Installing GitOps-Managed Components#

NVIDIA Mission Control delivers a set of components through GitOps with Argo CD. Together they provide the cluster’s common services: secrets management with OpenBao, certificate issuance with cert-manager and trust-manager, single sign-on with Keycloak, a shared ingress gateway, and the Launchpad portal. Two supporting components complete the set: External Secrets syncs OpenBao secrets into Kubernetes Secrets, and CloudNativePG runs the Keycloak database.

Note

This project downloads and installs additional third-party open source software projects. Review the license terms of these open source projects before use.

Overview#

Use values.yaml for installation and later changes to GitOps-managed components. Supply bootstrap credentials in a separate secrets.yaml. You prepare both files in the sections that follow. Ansible playbooks then act on these files: one seeds the credentials into the cluster as bootstrap Secrets, and another renders the component tree and pushes it to your GitOps repository. Argo CD reconciles the components onto the k8s-admin cluster in sync-wave order, starting with OpenBao.

%%{init: {'theme': 'base', 'themeVariables': {'lineColor': '#888888', 'edgeLabelBackground': '#e8e8e8'}}}%% flowchart TB subgraph head["BCM head node"] V["values.yaml"] S["secrets.yaml"] subgraph ans["Ansible playbooks"] Seed["deploy_k8s_bootstrap_secrets"] Render["deploy_argocd_gitops"] end V --> Render S --> Seed end Git[("GitOps repository")] subgraph cluster["k8s-admin cluster"] Argo["Argo CD"] Secrets[("Bootstrap Secrets")] OB["OpenBao"] Rest["External Secrets, cert-manager, trust-manager,<br/>CloudNativePG, NMC Gateway, Keycloak, Launchpad"] Argo -->|"reconciles, OpenBao first"| OB Argo -->|"then the rest, by sync wave"| Rest Secrets -->|"read + seed at startup"| OB end Cleanup["deploy_k8s_bootstrap_secrets<br/>(cleanup)"] Seed -->|"creates"| Secrets Render -->|"renders + pushes"| Git Git -->|"Argo CD syncs"| Argo Cleanup -->|"removes the seed Secrets once Argo CD fully syncs"| Secrets style head fill:#f5f5f5,stroke:#9e9e9e,stroke-width:1px style ans fill:#f1f8e9,stroke:#2e7d32,stroke-width:1px style cluster fill:#eef5ff,stroke:#1565c0,stroke-width:2px style V fill:#fffde7,stroke:#f9a825,color:#000 style S fill:#fffde7,stroke:#f9a825,color:#000 style Seed fill:#e8f5e9,stroke:#2e7d32,color:#000 style Render fill:#e8f5e9,stroke:#2e7d32,color:#000 style Cleanup fill:#e8f5e9,stroke:#2e7d32,color:#000 style Git fill:#e3f2fd,stroke:#1565c0,color:#000 style Argo fill:#ef7b4d,stroke:#c5410a,color:#fff style Secrets fill:#fff3e0,stroke:#e65100,color:#000 style OB fill:#ede7f6,stroke:#5e35b1,color:#000 style Rest fill:#ede7f6,stroke:#5e35b1,color:#000 linkStyle default stroke-width:1.5px

Argo CD is already installed (Argo CD Installation). These steps give it the components to manage.

Each component has its own page for its settings, secrets, verification, and operations. Configure every component first, then publish the component tree, verify the deployment, and clean up the bootstrap secrets. Publishing starts the sync. The components take several minutes to come up, and Progressing is normal until they do. When they are all Healthy, Argo CD, Keycloak, and Launchpad are reachable over HTTPS and you can sign in.

Components

Deploy and Manage

Prerequisites#

  • Argo CD is installed on k8s-admin and the nvidia.nmc Ansible collection is available on the machine you run the playbooks from. Refer to Argo CD Installation.

  • The shared-storage check after Kubernetes installation passed on every k8s-admin node.

  • The kgateway controller and its GatewayClass (kgateway-ha2) are present, installed by cm-kubernetes-setup. The shared gateway binds to this class. Confirm it with kubectl get gatewayclass kgateway-ha2.

  • A load-balancer IP for the shared gateway, reserved on your network. Create DNS records for each component host name (for example keycloak.dgx-<cluster-name>.nvidia.com and launchpad.dgx-<cluster-name>.nvidia.com) before you install. Point them at the BCM head-node external or floating IP for the standard head-node path, or at the gateway load-balancer IP for direct access when clients can route to it (refer to Reach the UIs). New DNS records often need a separate network team.

  • An NGC API key with access to the NVIDIA Mission Control collection in the NGC Catalog. One key serves every NGC step in this guide: installing the Ansible collection, pulling charts and images, and rendering the component templates.

  • Write access to the GitOps repository registered with Argo CD.

Prepare the values file#

Build one values.yaml from three parts: the shared settings, the release-pinned versions, and each component’s own settings.

This values.yaml is a separate file from the Argo CD argocd-values.yaml (Argo CD Installation), read by the render as Ansible variables. Use the same gitops repository and cluster name in both, so the render publishes to the repository Argo CD already syncs and the default host names match your cluster name. Keep this file private because it contains the Git repository token. Store component bootstrap credentials separately in secrets.yaml.

Shared settings#

# Where to fetch the component templates from NGC.
argocd_gitops_templates_ngc_org: nvidia
argocd_gitops_templates_ngc_team: nv-mission-control
argocd_gitops_templates_ngc_version: "0.6.2"
argocd_gitops_templates_ngc_subdir: k8s-admin

# GitOps repository and cluster identity (same values as the Argo CD step).
gitops:
  url: https://<git-host>/<group>/<repo>.git
  username: <git-username>
  password: <repo-token>
  branch: main
cluster_name: <cluster-name>             # your cluster's name, used in the default host names, e.g. keycloak.dgx-<cluster-name>.nvidia.com
k8s_cluster_name: k8s-admin              # the admin Kubernetes cluster, also the folder Argo CD reads in the GitOps repository
ngc_path: nvidia/nv-mission-control      # NGC path for component charts and images

Component versions and settings#

Each component has its own key. The version and syncWave on each key are pinned for this release. Copy them as shown and leave them unchanged. Then open each component’s page and add that component’s settings under the same key.

argocd:
  version: "9.5.20"
  syncWave: "-1"
  # add settings from the Argo CD page
openbao:
  version: "0.28.3"
  configuratorVersion: "0.2.1"
  syncWave: "-7"
  # add settings from the OpenBao page
externalSecrets:
  version: "2.5.0"
  syncWave: "-6"
  # add settings from the External Secrets page
certManager:
  version: "v1.17.2"
  syncWave: "-5"
  # add settings from the Certificates page
cnpgOperator:
  version: "0.28.2"
  syncWave: "-5"
  # add settings from the CloudNativePG page
trustManager:
  version: "v0.22.1"
  syncWave: "-4"
  # add settings from the Certificates page
nmcGateway:
  version: "0.3.0"
  syncWave: "-4"
  # add settings from the NMC Gateway page
keycloak:
  version: "7.2.0"
  syncWave: "-3"
  # add settings from the Keycloak page
keycloakCnpg:
  version: "0.6.1"
  syncWave: "-3"
  # add settings from the Keycloak page
keycloakConfigCli:
  version: "1.3.7"
  syncWave: "-2"
  # add settings from the Keycloak page
launchpad:
  version: "0.8.3"
  nmcVersion: "2.5"
  syncWave: "-2"
  # add settings from the Launchpad page

Add each component’s settings from its page:

Prepare the secrets file#

Build a private secrets.yaml with the bootstrap secrets. These are the credentials OpenBao and its consumers need at startup. A separate seed step creates them as Kubernetes Secrets in the openbao namespace before Argo CD brings the components up, and OpenBao reads them as it starts. Leave any value empty to auto-generate it, except the shared NGC image-pull credential, which you must set:

k8s_bootstrap_secrets_ngc_image_pull_token: <ngc-api-key>   # required. Shared NGC image-pull credential

Add each component’s secrets from its page. OpenBao (OpenBao), Keycloak (Keycloak), Launchpad (NMC Launchpad), and Argo CD (Argo CD) take bootstrap secrets. NMC Gateway (NMC Gateway) and Certificates (Certificates) take secrets only in certain configurations, described on their pages.

Warning

secrets.yaml holds credentials. Keep it private and do not commit it to the GitOps repository.

When both files are ready, continue to Seed and Publish the Components to seed the bootstrap secrets and publish the component tree.