  Configuration	Setting
  64-bit MMIO/Above 4G Decoding	Enabled
  SR-IOV	Enabled
  IOMMU	Enabled
  CPU Virtualization/VT	Disabled
  ECC Memory (if applicable)	Enabled
  Hyper-Threading	Enabled
  Power Setting or System Profile	High Performance
  CPU Performance (if applicable)	Enterprise or High-Throughput

NGC is NVIDIA’s AI hub that provides access to Fleet Command and to the private registry, which is used for hosting applications.

To get started with Fleet Command, you will need to log in to your NGC account.

For basic NGC setup and instructions, refer to the NGC Overview Documentation.

Once you have your first NGC Fleet Command Admin account, you will need to assign roles to your organization’s users. The table below lists the different roles and their capabilities.

In addition to these roles, three additional roles only apply to your NGC Private Registry access management:

• User Admin: This user can invite other user admins within an organization. This user cannot download/upload, push/pull, delete, or add/remove users at an org level.

• Registry User: This user can download, upload, push/pull artifacts within an organization.

• Registry Read: This user can download and pull artifacts within an organization.

For more information about managing users and teams, refer to the NGC User Management Guide.

By default, Fleet Command allows you to deploy applications from NGC Catalog and your NGC Private Registry. To access applications in your private registry from Fleet Command, you will need to sync your private registry to Fleet Command using an NGC API Key that provides authenticated access.

1. If necessary, log in to NGC to get an API key for the NGC Registry. Click the user account icon in the top right corner, and select Setup. Click Get API Key to open the Setup > API Key page.

2. Add the API key to Fleet Command user interface by navigating to the Applications page and clicking Add API Key on the top right corner of the page.

   

   
   

3. You will then be prompted to add an API key.

   

   
   

4. Click add to complete the process.

   Note

   Paste your API key into the API Key field shown above.

   
   

5. Once the API Key has been added, your NGC private registry and Fleet Command interface have synced applications from the private registry that Fleet Command can now pull during application deployment.

Changing Your API Key

If you have forgotten or lost your API Key, you can create a new one at any time through the NVIDIA NGC portal. When you generate a new API key, the old one is invalidated. Applications deployed with the old API key will keep running but could fail if the API key loses access during a new deployment.