NMC Launchpad#

Overview#

NMC Launchpad is the NVIDIA Mission Control web portal: a single landing page with cards that link to the other NVIDIA Mission Control components. It uses Keycloak for single sign-on.

How it works#

Launchpad is delivered as an Argo CD Application from NVIDIA Mission Control’s nmc-launchpad chart. It signs users in through Keycloak.

For single sign-on, Launchpad registers as the nmc-launchpad OIDC client against the configured Keycloak realm, building the OIDC endpoint from keycloakFQDN and keycloakRealm. Its client secret is delivered from OpenBao at runtime, so you never place it in a values file.

For its container image, Launchpad pulls from NGC using the shared NGC image-pull credential, delivered as a Kubernetes Secret by External Secrets (refer to External Secrets Operator).

For the OpenBao auth roles and KV paths behind both, refer to the Launchpad Application values in the component template tree (apps/launchpad/).

Configuration#

Add these settings under the launchpad key in values.yaml. The key already carries the pinned chart version, NVIDIA Mission Control release nmcVersion, and syncWave from Installing GitOps-Managed Components; the following fields are the ones you set. A field shown with a value uses that value as its default when you omit it.

launchpad:
  enabled: true                       # optional, deploy the Launchpad Application
  fqdn: <launchpad-fqdn>              # set to your portal host name; defaults to launchpad.dgx-<cluster-name>.nvidia.com
  keycloakFQDN: <keycloak-fqdn>       # optional, defaults to the Keycloak host name
  keycloakRealm: nmc                  # optional, Keycloak realm Launchpad authenticates against
  keycloakEnabled: true               # optional, enable single sign-on
  routeEnabled: true                  # optional, render an external route through the shared gateway
  imageRepository: <image-repository> # optional, override the image repo derived from ngc_path
  bcmUrl: ""                          # optional, Base Command Manager card link
  runaiUrl: ""                        # optional, Run:ai card link
  ajrUrl: ""                          # optional, Autonomous Job Recovery card link
  ahrUrl: ""                          # optional, Autonomous Hardware Recovery card link
  grafanaUrl: ""                      # optional, Grafana card link
  extraHostsAliases: []               # optional, pod /etc/hosts entries (ip and hostnames)

  • enabled – deploy the Launchpad Application. Default true.

  • fqdn – the host name the portal is served on. Defaults to launchpad.dgx-<cluster-name>.nvidia.com. Set it to your environment’s host name.

  • keycloakFQDN – the Keycloak host name used to build the OIDC endpoint. Defaults to the Keycloak host name. Set it if Keycloak uses a different host.

  • keycloakRealm – the Keycloak realm Launchpad authenticates against. Default nmc.

  • keycloakEnabled – enable single sign-on. When false, no client secret is injected. Default true.

  • routeEnabled – render an external route through the shared gateway. When false, no external route is emitted. Default true.

  • imageRepository – the container image repository. Defaults to the repository derived from ngc_path.

  • bcmUrl / runaiUrl / ajrUrl / ahrUrl / grafanaUrl – card link targets. Default empty.

  • extraHostsAliases – extra /etc/hosts entries for the Launchpad pods, each an object with ip and a list of hostnames.

A card appears on the dashboard only when its URL is set. Leaving a card URL empty hides that card.

Cross-field consistency rules:

  • keycloakFQDN must match the Keycloak Application’s keycloak.fqdn. The OIDC endpoint is built from keycloakFQDN, so a mismatch points Launchpad at the wrong issuer and single sign-on fails.

  • keycloakRealm must match the realm Keycloak imports. A mismatch breaks the client-secret lookup and single sign-on fails.

  • Set extraHostsAliases when the Keycloak host name does not resolve in-cluster. Without it, the Launchpad pod cannot reach the OIDC endpoint.

When pod DNS cannot resolve the external Keycloak host name, map that same host name to the gateway or head-node IP that serves Keycloak:

launchpad:
  keycloakFQDN: <keycloak-fqdn>
  extraHostsAliases:
    - ip: "<gateway-or-head-node-ip>"
      hostnames:
        - "<keycloak-fqdn>"

The host name under hostnames must match keycloakFQDN and a subject alternative name on the gateway certificate. This setting adds an entry to the Launchpad pods’ /etc/hosts files. It does not change DNS for browsers or other workloads.

Secrets#

Launchpad consumes two bootstrap secrets. Add them to secrets.yaml:

k8s_bootstrap_secrets_ngc_image_pull_token: <ngc-api-key>   # required; shared NGC image-pull credential
k8s_bootstrap_secrets_launchpad_client_secret: ""             # nmc-launchpad OIDC client secret; leave empty to auto-generate

  • k8s_bootstrap_secrets_ngc_image_pull_token – the shared NGC image-pull credential, read as the password field. Every component that pulls images from NGC uses it. Required, not auto-generated. If it is missing, the seed step fails, so set it before you install. External Secrets bridges it to the image-pull Secret.

  • k8s_bootstrap_secrets_launchpad_client_secret – the client_secret for the nmc-launchpad OIDC client. Leave it empty to auto-generate. Seeded together with Keycloak so both sides share the same value. OpenBao delivers it to the pod at runtime.

Verify#

Confirm the Launchpad Application reports Synced and Healthy in Argo CD, then browse to https://<fqdn>. The portal shows one card for each component whose URL you configured. If authentication is enabled, Login sends you to the Keycloak sign-in page, then back to the portal after you sign in.