NMC Launchpad (air-gapped)#

NMC Launchpad is a landing page that links to the NMC components through one web interface.

In an air-gapped environment, install NMC Launchpad from the Helm chart in the bundle artifacts. Registry mirroring serves the container images from your local registry. Install NMC Gateway (NMC Gateway (air-gapped)) and Keycloak (Keycloak (air-gapped)) first. NMC Launchpad is reached through the gateway and signs its users in through Keycloak.

Create a Keycloak User for NMC Launchpad#

NMC Launchpad authenticates against the nmc realm, like other NMC components. The administrator account in values-keycloakx.yaml belongs to the master realm and cannot sign in to NMC Launchpad. The nmc realm needs its own users.

Federating BCM LDAP lets the BCM accounts sign in to this realm. Without LDAP federation, create a user through the Admin Console:

  1. Select the nmc realm in the realm selector.

  2. Select Users > Add user.

  3. Enter a Username and an Email, then select Create. Keycloak requires an email address to complete a sign-in, and stops a user without one at the Update Account Information screen.

  4. On the Credentials tab, select Set password, enter the password, and set Temporary to Off.

Create a Keycloak client for NMC Launchpad#

NMC Launchpad authenticates through an OpenID Connect client in Keycloak. Create the client in the Keycloak Admin Console and record its ID and secret.

  1. Sign in to the Keycloak Admin Console at https://<your-keycloak-domain>/.

  2. Select the nmc realm.

  3. Under Clients, select Create client.

  4. Set Client type to OpenID Connect, enter a Client ID such as nmc-launchpad, and select Next.

  5. Set Client authentication to On, then select Save.

  6. On the Settings tab, set:

    • Valid redirect URIs: https://<your-launchpad-domain>/api/auth/callback

    • Web origins: https://<your-launchpad-domain>

    • Valid post logout redirect URIs: https://<your-launchpad-domain>

  7. On the Credentials tab, record the Client secret.

Prepare the values file#

Create values-launchpad.yaml:

cat <<'EOF' > values-launchpad.yaml
cardUrls:
  bcm: ""       # NVIDIA Base Command Manager
  runai: ""     # NVIDIA Run:ai
  ajr: ""       # Autonomous Job Recovery
  ahr: ""       # Autonomous Hardware Recovery
  grafana: ""   # Grafana dashboards

nmc:
  version: "2.5"

ingress:
  enabled: false

route:
  enabled: true
  parentRefs:
    - name: nmc-gateway
      namespace: nmc-gateway
      sectionName: https
  hostnames:
    - "<your-launchpad-domain>"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /

# Enable when cluster DNS does not resolve the Keycloak host name:
# extraHostAliases:
#   - ip: "<gateway-ip>"
#     hostnames:
#       - "<your-keycloak-domain>"

auth:
  enabled: true
  provider: "keycloak"
  endpoint: "https://<your-keycloak-domain>/realms/<your-realm>/protocol/openid-connect"
  clientId: "<your-client-id>"
  clientSecret: "<your-client-secret>"
EOF

Set these values:

  • cardUrls: the URL for each component to show on the dashboard. Leave a value empty to hide its card.

  • nmc.version: the NVIDIA Mission Control release version.

  • route.hostnames: the fully qualified domain name for NMC Launchpad, for example launchpad.nmc.example.com. Resolve it as described in Reach the NMC interfaces, and make sure the gateway certificate covers that name.

  • auth.endpoint: the Keycloak OpenID Connect endpoint. Replace <your-realm> with the realm name, nmc in this guide.

  • auth.clientId and auth.clientSecret: the client ID and secret from the Keycloak client.

The route section attaches NMC Launchpad to NMC Gateway. The gateway terminates TLS, so NMC Launchpad serves plain HTTP inside the cluster.

NMC Launchpad completes the sign-in exchange from its own pod, so the pod resolves the Keycloak host name through cluster DNS. Uncomment extraHostAliases when cluster DNS does not carry your site domain. Without the alias, sign-in fails and the NMC Launchpad log records OAuth token request failed.

Note

NMC Launchpad pulls its images from your local registry, so values-launchpad.yaml needs no NGC registry credentials.

Install NMC Launchpad from the bundle#

helm upgrade --install launchpad \
  ./bundle/helm/nmc-launchpad-0.8.10.tgz \
  --namespace launchpad \
  --create-namespace \
  -f values-launchpad.yaml

Wait for NMC Launchpad to become ready:

kubectl rollout status deployment/launchpad-nmc-launchpad \
  -n launchpad --timeout=5m

Verify#

Open https://<your-launchpad-domain> in a browser. The dashboard appears with links to the components you configured. Select Login, sign in through Keycloak, and NMC Launchpad shows your authenticated identity.

Note

Authentication verifies user identity. All authenticated users have the same level of access.