File Storage

The NeMo Platform Files service stores uploaded files and datasets. By default, it uses filesystem storage backed by a Kubernetes ReadWriteMany PersistentVolumeClaim (PVC). Alternatively, you can configure S3-compatible object storage.

Prerequisites

If using S3 storage, you must provision and manage your own bucket and credentials. The platform does not create buckets, IAM roles, or manage permissions on your behalf.

Storage Options

Local Storage (Default)

By default, the Files service uses local filesystem storage. Files are stored on the shared PVC configured in Persistent Volumes.

The default configuration is equivalent to:

1
platformConfig:
2
 files:
3
 default_storage_config:
4
 type: local
5
 path: /vol/files

You do not need to add this to your values.yaml. Once the PVC is set up as described in Persistent Volumes, local storage works out of the box.

S3 Object Storage

For production workloads, S3-compatible storage is recommended over RWX PVCs for better performance. This option works with AWS S3, MinIO, Ceph, and other S3-compatible infrastructure.

When using S3 for file storage, the shared PVC is still required for jobs storage, but files are stored directly in your S3 bucket.

Configuration

Configure S3 storage in your Helm values:

1
platformConfig:
2
 files:
3
 default_storage_config:
4
 type: s3
5
 bucket: my-nemo-bucket
6
 region: us-east-1
7
 use_sdk_auth: true

The platform uses the boto3 credential chain for S3 authentication. It is the cluster administrator’s responsibility to ensure the platform pod has valid credentials available through one of the standard boto3 mechanisms:

• IAM Roles for Service Accounts (IRSA) on EKS - credentials are automatically injected via service account annotations
• Environment variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY mounted into the pod
• Shared credential files - AWS credentials file mounted at ~/.aws/credentials

See the boto3 credentials documentation for the full credential resolution order.

Example: Injecting Credentials from Kubernetes Secrets

To inject S3 credentials from a Kubernetes secret, first create the secret:

1
kubectl create secret generic s3-credentials \
2
 --from-literal=access_key_id='<my_aws_access_key_id>' \
3
 --from-literal=secret_access_key='<my_aws_secret_access_key>'

Then use the api.env field in your Helm values with valueFrom to inject the credentials:

1
api:
2
 env:
3
 AWS_ACCESS_KEY_ID:
4
 valueFrom:
5
 secretKeyRef:
6
 name: s3-credentials
7
 key: access_key_id
8
 AWS_SECRET_ACCESS_KEY:
9
 valueFrom:
10
 secretKeyRef:
11
 name: s3-credentials
12
 key: secret_access_key
13
14
platformConfig:
15
 files:
16
 default_storage_config:
17
 type: s3
18
 bucket: my-nemo-bucket
19
 region: us-east-1
20
 use_sdk_auth: true

Additional Options

Using a Prefix

You can use the prefix field to scope the Files service to a specific path within your bucket. The prefix functions like a directory path, making it useful for organizing files or sharing a bucket across multiple applications.

1
platformConfig:
2
 files:
3
 default_storage_config:
4
 type: s3
5
 bucket: my-nemo-bucket
6
 prefix: nemo-platform/files
7
 region: us-east-1
8
 use_sdk_auth: true

All files will be stored under s3://my-nemo-bucket/nemo-platform/files/.

S3-Compatible Storage

For S3-compatible storage like MinIO or Ceph, specify a custom endpoint URL:

1
platformConfig:
2
 files:
3
 default_storage_config:
4
 type: s3
5
 bucket: my-nemo-bucket
6
 endpoint_url: http://minio.minio-system.svc.cluster.local:9000
7
 region: us-east-1
8
 use_sdk_auth: true

Configuration Reference