Clusters
A Kubernetes cluster. Holds the Kubernetes version, network, CNI, etcd encryption, control-plane configuration and conditions.
Infrastructure provider. Each cluster, control plane and node pool
carries exactly one provider object. nico runs the cluster on NVIDIA
Infra Controller (NICo) bare-metal infrastructure: organization, site
and VPC at the cluster level; instance type, networking, SSH key groups
and release at the control-plane and node pool level. launchLayer
runs it on LaunchLayer compute: VPC or organization, site and security
groups at the cluster level; instance type and host OS or VM profile at
the control-plane and node pool level. A deployment accepts only the
providers its operator enables (supportedInfraProviders, NICo by
default) and rejects any other with 400. A cluster’s provider is fixed
at creation.
Kubernetes versions. Versions are semantic-version cores (X.Y.Z) with
no leading v. Control-plane upgrades move forward one minor version at a
time; downgrades and major-version changes are rejected. Worker node pools
may trail the control plane by at most 3 minor versions. A new node pool
starts at the cluster’s Kubernetes version. controlPlaneKubernetesVersion
and a pool’s kubernetesVersion are desired versions; the control plane’s
current running version is reported in ControlPlaneStatus.kubernetesVersion.
Networking. New clusters use ovn-kubernetes (default version 2.4.2).
Calico is retained only for existing fleets and its creation path is
disabled by default. Pod and service CIDRs are IPv4,
private, and immutable after
creation; the defaults are 192.168.0.0/16 for pods and 10.96.0.0/12 for
services. NVKE allocates a /24 from the pod CIDR to each node, so the pod
CIDR must have room for every desired node plus surge, or one spare block
when surge is 0. This is checked when clusters and node pools are created
or scaled. Set controlPlaneVIP to use a virtual IP (kube-vip) as the API
server endpoint; when omitted, the first control-plane node’s IP is the
endpoint. The VIP must not fall inside the pod or service CIDR.