Prerequisites
- A running Kubernetes cluster and
kubectlaccess. - Helm 3.14 or later (Helm 4 works).
metrics-serverinstalled. The chart refuses to install without it, because the resource monitor readsmetrics.k8s.io. On kubeadm and other clusters with self-signed kubelet certificates, start metrics-server with--kubelet-insecure-tls. If you can’t install it, setresourceMonitor.enabled: falseand the chart skips the resource monitor.- Your Client ID and password from the clients page.
Install
values.yaml (see Configuration → Authentication).
Verify
Running, your secure environment Online on the clients page.
Environment-specific config
On a single-node cluster, use hostPath-backed volumes:ReadWriteOnce directories on whichever node a pod lands on, so on a multi-node cluster, pods on different nodes see different data. For multi-node clusters, keep hostPath.enabled: false, set storageClass.create: false and set storageClass.name to a ReadWriteMany class (NFS, CephFS or similar).
-
GPU or CPU-only. In the
envblock ofvalues.yaml, declare what your nodes have. WithoutGPU_LIMITS, every training pod requests one NVIDIA GPU, and on CPU-only nodes it staysPending:The chart’svalues.yamlwritesenvin braces (env: { … }), where a new line without a comma is a YAML error. Replace that whole block with the one above, and carry over any other keys you’ve set. With GPUs, use x86_64 nodes with an NVIDIA GPU of the Turing generation or newer (GPU support). The nodes also need the NVIDIA device plugin. Install it yourself, or let the chart run it: - NetworkPolicy (training-pod egress lockdown) only enforces if your CNI supports it — Calico, Cilium, or kube-router. Flannel alone does not enforce.
Production notes
- Schedule MySQL and storage on reliable nodes; back up the data PVCs.
- Size training compute per job via
RESOURCE_REQUESTS/RESOURCE_LIMITS(Configuration). - Day-2 upgrades and rollbacks: see Operations.