Verify the Deployment#

After you publish the component tree, Argo CD syncs the components in sync-wave order. Confirm the rollout from the top down: first that every Argo CD Application is healthy, then each component, then end-to-end access.

Run every command on this page on the active BCM head node, where kubectl reaches k8s-admin.

Confirm Argo CD Application health#

kubectl -n argocd get applications

All twelve Applications report Synced and Healthy: root, argocd, and k8s-admin-{openbao, external-secrets, cert-manager, cnpg-operator, trust-manager, nmc-gateway, keycloak, keycloak-cnpg, keycloak-config-cli, launchpad}. keycloak-config-cli runs only when the realm import is enabled, which the standard install does. Without the import, eleven Applications appear. Argo CD prefixes each component’s Application with the cluster name, so openbao is k8s-admin-openbao. Sync waves are health-gated, so a wave does not start until the previous one is Healthy. Investigate any Application stuck in Progressing (refer to Troubleshooting).

Verify each component#

Argo CD reporting every Application Healthy is the first signal the stack is up. For component-level checks, refer to the Verify section on each component’s page:

OpenBao – Verify
External Secrets – Verify
Certificates – Verify
CloudNativePG – Verify
NMC Gateway – Verify
Keycloak – Verify
Launchpad – Verify
Argo CD – Verify

Reach the UIs#

The gateway serves the Argo CD, Keycloak, and Launchpad UIs over HTTPS. Reach them through the BCM head node or directly at the gateway IP.

Through the BCM head node#

This is the standard path, the same way you reach the other NVIDIA Mission Control services. Resolve the Argo CD, Keycloak, and Launchpad host names to the BCM head-node external or floating IP, the address you use to SSH to the head node. In a high-availability setup, use the floating IP, not a physical node IP. The head node forwards HTTPS to the gateway by host name.

The head node needs a forwarding rule for each gateway host name. NVIDIA Mission Control does not add it during cluster setup, because Argo CD creates the gateway afterward, so its host names are not yet known. Once the gateway is programmed, generate the rules as root on the active head node:

cm-kubernetes-setup --cluster k8s-admin --configure-gateway-proxy

The command reads the gateway’s listener host names and writes the matching head-node forwarding rules. It needs the Kubernetes ingress proxy, which you enable when you create the k8s-admin cluster. The rules match the gateway’s host names and IP, so run the command again if you change either.

Launchpad sends its sign-in redirect to the Keycloak host name, which resolves through this same path, so generate the rules before you test single sign-on.

Directly to the gateway#

Resolve the host names to the loadBalancerIP you set, from a host that can route to that address. This path needs no head-node forwarding. Use site DNS, or a local /etc/hosts entry on a test cluster.

Trust the served certificate#

How you trust the served certificate depends on the gateway’s TLS source. On the default OpenBao issuer, the certificates are NVIDIA Mission Control-issued, so import the root CA or accept the browser warning. A certificate from a publicly trusted CA is already trusted. Trust a certificate from a private CA by importing that CA into your client’s trust store. Retrieve the NVIDIA Mission Control root CA with:

kubectl -n cert-manager get secret nmc-ca-anchor-tls \
  -o jsonpath='{.data.ca\.crt}' | base64 -d > nmc-root.crt

Confirm end-to-end sign-in#

The nmc realm has no users after install. Create one to verify single sign-on.

Open the Keycloak admin console as user admin. If you set k8s_bootstrap_secrets_keycloak_admin_password, sign in with that value. If you left it empty to auto-generate, read the generated password from its seed Secret, which stays in the cluster until you clean up. The seed Secret holds a JSON payload, so use jq to read the password field:

kubectl -n openbao get secret openbao-bootstrap-seeds-keycloak-admin \
  -o jsonpath='{.data.payload}' | base64 -d | jq -r .password

Switch to the nmc realm, add a user with an email address, set a password under Credentials, then sign in to Launchpad as that user. The same user signs in to Argo CD with read-only access (Verify).

Next step#

Continue to Clean Up the Bootstrap Secrets to back up and remove the bootstrap secrets.