Seed and Publish the Components#

With your values.yaml and secrets.yaml prepared, two steps bring the components up: seed the bootstrap secrets, then render and publish the component tree for Argo CD to sync.

Run the playbooks from a machine that can reach the active BCM head node over SSH as root with your SSH key. Ansible runs the tasks on the head node, where kubectl reaches k8s-admin.

Prerequisites#

  • Argo CD is installed and the nvidia.nmc collection is available on the machine you run the playbooks from. Refer to Argo CD Installation.

  • git is installed on the machine you run the playbooks from, and that machine reaches NGC and your Git host. The render-and-publish command clones and pushes your GitOps repository from there.

  • values.yaml and secrets.yaml are prepared. Refer to Installing GitOps-Managed Components for the shared settings, and to each component page for its settings and secrets.

Seed the bootstrap secrets#

This step reads secrets.yaml and creates Kubernetes Secrets in the openbao namespace. Run it before you publish, so the material is in place when Argo CD brings OpenBao up.

ansible-playbook nvidia.nmc.deploy_k8s_bootstrap_secrets \
  -i "<head-node-ip>," \
  -u root \
  -e k8s_cluster_name=k8s-admin \
  -e @secrets.yaml

The command creates three kinds of Secret, all create-only, so a rerun never overwrites material already in use:

  • openbao-seal – the static auto-unseal key. Permanent. Back it up and never delete it while OpenBao’s storage exists.

  • openbao-admin-credentials – the nmc-admin login OpenBao reads once at self-initialization.

  • openbao-bootstrap-seeds-<name> – one per credential the components need, such as the Keycloak and Launchpad secrets and the shared NGC image-pull credential. OpenBao’s configure Job reads these into its KV store on the first sync.

After you verify the deployment, back up and remove the seed Secrets. Refer to Clean Up the Bootstrap Secrets.

Warning

With k8s_bootstrap_secrets_ldap_enabled: true, this step reads the LDAP bind password and signs a client certificate with the BCM certificate authority. Both are on the active head node, so target that node.

Render and publish#

Set your NGC API key in the environment, then run the render-and-publish command once. It fetches the template tree from NGC and renders it with your values. Then it pushes the component tree to your GitOps repository and triggers an Argo CD refresh. Argo CD syncs the components in sync-wave order.

export NGC_API_KEY=<ngc-api-key>
ansible-playbook nvidia.nmc.deploy_argocd_gitops \
  -i "<head-node-ip>," \
  -u root \
  -e @values.yaml

Each run replaces the complete NVIDIA Mission Control-managed tree in the GitOps repository. Keep your full values.yaml for subsequent changes; a publish overwrites direct edits to the generated manifests. To change the deployed component set, follow Change GitOps-Managed Components.

Next step#

Continue to Verify the Deployment to confirm the deployment.