Quick Start

Configuration Samples

View as Markdown

The samples below show common starting points for nv-config-manager-install.yaml. Start with the minimal example, then add storage, SSO, ESO, and load balancer settings as needed for your environment.

Minimal in-cluster deployment

version: "1"
cluster:
  hostname: config-manager.example.com
  environment: test
  namespace: nv-config-manager
  airgapped: false
  size: small
secrets:
  method: kubernetes
  config_manager_service_username: nv-config-manager
network_secrets:
  - name: Hash Salt
    secret_key: hash_salt
  - name: BGP Password
    secret_key: bgp_password
    rotation: r1
sites:
  - name: dc01
services:
  nautobot: true

External DCIM provider

The provider package is owned separately from Config Manager. Until the publishing story is finalized, install it from Git or a sibling checkout and ship it in the deployment’s provider-package image. This example uses the deliberately neutral synthetic provider name; replace every synthetic value with the provider’s documented name, endpoint, token, and OCI wheel image. Installing a package does not certify that provider for every Config Manager capability. The provider must implement the normalized operations used by the universal Config Manager workflow surface; workflows are not enabled or disabled by provider name.

For the SDK and package contract, including provider-owned event handling and render data, see Contribute a DCIM Provider.

version: "1"
cluster:
  hostname: config-manager.example.com
  environment: test
  namespace: nv-config-manager
secrets:
  method: kubernetes
  k8s:
    dcim:
      values:
        token: "<synthetic-provider-token>"
dcim:
  provider: synthetic
  server: https://synthetic-dcim.example
  public_url: https://synthetic-dcim.example
  display_name: Synthetic DCIM
  event_stream: synthetic-dcim
  event_subject: synthetic.change
  options:
    tenant: lab
  provider_packages:
    - name: synthetic
      image: registry.example.com/synthetic-dcim-provider:1.0
services:
  nautobot: false
sites:
  - name: dc01

For secrets.method: eso, enable secrets.vault.paths.dcim and configure its path and token key. Provider-specific sensitive settings belong in the provider’s documented secret references, not in dcim.options.

For an airgapped deployment, the image in each provider_packages entry must be included in the bundle. Pass a file containing that OCI image reference to create-airgapped.sh --extra-images-file; the bundle builder cannot infer site-specific provider packages from an installer configuration. The standard provider-wheel installer image is included in the bundle and is automatically mapped to images.registry. To use a different installer image, configure images.overrides.dcimProviderInstaller so it follows the same registry and airgap handling as other third-party images.

Local Redis exporter without monitoring

Set redis_metrics_enabled under infrastructure.monitoring for headless deployments. This example enables the bundled Redis exporter without creating a Redis PodMonitor:

version: "1"
cluster:
  hostname: nv-config-manager.local
  environment: local
infrastructure:
  monitoring:
    enabled: false
    redis_metrics_enabled: true

When monitoring is enabled, the Redis PodMonitor is enabled too. Local observability automatically enables both settings without changing the saved redis_metrics_enabled preference. Configuring external Redis suppresses the exporter and PodMonitor.

File storage with OS images

version: "1"
cluster:
  hostname: nv-config-manager.local
  environment: local
  namespace: nv-config-manager
  size: small
infrastructure:
  ztp_storage:
    type: file
    pvc_name: ztp-os-images
    pvc_size: 20Gi
    os_images:
      - platform: cumulus-linux
        version: "5.14.0"
        path: /images/cumulus-linux-5.14.0-mlx-amd64.bin
      - platform: mlnx-os
        version: "3.10.4000"
        path: /images/mlnx-os-3.10.4000.bin
secrets:
  method: kubernetes
sites:
  - name: dc01
services:
  nautobot: true

AWS with Keycloak SSO and ESO

version: "1"
cluster:
  hostname: platform.nv-config-manager.example.com
  environment: production
  namespace: nv-config-manager-prod
  release_name: nv-config-manager-platform
  size: large
secrets:
  method: eso
  config_manager_service_username: nv-config-manager
  vault:
    server: https://vault.example.com
    namespace: engineering
    secrets_path: nv-config-manager/secrets
    mount_path: auth/kubernetes/prod
    role: nv-config-manager-vault-agent
    auth:
      method: jwt
sso:
  enabled: true
  provider: keycloak
  issuer_url: https://keycloak.example.com/realms/nv-config-manager
  client_id: nv-config-manager
  client_secret: your-keycloak-client-secret
spiffe:
  enabled: true
  provider: spire
  auth_mode: jwt
  trust_domain: example.com
  group_prefixes:
    - spiffe://example.com/ns/nv-config-manager-prod=nv-config-manager-admin
infrastructure:
  load_balancer:
    provider: nlb
    nlb_gateway:
      type: external
      target_type: ip
      subnets: "subnet-abc123, subnet-def456"
      dns_name: "platform.nv-config-manager.example.com,*.platform.nv-config-manager.example.com"
    nlb_ztp:
      type: external
      target_type: ip
      name: nv-config-manager-prod-ztp-lb
      sg: "sg-111222, sg-333444"
      subnets: "subnet-abc123, subnet-def456"
      ips: "10.0.1.10, 10.0.1.20"
      dns_name: ztp-ext.platform.nv-config-manager.example.com
    nlb_dhcp:
      type: external
      target_type: ip
      name: nv-config-manager-prod-dhcp-lb
      sg: "sg-111222, sg-555666"
      subnets: "subnet-abc123, subnet-def456"
      ips: "10.0.1.30, 10.0.1.40"
      dns_name: dhcp-ext.platform.nv-config-manager.example.com
  cnpg_s3_backup:
    enabled: true
    bucket: nv-config-manager-postgres-backups
    path: production
    endpoint: https://s3.us-west-2.amazonaws.com
images:
  source: registry
  registry: nvcr.io/nvidian/cfa
  tag: v1.4.0
network_secrets:
  - name: Hash Salt
    secret_key: hash_salt
    source: vault
  - name: BGP Password
    secret_key: bgp_password
    source: vault
    rotation: r1
sites:
  - name: dc01
    vault_path: secrets/nv-config-manager/site/dc01/config_secrets
  - name: dc02
    vault_path: secrets/nv-config-manager/site/dc02/config_secrets