Bare-metal

​

Prerequisites

• A running Kubernetes cluster and kubectl access.
• Helm 3.14 or later (Helm 4 works).
• metrics-server installed. The chart refuses to install without it, because the resource monitor reads metrics.k8s.io. On kubeadm and other clusters with self-signed kubelet certificates, start metrics-server with --kubelet-insecure-tls. If you can’t install it, set resourceMonitor.enabled: false and the chart skips the resource monitor.
• The tracebloc CLI, signed in (tracebloc login). It creates your secure environment’s Client ID and password; see Configuration → Authentication.

​

Install

tracebloc client create --credential-file tb.env   # Client ID, password and namespace, see below
helm repo add tracebloc https://tracebloc.github.io/client
helm repo update
helm show values tracebloc/client > values.yaml   # edit per below
. ./tb.env
helm upgrade --install "$TRACEBLOC_NAMESPACE" tracebloc/client \
  -n "$TRACEBLOC_NAMESPACE" --create-namespace -f values.yaml

​

Verify

kubectl get pods -n "$TRACEBLOC_NAMESPACE"

​

Environment-specific config

hostPath:
  enabled: true
pvcAccessMode: ReadWriteOnce
storageClass:
  create: true
  provisioner: kubernetes.io/no-provisioner
namespace:
  podSecurity:
    enforce: ""        # hostPath needs the privileged init-mysql-data container
clusterScope: true

• GPU or CPU-only. In the env block of values.yaml, declare what your nodes have. Without GPU_LIMITS, every training pod requests one NVIDIA GPU, and on CPU-only nodes it stays Pending:
  env:
    TRACEBLOC_DDP: "1"           # from the chart's env block; keep it
    GPU_LIMITS: ""               # CPU-only nodes. For NVIDIA GPUs: "nvidia.com/gpu=1"
  
  The chart’s values.yaml writes env in braces (env: { … }), where a new line without a comma is a YAML error. Replace that whole block with the one above, and carry over any other keys you’ve set. With GPUs, use x86_64 nodes with an NVIDIA GPU of the Turing generation or newer (GPU support). The nodes also need the NVIDIA device plugin. Install it yourself, or let the chart run it:
  gpu:
    devicePlugin:
      enabled: true
      vendor: nvidia
  
• NetworkPolicy (training-pod egress lockdown) only enforces if your CNI supports it — Calico, Cilium, or kube-router. Flannel alone does not enforce.

​

Production notes

• Schedule MySQL and storage on reliable nodes; back up the data PVCs.
• Size training compute per job via RESOURCE_REQUESTS / RESOURCE_LIMITS (Configuration).
• Day-2 upgrades and rollbacks: see Operations.