> This page is for Self-Hosted, version v3.0 (default). > For other versions, use one of these documentation indexes: > - v3.0 (default): https://docs.nvidia.com/run-ai/self-hosted/v3.0/llms.txt > - v2.26: https://docs.nvidia.com/run-ai/self-hosted/v2.26/llms.txt > - v2.25: https://docs.nvidia.com/run-ai/self-hosted/v2.25/llms.txt > - v2.24: https://docs.nvidia.com/run-ai/self-hosted/v2.24/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server. # Advanced Control Plane Configurations Use this page to customize the NVIDIA Run:ai control plane beyond the default installation settings. The settings on this page use NVIDIA Run:ai control plane Helm chart values. You can provide the same values through either installation path: - Manual Helm - Set the values in a Helm values file or pass them as Helm flags. - Guided Installation - Set the same values under `controlPlane.customHelmValues` in `config.yaml`. See [`controlPlane`](/run-ai/self-hosted/documentation/installation-and-configuration/install/guided-installation/configuration-reference#control-plane-configuration). ## Helm Chart Values The following Helm chart values can be used to customize the control plane for your environment. After changing a value, restart the relevant NVIDIA Run:ai pods so they can load the updated configuration. | Key | Change | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `global.ingress.ingressClass` | Ingress class | NVIDIA Run:ai uses NGINX as the default ingress controller. If your cluster has a different ingress controller, you can configure the ingress class to be created by NVIDIA Run:ai. | | `global.ingress.tlsSecretName` | TLS secret name | NVIDIA Run:ai requires the creation of a secret with [domain certificate](/run-ai/self-hosted/documentation/installation-and-configuration/system-requirements/networking-setup#control-plane-certificate). If the `runai-backend` namespace already had such a secret, you can set the secret name here | | `.podLabels` | Pod labels | Set NVIDIA Run:ai and 3rd party services' [Pod Labels ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels)in a format of key/value pairs. | | `.tolerations` | Pod tolerations | Set NVIDIA Run:ai and third-party services' [Pod Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) in list format. These tolerations apply only to the specified service. | | `global.tolerations` | Pod tolerations | Set NVIDIA Run:ai and 3rd party services' [Pod Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) in list format. These tolerations are applied globally to all supported services. | | `.replicaCount` | Pod replicas | By default, NVIDIA Run:ai services are deployed with a single replica. Set this value to run the specified service with multiple pod replicas. | | `global.replicaCount` | Pod replicas | By default, NVIDIA Run:ai services are deployed with a single replica. Set this value to apply a global replica count to all services. | | `global.requireDefaultPodAntiAffinity` | Enable default pod anti-affinity |

When enabled, NVIDIA Run:ai applies a default pod anti-affinity rule that attempts to prevent pods belonging to the same service from being scheduled on the same node.
Default: true

| |

<service-name>
 resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 250m
    memory: 256Mi

| Pod request and limits | Set NVIDIA Run:ai and 3rd party services' resources | | `disableIstioSidecarInjection.enabled` | Disable Istio sidecar injection | Disable the automatic injection of Istio sidecars across the entire NVIDIA Run:ai Control Plane services. | | `global.affinity` | System nodes |

Sets the system nodes where NVIDIA Run:ai system-level services are scheduled.
Default: Prefer to schedule on nodes that are labeled with node-role.kubernetes.io/runai-system

| | `global.customCA.enabled` | Certificate authority | Enables the use of a custom Certificate Authority (CA) in your deployment. When set to `true`, the system is configured to trust a user-provided CA certificate for secure communication. | ## Email Notifications Configuration To enable and manage outbound email notifications for the NVIDIA Run:ai platform, configure the following values under the `notificationsService.config.sinks.runai-email` section in your Helm values. These settings are used both for workload-related notifications and for system messages from NVIDIA Run:ai. All parameters can be set in your `values.yaml` file during Helm deployment or via Helm upgrade. | Parameter | Required | Default Value | Description | | -------------------------------------------------------------------- | -------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | `notificationsService.config.sinks.runai-email.type` | required | email | Type of sink; must be set as **email** | | `notificationsService.config.sinks.runai-email.smtp_host` | required | Empty | SMTP server hostname | | `notificationsService.config.sinks.runai-email.smtp_port` | optional | 587 | SMTP server port | | `notificationsService.config.sinks.runai-email.user` | optional | Empty | SMTP authentication username | | `notificationsService.config.sinks.runai-email.password` | optional | Empty | SMTP authentication password | | `notificationsService.config.sinks.runai-email.smtp_tls_enabled` | optional | true | Enable TLS for SMTP | | `notificationsService.config.sinks.runai-email.from_display_name` | optional | NVIDIA Run:ai | Display name for the sender email address | | `notificationsService.config.sinks.runai-email.from` | optional | [test@run.ai](mailto:test@run.ai) | Sender email address, e.g. [notifications@my.domain](mailto:notifications@my.domain) | | `notificationsService.config.sinks.runai-email.direct_notifications` | optional | False | Send workload notifications directly to the submitter’s inbox instead of sending all notifications to a single global email address | | `notificationsService.config.sinks.runai-email.auth_type` | optional | auth\_login | Authentication type: auth\_login or auth\_plain | ### Example Configuration ```yaml notificationsService: config: sinks: runai-email: type: email smtp_host: my.smtp.host smtp_port: 587 user: smtp_user password: smtp_password smtp_tls_enabled: true from_display_name: NVIDIA Run:ai from: notifications@my.domain direct_notifications: true logo_url: https://s3.amazonaws.com/www.run.ai/nvidia_runai_logo_new.png auth_type: auth_login ``` ## Third-Party Services The NVIDIA Run:ai control plane bundles third-party services it depends on - Keycloak for authentication, PostgreSQL as its database, and Thanos for metrics storage - and deploys them for you by default. This section covers tuning those built-in deployments and rotating their credentials. For what each service does, supported versions, and replacing one with an externally managed instance instead, see [Third-Party Services](/run-ai/self-hosted/documentation/installation-and-configuration/system-requirements/third-party-services/standard-third-party-services). ### Keycloak Keycloak provides authentication and identity management for the NVIDIA Run:ai control plane. The Helm chart uses [Keycloakx](https://artifacthub.io/packages/helm/codecentric/keycloakx) (`keycloakx`). **Note** The `keycloakx.adminUser` can only be set during the initial installation. The admin password can be changed later through the Keycloak UI, but you must also update `keycloakx.adminPassword` in the Helm chart using `helm upgrade`. | Key | Change | Description | | --- | ------ | ----------- | | `keycloakx.adminUser` | Admin username | Defines the username for the Keycloak administrator. Can only be set during initial installation. | | `keycloakx.adminPassword` | Admin password | Defines the password for the Keycloak administrator. | | `keycloakx.existingSecret` | Credentials secret | Existing secret name with authentication credentials. | | `global.keycloakx.host` | Keycloak host path | Overrides the DNS for Keycloak. Use this to access Keycloak externally to the cluster. | #### Changing the Keycloak Admin Password 1. Open the Keycloak UI at: `https:///auth` 2. Sign in with your existing admin credentials 3. Go to **Users** and select **admin** (or your admin username) 4. Open **Credentials** and select **Reset password** 5. Set the new password and click **Save** 6. Run `helm upgrade` and set `keycloakx.adminPassword` to the new password **Note** Failing to update the Helm values after changing the password can cause control plane services to encounter errors. ### PostgreSQL PostgreSQL is the centralized database for the NVIDIA Run:ai control plane, deployed as part of the control plane Helm chart using [Bitnami PostgreSQL](https://artifacthub.io/packages/helm/bitnami/postgresql) (`postgresql`). The following values tune the built-in PostgreSQL deployment: | Key | Change | Description | | --- | ------ | ----------- | | `global.postgresql.auth.postgresPassword` | PostgreSQL admin password | Password for the built-in PostgreSQL superuser (`postgres`). | | `postgresql.primary.initdb.password` | PostgreSQL admin password | Set the same password as `global.postgresql.auth.postgresPassword` if changed. | | `postgresql.primary.persistence.storageClass` | Storage class | Use a specific storage class instead of the default. | #### Changing PostgreSQL Passwords 1. Connect to the PostgreSQL pod: ```bash kubectl exec -it runai-backend-postgresql-0 -n runai-backend -- bash psql -U postgres ``` 2. Update the passwords: ```sql ALTER USER "postgres" WITH PASSWORD ''; ALTER USER "user" WITH PASSWORD ''; ``` 3. Find the Kubernetes secret (default name: `runai-backend-gen-postgresql`) and update it with the new base64-encoded passwords. The keys are typically `postgres-password` and `password`. 4. Restart all deployments to apply the changes: ```bash kubectl rollout restart deployment -n runai-backend ``` **Note** Failing to restart the pods after updating the secret can cause control plane services to encounter errors. ### Thanos Thanos provides long-term metrics storage for the NVIDIA Run:ai control plane, deployed using [Bitnami Thanos](https://artifacthub.io/packages/helm/bitnami/thanos) (`thanos`). | Key | Change | Description | | --- | ------ | ----------- | | `thanos.receive.persistence.storageClass` | Storage class | Use a specific storage class instead of the default. |