NeMo Platform Helm Chart

For deployment guide, see Self-Managed Deployment in the NeMo Platform documentation.

Platform Secrets Encryption Key

The platform secrets service reads NMP_SECRETS_DEFAULT_ENCRYPTION_KEY from the API env Secret. The value must be base64-encoded and decode to at least 32 bytes.

Set secrets.defaultEncryptionKey.value to provide your own key. When that value is empty and neither envFromSecret nor secrets.defaultEncryptionKey.existingSecret.name is set, the chart runs a pre-install hook that creates <fullname>-api-env with a per-install random key. The hook is install-only and refuses to patch or rotate an existing Secret.

Set secrets.defaultEncryptionKey.existingSecret.name to use an existing Secret for only the secrets service encryption key. After Kubernetes decodes the Secret data, the value loaded from secrets.defaultEncryptionKey.existingSecret.key must be a base64-encoded key that decodes to at least 32 bytes.

Set envFromSecret to use a fully user-managed API env Secret. In that mode the chart does not create or generate the API env Secret.

On upgrade, the generated Secret must already exist and contain NMP_SECRETS_DEFAULT_ENCRYPTION_KEY. If it is missing, restore the original Secret instead of generating a replacement key; existing encrypted platform secrets will not decrypt with a new key.

Values

The following is the complete values.yaml for the NeMo Platform Helm Chart. All configuration options are documented inline with comments.