> For the complete documentation index, see [llms.txt](https://run-ai-docs.nvidia.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://run-ai-docs.nvidia.com/self-hosted/2.20/getting-started/installation/install-using-helm/install-control-plane.md).

# Install the Control Plane

## System and Network Requirements

Before installing the NVIDIA Run:ai control plane, validate that the [system requirements](/self-hosted/2.20/getting-started/installation/install-using-helm/cp-system-requirements.md) and [network requirements ](/self-hosted/2.20/getting-started/installation/install-using-helm/network-requirements.md)are met. For air-gapped environments, make sure you have the [software artifacts ](/self-hosted/2.20/getting-started/installation/install-using-helm/preparations.md#software-artifacts)prepared.

## Permissions

As part of the installation, you will be required to install the NVIDIA Run:ai control plane [Helm chart](https://helm.sh/). The Helm charts require Kubernetes administrator permissions. You can review the exact objects that are created by the charts using the `--dry-run` on both helm charts.

## Installation

{% hint style="info" %}
**Note**

* To customize the installation based on your environment, see [Customized installation](/self-hosted/2.20/getting-started/installation/install-using-helm/custom-install.md).
* PostgreSQL and Keycloakx are installed with default usernames and passwords. To change the default credentials, see [Additional third-party configurations](/self-hosted/2.20/infrastructure-setup/advanced-setup/control-plane-config.md).
  {% endhint %}

### NVIDIA Run:ai version

It’s recommended to install the latest NVIDIA Run:ai release. If you need to install a specific version, you can browse the available versions using the following commands:

<details>

<summary>Connected</summary>

Run the following command:

```bash
helm search repo -l runai-backend
```

</details>

<details>

<summary>Air-gapped</summary>

Run the following command to browse all available air-gapped packages using the token provided by NVIDIA Run:ai.

To download and extract a specific version, and to upload the container images to your private registry, see the [Preparations](/self-hosted/2.20/getting-started/installation/install-using-helm/preparations.md) section.

```bash
curl -H "Authorization: Bearer <token>" "https://runai.jfrog.io/artifactory/api/storage/runai-airgapped-prod/?list"
```

</details>

### Kubernetes

<details>

<summary>Connected</summary>

Run the following command and update the values as described below:

1. Replace `global.domain=<DOMAIN>` with the one obtained [here](/self-hosted/2.20/getting-started/installation/install-using-helm/cp-system-requirements.md#fully-qualified-domain-name-fqdn):
2. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
3. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

```bash
helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \ 
    --set global.domain=<DOMAIN> \
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>"
```

For example:

<pre class="language-shellscript"><code class="lang-shellscript"><strong>helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
</strong>helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \ 
    --set global.domain=runai.mycorp.local \
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!"
</code></pre>

**Note:** Use the `--dry-run` flag to gain an understanding of what is being installed before the actual installation.

</details>

<details>

<summary>Air-gapped</summary>

To run the following command, make sure to replace the following. The `custom-env.yaml` is created when [preparing the installation script](/self-hosted/2.20/getting-started/installation/install-using-helm/preparations.md#software-artifacts):

{% hint style="warning" %}
**Prerequisites**

Make sure you have extracted the software artifacts as described in the [Preparations](/self-hosted/2.20/getting-started/installation/install-using-helm/preparations.md#software-artifacts) section. The helm chart is located in the `chart` folder of the extracted directory.
{% endhint %}

1. `./chart/control-plane-<VERSION>.tgz` - The NVIDIA Run:ai control plane Helm chart, located in the `chart` folder of the extracted software artifacts
2. `global.domain=<DOMAIN>` - The domain name set [here](/self-hosted/2.20/getting-started/installation/install-using-helm/cp-system-requirements.md#fully-qualified-domain-name-fqdn)
3. `global.customCA.enabled=true` as described [here](/self-hosted/2.20/getting-started/installation/install-using-helm/cp-system-requirements.md#local-certificate-authority)
4. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
5. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

Run the following command from the root of the extracted software artifacts directory:

```shellscript
helm upgrade -i runai-backend ./chart/control-plane-<VERSION>.tgz \
    --set global.domain=<DOMAIN> \ 
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>" \
    -n runai-backend -f custom-env.yaml
```

For example:

```shellscript
helm upgrade -i runai-backend ./chart/control-plane-<VERSION>.tgz \
    --set global.domain=<DOMAIN> \ 
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!" \
    -n runai-backend -f custom-env.yaml
```

**Note:** Use the `--dry-run` flag to gain an understanding of what is being installed before the actual installation.

</details>

### OpenShift

<details>

<summary>Connected</summary>

Run the following command and update the values as described below:

1. The `<OPENSHIFT-CLUSTER-DOMAIN>` is the subdomain configured for the OpenShift cluster
2. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
3. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

```shellscript
helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \
    --set global.domain=runai.apps.<OPENSHIFT-CLUSTER-DOMAIN> \ 
    --set global.config.kubernetesDistribution=openshift \
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>" 
```

For example:

```shellscript
helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \
    --set global.domain=runai.apps.mycorp.local \ 
    --set global.config.kubernetesDistribution=openshift \
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!" 
```

</details>

<details>

<summary>Air-gapped</summary>

To run the following command, make sure to replace the following. The `custom-env.yaml` is created when [preparing the installation script:](/self-hosted/2.20/getting-started/installation/install-using-helm/preparations.md#software-artifacts)

{% hint style="warning" %}
**Prerequisites**

Make sure you have extracted the software artifacts as described in the [Preparations](/self-hosted/2.20/getting-started/installation/install-using-helm/preparations.md#software-artifacts) section. The helm chart is located in the `chart` folder of the extracted directory.
{% endhint %}

1. `./chart/control-plane-<VERSION>.tgz` - The NVIDIA Run:ai control plane Helm chart, located in the `chart` folder of the extracted software artifacts
2. `<OPENSHIFT-CLUSTER-DOMAIN>` - The domain configured for the OpenShift cluster. To find out the OpenShift cluster domain, run `oc get routes -A`
3. `global.customCA.enabled=true` as described [here](/self-hosted/2.20/getting-started/installation/install-using-helm/cp-system-requirements.md#local-certificate-authority)
4. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
5. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

Run the following command from the root of the extracted software artifacts directory:

```bash
helm upgrade -i runai-backend ./chart/control-plane-<VERSION>.tgz -n runai-backend \
    --set global.domain=runai.apps.<OPENSHIFT-CLUSTER-DOMAIN> \ 
    --set global.config.kubernetesDistribution=openshift \
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>" \
    -f custom-env.yaml 
```

For example:

```shellscript
helm upgrade -i runai-backend ./chart/control-plane-<VERSION>.tgz -n runai-backend \
    --set global.domain=runai.apps.mycorp.local \ 
    --set global.config.kubernetesDistribution=openshift \
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!" \
    -f custom-env.yaml 
```

**Note:** Use the `--dry-run` flag to gain an understanding of what is being installed before the actual installation.

</details>

## Connect to NVIDIA Run:ai User Interface

1. Open your browser and go to:

{% tabs %}
{% tab title="Kubernetes" %}
`https://<DOMAIN>`
{% endtab %}

{% tab title="OpenShift" %}
`https://runai.apps.<OpenShift-DOMAIN>`
{% endtab %}
{% endtabs %}

2. Log in using the administrator credentials provided during installation. It is recommended to change the password after the first login.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://run-ai-docs.nvidia.com/self-hosted/2.20/getting-started/installation/install-using-helm/install-control-plane.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.