Skip to navigation
Installation and ConfigurationSystem Requirements

External Access to Critical Services

View as Markdown

NVIDIA Run:ai requires certain network connectivity and access. This page outlines the network endpoints and protocols that must be reachable from your NVIDIA Run:ai control plane and cluster nodes to support installation, artifact retrieval, and ongoing platform communication.

Meeting these requirements ensures that:

  • Users and API clients can reach the NVIDIA Run:ai control plane and cluster
  • The NVIDIA Run:ai cluster can sync with and report metrics to the control plane
  • The control plane and cluster nodes can pull the images required for installation
Network access map: inbound access from users and API clients, cluster sync and metrics between the control plane and cluster in multi-cluster deployments, internal node-to-node traffic, and outbound access to the NVIDIA Run:ai, third-party service, and prerequisite and feature image registries
CategoryRequirementDetails
InboundPorts open for user and API accessSee Inbound Rules
OutboundControl plane and cluster syncSee Control Plane and Cluster Sync
OutboundNVIDIA Run:ai registry and catalog accessSee NVIDIA Run:ai Registry and Catalogs
OutboundNetworking component registry accessSee Networking Component Registries
OutboundThird-party service registry accessSee Third-Party Service Registries
OutboundPrerequisite and feature component registry accessSee Prerequisite and Feature Registries
InternalNode-to-node connectivitySee Internal Network

Note

Ensure the inbound and outbound rules below are correctly applied to your firewall before proceeding with installation.

Inbound Rules

To allow your organization’s NVIDIA Run:ai users to interact with the cluster using the NVIDIA Run:ai Command-line interface, or access specific UI features, certain inbound ports need to be open:

NameDescriptionSourceDestinationPort
NVIDIA Run:ai control planeHTTPS entry point0.0.0.0NVIDIA Run:ai system nodes443
NVIDIA Run:ai clusterHTTPS entry point0.0.0.0NVIDIA Run:ai system nodes443

Outbound Rules

Control Plane and Cluster Sync

Note

These rules apply only to multi-cluster deployments, where the NVIDIA Run:ai cluster is installed on a separate Kubernetes cluster from the control plane. In a same-cluster deployment, the control plane and cluster run on the same Kubernetes cluster and communicate internally.

NameDescriptionSourceDestinationPort
Cluster syncSync NVIDIA Run:ai cluster with NVIDIA Run:ai control planeNVIDIA Run:ai cluster system nodesNVIDIA Run:ai control plane FQDN443
Metric storePush NVIDIA Run:ai cluster metrics to NVIDIA Run:ai control plane’s metric storeNVIDIA Run:ai cluster system nodesNVIDIA Run:ai control plane FQDN443

NVIDIA Run:ai Registry and Catalogs

NameDescriptionSourceDestinationPort
NVIDIA Run:ai NGC RegistryPull NVIDIA Run:ai images and Helm chart for installationAll Kubernetes nodesnvcr.io443
NVIDIA NGCBrowse NGC catalogNVIDIA Run:ai control plane system nodesapi.ngc.nvidia.com443
Hugging FaceBrowse Hugging Face modelsNVIDIA Run:ai control plane system nodeshuggingface.co443

Networking Component Registries

The ingress controller you install as part of Networking Setup is pulled from the following registry:

NameDescriptionSourceDestinationPort
Ingress Controller RegistryHAProxy ingress controller image repositoryAll Kubernetes nodesdocker.io443

Third-Party Service Registries

NVIDIA Run:ai deploys the following third-party services as part of installation. Images are pulled from Docker Hub, Quay, or the Kubernetes registry. For the full registry model, see Image Registry in Third-Party Services.

NameDescriptionSourceDestinationPort
KeycloakIdentity federation and SSO serviceNVIDIA Run:ai control plane system nodesdocker.io / quay.io443
PostgreSQLCentralized platform databaseNVIDIA Run:ai control plane system nodesdocker.io / quay.io443
TraefikAPI gatewayNVIDIA Run:ai control plane system nodesdocker.io / quay.io443
NATSMessage brokerNVIDIA Run:ai control plane system nodesdocker.io / quay.io443
ThanosLong-term metrics storageNVIDIA Run:ai control plane system nodesdocker.io / quay.io443
ValkeyWorkload cacheNVIDIA Run:ai cluster system nodesdocker.io / quay.io443
oauth2-proxyWorkload access authenticationNVIDIA Run:ai cluster system nodesdocker.io / quay.io443
git-syncGit data source syncNVIDIA Run:ai cluster system nodesregistry.k8s.io443

Gov-Ready

For a Gov-ready installation, the following services are pulled from Docker Hub as hardened images. You provide Docker Hub credentials to pull them.

NameDescriptionSourceDestinationPort
KeycloakIdentity federation and SSO serviceNVIDIA Run:ai control plane system nodesdocker.io443
PostgreSQLClient image that waits for the databaseNVIDIA Run:ai control plane system nodesdocker.io443
TraefikAPI gatewayNVIDIA Run:ai control plane system nodesdocker.io443
NATSMessage brokerNVIDIA Run:ai control plane system nodesdocker.io443
ThanosLong-term metrics storageNVIDIA Run:ai control plane system nodesdocker.io443
ValkeyWorkload cacheNVIDIA Run:ai cluster system nodesdocker.io443
git-syncGit data source syncNVIDIA Run:ai cluster system nodesdocker.io443

Prerequisite and Feature Registries

NVIDIA Run:ai requires additional prerequisite and feature components to be installed on the cluster, such as the GPU Operator and Prometheus Operator. These components are pulled from the following registries:

NameTypeDescriptionSourceDestinationPort
NVIDIA NGC CatalogPrerequisiteGPU Operator image repositoryAll Kubernetes nodesnvcr.io443
Red Hat Container RegistryPrerequisitePrometheus Operator image repositoryAll Kubernetes nodesquay.io443
Google Container RegistryFeatureKnative image repositoryAll Kubernetes nodesgcr.io443
Docker Hub RegistryFeatureKubeflow Training Operator image repositoryAll Kubernetes nodesdocker.io443

Internal Network

Ensure that all Kubernetes nodes can communicate with each other across all necessary ports. Kubernetes assumes full interconnectivity between nodes, so you must configure your network to allow this seamless communication. Specific port requirements may vary depending on your network setup.

IPv6 Considerations

For IPv6-only environments, nvcr.io only has an IPv4 DNS record, so clients on IPv6-only networks cannot resolve it and image pulls will fail. Two options:

  • Configure NAT64/DNS64 - Translates between IPv6 and IPv4 so the cluster reaches the registry transparently.
  • Deploy an internal mirror registry - Use Harbor, Artifactory, or a similar registry over IPv6, configured to pull from nvcr.io over IPv4. Point the cluster at the mirror through the container runtime config and NVIDIA Run:ai Helm image-registry overrides. Choose this option for air-gapped or strictly controlled networks.

gcr.io, quay.io, and docker.io are reachable over IPv6 directly.