This section includes release information for the self-hosted version of NVIDIA Run:ai:
New Features and Enhancements - Highlights major updates introduced in each version, including new capabilities, UI improvements, and changes to system behavior..
Hotfixes - Lists patches applied to released versions, including critical fixes and behavior corrections.
Note
See our for a list of supported versions and their respective support timelines.
Feature Life Cycle
NVIDIA Run:ai uses life cycle labels to indicate the maturity and stability of features across releases:
Experimental - This feature is in early development. It may not be stable and could be removed or changed significantly in future versions. Use with caution.
Beta - This feature is still being developed for official release in a future version and may have some limitations. Use with caution.
Legacy - This feature is scheduled to be removed in future versions. We recommend using alternatives if available. Use only if necessary.
Overview
NVIDIA Run:ai is a GPU orchestration and optimization platform that helps organizations maximize compute utilization for AI workloads. By optimizing the use of expensive compute resources, NVIDIA Run:ai accelerates AI development cycles, and drives faster time-to-market for AI-powered innovations.
Built on Kubernetes, NVIDIA Run:ai supports dynamic GPU allocation, workload submission, workload scheduling, and resource sharing, ensuring that AI teams get the compute power they need while IT teams maintain control over infrastructure efficiency.
NVIDIA Run:ai centralizes cluster management and optimizes infrastructure control by offering:
- Manage all clusters from a single platform, ensuring consistency and control across environments.
Installation
As part of the installation process, you will install:
A managing cluster/s
One or more
Both the control plane and clusters require Kubernetes. Typically, the control plane and first cluster are installed on the same Kubernetes cluster.
The self-hosted option is for organizations that cannot use a SaaS solution due to data leakage concerns. NVIDIA Run:ai self-hosting comes with two variants:
Monitoring and Maintenance
Deploying NVIDIA Run:ai in mission-critical environments requires proper monitoring and maintenance of resources to ensure workloads run and are deployed as expected.
Details on how to monitor different parts of the physical resources in your Kubernetes system, including and , can be found in the monitoring and maintenance section. Adjacent configuration and troubleshooting sections also cover high availability, and clusters, , and to meet compliance requirements.
In addition to monitoring NVIDIA Run:ai resources, it is also highly recommended to monitor NVIDIA Run:ai runs on Kubernetes, which manages containerized applications. In particular, focus on three main layers:
This is the highest layer and includes the parts of NVIDIA Run:ai pods, which run in containers managed by Kubernetes.
This layer includes the main Kubernetes system that runs and manages NVIDIA Run:ai components. Important elements to monitor include:
The health of the cluster and nodes (machines in the cluster).
The status of key Kubernetes services, such as the API server. For detailed information on managing clusters, see the official Kubernetes documentation.
This is the base layer, representing the actual machines (virtual or physical) that make up the cluster IT teams need to handle:
Managing CPU, memory, and storage
Keeping the operating system updated
Setting up the network and balancing the load
NVIDIA Run:ai does not require any special configurations at this level.
The articles below explain how to monitor these layers, maintain system security and compliance, and ensure the reliable operation of NVIDIA Run:ai in critical environments.
Uninstall of NVIDIA Run:ai cluster from the Kubernetes cluster does not delete existing projects, departments or workloads submitted by users.
To uninstall the NVIDIA Run:ai cluster, run the following helm command in your terminal:
To remove the NVIDIA Run:ai cluster from the NVIDIA Run:ai Platform, see Removing a cluster.
helm uninstall runai-cluster -n runai
Usage monitoring and capacity planning - Gain real-time and historical insights into GPU consumption across clusters to optimize resource allocation and plan future capacity needs efficiently.
Policy enforcement - Define and enforce security and usage policies to align GPU consumption with business and compliance requirements.
Enterprise-grade authentication - Integrate with your organization's identity provider for streamlined authentication (Single Sign-On) and role-based access control (RBAC).
Kubernetes-native application - Install as a Kubernetes-native application, seamlessly extending Kubernetes for native cloud experience and operational standards (install, upgrade, configure).
NVIDIA Run:ai simplifies AI infrastructure management by providing a structured approach to managing AI initiatives, resources, and user access. It enables platform administrators maintain control, efficiency, and scalability across their infrastructure:
Centralized GPU resource management - Enable seamless sharing and pooling of GPUs across multiple users, reducing idle time and optimizing utilization.
User and access control - Assign users (AI practitioners, ML engineers) to specific projects and departments to manage access and enforce security policies, utilizing role-based access control (RBAC) to ensure permissions align with user roles.
- Use scheduling to prioritize and allocate GPUs based on workload needs.
- Track real-time and historical data on GPU usage to help track resource consumption and optimize costs.
NVIDIA Run:ai empowers data scientists and ML engineers by providing:
Optimized workload scheduling - Ensure high-priority jobs get GPU resources. Workloads dynamically receive resources based on demand.
Fractional GPU usage - Request and utilize only a fraction of a GPU's memory, ensuring efficient resource allocation and leaving room for other workloads.
AI initiatives lifecycle support - Run your entire AI initiatives lifecycle – Jupyter Notebooks, training jobs, and inference workloads efficiently.
- Ensure an uninterrupted experience when working on Jupyter Notebooks without taking away GPUs.
- Support for distributed training across multiple GPUs and auto-scales inference workloads.
- Integrate with popular ML frameworks - PyTorch, TensorFlow, XGBoost, Knative, Spark, Kubeflow Pipelines, Apache Airflow, Argo workloads, Ray and more.
- Submit workloads using the NVIDIA Run:ai UI, API, CLI or run third-party workloads.
NVIDIA Run:ai is made up of two components both installed over a Kubernetes cluster:
NVIDIA Run:ai control plane – Provides resource management, handles workload submission and provides cluster monitoring and analytics.
The NVIDIA Run:ai cluster is responsible for scheduling AI workloads and efficiently allocating GPU resources across users and projects:
NVIDIARun:ai Scheduler - Applies AI-aware rules to efficiently schedule workloads submitted by AI practitioners.
Workload management - Handles workload management which includes the researcher code running as a Kubernetes container and the system resources required to run the code, such as storage, credentials, network endpoints to access the container and so on.
Kubernetes operator-based deployment- Installed as a Kubernetes Operator to automate deployment, upgrades and configuration of NVIDIA Run:ai cluster services.
Storage - Supports Kubernetes-native storage using , allowing organizations to bring their own storage solutions. Additionally, it also integrates with such as Git, S3, and NFS to support various data requirements.
Secured communication - Uses an outbound-only, secured (SSL) connection to synchronize with the NVIDIA Run:ai control plane.
Private - NVIDIA Run:ai only synchronizes metadata and operational metrics (e.g., workloads, nodes) with the control plane. No proprietary data, model artifacts, or user data sets are ever transmitted, ensuring full data privacy and security.
The NVIDIA Run:ai control plane provides a centralized management interface for organizations to oversee their GPU infrastructure across multiple locations/subnets, accessible via Web UI, API and . The control plane can be deployed on the cloud or on-premise for organizations that require local control over their infrastructure (self-hosted).
Multi-cluster management - Manages multiple NVIDIA Run:ai clusters for a single tenant across different locations and subnets from a single unified interface.
Resource and access management - Allows administrators to define Projects, Departments and user roles, enforcing policies for fair resource distribution.
NVIDIA Run:ai is installed on the customer's data science GPU clusters. The cluster connects to the NVIDIA Run:ai control plane on the cloud (https://<tenant-name>.run.ai).
With this installation, the cluster requires an outbound connection to the NVIDIA Run:ai cloud.
Self-hosted
The NVIDIA Run:ai control plane is also installed in the customer's data center
This article explains the procedure to create your own user applications.
Applications are used for API integrations with NVIDIA Run:ai. An application contains a client ID and a client secret. With the client credentials, you can obtain a token as detailed in and use it within subsequent API calls.
To create an application:
Click the user avatar at the top right corner, then select Settings
Secure Your Cluster
This section details the security considerations for deploying NVIDIA Run:ai. It is intended to help administrators and security officers understand the specific permissions required by NVIDIA Run:ai.
NVIDIA Run:ai integrates with Kubernetes clusters and requires specific permissions to successfully operate. These are permissions are controlled with configuration flags that dictate how NVIDIA Run:ai interacts with cluster resources. Prior to installation, security teams can review the permissions and ensure it aligns with their organization’s policies.
NVIDIA Run:ai provides various security-related permissions that can be customized to fit specific organizational needs. Below are brief descriptions of the key use cases for these customizations:
Permission
Use case
Shared Storage
Shared storage is a critical component in AI and machine learning workflows, particularly in scenarios involving distributed training and shared datasets. In AI and ML environments, data must be readily accessible across multiple nodes, especially when training large models or working with vast datasets. Shared storage enable seamless access to data, ensuring that all nodes in a distributed training setup can read and write to the same datasets simultaneously. This setup not only enhances efficiency but is also crucial for maintaining consistency and speed in high-performance computing environments.
While NVIDIA Run:ai Platform supports a variety of remote data sources, such as Git and S3, it is often more efficient to keep data close to the compute resources. This proximity is typically achieved through the use of shared storage, accessible to multiple nodes in your Kubernetes cluster.
When implementing shared storage in Kubernetes, there are two primary approaches:
Utilizing the of your storage provider (Recommended)
Workload Assets
NVIDIA Run:ai assets are preconfigured building blocks that simplify the workload submission effort and remove the complexities of Kubernetes and networks for AI practitioners.
Workload assets enable organizations to:
Create and reuse preconfigured setup for code, data, storage and resources to be used by AI practitioners to simplify the process of submitting workloads
Share the preconfigured setup with a wide audience of AI practitioners with similar needs
Click
+APPLICATION
Enter the application's name
Click CREATE
Copy the Client ID and Client secret and store securely
Click DONE
You can create up to 20 user applications.
To regenerate a client secret:
Locate the application you want to regenerate its client secret
Click Regenerate client secret
Click REGENERATE
Copy the New client secret and store it securely
Click DONE
Locate the application you want to delete
Click on the trash icon
On the dialog, click DELETE to confirm
Go to the User Applications API reference to view the available actions.
Notes
All clusters in the tenant must be version 2.20 and onward.
The token obtained through user applications assumes the roles and permissions of the user
The client secret is visible only at the time of creation. It cannot be recovered but can be regenerated.
Regenerating a Client Secret
Important
Regenerating a client secret revokes the previous one.
Deleting an Application
Using API
Automatic Namespace creation
Controls whether NVIDIA Run:ai automatically creates Kubernetes namespaces when new projects are created. Useful in environments where namespace creation must be strictly managed.
Automatic user assignment
Decides if users are automatically assigned to projects within NVIDIA Run:ai. Helps manage user access more tightly in certain compliance-driven environments.
Secret propagation
Determines whether NVIDIA Run:ai should propagate secrets across the cluster. Relevant for organizations with specific security protocols for managing sensitive data.
Disabling Kubernetes limit range
Chooses whether to disable the Kubernetes Limit Range feature. May be adjusted in environments with specific resource management needs.
Many organizations enforce IT compliance rules for Kubernetes, with strict access control for installing and running workloads. OpenShift uses Security Context Constraints (SCC) for this purpose. NVIDIA Run:ai fully supports SCC, ensuring integration with OpenShift's security requirements.
The platform is actively monitored for security vulnerabilities, with regular scans conducted to identify and address potential issues. Necessary fixes are applied to ensure that the software remains secure and resilient against emerging threats, providing a safe and reliable experience.
Access to the Kubernetes Cluster
Permissions and their Related Use Case
Note
These security customizations allow organizations to tailor NVIDIA Run:ai to their specific needs. All changes should be modified cautiously and only when necessary to meet particular security, compliance or operational requirements.
Secure Installation
Security Vulnerabilities
Using a direct NFS (Network File System) mount
NVIDIA Run:ai Data Sources support both direct NFS mount and Kubernetes Storage Classes.
Storage classes in Kubernetes defines how storage is provisioned and managed. This allows you to select storage types optimized for AI workloads. For example, you can choose storage with high IOPS (Input/Output Operations Per Second) for rapid data access during intensive training sessions, or tiered storage options to balance cost and performance-based on your organization’s requirements. This approach supports dynamic provisioning, enabling storage to be allocated on-demand as required by your applications.
NVIDIA Run:ai data sources such as Persistent Volume Claims (PVC) and Data Volumes leverage storage class to manage and allocate storage efficiently. This ensures that the most suitable storage option is always accessible, contributing to the efficiency and performance of AI workloads.
Direct NFS allows you to mount a shared file system directly across multiple nodes in your Kubernetes cluster. This method provides a straightforward way to share data among nodes and is often used for simple setups or when a dedicated NFS server is available.
However, using NFS can present challenges related to security and control. Direct NFS setups might lack the fine-grained control and security features available with storage class.
NVIDIA Run:ai lists all available storage classes in the Kubernetes cluster, making it easy for users to select the appropriate storage. Additionally, can be set to restrict or enforce the use of specific storage classes, to help maintain compliance with organizational standards and optimize resource utilization.
Direct NFS Mount
There are four workload asset types used by the workload:
Environments
The container image, tools and connections for the workload
Data sources
The type of data, its origin and the target storage location such as PVCs or cloud storage buckets where datasets are stored
Compute resources
The compute specification, including GPU and CPU compute and memory
The secrets to be used to access sensitive data, services, and applications such as docker registry or S3 buckets
When a workload asset is created, a scope is required. The scope defines who in the organization can view and/or use the asset.
Any subject (user, application, or SSO group) with a role that has permissions to Create an asset, can do so within their scope.
Assets are used when submitting workloads. Any subject (user, application or SSO group) with a role that has permissions to Create workloads, can also use assets.
Any subject (user, application, or SSO group) with a role that has permission to View an asset, can do so within their scope.
Note
The creation of assets is possible only via API and the NVIDIA Run:ai UI.
The submission of workloads using assets, is possible only via the NVIDIA Run:ai UI.
NVIDIA Run:ai authentication and authorization enables a streamlined experience for the user with precise controls covering the data each user can see and the actions each user can perform in the NVIDIA Run:ai platform.
Authentication verifies user identity during login, and authorization assigns the user with specific permissions according to the assigned access rules.
Authenticated access is required to use all aspects of the NVIDIA Run:ai interfaces, including the NVIDIA Run:ai platform, the NVIDIA Run:ai Command Line Interface (CLI) and APIs.
Authentication
There are multiple methods to authenticate and access NVIDIA Run:ai.
Single Sign-On (SSO)
NVIDIA Run:ai supports three methods to set up SSO:
When using SSO, it is highly recommended to manage at least one local user, as a breakglass account (an emergency account), in case access to SSO is not possible.
Username and password access can be used when SSO integration is not possible.
Secret is the authentication method for . Applications use the NVIDIA Run:ai APIs to perform automated tasks including scripts and pipelines based on their assigned .
The NVIDIA Run:ai platform uses Role Base Access Control (RBAC) to manage authorization. Once a user or an application is authenticated, they can perform actions according to their assigned access rules.
While Kubernetes RBAC is limited to a single cluster, NVIDIA Run:ai expands the scope of Kubernetes RBAC, making it easy for administrators to manage access rules across multiple clusters.
RBAC at NVIDIA Run:ai is configured using access rules. An access rule is the assignment of a to a : <Subject> is a <Role> in a <Scope>.
Subject
A user, a group, or an application assigned with the role
Role
Below is an example of an access rule: username@company.com is a Department admin in Department: A
Interworking with Karpenter
Karpenter is an open-source, Kubernetes cluster autoscaler built for cloud deployments. Karpenter optimizes the cloud cost of a customer’s cluster by moving workloads between different node types, consolidating workloads into fewer nodes, using lower-cost nodes where possible, scaling up new nodes when needed, and shutting down unused nodes.
Karpenter’s main goal is cost optimization. Unlike Karpenter, NVIDIA Run:ai’s Scheduler optimizes for fairness and resource utilization. Therefore, there are a few potential friction points when using both on the same cluster.
Friction Points Using Karpenter with NVIDIA Run:ai
Karpenter looks for “unschedulable” pending workloads and may try to scale up new nodes to make those workloads schedulable. However, in some scenarios, these workloads may exceed their quota parameters, and the NVIDIA Run:ai Scheduler will put them into a pending state.
Karpenter is not aware of the NVIDIA Run:ai fractions mechanism and may try to interfere incorrectly.
Karpenter preempts any type of workload (i.e., high-priority, non-preemptible workloads will potentially be interrupted and moved to save cost).
Karpenter has no pod-group (i.e., workload) notion or gang scheduling awareness, meaning that Karpenter is unaware that a set of “arbitrary” pods is a single workload. This may cause Karpenter to schedule those pods into different node pools (in the case of multi-node-pool workloads) or scale up or down a mix of wrong nodes.
NVIDIA Run:ai Scheduler mitigates the friction points using the following techniques (each numbered bullet below corresponds to the related friction point listed above):
Karpenter uses a “nominated node” to recommend a node for the Scheduler. The NVIDIA Run:ai Scheduler treats this as a “preferred” recommendation, meaning it will try to use this node, but it’s not required and it may choose another node.
Fractions - Karpenter won’t consolidate nodes with one or more pods that cannot be moved. The NVIDIA Run:ai reservation pod is marked as ‘do not evict’ to allow the NVIDIA Run:ai Scheduler to control the scheduling of fractions.
Non-preemptible workloads - NVIDIA Run:ai marks non-preemptible workloads as ‘do not evict’ and Karpenter respects this annotation.
Using multi-node-pool workloads
Workloads may include a list of optional node pools. Karpenter is not aware that only a single node pool should be selected out of that list for the workload. It may therefore recommend putting pods of the same workload into different node pools and may scale up nodes from different node pools to serve a “multi-node-pool” workload instead of nodes on the selected single node pool.
If this becomes an issue (i.e., if Karpenter scales up the wrong node types), users can set an inter-pod affinity using the node pool label or another common label as a ‘topology’ identifier. This will force Karpenter to choose nodes from a single-node pool per workload, selecting from any of the node pools listed as allowed by the workload.
High Availability
This guide outlines the best practices for configuring the NVIDIA Run:ai platform to ensure high availability and maintain service continuity during system failures or under heavy load. The goal is to reduce downtime and eliminate single points of failure by leveraging Kubernetes best practices alongside NVIDIA Run:ai specific configuration options. The NVIDIA Run:ai platform relies on two fundamental high availability strategies:
Use of system nodes - Assigning multiple dedicated nodes for critical system services ensures control, resource isolation, and enables system-level scaling.
Replication of core and third-party services - Configuring multiple replicas of essential services, including both platform and third-party components, distributes workloads and reduces single points of failure. If a component fails on one node, requests can seamlessly route to another instance.
System Nodes
The NVIDIA Run:ai platform allows you to dedicate specific nodes (system nodes) exclusively for core platform services. This approach provides improved operational isolation and easier resource management.
Ensure that at least three system nodes are configured to support high availability. If you use only a single node for core services, horizontally scaled components will not be distributed, resulting in a single point of failure. See for more details. This practice applies to both the NVIDIA Run:ai cluster and control plane (self-hosted).
The NVIDIA Run:ai control plane runs in the runai-backend namespace and consists of multiple Kubernetes and . To achieve high availability, it is recommended to configure multiple replicas during installation or upgrade using Helm flags.
In addition, the control plane supports autoscaling for certain services to handle variable load and improve system resiliency. Autoscaling can be enabled or configured during installation or upgrade using Helm flags.
Each of the NVIDIA Run:ai deployments can be set to scale up, by adding a helm settings on install/upgrade. For a full list of settings, contact NVIDIA Run:ai support.
To increase the replica count, use the following NVIDIA Run:ai control plane Helm flag:
NVIDIA Run:ai uses the following third-party components which are managed as Kubernetes StatefulSets. For more information, see :
PostgreSQL - The internal PostgreSQL cannot be scaled horizontally. To connect NVIDIA Run:ai to an external PostgreSQL service which can be configured for high availability, see .
Thanos - To enable Thanos autoscaling, use the following NVIDIA Run:ai control plane helm flags:
Keycloak- By default, Keycloak sets a minimum of 3 pods and will scale to more on transaction load. To scale Keycloak, use the following NVIDIA Run:ai control plane helm flags:
By default, NVIDIA Run:ai cluster services are deployed with a single replica. To achieve high availability, it is recommended to configure multiple replicas for core NVIDIA Run:ai services. For more information, see .
Before You Start
NVIDIA Run:ai provides metrics and telemetry for both physical cluster entities such as clusters, nodes, and node pools and application organization entities such as departments and projects. Metrics represent over-time data while telemetry represents current analytics data. This data is essential for monitoring and analyzing the performance and health of your platform.
Consuming Metrics and Telemetry Data
Users can consume the data based on their permissions:
API - Access the data programmatically through the NVIDIA Run:ai API.
UI - Visualize the data through the NVIDIA Run:ai user interface.
Metrics API - Access over-time detailed analytics data programmatically.
Telemetry API - Access current analytics data programmatically.
Refer to to see the full list of supported metrics and telemetry APIs.
Use the list and describe commands to fetch and manage the data. See for more details.
Refer to to see the full list of supported metrics and telemetry.
Overview dashboard - Provides a high-level summary of the cluster's health and performance, including key metrics such as GPU utilization, memory usage, and node status. Allows administrators to quickly identify any potential issues or areas for optimization. Offers advanced analytics capabilities for analyzing GPU usage patterns and identifying trends. Helps administrators optimize resource allocation and improve cluster efficiency.
Quota management - Enables administrators to monitor and manage GPU quotas across the cluster. Includes features for setting and adjusting quotas, tracking usage, and receiving alerts when quotas are exceeded.
Workload visualizations - Provides detailed insights into the resource usage and utilization of each GPU in the cluster. Includes metrics such as GPU memory utilization, core utilization, and power consumption. Allows administrators to identify GPUs that are under-utilized and overloaded.
Data Volumes
Data volumes offer a powerful solution for storing, managing, and sharing AI training data within the NVIDIA Run:ai platform. They promote collaboration, simplify data access control, and streamline the AI development lifecycle.
Acting as a central repository for organizational data resources, data volumes can represent datasets or raw data, that is stored in Kubernetes Persistent Volume Claims (PVCs).
Why Use a Data Volume?
Sharing with multiple scopes
Unlike other NVIDIA Run:ai data sources, data volumes can be shared across projects, departments, or clusters, encouraging data reuse and collaboration within the organization.
Storage saving
A single copy of the data can be used across multiple
Sharing large data sets
In large organizations, the data is often stored in a remote location, which can be a barrier for large model training. Even if the data is transferred into the cluster, sharing it easily with multiple users is still challenging. Data volumes can help share the data seamlessly, with maximum security and control.
Sharing data with colleagues
When sharing training results, generated data sets, or other artifacts with team members is needed, data volumes can help make the data available easily.
To create a data volume, there must be a with a PVC in its namespace.
Working with data volumes is currently available using the API. To view the available actions, go to the API reference.
Data volume creation is limited to .
Data volume sharing (adding scopes) is limited to .
Once created, the data volume is available to its originating project (see the prerequisites above).
Data volumes can be shared with additional scopes in the organization.
Data volumes are used when . Any user, application or SSO group with a that has permissions to create workloads can also use data volumes.
Researchers can list available data volumes within their permitted scopes for easy selection.
Upgrade
Before proceeding with the upgrade, it's crucial to apply the specific prerequisites associated with your current version of NVIDIA Run:ai and every version in between up to the version you are upgrading to.
To ensure a smooth and supported upgrade process:
Align control plane and cluster versions - For best results, upgrade the control plane and cluster components to the same NVIDIA Run:ai version during the same maintenance window. Keeping versions aligned helps avoid unexpected behavior caused by version mismatches and ensures full compatibility across platform components.
Upgrade order - When performing an upgrade:
Customized Installation
This section explains the available configurations for customizing the NVIDIA Run:ai control plane and cluster installation.
The NVIDIA Run:ai control plane installation can be customized to support your environment via Helm or flags. See .
The NVIDIA Run:ai cluster installation can be customized to support your environment via Helm or flags.
These configurations are saved in the runaiconfig Kubernetes object and can be edited post-installation as needed. For more information, see .
The following table lists the available Helm chart values that can be configured to customize the NVIDIA Run:ai cluster installation.
Logs Collection
This section provides instructions for IT administrators on collecting NVIDIA Run:ai logs for support, including prerequisites, CLI commands, and log file retrieval. It also covers enabling verbose logging for Prometheus and the NVIDIA Run:ai Scheduler.
To collect NVIDIA Run:ai logs, follow these steps:
Ensure that you have administrator-level access to the Kubernetes cluster where NVIDIA Run:ai is installed.
The NVIDIA Run:ai (CLI) must be installed.
Using the Scheduler with Third-Party Workloads
By default, Kubernetes uses its own native scheduler to determine pod placement. The NVIDIA Run:ai platform provides a custom scheduler, runai-scheduler, which is used by default for workloads submitted using the platform. This section outlines how to configure third-party workloads, such as those submitted directly to Kubernetes, to run with the , runai-scheduler, instead of the default Kubernetes scheduler.
To use the NVIDIA Run:ai Scheduler for third-party workloads, specify it in the workload’s YAML file. This instructs Kubernetes to schedule the workload using the NVIDIA Run:ai Scheduler instead of the default one.
For example:
If modifying the workload YAML is not possible, you can enforce the use of the NVIDIA Run:ai Scheduler for all workloads in a given namespace (i.e., NVIDIA Run:ai ) by applying an annotation. Once applied, all workloads submitted to the annotated namespace will automatically use the NVIDIA Run:ai Scheduler without requiring individual YAML modifications.
NVIDIA Run:ai node pools (single-node-pool workloads) - Karpenter respects the ‘node affinity’ that NVIDIA Run:ai sets on a pod, so Karpenter uses the node affinity for its recommended node. For the gang-scheduling/pod-group (workload) notion, NVIDIA Run:ai Scheduler considers Karpenter directives as preferred recommendations rather than mandatory instructions and overrides Karpenter instructions where appropriate.
An alternative approach is to use a single-node pool for each workload instead of multi-node pools.
Consolidation
To make Karpenter more effective when using its consolidation function, users should consider separating preemptible and non-preemptible workloads, either by using node pools, node affinities, taint/tolerations, or inter-pod anti-affinity.
If users don’t separate preemptible and non-preemptible workloads (i.e., make them run on different nodes), Karpenter’s ability to consolidate (bin-pack) and shut down nodes will be reduced, but it is still effective.
Conflicts between bin-packing and spread policies
If NVIDIA Run:ai is used with a scheduling spread policy, it will clash with Karpenter’s default bin-packs/consolidation policy, and the outcome may be a deployment that is not optimized for any of these policies.
Usually spread is used for Inference, which is non-preemptible and therefore not controlled by Karpenter (NVIDIA Run:ai Scheduler will mark those workloads as ‘do not evict’ for Karpenter), so this should not present a real deployment issue for customers.
A set of permissions that can be assigned to subjects. Roles at NVIDIA Run:ai are system defined and cannot be created, edited or deleted.
A permission is a set of actions (view, edit, create and delete) over a NVIDIA Run:ai entity (e.g. projects, workloads, users). For example, a role might allow a user to create and read Projects, but not update or delete them
Scope
A scope is part of an organization in which a set of permissions (roles) is effective. Scopes include Projects, Departments, Clusters, Account (all clusters).
Node and node pool visualizations - Similar to workload visualizations, but focused on the resource usage and utilization of each GPU within a specific node or node pool. Helps administrators identify potential issues or bottlenecks at the node level.
Advanced NVIDIA metrics - Provides access to a range of advanced NVIDIA metrics, such as GPU temperature, fan speed, and voltage. Enables administrators to monitor the health and performance of GPUs in greater detail. This data is available at the node and workload level. To enable these metrics, contact NVIDIA Run:ai customer support.
Note
Some NVIDIA Run:ai services do not have a replicas configuration. These will always run a single replica, and their recovery time after failure is tied to pod restart and rescheduling time.
Upgrade the cluster Helm chart only after the control plane upgrade completes successfully
NVIDIA Run:ai requires Helm 3.14 or later. Before you continue, validate your installed helm client version. To install or upgrade Helm, see Installing Helm. If you are installing an air-gapped version of NVIDIA Run:ai, the NVIDIA Run:ai tar file contains the helm binary.
Run the following commands to add the NVIDIA Run:ai Helm repository and browse the available versions:
Before upgrading the NVIDIA Run:ai control plane, validate that the latest system requirements and network requirements are met, as they can change from time to time.
Before upgrading the NVIDIA Run:ai cluster, validate that the latest system requirements and network requirements are met, as they can change from time to time.
Follow the setup and installation instructions below to get the installation instructions to upgrade the NVIDIA Run:ai cluster.
In the NVIDIA Run:ai UI, go to Clusters
Select the cluster you want to upgrade
Click INSTALLATION INSTRUCTIONS
Optional: Select the NVIDIA Run:ai cluster version (latest, by default)
Click CONTINUE
Follow the installation instructions. Run the Helm commands provided on your Kubernetes cluster. See the below if installation fails.
Click DONE
Once installation is complete, validate the cluster is Connected and listed with the new cluster version (see the cluster troubleshooting scenarios). Once you have done this, the cluster is upgraded to the latest version.
If you encounter an issue with the cluster upgrade, use the troubleshooting scenarios below.
If the NVIDIA Run:ai cluster installation failed, check the installation logs to identify the issue. Run the following script to print the installation logs:
If the NVIDIA Run:ai cluster upgrade completes, but the cluster status does not show as Connected, refer to the cluster troubleshooting scenarios.
Before Upgrade
Helm
Note
Helm 4 defaults to when installing a new chart release, which can conflict with resources managed by the NVIDIA Run:ai operator. Append --server-side=false to your helm upgrade command. NVIDIA Run:ai clusters originally installed with Helm 3.x are unaffected.
Software Files
Upgrade Control Plane
System and Network Requirements
Upgrade
Note
To upgrade to a specific version, modify the --version flag by specifying the desired <VERSION>. You can find all available versions by using the helm search repo runai-backend/control-plane --versions command.
Upgrade Cluster
System and Network Requirements
Note
It is highly recommended to upgrade the Kubernetes version together with the NVIDIA Run:ai cluster version, to ensure compatibility with latest supported version of your .
Getting Installation Instructions
Note
To upgrade to a specific version, modify the --version flag by specifying the desired <VERSION>. You can find all available versions by using the helm search repo runai/runai-cluster --versions command.
Run the Command from your local machine or a Bastion Host (secure server). Open a terminal on your local machine (or any machine that has network access to the Kubernetes cluster) where the NVIDIA Run:ai Administrator CLI is installed.
Collect the Logs. Execute the following command to collect the logs:
This command gathers all relevant NVIDIA Run:ai logs from the system and generate a compressed file.
Locate the Generated File. After running the command, note the location of the generated compressed log file. You can retrieve and send this file to NVIDIA Run:ai Support for further troubleshooting.
Increase log verbosity to capture more detailed information, providing deeper insights into system behavior and make it easier to identify and resolve issues.
Before you begin, ensure you have the following:
Access to the Kubernetes cluster where NVIDIA Run:ai is installed
The tar file packages the logs of NVIDIA Run:ai components only. It does not include logs of researcher containers that may contain private information.
Logs Verbosity
Prerequisites
Adding Verbosity
Adding verbosity to Prometheus
To increase the logging verbosity for Prometheus, follow these steps:
Edit the RunaiConfig to adjust Prometheus log levels. Copy the following command to your terminal:
Adding verbosity to the Scheduler
To enable extended logging for the NVIDIA Run:ai scheduler:
Edit the RunaiConfig to adjust scheduler verbosity:
Add or modify the following section under the scheduler settings:
Preparations
The following section provides the information needed to prepare for a NVIDIA Run:ai installation.
Software Artifacts
The following software artifacts should be used when installing the control plane and cluster.
Kubernetes
Connected
You will receive a token from NVIDIA Run:ai to access the NVIDIA Run:ai container registry. Use the following command to create the required Kubernetes secret:
Air-gapped
You will receive a token from NVIDIA Run:ai to access the NVIDIA Run:ai air-gapped installation package. Use the following commands with the token provided by NVIDIA Run:ai to download and extract the package.
Download and Extract the Air-gapped Package
Run the following command to browse all available air-gapped packages:
OpenShift
Connected
You will receive a token from NVIDIA Run:ai to access the NVIDIA Run:ai container registry. Use the following command to create the required Kubernetes secret:
Air-gapped
You will receive a token from NVIDIA Run:ai to access the NVIDIA Run:ai air-gapped installation package. Use the following commands with the token provided by NVIDIA Run:ai to download and extract the package.
Download and Extract the Air-gapped Package
Run the following command to browse all available air-gapped packages:
Private Docker Registry (Optional)
Kubernetes
To access the organization's docker registry it is required to set the registry's credentials (imagePullSecret).
Create the secret named runai-reg-creds based on your existing credentials. For more information, see .
OpenShift
To access the organization's docker registry it is required to set the registry's credentials (imagePullSecret).
Create the secret named runai-reg-creds in the runai-backend namespace based on your existing credentials. The configuration will be copied over to the runai namespace at cluster install. For more information, see .
Set Up Your Environment
External Postgres Database (Optional)
If you have opted to use an external PostgreSQL database, you need to perform initial setup to ensure successful installation. Follow these steps:
Create a SQL script file, edit the parameters below, and save it locally:
Replace <DATABASE_NAME> with a dedicate database name for NVIDIA Run:ai in your PostgreSQL database.
Replace <ROLE_NAME> with a dedicated role name (user) for NVIDIA Run:ai database.
Replace <ROLE_PASSWORD> with a password for the new PostgreSQL role.
Replace <GRAFANA_PASSWORD> with the password to be set for Grafana integration.
Run the following command on a machine where PostgreSQL client (pgsql) is installed:
Replace <POSTGRESQL_HOST> with the PostgreSQL ip address or hostname.
Replace <POSTGRESQL_USER> with the PostgreSQL username.
Access Rules
This section explains the procedure to manage Access rules.
Access rules provide users, groups, or applications privileges to system entities. An access rule is the assignment of a role to a subject in a scope: <Subject> is a <Role> in a <Scope>. For example, user user@domain.com is a department admin in department A.
Access Rules Table
The Access rules table can be found under Access in the NVIDIA Run:ai platform.
The Access rules table provides a list of all the access rules defined in the platform and allows you to manage them.
Flexible management
It is also possible to manage access rules directly for a specific , , , or .
The Access rules table consists of the following columns:
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
To add a new access rule:
Click +NEW ACCESS RULE
Select a subject User, SSO Group, or Application
Select or enter the subject identifier:
Access rules cannot be edited. To change an access rule, you must delete the rule, and then create a new rule to replace it.
Select the access rule you want to delete
Click DELETE
On the dialog, click DELETE to confirm
Go to the API reference to view the available actions.
Users
This section explains the procedure to manage users and their permissions.
Users can be managed locally, or via the identity provider (Idp), while assigned with access rules to manage permissions. For example, user user@domain.com is a department admin in department A.
Users Table
The Users table can be found under Access in the NVIDIA Run:ai platform.
The users table provides a list of all the users in the platform.
You can manage users and user permissions (access rules) for both local and SSO users.
Single Sign-On Users
SSO users are managed by the identity provider and appear once they have signed in to NVIDIA Run:ai.
The Users table consists of the following columns:
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
To create a local user:
Click +NEW LOCAL USER
Enter the user's Email address
Click CREATE
Review and copy the user's credentials:
To create an access rule:
Select the user you want to add an access rule for
Click ACCESS RULES
Click +ACCESS RULE
Select a role
To delete an access rule:
Select the user you want to remove an access rule from
Click ACCESS RULES
Find the access rule assigned to the user you would like to delete
Click on the trash icon
To reset a user's password:
Select the user you want to reset it's password
Click RESET PASSWORD
Click RESET
Review and copy the user's credentials:
Select the user you want to delete
Click DELETE
In the dialog, click DELETE to confirm
Go to the , API reference to view the available actions.
User Identity in Containers
The identity of the user inside a container determines its access to various resources. For example, network file systems often rely on this identity to control access to mounted volumes. As a result, propagating the correct user identity into a container is crucial for both functionality and security.
By default, containers in both Docker and Kubernetes run as the root user. This means any process inside the container has full administrative privileges, capable of modifying system files, installing packages, or changing configurations.
While this level of access provides researchers with maximum flexibility, it conflicts with modern enterprise security practices. If the container’s root identity is propagated to external systems (e.g., network-attached storage), it can result in elevated permissions outside the container, increasing the risk of security breaches.
NVIDIA Run:ai Controls for User Identity and Privileges
NVIDIA Run:ai allows you to enhance security and enforce organizational policies by:
Controlling root access and privilege escalation within containers
Propagating the user identity to align with enterprise access policies
NVIDIA Run:ai supports security-related workload configurations to control user permissions and restrict privilege escalation. These options are available via the API and CLI during workload creation:
runAsNonRoot / --run-as-user - Force the container to run as non-root user.
allowPrivilegeEscalation / --allow-privilege-escalation - Allow the container to use setuid binaries to escalate privileges, even when running as a non-root user. This setting can increase security risk and should be disabled if elevated privileges are not required.
Administrators can enforce secure defaults across the environment using , ensuring consistent workload behavior aligned with organizational security practices.
A best practice is to store the User Identifier (UID) and Group Identifier (GID) in the organization's directory. NVIDIA Run:ai allows you to pass these values to the container and use them as the container identity. To perform this, you must set up and perform the steps for UID/GID integration.
It is possible to explicitly pass user identity when creating an or submitting a :
From the image - Use the UID/GID defined in the container image.
From the IdP token - Use identity attributes provided by the SSO identity provider (available only in SSO-enabled installations).
Custom - Manually set the User ID (UID), Group ID (GID) and supplementary groups that can run commands in the container.
Administrators can enforce secure defaults across the environment using , ensuring consistent workload behavior aligned with organizational security practices.
In OpenShift, Security Context Constraints (SCCs) manage pod-level security, including root access. By default, containers are assigned a random non-root UID, and flags such as --run-as-user and --allow-privilege-escalation are disabled.
On non-OpenShift Kubernetes clusters, similar enforcement can be achieved using tools like , which applies system-level policies to restrict containers from running as root.
By default, OpenShift restricts setting specific user and group IDs (UIDs/GIDs) in workloads through its SCCs. To allow NVIDIA Run:ai workloads to run with explicitly defined UIDs and GIDs, a cluster administrator must modify the relevant SCCs.
To enable UID and GID assignment:
Edit the runai-user-job SCC:
Edit the runai-jupyter-notebook SCC (only required if using Jupyter environments):
In both SCC definitions, ensure the following sections are configured:
These settings allow NVIDIA Run:ai to pass specific UID and GID values into the container, enabling compatibility with identity-aware file systems and enterprise access controls.
When containers run as a specific user, the user must have a home directory defined within the image. Otherwise, starting a shell session will fail due to the absence of a home directory.
Since pre-creating a home directory for every possible user is impractical, NVIDIA Run:ai offers the createHomeDir / --create-home-dir option. When enabled, this flag creates a temporary home directory for the user inside the container at runtime. By default, the directory is created at /home/<username>.
NVIDIA Run:ai at Scale
Operating NVIDIA Run:ai at scale ensures that the system can efficiently handle fluctuating workloads while maintaining optimal performance. As clusters grow, whether due to an increasing number of nodes or a surge in workload demand, NVIDIA Run:ai services must be appropriately tuned to support large-scale environments.
This guide outlines the best practices for optimizing NVIDIA Run:ai for high-performance deployments, including NVIDIA Run:ai system services configurations, vertical scaling (adjusting CPU and memory resources) and where applicable, horizontal scaling (replicas).
NVIDIA Run:ai Services
Vertical Scaling
Each of the NVIDIA Run:ai containers has default resource requirements that reflect an average customer load. With significantly larger cluster loads, certain NVIDIA Run:ai services will require more CPU and memory resources. NVIDIA Run:ai supports configuring these resources for each NVIDIA Run:ai service group separately. For instructions and more information, see NVIDIA Run:ai services resource management.
Scheduling Services
The scheduling services group should be scaled together with the number of nodes and the number of workloads handled by the Scheduler (running / pending). These resource recommendations are based on internal benchmarks performed on stressed environments:
Scale (nodes/workloads)
CPU (request)
Memory (request)
The sync and workload service groups are less sensitive for scale. The recommendation for large or intensive environments is set to the following:
Scale (nodes/workloads)
CPU (request)
Memory (request)
By default, NVIDIA Run:ai cluster services are deployed with a single replica. For large scale and intensive environments it is recommended to scale the NVIDIA Run:ai services horizontally by increasing the number of replicas. For more information, see .
NVIDIA Run:ai relies on to scrape cluster metrics and forward them to the NVIDIA Run:ai control plane. The volume of metrics generated is directly proportional to the number of nodes, workloads, and projects in the system. When operating at scale—reaching hundreds, and thousands of nodes and projects—the system generates a significant volume of metrics which can place a strain on the cluster and the network bandwidth.
To mitigate this impact, it is recommended to tune the Prometheus configurations. See to read more about the tuning parameters available via the remote write configuration and refer to this for optimizing Prometheus remote write performance.
You can apply the remote-write configurations required as described in
The following example demonstrates the recommended approach in NVIDIA Run:ai for tuning Prometheus remote-write configurations:
For clusters with more than 32 nodes (SuperPod and larger), increase the replica count for key control plane services to 2.
To set the replica count, use the following NVIDIA Run:ai control plane Helm flag:
Replicas for following services should not be increased: postgres, keycloak, grafana, thanos, nats, redoc, cluster-migrator, identity provider reconciler, settings migrator.
For Grafana, enable autoscaling first and then set the number of minReplicas. Use the following NVIDIA Run:ai control plane Helm flags:
is the third-party used by NVIDIA Run:ai to store metrics under a significant user load. Use the following NVIDIA Run:ai control plane Helm flags to increase resources for the Thanos query function:
Node Roles
This article explains how to designate specific node roles in a Kubernetes cluster to ensure optimal performance and reliability in production deployments.
For optimal performance in production clusters, it is essential to avoid extensive CPU usage on GPU nodes where possible. This can be done by ensuring the following:
NVIDIA Run:ai system-level services run on dedicated CPU-only nodes.
Workloads that do not request GPU resources (e.g. Machine Learning jobs) are executed on CPU-only nodes.
NVIDIA Run:ai services are scheduled on the defined node roles by applying using node labels .
To perform these tasks, make sure to install the NVIDIA Run:ai .
The following node roles can be configured on the cluster:
System node: Reserved for NVIDIA Run:ai system-level services.
GPU Worker node: Dedicated for GPU-based workloads.
CPU Worker node: Used for CPU-only workloads.
NVIDIA Run:ai system nodes run system-level services required to operate. This can be done via the (preferred method) or via NVIDIA Run:ai .
By default, NVIDIA Run:ai applies a node affinity rule to prefer nodes that are labeled with node-role.kubernetes.io/runai-system for system services scheduling. You can modify the default node affinity rule by:
Editing the spec.global.affinity configuration parameter as detailed in .
Editing the global.affinity configuration as detailed in for self-hosted deployments
To set a system role for a node in your Kubernetes cluster using Kubectl, follow these steps:
Use the kubectl get nodes command to list all the nodes in your cluster and identify the name of the node you want to modify.
Run one of the following commands to label the node with its role:
To set a system role for a node in your Kubernetes cluster, follow these steps:
Run the kubectl get nodes command to list all the nodes in your cluster and identify the name of the node you want to modify.
Run one of the following commands to set or remove a node’s role
The set node-role command will label the node and set relevant cluster configurations.
NVIDIA Run:ai worker nodes run user-submitted workloads and system-level required to operate. This can be managed via the (preferred method) or via NVIDIA Run:ai ,
By default, GPU workloads are scheduled on GPU nodes based on the nvidia.com/gpu.present label. When global.nodeAffinity.restrictScheduling is set to true via the :
GPU Workloads are scheduled with node affinity rule to require nodes that are labeled with node-role.kubernetes.io/runai-gpu-worker
CPU-only Workloads are scheduled with node affinity rule to require nodes that are labeled with node-role.kubernetes.io/runai-cpu-worker
To set a worker role for a node in your Kubernetes cluster using Kubectl, follow these steps:
Validate the global.nodeAffinity.restrictScheduling is set to true in the cluster’s .
Use the kubectl get nodes command to list all the nodes in your cluster and identify the name of the node you want to modify.
Run one of the following commands to label the node with its role. Replace the label and value (true
To set worker role for a node in your Kubernetes cluster via NVIDIA Run:ai , follow these steps:
Use the kubectl get nodes command to list all the nodes in your cluster and identify the name of the node you want to modify.
Run one of the following commands to set or remove a node’s role. <node-role> must be either --gpu-worker or --cpu-worker :
The set node-role command will label the node and set cluster configuration global.nodeAffinity.restrictScheduling true.
External Access to Containers
Researchers may need to access containers remotely during workload execution. Common use cases include:
Running a Jupyter Notebook inside the container
Connecting PyCharm for remote Python development
Viewing machine learning visualizations using TensorBoard
To enable this access, you must expose the relevant container ports.
Accessing the containers remotely requires exposing container ports. In Docker, ports are exposed by them when launching the container. NVIDIA Run:ai provides similar functionality within a Kubernetes environment.
Since Kubernetes abstracts the container's physical location, exposing ports is more complex. Kubernetes supports multiple methods for exposing container ports. For more details, refer to the .
Method
Description
NVIDIA Run:ai Support
Many tools used by researchers, such as Jupyter, TensorBoard, or VSCode, require remote access to the running workload's container. In NVIDIA Run:ai, this access is provided through dynamically generated URLs.
By default, NVIDIA Run:ai uses the provided to dynamically create SSL-secured URLs in the following format:
While path-based routing works with applications such as Jupyter Notebooks, it may not be compatible with other applications. Some applications assume they are running at the root file system, so hardcoded file paths and settings within the container may become invalid when running at a path other than the root. For example, if an application expects to access /etc/config.json but is served at /project-name/workspace-name, the file will not be found. This can cause the container to fail or not function as intended.
NVIDIA Run:ai provides support for host-based routing. When enabled, URLs follow the format:
This allows all workloads to run at the root path, avoiding file path issues and ensuring proper application behavior.
To enable host-based routing, perform the following steps:
Create a second DNS entry (A record) for *.<CLUSTER_URL>, pointing to the same IP as the cluster's .
Obtain a wildcard SSL certificate for this second DNS entry.
Add the certificate as a secret:
Create the following ingress rule and replace <CLUSTER_URL>:
Run the following:
Edit to generate the URLs correctly:
Once these requirements have been met, all workloads will automatically be assigned a secured URL with a subdomain, ensuring full functionality for all researcher applications.
Scheduling Rules
This article explains the procedure to configure and manage scheduling rules.
Scheduling rules are restrictions applied to workloads. These restrictions apply to either the resources (nodes) on which workloads can run or the duration of the run time. Scheduling rules are set for Projects or Departments and apply to specific workload types. Once scheduling rules are set for a project or department, all matching workloads associated with the project have the restrictions applied to them, as defined, when the workload was submitted. New scheduling rules added to a project are not applied over previously created workloads associated with that project.
There are three types of scheduling rules:
Workload Duration (Time Limit)
This rule limits the duration of a workload run time. Workload run time is calculated as the total time in which the workload was in status Running. You can apply a single rule per workload type - Preemptive Workspaces, Non-preemptive Workspaces, and Training.
Idle GPU Time Limit
This rule limits the total GPU time of a workload. Workload idle time is counted from the first time the workload is in status Running and the GPU was idle. Idleness is calculated by employing the runai_gpu_idle_seconds_per_workload metric. This metric determines the total duration of zero GPU utilization within each 30-second interval. If the GPU remains idle throughout the 30-second window, 30 seconds are added to the idleness sum; otherwise, the idleness count is reset. You can apply a single rule per workload type - "Preemptible" Workspaces, "Non-preemptible" Workspaces, and Training.
Node type is used to select a group of nodes, typically with specific characteristics such as a hardware feature, storage type, fast networking interconnection, etc. The uses node type as an indication of which nodes should be used for your workloads, within this project.
Node type is a label in the form of run.ai/type and a value (e.g. run.ai/type = dgx200) that the administrator uses to tag a set of nodes. Adding the node type to the project's scheduling rules mandates the user to submit workloads with a node type label/value pairs from this list, according to the workload type - Workspace or Training. The Scheduler then schedules workloads using a node selector, targeting nodes tagged with the NVIDIA Run:ai node type label/value pair. Node pools and a node type can be used in conjunction. For example, specifying a node pool and a smaller group of nodes from that node pool that includes a fast SSD memory or other unique characteristics.
The administrator should use a node label with the key of run.ai/type and any coupled value
To assign a label to nodes you want to group, set the 'node type (affinity)' on each relevant node:
Obtain the list of nodes and their current labels by copying the following to your terminal:
Annotate a specific node with a new label by copying the following to your terminal:
To add a scheduling rule:
Select the project/department for which you want to add a scheduling rule
Click EDIT
In the Scheduling rules section click +RULE
To edit a scheduling rule:
Select the project/department for which you want to edit its scheduling rule
Click EDIT
Find the scheduling rule you would like to edit
Edit the rule
To delete a scheduling rule:
Select the project/department from which you want to delete a scheduling rule
Click EDIT
Find the scheduling rule you would like to delete
Click on the x icon
Go to the API reference to view the available actions.
Optimize Performance with Node Level Scheduler
The Node Level Scheduler optimizes the performance of your pods and maximizes the utilization of GPUs by making optimal local decisions on GPU allocation to your pods. While the NVIDIA Run:ai Scheduler chooses the specific node for a pod, it has no visibility to the node’s GPUs internal state. The Node Level Scheduler is aware of the local GPUs states and makes optimal local decisions such that it can optimize both the GPU utilization and pods’ performance running on the node’s GPUs.
This guide provides an overview of the best use cases for the Node Level Scheduler and instructions for configuring it to maximize GPU performance and pod efficiency.
Deployment Considerations
While the Node Level Scheduler applies to all workload types, it will best optimize the performance of burstable workloads. Burstable workloads are workloads that use dynamic GPU fractions, giving those more GPU memory than requested and up to the Limit specified.
Burstable workloads are always susceptible to an OOM Kill signal if the owner of the excess memory requires it back. This means that using the Node Level Scheduler with inference or training workloads may cause pod preemption.
Using interactive workloads with notebooks is the best use case for burstable workloads and Node Level Scheduler. These workloads behave differently since the OOM Kill signal will cause the notebooks' GPU process to exit but not the notebook itself. This keeps the interactive pod running and retrying to attach a GPU again.
This use case is one scenario that shows how Node Level Scheduler locally optimizes and maximizes GPU utilization and pods’ performance.
The below shows a node with 2 GPUs and 2 submitted workspaces:
The Scheduler instructs the node to put the 2 workspaces on a single GPU, a single GPU and leaving the other free for a workload that requires resources. This means GPU#2 is idle while the two workspaces can only use up to half a GPU, even if they temporarily need more:
With the Node Level Scheduler enabled, the local decision will be to spread those 2 workspaces on 2 GPUs and allow them to maximize both workspaces’ performance and GPUs’ utilization by bursting out up to the full GPU memory and GPU compute resources:
The NVIDIA Run:ai Scheduler still sees a node with one fully empty GPU and one fully occupied GPU. When a 3rd workload is scheduled, and it requires a full GPU (or more than 0.5 GPU), the Scheduler will schedule it to that node, and the Node Level Scheduler will move one of the workspaces to run with the other in GPU#1, as was the Scheduler’s initial plan. Moving the workspace from GPU#1 back to GPU#2 maintains the workspace running while the GPU process within the Jupyter notebook is killed and re-established on GPU#2, continuing to serve the workspace:
The Node Level Scheduler can be enabled per node pool. To use Node Level Scheduler, follow the below steps.
Enable the Node Level Scheduler at the cluster level (per cluster) by:
Editing the runaiconfig as follows. For more details, see :
Or, using the following kubectl patch command:
Enable Node Level Scheduler on any of the node pools:
Select Resources → Node pools
or
Under the Resource Utilization Optimization tab, change the number of workloads on each GPU to any value other than Not Enforced (i.e. 2, 3, 4, 5)
The Node Level Scheduler is now ready to be used on that node pool.
In order for a workload to be considered by the Node Level Scheduler for rerouting, it must be submitted with a GPU Request and Limit where the Limit is larger than the Request:
Enable and set
Then using dynamic GPU fractions
Backup and Restore
This document outlines how to back up and restore a NVIDIA Run:ai deployment, including both the NVIDIA Run:ai cluster and control plane.
Back Up the Cluster
The restoration or backup of NVIDIA Run:ai advanced cluster configurations and customized deployment configurations which are stored locally on the Kubernetes cluster is optional and can be restored and backed up separately. As backup of data is not required, the backup procedure is optional for advanced deployments.
Save Cluster Configurations
To back up the NVIDIA Run:ai cluster configurations:
Once the runaiconfig_back.yaml backup file is created, save the file externally, so that it can be retrieved later.
In the event of a critical Kubernetes failure or alternatively, if you want to migrate a NVIDIA Run:ai cluster to a new Kubernetes environment, simply reinstall the NVIDIA Run:ai cluster. Once you have reinstalled and reconnected the cluster, projects, workloads and other cluster data are synced automatically. Follow the steps below to restore the NVIDIA Run:ai cluster on a new Kubernetes environment.
Before restoring the NVIDIA Run:ai cluster, it is essential to validate that it is both disconnected and uninstalled:
If the Kubernetes cluster is still available, the NVIDIA Run:ai cluster. Make sure not to remove the cluster from the control plane.
Navigate to the Clusters grid in the NVIDIA Run:ai UI
Locate the cluster and verify its status is Disconnected
Follow the NVIDIA Run:ai cluster instructions and ensure all are met.
If you have a backup of the cluster configurations, reload it once the installation is complete:
Navigate to the Clusters grid in the NVIDIA Run:ai UI
If your cluster configuration disables automatic namespace creation for projects, you must manually:
Re-create each project namespace
Reapply the required role bindings for access control
For more information, see .
By default, NVIDIA Run:ai utilizes an internal PostgreSQL database to manage control plane data. This database resides on a Kubernetes Persistent Volume (PV). To safeguard against data loss, it's essential to implement a reliable backup strategy.
Consider the following methods to back up the PostgreSQL database:
PostgreSQL logical backup - Use pg_dump to create a logical backup of the database. Replace <password> with the appropriate PostgreSQL password. For example:
Persistent volume backup - Back up the entire PV that stores the PostgreSQL data.
Third-Party backup solutions - Integrate with external backup tools that support Kubernetes and PostgreSQL to automate and manage backups effectively.
NVIDIA Run:ai stores metrics history using . Thanos is configured to write data to a persistent volume (PV). To protect against data loss, it is recommended to regularly back up this volume.
The NVIDIA Run:ai control plane installation can be using --set flags during Helm deployment. These configuration overrides are preserved during upgrades but are not retained if Kubernetes is uninstalled or damaged. To ensure recovery, it's recommended to back up the full set of applied Helm customizations. You can retrieve the current configuration using:
Follow the steps below to restore the control plane including previously backed-up data and configurations:
Recreate the Kubernetes environment - Begin by provisioning a new Kubernetes or OpenShift cluster that meets all NVIDIA Run:ai installation .
Restore Persistent Volumes - Recover the PVs and ensure these volumes are correctly reattached or restored from your backup solution:
PostgreSQL database - Stores control plane metadata
Applications
This section explains the procedure to manage your organization's applications.
Applications are used for API integrations with NVIDIA Run:ai. An application contains a client ID and a client secret. With the client credentials, you can obtain a token as detailed in API authentication and use it within subsequent API calls.
Applications are assigned with access rules to manage permissions. For example, application ci-pipeline-prod is assigned with a Researcher role in Cluster: A.
Applications Table
The Applications table can be found under Access in the NVIDIA Run:ai platform.
The Applications table provides a list of all the applications defined in the platform, and allows you to manage them.
The Applications table consists of the following columns:
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
To create an application:
Click +NEW APPLICATION
Enter the application's name
Click CREATE
Copy the
To create an access rule:
Select the application you want to add an access rule for
Click ACCESS RULES
Click +ACCESS RULE
Select a role
To delete an access rule:
Select the application you want to remove an access rule from
Click ACCESS RULES
Find the access rule assigned to the user you would like to delete
Click on the trash icon
To regenerate a client secret:
Locate the application you want to regenerate its client secret
Click REGENERATE CLIENT SECRET
Click REGENERATE
Copy the
Select the application you want to delete
Click DELETE
On the dialog, click DELETE to confirm
Go to the , API reference to view the available actions.
NVIDIA Run:ai Workload Types
In the world of machine learning (ML), the journey from raw data to actionable insights is a complex process that spans multiple stages. Each stage of the AI lifecycle requires different tools, resources, and frameworks to ensure optimal performance. NVIDIA Run:ai simplifies this process by offering specialized workload types tailored to each phase, facilitating a smooth transition across various stages of the ML workflows.
The ML lifecycle usually begins with the experimental work on data and exploration of different modeling techniques to identify the best approach for accurate predictions. At this stage, resource consumption is usually moderate as experimentation is done on a smaller scale. As confidence grows in the model's potential and its accuracy, the demand for compute resources increases. This is especially true during the training phase, where vast amounts of data need to be processed, particularly with complex models such as large language models (LLMs), with their huge parameter sizes, that often require distributed training across multiple GPUs to handle the intensive computational load.
Finally, once the model is ready, it moves to the inference stage, where it is deployed to make predictions on new, unseen data. NVIDIA Run:ai's workload types are designed to correspond with the natural stages of this lifecycle. They are structured to align with the specific resource and framework requirements of each phase, ensuring that AI researchers and data scientists can focus on advancing their models without worrying about infrastructure management.
NVIDIA Run:ai offers three workload types that correspond to a specific phase of the researcher’s work:
Workspaces – For experimentation with data and models.
Training – For resource-intensive tasks such as model training and data preparation.
Inference – For deploying and serving the trained model.
The Workspace is where data scientists conduct initial research, experiment with different data sets, and test various algorithms. This is the most flexible stage in the ML lifecycle, where models and data are explored, tuned, and refined. The value of workspaces lies in the flexibility they offer, allowing the researcher to iterate quickly without being constrained by rigid infrastructure.
Framework flexibility
Workspaces support a variety of machine learning frameworks, as researchers need to experiment with different tools and methods.
Resource requirements
Workspaces are often lighter on resources compared to the training phase, but they still require significant computational power for data processing, analysis, and model iteration.
Hence, the default for the NVIDIA Run:ai workspaces considerations is to allow scheduling those workloads without the ability to preempt them once the resources were allocated. However, this non-preemptible state doesn’t allow utilizing more resources outside of the project’s deserved quota.
See to learn more about how to submit a workspace via the NVIDIA Run:ai platform. For quick starts, see .
As models mature and the need for more robust data processing and model training increases, NVIDIA Run:ai facilitates this shift through the Training workload. This phase is resource-intensive, often requiring distributed computing and high-performance clusters to process vast data sets and train models.
Training architecture
For training workloads NVIDIA Run:ai allows you to specify the architecture - standard or distributed. The distributed architecture is relevant for larger data sets and more complex models that require utilizing multiple nodes. For the distributed architecture, NVIDIA Run:ai allows you to specify different configurations for the master and workers and select which framework to use - PyTorch, XGBoost, MPI, and TensorFlow. In addition, as part of the distributed configuration, NVIDIA Run:ai enables the researchers to schedule their distributed workloads on nodes within the same region, zone, placement group, or any other topology.
Resource requirements
Training tasks demand high memory, compute power, and storage. NVIDIA Run:ai ensures that the allocated resources match the scale of the task and allows those workloads to utilize more compute resources than the project’s deserved quota. Make sure that if you wish your training workload not to be preempted, specify the number of GPUs that are in your quota.
See and to learn more about how to submit a training workload via the NVIDIA Run:ai UI. For quick starts, see and .
Once a model is trained and validated, it moves to the Inference stage, where it is deployed to make predictions (usually in a production environment). This phase is all about efficiency and responsiveness, as the model needs to serve real-time or batch predictions to end-users or other systems.
Inference-specific use cases
Naturally, inference workloads are required to change and adapt to the ever-changing demands to meet SLA. For example, additional replicas may be deployed, manually or automatically, to increase compute resources as part of a horizontal scaling approach or a new version of the deployment may need to be rolled out without affecting the running services.
Resource requirements
Inference models differ in size and purpose, leading to varying computational requirements. For example, small OCR models can run efficiently on CPUs, whereas LLMs typically require significant GPU memory for deployment and serving. Inference workloads are considered production-critical and are given the highest priority to ensure compliance with SLAs. Additionally, NVIDIA Run:ai ensures that inference workloads cannot be preempted, maintaining consistent performance and reliability.
See to learn more about how to submit an inference workload via the NVIDIA Run:ai UI. For a quick start, see .
Set Up SSO with OpenShift
Single Sign-On (SSO) is an authentication scheme, allowing users to log-in with a single pair of credentials to multiple, independent software systems.
This article explains the procedure to to NVIDIA Run:ai using the OpenID Connect protocol in OpenShift V4.
Before starting, make sure you have the following available from your OpenShift cluster:
:
Network Requirements
The following network requirements are for the NVIDIA Run:ai components installation and usage.
Set out below are the domains to whitelist and ports to open for installation, upgrade, and usage of the application and its management.
To allow your organization’s NVIDIA Run:ai users to interact with the cluster using the , or access specific UI features, certain inbound ports need to be open.
Name
Description
Source
Destination
Port
Nodes Maintenance
This section provides detailed instructions on how to manage both planned and unplanned node downtimes in a Kubernetes cluster running NVIDIA Run:ai. It covers all the steps to maintain service continuity and ensure the proper handling of workloads during these events.
Access to Kubernetes cluster - Administrative access to the Kubernetes cluster, including permissions to run kubectl commands
Basic knowledge of Kubernetes - Familiarity with Kubernetes concepts such as nodes, taints, and workloads
GPU Time-Slicing
NVIDIA Run:ai supports simultaneous submission of multiple workloads to single or multi-GPUs when using . This is achieved by slicing the GPU memory between the different workloads according to the requested GPU fraction, and by using NVIDIA’s GPU time-slicing to share the GPU compute runtime. NVIDIA Run:ai ensures each workload receives the exact share of the GPU memory (= gpu_memory * requested), while the NVIDIA GPU time-slicing splits the GPU runtime evenly between the different workloads running on that GPU.
To provide customers with predictable and accurate GPU compute resource scheduling, NVIDIA Run:ai’s GPU time-slicing adds fractional compute capabilities on top of NVIDIA Run:ai GPU fraction capabilities.
While the default NVIDIA GPU time-slicing allows for sharing the GPU compute runtime evenly without splitting or limiting the runtime of each workload, NVIDIA Run:ai’s GPU time-slicing mechanism gives each workload exclusive access to the full GPU for a limited amount of time, lease time, in each scheduling cycle, plan time. This cycle repeats itself for the lifetime of the workload. Using the GPU runtime this way guarantees a workload is granted its requested GPU compute resources proportionally to its requested GPU fraction, but also allows splitting GPU unused compute time up to a requested Limit.
For example, when there are 2 workloads running on the same GPU, with NVIDIA’s default GPU time slicing, each workload gets 50% of the GPU compute runtime, even if one workload requests 25% of the GPU memory, and the other workload requests 75% of the GPU memory. With the NVIDIA Run:ai GPU time-slicing, the first workload will get 25% of the GPU compute time and the second will get 75%. If one of the workloads does not use its deserved GPU compute time, the others can split that time evenly between them. As shown in the example, if one of the workloads does not request the GPU for some time, the other will get the full GPU compute time.
How the Scheduler Works
Efficient resource allocation is critical for managing AI and compute-intensive workloads in Kubernetes clusters. The NVIDIA Run:ai Scheduler enhances Kubernetes' native capabilities by introducing advanced scheduling principles such as fairness, quota management, and dynamic resource balancing. It ensures that workloads, whether simple single-pod or complex distributed tasks, are allocated resources effectively while adhering to organizational policies and priorities.
This guide explores the NVIDIA Run:ai Scheduler’s allocation process, preemption mechanisms, and resource management. Through examples and detailed explanations, you'll gain insights into how the Scheduler dynamically balances workloads to optimize cluster utilization and maintain fairness across .
When a workload is submitted, the workload controller creates a pod or pods (for distributed training workloads or deployment based inference). When the Scheduler gets a submit request with the first pod, it creates a and allocates all the relevant building blocks of that workload. The next pods of the same workload are attached to the same pod group.
A workload, with its associated pod group, is queued in the appropriate . In every scheduling cycle, the Scheduler ranks the order of queues by calculating their precedence for scheduling.
Policies and Rules
At NVIDIA Run:ai, Administrators can access a suite of tools designed to facilitate efficient account management. This article focuses on two key features: workload policies and workload scheduling rules. These features empower admins to establish default values and implement restrictions allowing enhanced control, assuring compatibility with organizational policies, and optimizing resource usage and utilization.
A workload policy is an end-to-end solution for AI managers and administrators to control and simplify how workloads are submitted. This solution allows them to set best practices, enforce limitations, and standardize processes for the submission of workloads for AI projects within their organization. It acts as a key guideline for data scientists, researchers, ML & MLOps engineers by standardizing submission practices and simplifying the workload submission process.
Implementing workload policies is essential when managing complex AI projects within an enterprise for several reasons:
Resource control and management - Defining or limiting the use of costly resources across the enterprise via a centralized management system to ensure efficient allocation and prevent overuse.
Reports
This section explains the procedure of managing reports in NVIDIA Run:ai.
Reports allow users to access and organize large amounts of data in a clear, CSV-formatted layout. They enable users to monitor resource consumption, analyze trends, and make data-driven decisions to optimize their AI workloads effectively.
Currently, only "Consumption Reports" are available, which provides insights into the consumption of resources such as GPU, CPU, and CPU memory across organizational units.
The Reports table can be found under Analytics in the NVIDIA Run:ai platform.
The Reports table provides a list of all the reports defined in the platform and allows you to manage them.
Users are able to access the reports they have generated themselves. Users with project viewing permissions throughout the tenant can access all reports within the tenant.
Configuring NVIDIA MIG Profiles
NVIDIA’s Multi-Instance GPU (MIG) enables splitting a GPU into multiple logical GPU devices, each with its own memory and compute portion of the physical GPU.
NVIDIA provides two MIG strategies:
Single - A GPU can be divided evenly. This means all MIG profiles are the same.
Mixed - A GPU can be divided into different profiles.
The NVIDIA Run:ai platform supports running workloads using NVIDIA MIG. Administrators can set the Kubernetes nodes to their preferred MIG strategy and configure the appropriate MIG profiles for researchers and MLOPS engineers to use.
Event History
This section provides details about NVIDIA Run:ai's Audit log.
The NVIDIA Run:ai control plane provides the audit log API and event history table in the NVIDIA Run:ai UI. Both reflect the same information regarding changes to business objects: clusters, projects and assets etc.
The Event history table can be found under Event history in the NVIDIA Run:ai UI.
The Event history table consists of the following columns:
Column
Description
Workspaces: The Experimentation Phase
Training: Scaling Resources for Model Development
Note
Multi-GPU training and distributed training are two distinct concepts. Multi-GPU training uses multiple GPUs within a single node, whereas distributed training spans multiple nodes and typically requires coordination between them.
Existing secret key where cluster TLS certificates are are stored (OpenShift only)
Default: ""
spec.prometheus.spec.image(string)
Due to a known issue In the Prometheus Helm chart, the imageRegistry setting is ignored. To pull the image from a different registry, you can manually specify the Prometheus image reference.
Default: quay.io/prometheus/prometheus
spec.prometheus.spec.imagePullSecrets(string)
List of image pull secrets references in the runai namespace to use for pulling Prometheus images (relevant for air-gapped installations).
Default: []
global.customCA.enabled
Enables the use of a custom Certificate Authority (CA) in your deployment. When set to true, the system is configured to trust a user-provided CA certificate for secure communication.
openShift.securityContextConstraints.create
Enables the deployment of Security Context Constraints (SCC). Disable for CIS compliance.
Default: true
controlPlane.existingSecret
Specifies the name of the existing Kubernetes secret where the cluster’s clientSecret used for secure connection with the control plane is stored.
controlPlane.secretKeys.clientSecret
Specifies the key within the controlPlane.existingSecret that stores the cluster’s clientSecret used for secure connection with the control plane.
The scope to which the subject has access. Click the name of the scope to see the scope and its subordinates
Authorized by
The user who granted the access rule
Creation time
The timestamp for when the rule was created
Last updated
The last time the access rule was updated
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
User Email for a local user created in NVIDIA Run:ai or for SSO user as recognized by the IDP
Group name as recognized by the IDP
Application name as created in NVIDIA Run:ai
Select a role
Select a scope
Click SAVE RULE
Type
The type of subject assigned to the access rule (user, SSO group, or application).
Subject
The user, SSO group, or application assigned with the role
Role
The role assigned to the subject
Customizing the Table View
Adding a New Access Rule
Note
An access rule consists of a single subject with a single role in a single scope. To assign multiple roles or multiple scopes to the same subject, multiple access rules must be added.
It is also possible to set the above using the API or CLI.
Using OpenShift or Gatekeeper to Provide Cluster Level Controls
Enabling UID and GID on OpenShift
Creating a Temporary Home Directory
Note
This home directory is temporary and exists only for the duration of the container's lifecycle. Any data saved in this location will be lost when the container exits.
By default, this flag is set to true when --run-as-user is enabled, and false otherwise.
Exposes the service externally using a cloud provider’s load balancer.
Supported via API with limited capabilities
Port Forwarding
Simple port forwarding allows access to the container via local and/or remote port.
Supported natively via Kubernetes
NodePort
Exposes the service on each Node’s IP at a static port (the NodePort). You’ll be able to contact the NodePort service from outside the cluster by requesting <NODE-IP>:<NODE-PORT> regardless of which node the container actually resides in.
Supported
Exposing Container Ports
Access to the Running Workload's Container
Path-Based Routing
Host-Based Routing
Enabling Host-Based Routing
Note
For OpenShift, editing the runaiconfig command is the only step required to generate URLs. Refer to the last step below.
GPU resource optimization is disabled by default. It must be enabled by your Administrator, under General Settings → Resources → GPU resource optimization.
To ensure high availability and prevent a single point of failure, it is recommended to configure at least three system nodes in your cluster.
By default, Kubernetes master nodes are configured to prevent workloads from running on them as a best-practice measure to safeguard control plane stability. While this restriction is generally recommended, certain NVIDIA reference architectures allow adding tolerations to the NVIDIA Run:ai deployment so critical system services can run on these nodes.
Kubectl
NVIDIA Run:ai Administrator CLI
Note
The NVIDIA Run:ai Administrator CLI only supports the default node affinity.
Worker Nodes
Kubectl
NVIDIA Run:ai Administrator CLI
Note
Use the --all flag to set or remove a role to all nodes.
In the configuration file that opens, add or modify the following section to set the log level to debug:
Save the changes. To view the Prometheus logs with the new verbosity level, run:
This command streams the last 100 lines of logs from Prometheus, providing detailed information useful for debu
This increases the verbosity level of the scheduler logs to provide more detailed output.
Warning: Enabling verbose logging can significantly increase disk space usage. Monitor your storage capacity and adjust the verbosity level as necessary.
kubectl create secret tls runai-cluster-domain-star-tls-secret -n runai \
--cert /path/to/fullchain.pem \ # Replace /path/to/fullchain.pem with the actual path to your TLS certificate
--key /path/to/private.pem # Replace /path/to/private.pem with the actual path to your private key
Replace <POSTGRESQL_PORT> with the port number where PostgreSQL is running.
Replace <POSTGRESQL_DB> with the name of your PostgreSQL database.
Replace <POSTGRESQL_DB> with the name of your PostgreSQL database.
Replace <SQL_FILE> with the path to the SQL script created in the previous step.
Run the following command to download the desired package:
SSH into a node with kubectl access to the cluster and Docker installed.
Extract the NVIDIA Run:ai package and replace <VERSION> in the command below and run:
tarxvfrunai-airgapped-package-<VERSION>.tar.gz
Upload Images
NVIDIA Run:ai assumes the existence of a Docker registry within your organization for hosting container images. The installation requires the network address and port for this registry (referred to as <REGISTRY_URL>).
Upload images to a local Docker Registry. Set the Docker Registry address in the form of NAME:PORT (do not add https):
exportREGISTRY_URL=<DOCKERREGISTRYADDRESS>
Run the following script. You must have at least 20GB of free disk space to run. If Docker is configured to run as non-root then sudo is not required:
sudo./setup.sh
The script should create a file named custom-env.yaml which will be used during control plane installation.
Run the following command to download the desired package:
SSH into a node with oc access to the cluster and Docker installed.
Extract the NVIDIA Run:ai package and replace <VERSION> in the command below and run:
tar xvf runai-airgapped-package-<VERSION>.tar.gz
Upload Images
NVIDIA Run:ai assumes the existence of a Docker registry within your organization for hosting container images. The installation requires the network address and port for this registry (referred to as <REGISTRY_URL>).
Upload images to a local Docker Registry. Set the Docker Registry address in the form of NAME:PORT (do not add https):
export REGISTRY_URL=<DOCKER REGISTRY ADDRESS>
Run the following script. You must have at least 20GB of free disk space to run. If Docker is configured to run as non-root then sudo is not required:
sudo ./setup.sh
The script should create a file named custom-env.yaml which will be used by the control plane installation.
-- Create a new database for runai
CREATE DATABASE <DATABASE_NAME>;
-- Create the role with login and password
CREATE ROLE <ROLE_NAME> WITH LOGIN PASSWORD '<ROLE_PASSWORD>';
-- Grant all privileges on the database to the role
GRANT ALL PRIVILEGES ON DATABASE <DATABASE_NAME> TO <ROLE_NAME>;
-- Connect to the newly created database
\c <DATABASE_NAME>
-- grafana
CREATE ROLE grafana WITH LOGIN PASSWORD '<GRAFANA_PASSWORD>';
CREATE SCHEMA grafana authorization grafana;
ALTER USER grafana set search_path='grafana';
-- Exit psql
\q
To obtain your PGPASSWORD=<password>, run helm get values runai-backend -n runai-backend --all.
NVIDIA Run:ai also supports an external PostgreSQL database. If you are using an PostgreSQL database, the above steps do not apply. For more details, see .
Metrics Storage
Deployment Configurations
Restore the Control Plane
Note
For external PostgreSQL databases, ensure the appropriate connection details and credentials are reconfigured. See External PostgreSQL database for more details.
To avoid losing access, removing the identity provider must be carried out by a local user.
Troubleshooting
Troubleshooting Scenarios
Error: "403 - Sorry, we can’t let you see this page. Something about permissions…"
Description: The authenticated user is missing permissions
Mitigation:
Validate either the user or its related group/s are assigned with
Error: "401 - We’re having trouble identifying your account because your email is incorrect or can’t be found."
Description: Authentication failed because email attribute was not found.
Mitigation:
Validate email attribute is available in the configured OIDC Scopes
Error: "Unexpected error when authenticating with identity provider"
Description: User authentication failed
Mitigation: Validate the the configured OIDC Scopes exist and match the Identity Provider’s available scopes
Advanced: Look for the specific error message in the URL address
Error: "Unexpected error when authenticating with identity provider (SSO sign-in is not available)"
Description: User authentication failed
Mitigation:
Validate the the configured OIDC scope exists in the Identity Provider
Error: "unauthorized_client"
Description: OIDC Client ID was not found in the OpenShift IDP
Mitigation: Validate the the configured Client ID matches the value in the OAuthclient Kubernetes object
NVIDIA Run:ai control plane
HTTPS entrypoint
0.0.0.0
NVIDIA Run:ai system nodes
443
NVIDIA Run:ai cluster
HTTPS entrypoint
0.0.0.0
NVIDIA Run:ai system nodes
443
For the NVIDIA Run:ai cluster installation and usage, certain outbound ports must be open.
Name
Description
Source
Destination
Port
Cluster sync
Sync NVIDIA Run:ai cluster with NVIDIA Run:ai control plane
NVIDIA Run:ai cluster system nodes
NVIDIA Run:ai control plane FQDN
443
The NVIDIA Run:ai installation has software requirements that require additional components to be installed on the cluster. This article includes simple installation examples which can be used optionally and require the following cluster outbound ports to be open:
Name
Description
Source
Destination
Port
Kubernetes Registry
Ingress Nginx image repository
All kubernetes nodes
registry.k8s.io
443
Ensure that all Kubernetes nodes can communicate with each other across all necessary ports. Kubernetes assumes full interconnectivity between nodes, so you must configure your network to allow this seamless communication. Specific port requirements may vary depending on your network setup.
External Access
Note
Ensure the inbound and outbound rules are correctly applied to your firewall.
Outbound rules applied to the NVIDIA Run:ai cluster component only, In case the NVIDIA Run:ai cluster is installed together with the NVIDIA Run:ai control plane - The NVIDIA Run:ai cluster FQDN refers to the NVIDIA Run:ai control plane FQDN.
Node naming conventions - Know the names of the nodes within your cluster, as these are required when executing the commands
This section distinguishes between two types of nodes within a NVIDIA Run:ai installation:
Worker nodes - Nodes on which AI practitioners can submit and run workloads
NVIDIA Run:ai system nodes - Nodes on which the NVIDIA Run:ai software runs, managing the cluster's operations
Worker nodes are responsible for running workloads. When a worker node goes down, either due to planned maintenance or unexpected failure, workloads ideally migrate to other available nodes or wait in the queue to be executed when possible.
The following workload types can run on worker nodes:
Training workloads - These are long-running processes that, in case of node downtime, can automatically move to another node.
Interactive workloads - These are short-lived, interactive processes that require manual intervention to be relocated to another node.
Before stopping a worker node for maintenance, perform the following steps:
Prevent new workloads on the node
To stop the Kubernetes Scheduler from assigning new workloads to the node and to safely remove all existing workloads, copy the following command to your terminal:
<node-name>
Replace this placeholder with the actual name of the node you want to drain
kubectl taint nodes
This command is used to add a taint to the node, which prevents any new pods from being scheduled on it
runai=drain:NoExecute
This specific taint ensures that all existing pods on the node are evicted and rescheduled on other available nodes, if possible
Result: The node stops accepting new workloads, and existing workloads either migrate to other nodes or are placed in a queue for later execution.
Shut down and perform maintenance
After draining the node, you can safely shut it down and perform the necessary maintenance tasks.
Restart the node
Once maintenance is complete and the node is back online, remove the taint to allow the node to resume normal operations. Copy the following command to your terminal:
runai=drain:NoExecute-
The - at the end of the command indicates the removal of the taint. This allows the node to start accepting new workloads again.
Result: The node rejoins the cluster's pool of available resources, and workloads can be scheduled on it as usual.
In the event of unplanned downtime:
Automatic restart
If a node fails but immediately restarts, all services and workloads automatically resume.
Extended downtime
If the node remains down for an extended period, drain the node to migrate workloads to other nodes. Copy the following command to your terminal:
The command works the same as in the planned maintenance section, ensuring that no workloads remain scheduled on the node while it is down.
Reintegrate the node
Once the node is back online, remove the taint to allow it to rejoin the cluster's operations. Copy the following command to your terminal:
Result: This action reintegrates the node into the cluster, allowing it to accept new workloads.
Permanent shutdown
If the node is to be permanently decommissioned, remove it from Kubernetes with the following command:
kubectl delete node
This command completely removes the node from the cluster
<node-name>
In a production environment, the services responsible for scheduling, submitting and managing NVIDIA Run:ai workloads operate on one or more NVIDIA Run:ai system nodes. It is recommended to have more than one system node to ensure high availability. If one system node goes down, another can take over, maintaining continuity. If a second system node does not exist, you must designate another node in the cluster as a temporary NVIDIA Run:ai system node to maintain operations.
The protocols for handling planned maintenance and unplanned downtime are identical to those for worker nodes. Refer to the above section for detailed instructions.
To rejoin a node to the Kubernetes cluster, follow these steps:
Generate a join command on the master node
On the master node, copy the following command to your terminal:
kubeadm token create --print-join-command
kubeadm token create
This command generates a token that can be used to join a node to the Kubernetes cluster.
--print-join-command
This option outputs the full command that needs to be run on the worker node to rejoin it to the cluster.
Result: The command outputs a kubeadm join command.
Run the join command on the worker node
Copy the kubeadm join command generated from the previous step and run it on the worker node that needs to rejoin the cluster.
The kubeadm join command re-enrolls the node into the cluster, allowing it to start participating in the cluster's workload scheduling.
Verify node rejoining
Verify that the node has successfully rejoined the cluster by running:
kubectl get nodes
This command lists all nodes currently part of the Kubernetes cluster, along with their status
Result: The rejoined node should appear in the list with a status of Ready
Re-label nodes
Once the node is ready, ensure it is labeled according to its role within the cluster.
Prerequisites
Node Types
Worker Nodes
Training vs. Interactive Workloads
Note
While training workloads can be automatically migrated, it is recommended to plan maintenance and manually manage this process for a faster response, as it may take time for Kubernetes to detect a node failure.
Planned Maintenance
Unplanned Downtime
NVIDIA Run:ai System Nodes
Rejoining a Node into the Kubernetes Cluster
NVIDIA Run:ai offers two GPU time-slicing modes:
Strict - Each workload gets its precise GPU compute fraction, which equals to its requested GPU (memory) fraction. In terms of official Kubernetes resource specification, this means:
Fair - Each workload is guaranteed at least its GPU compute fraction, but at the same time can also use additional GPU runtime compute slices that are not used by other idle workloads. Those excess time slices are divided equally between all workloads running on that GPU (after each got at least its requested GPU compute fraction). In terms of official Kubernetes resource specification, this means:
The figure below illustrates how Strict time-slicing mode uses the GPU from Lease (slice) and Plan (cycle) perspective:
Strict time-slicing mode
The figure below illustrates how Fair time-slicing mode uses the GPU from Lease (slice) and Plan (cycle) perspective:
Fair time-slicing mode
Each GPU scheduling cycle is a plan. The plan is determined by the lease time and granularity (precision). By default, basic lease time is 250ms with 5% granularity (precision), which means the plan (cycle) time is: 250 / 0.05 = 5000ms (5 Sec). Using these values, a workload that requests gpu-fraction=0.5 gets 2.5s runtime out of the 5s cycle time.
Different workloads require different SLA and precision, so it also possible to tune the lease time and precision for customizing the time-slicing capabilities to your cluster.
Once timeSlicing is enabled in the runaiconfig, all submitted GPU fractions or GPU memory workloads will have their gpu-compute-request/limit set automatically by the system, depending on the annotation used on the time-slicing mode:
Strict compute resources:
Annotation
Value
GPU Compute Request
GPU Compute Limit
gpu-fraction
x
x
x
Fair compute resources:
Annotation
Value
GPU Compute Request
GPU Compute Limit
gpu-fraction
x
x
1.0
NVIDIA Run:ai’s GPU time-slicing is a cluster flag which changes the default NVIDIA time-slicing used by GPU fractions. For more details, see Advanced cluster configurations.
Enable GPU time-slicing by setting the following cluster flag in the runaiconfig file:
If the timeSlicing flag is not set, the system continues to use the default NVIDIA GPU time-slicing to maintain backward compatibility.
Decreasing the lease time makes time-slicing less accurate. Increasing the lease time makes the system more accurate, but each workload is less responsive.
Note
The above tables show that when submitting a workload using gpu-memory annotation, the system will split the GPU compute time between the different workloads running on that GPU. This means the workload can get anything from very little compute time (>0) to full GPU compute time (1.0).
Enabling GPU Time-Slicing
The next step is for the Scheduler to find nodes for those pods, assign the pods to their nodes (bind operation), and bind other building blocks of the pods such as storage, ingress and so on. If the pod group has a
rule attached to it, the Scheduler either allocates and binds all pods together, or puts all of them into pending state. It retries to schedule them all together in the next scheduling cycle. The Scheduler also updates the status of the pods and their associated pod group. Users are able to track the workload submission process both in the CLI or NVIDIA Run:ai UI. For more details on submitting and managing workloads, see
.
If the Scheduler cannot find resources for the submitted workloads (and all of its associated pods), and the workload deserves resources either because it is under its queue quota or fairshare, the Scheduler tries to reclaim resources from other queues. If this does not solve the resource issue, the Scheduler tries to preempt lower priority preemptible workloads within the same queue (project).
Reclaim is an inter-project and inter-department resource balancing action that takes back resources from one project or department that has used them as an over quota. It returns the resources back to a project (or department) that deserves those resources as part of its deserved quota, or to balance fairness between projects (or departments), so a project (or department) does not exceed its fairshare (portion of the unused resources).
This mode of operation means that a lower priority workload submitted in one project (e.g. training) can reclaim resources from a project that runs a higher priority workload (e.g. preemptive workspace) if fairness balancing is required.
Higher priority workloads may preempt lower priority preemptible workloads within the same project/node pool queue. For example, in a project that runs a training workload that exceeds the project quota for a certain node pool, a newly submitted workspace within the same project/node pool may stop (preempt) the training workload if there are not enough over quota resources for the project within that node pool to run both workloads (e.g. workspace using in-quota resources and training using over quota resources).
The NVIDIA Run:ai Scheduler strives to ensure fairness between projects and between departments. This means each department and project always strive to get their deserved quota, and unused resources are split between projects according to known rules (e.g. over quota weights).
If a project needs more resources even beyond its fairshare, and the Scheduler finds unused resources that no other project needs, this project can consume resources even beyond its fairshare.
Some scenarios can prevent the Scheduler from fully providing deserved quota and fairness:
Fragmentation or other scheduling constraints such affinities, taints etc.
Some requested resources, such as GPUs and CPU memory, can be allocated, while others, like CPU cores, are insufficient to meet the request. As a result, the Scheduler will place the workload in a pending state until the required resource becomes available.
The example below illustrates a split of quota between different projects and departments using several node pools:
The example below illustrates how fairshare is calculated per project/node pool for the above example:
For each Project:
The over quota (OQ) portion of each project (per node pool) is calculated as:
[(OQ-Weight) / (Σ Projects OQ-Weights)] x (Unused Resource per node pool)
Fairshare is calculated as the sum of quota + over quota.
In Project 2, we assume that out of the 36 available GPUs in node pool A, 20 GPUs are currently unused. This means either these GPUs are not part of any project’s quota, or they are part of a project’s quota but not used by any workloads of that project:
Project 2 over quota share:
[(Project 2 OQ-Weight) / (Σ all Projects OQ-Weights)] x (Unused Resource within node pool A)
[(3) / (2 + 3 + 1)] x (20) = (3/6) x 20 = 10 GPUs
In Project 3, fairshare = deserved quota + over quota = 0 +3 = 3 GPUs. Project 3 has no guaranteed quota, but it still has a share of the excess resources in node pool A. The NVIDIA Run:ai Scheduler ensures that Project 3 receives its part of the unused resources for over quota, even if this results in reclaiming resources from other projects and preempting preemptible workloads.
The Scheduler constantly re-calculates the fairshare of each project and department per node pool, represented in the scheduler as queues, resulting in the re-balancing of resources between projects and between departments. This means that a preemptible workload that was granted resources to run in one scheduling cycle, can find itself preempted and go back to pending state while waiting for resources in the next cycle.
A queue, representing a scheduler-managed object for each project or department per node pool, can be in one of 3 states:
In-quota: The queue’s allocated resources ≤ queue deserved quota. The Scheduler’s first priority is to ensure each queue receives its deserved quota.
Over quota but below fairshare: The queue’s deserved quota < queue’s allocated resources <= queue’s fairshare. The Scheduler tries to find and allocate more resources to queues that need resources beyond their deserved quota and up to their fairshare.
Over-fairshare and over quota: The queue’s fairshare < queue’s allocated resources. The Scheduler tries to allocate resources to queues that need even more resources beyond their fairshare.
When re-balancing resources between queues of different projects and departments, the Scheduler goes in the opposite direction, i.e. first take resources from over-fairshare queues, then from over quota queues, and finally, in some scenarios, even from queues that are below their deserved quota.
Now that you have gained insights into how the Scheduler dynamically balances workloads to optimize cluster utilization and maintain fairness across projects and departments, you can submit workloads. Before submitting your workloads, it’s important to familiarize yourself with the following key topics:
Introduction to workloads - Learn what workloads are and what is supported for both NVIDIA Run:ai and third-party workloads.
NVIDIA Run:ai workload types - Explore the various NVIDIA Run:ai workload types available and understand their specific purposes to enable you to choose the most appropriate workload type for your needs.
Reclaim Preemption Between Projects and Departments
Note
Only preemptive workloads can go over quota as they are susceptible to reclaim (cross-projects preemption) of the over quota resources they are using. The amount of over quota resources a project can gain depends on the over quota weight or quota (if over quota weight is disabled). Departments’ over quota is always proportional to its quota.
Priority Preemption Within a Project
Note
Workload priority applies only within the same project and does not influence workloads across different projects, where fairness determines precedence.
Setting best practices - Provide managers with the ability to establish guidelines and standards to follow, reducing errors amongst AI practitioners within the organization.
Security and compliance - Define and enforce permitted and restricted actions to uphold organizational security and meet compliance requirements.
Simplified setup - Conveniently allow setting defaults and streamline the workload submission process for AI practitioners.
Scalability and diversity
Multi-purpose clusters with various workload types that may have different requirements and characteristics for resource usage.
The organization has multiple hierarchies, each with distinct goals, objectives, and degrees of flexibility.
Manage multiple users and projects with distinct requirements and methods, ensuring appropriate utilization of resources.
The following sections provide details of how the workload policy mechanism works.
The policy enforces the workloads regardless of whether they were submitted via UI, CLI, Rest APIs, or Kubernetes YAMLs.
NVIDIA Run:ai’s policies enforce NVIDIA Run:ai workloads. The policy type is per NVIDIA Run:ai workload type. This allows administrators to set different policies for each workload type.
Policy type
Workload type
Kubernetes name
Workspace
Workspace
Interactive workload
Training: Standard
Training: Standard
Training workload
A policy consists of rules for limiting and controlling the values of fields of the workload. In addition to rules, some defaults allow the implementation of default values to different workload fields. These default values are not rules, as they simply suggest values that can be overridden during the workload submission.
Furthermore, policies allow the enforcement of workload assets. For example, as an admin, you can impose a data source of type PVC to be used by any workload submitted.
Numerous teams working on various projects require the use of different tools, requirements, and safeguards. One policy may not suit all teams and their requirements. Hence, administrators can select the scope to cover the effectiveness of the policy. When a scope is selected, all of its subordinate units are also affected. As a result, all workloads submitted within the selected scope are controlled by the policy.
For example, if a policy is set for Department A, all workloads submitted by any of the projects within this department are controlled.
A scope for a policy can be:
The different scoping of policies also allows the breakdown of the responsibility between different administrators. This allows delegation of ownership between different levels within the organization. The policies, containing rules and defaults, propagate* down the organizational tree, forming an “effective” policy that enforces any workload submitted by users within the project.
If a field is used by multiple policies at different scopes, the platform applies a reconciliation mechanism to determine which policy takes effect. Defaults of the same field can still be submitted by different organizational policies, as they are considered “soft” rules. In this case, the closest scope to the workload becomes the effective default (project default “wins” vs. department default, department default “wins” vs. cluster default, etc.). For rules, precedence depends on their type: simple rules on non-security and non-compute fields follow the same order as defaults (project > department > cluster), while strict rules on security and compute fields apply in reverse order (cluster > department > project).
Scheduling rules limit a researcher's access to resources and provides a way for the admin to control resource allocation and prevent the waste of resources. Admins should use the rules to prevent GPU idleness, prevent GPU hogging and allocate specific types of resources to different types of workloads.
Admin can limit the duration of a workload, the duration of the idle time, or the type of nodes the workload can use. Rules are defined for and apply to all workloads in the project or department. In addition, rules can be applied to a specific type of workload in a project or department (workspace, standard training, or inference). When a workload reaches the limitation of the rule, it is stopped if the rule is time-limited. The rule type prevents the workload from being scheduled on nodes that violate the rule limitation.
Workload Policies
Why Use a Workload Policy?
Understanding the Mechanism
Cross-Interface Enforcement
Policy Types
Policy Structure - Rules, Defaults, and Imposed Assets
Scope of Effectiveness
Note
The policy submission to the entire account scope is supported via API only.
NVIDIA Run:ai policies vs. Kyverno policies
Kyverno runs as a dynamic admission controller in a Kubernetes cluster. Kyverno receives validating and mutating admission webhook HTTP callbacks from the Kubernetes API server and applies matching policies to return results that enforce admission policies or reject requests. Kyverno policies can match resources using the resource kind, name, label selectors, and much more. For more information, see .
Scheduling Rules
The Reports table comprises the following columns:
Column
Description
Report
The name of the report
Description
The description of the report
Status
The different lifecycle phases and representation of the report condition
The following table describes the reports' condition and whether they were created successfully:
Status
Description
Ready
Report is ready and can be downloaded as CSV
Pending
Report is in the queue and waiting to be processed
Failed
The report couldn't be created
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Before you start, make sure you have a project.
To create a new report:
Click +NEW REPORT
Enter a name for the report (if the name already exists, you will need to choose a different one)
Optional: Provide a description of the report
Set the report's data collection period
Start date - The date at which the report data commenced
End date - The date at which the report data concluded
Set the report segmentation and filters
Filters - Filter by project or department name
Segment by - Data is collected and aggregated based on the segment
Click CREATE REPORT
Select the report you want to delete
Click DELETE
On the dialog, click DELETE to confirm
Select the report you want to download
Click DOWNLOAD CSV
Reports must be saved in a storage solution compatible with S3. To activate this feature for self-hosted accounts, the storage needs to be linked to the account. The configuration should be incorporated into two ConfigMap objects within the Control Plane.
Edit the runai-backend-org-unit-service ConfigMap:
kubectl edit cm runai-backend-org-unit-service -n runai-backend
kubectl edit cm runai-backend-metrics-service -n runai-backend
Add the following lines to the file:
In addition on the same file, under config.yaml section, add the following right after log_level: \"Info\":
Restart the deployments:
Refresh the page to see Reports under Analytics in the NVIDIA Run:ai platform.
To view the available actions, go to the Reports API reference.
Note
Reports are enabled by default for SaaS. To enable this feature for self-hosted, additional configurations must be added. See Enabling reports for self-hosted accounts.
Report Types
Reports Table
Reports Status
Customizing the Table View
Creating a New Report
Deleting a Report
Downloading a Report
Note
To download, the report must be in status "Ready".
Enabling Reports for Self-Hosted Accounts
Using API
This guide explains how to configure MIG in each strategy to submit workloads. It also outlines the individual implications of each strategy and best practices for administrators.
To use MIG single and mixed strategy effectively, make sure to familiarize yourself with the following NVIDIA resources:
When deploying MIG using single strategy, all GPUs within a node are configured with the same profile. For example, a node might have GPUs configured with 3 MIG slices of profile type 1g.20gb, or 7 MIG slices of profile 1g.10gb. With this strategy, MIG profiles are displayed as whole GPU devices by CUDA.
The NVIDIA Run:ai platform discovers these MIG profiles as whole GPU devices as well, ensuring MIG devices are transparent to the end-user (practitioner). For example, a node that consists of 8 physical GPUs split into MIG slices, 3×2g20gb slices each, is discovered by the NVIDIA Run:ai platform as a node with 24 GPU devices.
Users can submit workloads by requesting a specific number of GPU devices (X GPU) and NVIDIA Run:ai will allocate X MIG slices (logical devices). The NVIDIA Run:ai platform deducts X GPUs from the workload’s Project quota, regardless of whether this ‘logical GPU’ represents 1/3 of a physical GPU device or 1/7 of a physical GPU device.
When deploying MIG using mixed strategy, each GPU in a node can be configured with a different combination of MIG profiles such as 2×2g.20gb and 3×1g.10gb. For details on supported combinations per GPU type, refer to Supported MIG Profiles.
In mixed strategy, physical GPU devices continue to be displayed as physical GPU devices by CUDA, and each MIG profile is shown individually. The NVIDIA Run:ai platform identifies the physical GPU devices normally, however, MIG profiles are not visible in the UI or node APIs.
When submitting third-party workloads with this strategy, the user should explicitly specify the exact requested MIG profile (for example, nvidia.com/gpu.product: A100-SXM4-40GB-MIG-3g.20gb). The NVIDIA Run:ai Scheduler finds a node that can provide this specific profile and binds it to the workload.
A third-party workload submitted with a MIG profile of type Xg.Ygb (e.g. 3g.40gb or 2g.20gb) is considered as consuming X GPUs. These X GPUs will be deducted from the workload’s project quota of GPUs. For example, a 3g.40gb profile deducts 3 GPUs from the associated Project’s quota, while 2g.20gb deducts 2 GPUs from the associated Project’s quota. This is done to maintain a logical ratio according to the characteristics of the MIG profile.
Configure proper and uniform sizes of MIG slices (profiles) across all GPUs within a node.
Set the same MIG profiles on all nodes of a single node pool.
Create separate node pools with different MIG profile configurations allowing users to select the pool that best matches their workloads’ needs.
Ensure Project quotas are allocated according to the MIG profile sizes.
Use mixed strategy with workloads that require diverse resources. Make sure to evaluate the workload requirements and plan accordingly.
Configure individual MIG profiles on each node by using a limited set of MIG profile combinations to minimize complexity. Make sure to evaluate your requirements and node configurations.
Ensure Project quotas are allocated according to the MIG profile sizes.
Note
Starting from v2.19, Dynamic MIG feature began a and is now no longer supported. With Dynamic MIG, the NVIDIA Run:ai platform automatically configured MIG profiles according to on-demand user requests for different MIG profiles or memory fractions.
GPU fractions and memory fractions are not supported with MIG profiles.
Before You Start
Configuring Single MIG Strategy
Configuring Mixed MIG Strategy
Best Practices for Administrators
Single Strategy
Mixed Strategy
Note
Since MIG slices are a fixed size, once configured, changing MIG profiles requires administrative intervention.
Subject
The name of the subject
Subject type
The user or application assigned with the role
Source IP
The IP address of the subject
Date & time
The exact timestamp at which the event occurred. Format dd/mm/yyyy for date and hh:mm am/pm for time.
Event
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Download table - Click MORE and then Click Download as CSV or Download as JSON
The Event history table saves events for the last 90 days. However, the table itself presents up to the last 30 days of information due to the potentially very high number of operations that might be logged during this period.
To view older events, or to refine your search for more specific results or fewer results, use the time selector and change the period you search for.
You can also refine your search by clicking and using ADD FILTER accordingly.
Go to the Audit log API reference to view the available actions.
Since the amount of data is not trivial, the API is based on paging. It retrieves a specified number of items for each API call. You can get more data by using subsequent calls.
Submissions of workloads are not audited. As a result, the system does not track or log details of workload submissions, such as timestamps or user activity.
As part of the installation, you will be required to install the NVIDIA Run:ai control plane Helm chart. The Helm charts require Kubernetes administrator permissions. You can review the exact objects that are created by the charts using the --dry-run on both helm charts.
Installation
Note
To customize the installation based on your environment, see .
PostgreSQL and Keycloakx are installed with default usernames and passwords. To change the default credentials, see .
NVIDIA Run:ai version
It’s recommended to install the latest NVIDIA Run:ai release. If you need to install a specific version, you can browse the available versions using the following commands:
Connected
Run the following command:
Air-gapped
Run the following command to browse all available air-gapped packages using the token provided by NVIDIA Run:ai.
To download and extract a specific version, and to upload the container images to your private registry, see the section.
Kubernetes
Connected
Run the following command and update the values as described below:
Replace global.domain=<DOMAIN> with the one obtained :
Set tenantsManager.config.adminUsername=<ADMIN_EMAIL>
Air-gapped
To run the following command, make sure to replace the following. The custom-env.yaml is created when :
./chart/control-plane-<VERSION>.tgz - The NVIDIA Run:ai control plane Helm chart, located in the chart folder of the extracted software artifacts
OpenShift
Connected
Run the following command and update the values as described below:
The <OPENSHIFT-CLUSTER-DOMAIN> is the subdomain configured for the OpenShift cluster
Set tenantsManager.config.adminUsername=<ADMIN_EMAIL>
Air-gapped
To run the following command, make sure to replace the following. The custom-env.yaml is created when
./chart/control-plane-<VERSION>.tgz - The NVIDIA Run:ai control plane Helm chart, located in the chart folder of the extracted software artifacts
Connect to NVIDIA Run:ai User Interface
Open your browser and go to:
https://<DOMAIN>
https://runai.apps.<OpenShift-DOMAIN>
Log in using the administrator credentials provided during installation. It is recommended to change the password after the first login.
GPU Memory Swap
NVIDIA Run:ai’s GPU memory swap helps administrators and AI practitioners to further increase the utilization of their existing GPU hardware by improving GPU sharing between AI initiatives and stakeholders. This is done by expanding the GPU physical memory to the CPU memory, typically an order of magnitude larger than that of the GPU.
Expanding the GPU physical memory helps the NVIDIA Run:ai system to put more workloads on the same GPU physical hardware, and to provide a smooth workload context switching between GPU memory and CPU memory, eliminating the need to kill workloads when the memory requirement is larger than what the GPU physical memory can provide.
Benefits of GPU Memory Swap
There are several use cases where GPU memory swap can benefit and improve the user experience and the system's overall utilization.
Sharing a GPU Between Multiple Interactive Workloads (Notebooks)
AI practitioners use notebooks to develop and test new AI models and to improve existing AI models. While developing or testing an AI model, notebooks use GPU resources intermittently, yet, required resources of the GPUs are pre-allocated by the notebook and cannot be used by other workloads after one notebook has already reserved them. To overcome this inefficiency, NVIDIA Run:ai introduced dynamic GPU fractions.
When one or more workloads require more than their requested GPU resources, there’s a high probability not all workloads can run on a single GPU because the total memory required is larger than the physical size of the GPU memory.
With GPU memory swap, several workloads can run on the same GPU, even if the sum of their used memory is larger than the size of the physical GPU memory. GPU memory swap can swap in and out workloads interchangeably, allowing multiple workloads to each use the full amount of GPU memory. The most common scenario is for one workload to run on the GPU (for example, an interactive notebook), while other notebooks are either idle or using the CPU to develop new code (while not using the GPU). From a user experience point of view, the swap in and out is a smooth process since the notebooks do not notice that they are being swapped in and out of the GPU memory. On rare occasions, when multiple notebooks need to access the GPU simultaneously, slower workload execution may be experienced.
Notebooks typically use the GPU intermittently, therefore with high probability, only one workload (for example, an ), will use the GPU at a time. The more notebooks the system puts on a single GPU, the higher the chances are that there will be more than one notebook requiring the GPU resources at the same time. Admins have a significant role here in fine tuning the number of notebooks running on the same GPU, based on specific use patterns and required SLAs.
A single GPU can be shared between an (for example, a Jupyter notebook, image recognition services, or an LLM service), and a training workload that is not time-sensitive or delay-sensitive. At times when the inference/interactive workload uses the GPU, both training and inference/interactive workloads share the GPU resources, each running part of the time swapped-in to the GPU memory, and swapped-out into the CPU memory the rest of the time.
Whenever the inference/interactive workload stops using the GPU, the swap mechanism swaps out the inference/interactive workload GPU data to the CPU memory. Kubernetes wise, the pod is still alive and running using the CPU. This allows the training workload to run faster when the inference/interactive workload is not using the GPU, and slower when it does, thus sharing the same resource between multiple workloads, fully utilizing the GPU at all times, and maintaining uninterrupted service for both workloads.
Running multiple is a demanding task and you will need to ensure that your SLA is met. You need to provide high performance and low latency, while maximizing GPU utilization. This becomes even more challenging when the exact model usage patterns are unpredictable. You must plan for the agility of inference services and strive to keep models on standby in a ready state rather than an idle state.
NVIDIA Run:ai’s GPU memory swap feature enables you to load multiple models to a single GPU, where each can use up to the full amount GPU memory. Using an application load balancer, the administrator can control to which server each inference request is sent. Then the GPU can be loaded with multiple models, where the model in use is loaded into the GPU memory and the rest of the models are swapped-out to the CPU memory. The swapped models are stored as ready models to be loaded when required. GPU memory swap always maintains the context of the workload (model) on the GPU so it can easily and quickly switch between models. This is unlike industry standard model servers that load models from scratch into the GPU whenever required.
Swapping the workload’s GPU memory to and from the CPU is performed simultaneously and synchronously for all GPUs used by the workload. In some cases, if workloads specify a memory limit smaller than a full GPU memory size, multiple workloads can run in parallel on the same GPUs, maximizing the utilization and shortening the response times.
In other cases, workloads will run serially, with each workload running for a few seconds before the system swaps them in/out. If multiple workloads occupy more than the GPU physical memory and attempt to run simultaneously, memory swapping will occur. In this scenario, each workload will run part of the time on the GPU while being swapped out to the CPU memory the other part of the time, slowing down the execution of the workloads. Therefore, it is important to evaluate whether memory swapping is suitable for your specific use cases, weighing the benefits against the potential for slower execution time. To better understand the benefits and use cases of GPU memory swap, refer to the detailed sections below. This will help you determine how to best utilize GPU swap for your workloads and achieve optimal performance.
The workload MUST use . This means the workload’s memory Request is less than a full GPU, but it may add a GPU memory Limit to allow the workload to effectively use the full GPU memory. The NVIDIA Run:ai Scheduler allocates the dynamic fraction pair (Request and Limit) on single or multiple GPU devices in the same node.
The administrator must label each node that they want to provide GPU memory swap with a run.ai/swap-enabled=true to enable that node. Enabling the feature reserves CPU memory to serve the swapped GPU memory from all GPUs on that node. The administrator sets the size of the CPU reserved RAM memory using the runaiconfig file as detailed in .
NVIDIA Run:ai also supports workload submission using multi-GPU memory swap. Multi-GPU memory swap works similarly to single GPU memory swap, but instead of swapping memory for a single GPU workload, it swaps memory for workloads across multiple GPUs simultaneously and synchronously.
The NVIDIA Run:ai Scheduler allocates the same dynamic GPU fraction pair (Request and Limit) on multiple GPU devices in the same node. For example, if you want to run two LLM models, each consuming 8 GPUs that are not used simultaneously, you can use GPU memory swap to share their GPUs. This approach allows multiple models to be stacked on the same node.
The following outlines the advantages of stacking multiple models on the same node:
Maximizes GPU utilization - Efficiently uses available GPU resources by enabling multiple workloads to share GPUs.
Improves cold start times - Loading large LLM models to a node and its GPUs can take several minutes during a “cold start”. Using memory swap turns this process into a “warm start” that takes only a fraction of a second to a few seconds (depending on the model size and the GPU model).
Increases GPU availability - Frees up and maximizes GPU availability for additional workloads (and users), enabling better resource sharing.
A pod created before the GPU memory swap feature was enabled in that cluster, cannot be scheduled to a swap-enabled node. A proper event is generated in case no matching node is found. Users must re-submit those pods to make them swap-enabled.
GPU memory swap cannot be enabled if the NVIDIA Run:ai is used. GPU memory swap can only be used with the default NVIDIA time-slicing mechanism.
CPU RAM size cannot be decreased once GPU memory swap is enabled.
Before configuring GPU memory swap, dynamic GPU fractions must be enabled. Dynamic GPU fractions enable you to make your workloads burstable as well as maximize your workloads’ performance and GPU utilization within a single node.
To enable GPU memory swap in a NVIDIA Run:ai cluster:
Add the following label to each node where you want to enable GPU memory swap:
Edit the runaiconfig file with the following parameters. This example uses 100Gi as the size of the swap memory. For more details, see :
Or, use the following patch command from your terminal:
Swappable workloads require reserving a small part of the GPU for non-swappable allocations like binaries and GPU context. To avoid getting out-of-memory (OOM) errors due to non-swappable memory regions, the system reserves a 2GiB of GPU RAM memory by default, effectively truncating the total size of the GPU memory. For example, a 16GiB T4 will appear as 14GiB on a swap-enabled node. The exact reserved size is application-dependent, and 2GiB is a safe assumption for 2-3 applications sharing and swapping on a GPU. This value can be changed by:
Editing the runaiconfig as follows:
Or, using the following patch command from your terminal:
If you prefer your workloads not to be swapped into CPU memory, you can specify on the pod an anti-affinity to run.ai/swap-enabled=true node label when submitting your workloads and the Scheduler will ensure not to use swap-enabled nodes. An alternative way is to set swap on a dedicated node pool and not use this node pool for workloads you prefer not to swap.
CPU memory is limited, and since a single CPU serves multiple GPUs on a node, this number is usually between 2 to 8. For example, when using 80GB of GPU memory, each swapped workload consumes up to 80GB (but may use less) assuming each GPU is shared between 2-4 workloads. In this example, you can see how the swap memory can become very large. Therefore, we give administrators a way to limit the size of the CPU reserved memory for swapped GPU memory on each swap-enabled node as shown in .
The NVIDIA Run:ai Scheduler: Concepts and Principles
When a user submits a workload, the workload is directed to the selected Kubernetes cluster and managed by the NVIDIA Run:ai Scheduler. The Scheduler’s primary responsibility is to allocate workloads to the most suitable node or nodes based on resource requirements and other characteristics, as well as adherence to NVIDIA Run:ai’s fairness and quota management.
The NVIDIA Run:ai Scheduler schedules native Kubernetes workloads, NVIDIA Run:ai workloads, or any other type of third-party workloads. To learn more about workloads support, see Introduction to workloads.
To understand what is behind the NVIDIA Run:ai Scheduler’s decision-making logic, get to know the key concepts, resource management and scheduling principles of the Scheduler.
Workloads and Pod Groups
Workloads can range from a single pod running on individual nodes to distributed workloads using multiple pods, each running on a node (or part of a node). For example, a large scale training workload could use up to 128 nodes or more, while an inference workload could use many pods (replicas) and nodes.
Every newly created pod is assigned to a pod group, which can represent one or multiple pods within a workload. For example, a distributed PyTorch training workload with 32 workers is grouped into a single pod group. All pods are attached to the pod group with certain rules, such as , applied to the entire pod group.
A scheduling queue (or simply a queue) represents a scheduler primitive that manages the scheduling of workloads based on different parameters.
A queue is created for each and . The NVIDIA Run:ai Scheduler supports hierarchical queueing, project queues are bound to department queues, per node pool. This allows an organization to manage quota, over quota and more for projects and their associated departments.
Each project and department includes a set of deserved resource quotas, per node pool and resource type. For example, project “LLM-Train/Node Pool NV-H100” quota parameters specify the number of GPUs, CPUs(cores), and the amount of CPU memory that this project deserves to get when using this node pool. can only be scheduled if their requested resources are within the deserved resource quotas of their respective project/node-pool and department/node-pool.
Projects and departments can have a share in the unused resources of any node pool, beyond their quota of deserved resources. These resources are referred to as over quota resources. The administrator configures the per node pool for each project and department.
Projects can receive a share of the cluster/node pool unused resources when the over quota weight setting is enabled. The part each Project receives depends on its over quota weight value, and the total weights of all other projects’ over quota weights. The administrator configures the per node pool for each project and department.
Each project has a set of guaranteed resource quotas (GPUs, CPUs, and CPU memory) per node pool. Projects can go over quota and get a share of the unused resources in a node pool beyond their guaranteed quota in that node pool. The same applies to Departments. The Scheduler balances the amount of over quota between departments, and then between projects. The department’s deserved quota and over quota limit the sum of resources of all projects, within the department. If the project shows it has deserved quota, but the department deserved quota is exhausted, the Scheduler will not give the project anymore deserved resources. The same applies to over quota resources. over quota resources are first given to the department, and only then split among its projects.
The NVIDIA Run:ai Scheduler calculates a numerical value, fairshare, per project (or department) for each node pool, representing the project’s (department’s) sum of guaranteed resources plus the portion of non-guaranteed resources in that node pool.
The Scheduler aims to provide each project (or department) the resources they deserve per node pool using two main parameters: deserved quota and deserved fairshare (i.e. quota + over quota resources). If one project’s node pool queue is below fairshare and another project’s node pool queue is above fairshare, the Scheduler shifts resources between queues to balance . This may result in the preemption of some over quota preemptible workloads.
Over-subscription is a scenario where the sum of all guaranteed resource quotas surpasses the physical resources of the cluster or node pool. In this case, there may be scenarios in which the Scheduler cannot find matching nodes to all workload requests, even if those requests were within the resource quota of their associated projects.
The administrator can set a , bin-pack or spread, of the Scheduler per node pool. For GPU based workloads, workloads can request both GPU and CPU resources. For CPU-only based workloads, workloads can request CPU resources only.
GPU workloads:
Bin-pack - The Scheduler places as many workloads as possible in each GPU and node to use fewer resources and maximize GPU and node vacancy.
Spread - The Scheduler spreads workloads across as many GPUs and nodes as possible to minimize the load and maximize the available resources per workload.
NVIDIA Run:ai supports scheduling workloads using different priority and preemption policies:
High-priority workloads (pods) can preempt (pods) within the same scheduling queue (project), according to their preemption policy. The NVIDIA Run:ai Scheduler implicitly assumes any PriorityClass >= 100 is non-preemptible and any PriorityClass < 100 is preemptible.
Cross project and cross department workload preemptions are referred to as and are based on between queues rather than the priority of the workloads.
To make it easier for users to submit workloads, NVIDIA Run:ai preconfigured several Kubernetes PriorityClass objects. The NVIDIA Run:ai preset PriorityClass objects have their ‘preemptionPolicy’ always set to ‘PreemptLowerPriority’, regardless of their actual NVIDIA Run:ai preemption policy within the NVIDIA Run:ai platform. A non-preemptible workload is only scheduled if in-quota and cannot be preempted after being scheduled, not even by a higher priority workload.
PriorityClass Name
PriorityClass
NVIDIA Run:ai preemption policy
K8s preemption policy
Workload priority is always respected within a project. This means higher priority workloads are scheduled before lower priority workloads. It also means that higher priority workloads may preempt lower priority workloads within the same project if the lower priority workloads are preemptible.
is a major principle within the NVIDIA Run:ai scheduling system. It means that the NVIDIA Run:ai Scheduler always respects certain resource splitting rules (fairness) between projects and between departments.
is an inter-project (and inter-department) scheduling action that takes back resources from one project (or department) that has used them as over quota, back to a project (or department) that deserves those resources as part of its deserved quota, or to balance fairness between projects, each to its fairshare (i.e. sharing fairly the portion of the unused resources).
Gang scheduling describes a scheduling principle where a workload composed of multiple pods is either fully scheduled (i.e. all pods are scheduled and running) or fully pending (i.e. all pods are not running). Gang scheduling refers to a single pod group.
Now that you have learned the key concepts and principles of the NVIDIA Run:ai Scheduler, see - allocating pods to workloads, applying preemption mechanisms, and managing resources.
Adapting AI Initiatives to Your Organization
AI initiatives refer to advancing research, development, and implementation of AI technologies. These initiatives represent your business needs and involve collaboration between individuals, teams, and other stakeholders. AI initiatives require compute resources and a methodology to effectively and efficiently use those compute resources and split them among the different AI initiatives stakeholders. The building blocks of AI compute resources are GPUs, CPUs, and memory, which are built into nodes (servers) and can be further grouped into node pools. Nodes and node pools are part of a Kubernetes cluster.
To manage AI initiatives in NVIDIA Run:ai you should:
Map your organization and initiatives to projects and optionally departments
Map compute resources (node pools and quotas) to projects and optionally departments
Assign users (e.g. AI practitioners, ML engineers, Admins) to projects and departments
The way you map your AI initiatives and organization into NVIDIA Run:ai and should reflect your organization’s structure and Project management practices. There are multiple options, and we provide you here with 3 examples of typical forms in which to map your organization, initiatives, and users into NVIDIA Run:ai, but of course, other ways that suit your requirements are also acceptable.
A typical use case would be students (individual practitioners) within a faculty (business unit) - an individual practitioner may be involved in one or more initiatives. In this example, the resources are accounted for by the student (project) and aggregated per faculty (department).
Department = business unit / Project = individual practitioner
A typical use case would be an AI service (business unit) split into AI capabilities (initiatives) - an individual practitioner may be involved in several initiatives. In this example, the resources are accounted for by Initiative (project) and aggregated per AI service (department).
Department = business unit / Project = initiative
A typical use case would be a business unit split into teams - an individual practitioner is involved in a single team (project) but the team may be involved in several AI initiatives. In this example, the resources are accounted for by team (project) and aggregated per business unit (department).
Department = business unit / Project = team
AI initiatives require compute resources such as GPUs and CPUs to run. Compute resources in any organization are limited, either due to the number of servers (nodes) owned by the organization is limited, the budget it can spend to lease resources in the cloud or spending for in-house servers is also limited. Every organization strives to optimize the usage of its resources by maximizing their utilization and providing all users with their needs. Therefore, the organization needs to split resources according to the organization's internal priorities and budget constraints. But even after splitting the resources, the orchestration layer should still provide fairness between the resourced consumers, and allow access to unused resources to minimize scenarios of idle resources.
Another aspect of resource management is how to group your resources effectively, especially in large environments, or environments that are made of heterogeneous types of hardware, where some users need to use specific hardware types, or where other users should avoid occupying critical hardware of some users or initiatives.
NVIDIA Run:ai assists you with all of these complex issues by allowing you to map your cluster resources to node pools, then map each Project and Department a quota allocation per node pool, and set access rights to unused resources () per node pool.
There are several reasons why you would group resources (nodes) into node pools:
Control the GPU type to use in heterogeneous hardware environment - in many cases, AI models can be optimized per hardware type they will use, e.g. a training workload that is optimized for H100 does not necessarily run optimally on an A100, and vice versa. Therefore segmenting into node pools, each with a different hardware type gives the AI researcher and ML engineer better control of where to run.
Quota control - splitting to node pools allows the admin to set specific quota per hardware type, e.g. give high priority project guaranteed access to advanced GPU hardware, while keeping lower priority project with a lower quota or even with no quota at all for that high-end GPU, but give it a “best-effort” access only (i.e. if the high priority guaranteed project is not using those resources).
Multi-region or multi-availability-zone cloud environments
Set out below are illustrations of different grouping options.
Example: grouping nodes by topology
Example: grouping nodes by hardware type
After the initial grouping of resources, it is time to associate resources to AI initiatives, this is performed by assigning quotas to projects and optionally to departments. Assigning GPU quota to a project, on a node pool basis, means that the workloads submitted by that project are entitled to use those GPUs as guaranteed resources and can use them for all .
However, what happens if the project requires more resources than its quota? This depends on the type of workloads that the user wants to submit. If the user requires more resources for non-preemptible workloads, then the quota must be increased, because non-preemptible workloads require guaranteed resources. On the other hand, if the type of workload is, for example, a model Training workload that is preemptible - in this case the project can exploit unused resources of other projects, as long as the other projects don’t need them. over quota is set per project on a node-pool basis and per department.
Administrators can use quota allocations to prioritize resources between users, teams, and AI initiatives. The administrator can completely prevent the use of certain node pools by a project or department by setting the node pool quota to 0 and disabling over quota for that node pool, or it can keep the quota to 0 and enable over quota to that node pool and allow access based on resource availability only (e.g. unused GPUs). However, when a project with a non-zero quota needs to use those resources, the Scheduler reclaims those resources back and preempts the preemptible workloads of over quota projects. As an administrator, you can also have an impact on the amount of over quota resources a project or department uses.
It is essential to make sure that the sum of all projects' quota does NOT surpass that of the Department, and that the sum of all departments does not surpass the number of physical resources, per node pool and for the entire cluster (we call such behavior - ‘over-subscription’). The reason over-subscription is not recommended is that it may produce unexpected scheduling decisions, especially those that might preempt ‘non-preemptive’ workloads or fail to schedule workloads within quota, either non-preemptible or preemptible, thus quota cannot be considered anymore as ‘guaranteed’. Admins can opt-in a system flag that helps to prevent over-subscription scenarios.
Example: assigning resources to projects
NVIDIA Run:ai system is using to manage users’ access rights to the different objects of the system, its resources, and the set of allowed actions.
To allow AI researchers, ML engineers, Project Admins, or any other stakeholder of your AI initiatives to access projects and use AI compute resources with their AI initiatives, the administrator needs to assign users to projects. After a user is assigned to a project with the proper role, e.g. ‘L1 Researcher’, the user can submit and monitor its workloads under that project. Assigning users to departments is usually done to assign ‘Department Admin’ to manage a specific department. Other roles, such as ‘L1 Researcher’, can also be assigned to departments, this allows the researcher access to all projects within that department.
This is an example of an organization, as represented in the NVIDIA Run:ai platform:
The organizational tree is structured from top down under a single node headed by the account. The account is comprised of clusters, departments and projects.
After mapping and building your hierarchal structured organization as shown above, you can assign or associate various NVIDIA Run:ai components (e.g. workloads, roles, assets, policies, and more) to different parts of the organization - these organizational parts are the Scopes. The following organizational example consists of 5 optional scopes:
Now that resources are grouped into node pools, organizational units or business initiatives are mapped into projects and departments, projects’ quota parameters are set per node pool, and users are assigned to projects, you can finally from a project and use compute resources to run your AI initiatives.
Install the Cluster
Before installing the NVIDIA Run:ai cluster, validate that the and are met. For air-gapped environments, make sure you have the prepared.
Once all the requirements are met, it is highly recommend to use the NVIDIA Run:ai cluster preinstall diagnostics tool to:
Test the below requirements in addition to failure points related to Kubernetes, NVIDIA, storage, and networking
Look at additional components installed and analyze their relevance to a successful installation
Set Up SSO with OpenID Connect
Single Sign-On (SSO) is an authentication scheme, allowing users to log-in with a single pair of credentials to multiple, independent software systems.
This article explains the procedure to to NVIDIA Run:ai using the OpenID Connect protocol.
Before you start, make sure you have the following available from your identity provider:
Discovery URL - The OpenID server where the content discovery information is published.
Dynamic GPU Fractions
Many workloads utilize GPU resources intermittently, with long periods of inactivity. These workloads typically need GPU resources when they are running AI applications or debugging a model in development. Other workloads such as inference may utilize GPUs at lower rates than requested, but may demand higher resource usage during peak utilization. The disparity between resource request and actual resource utilization often leads to inefficient utilization of GPUs. This usually occurs when multiple workloads request resources based on their peak demand, despite operating below those peaks for the majority of their runtime.
To address this challenge, NVIDIA Run:ai has introduced dynamic GPU fractions. This feature optimizes GPU utilization by enabling workloads to dynamically adjust their resource usage. It allows users to specify a guaranteed fraction of GPU memory and compute resources with a higher limit that can be dynamically utilized when additional resources are requested.
With dynamic GPU fractions, users can using GPU fraction Request and Limit which is achieved by leveraging the Kubernetes Request and Limit notations. You can either:
Security Best Practices
This guide provides actionable best practices for administrators to securely configure, operate, and manage NVIDIA Run:ai environments. Each section highlights both platform-native features and mapped Kubernetes security practices to maintain robust protection for workloads and resources.
Security Area
Best Practice
Launching Workloads with GPU Fractions
This quick start provides a step-by-step walkthrough for running a Jupyter Notebook workspace using .
NVIDIA Run:ai's GPU fractions provides an agile and easy-to-use method to share a GPU or multiple GPUs across workloads. With GPU fractions, you can divide the GPU/s memory into smaller chunks and share the GPU/s compute resources between different workloads and users, resulting in higher GPU utilization and more efficient resource allocation.
Before you start, make sure:
You have created a or have one created for you.
Workload Policies
This section explains the procedure to manage workload policies.
The Workload policies table can be found under Policies in the NVIDIA Run:ai platform.
The Workload policies table provides a list of all the policies defined in the platform, and allows you to manage them.
The Workload policies table consists of the following columns:
only has IPv4 DNS records, so clients on IPv6-only networks cannot resolve it and image pulls will fail. Two options:
Configure NAT64/DNS64 - Translates between IPv6 and IPv4 so the cluster reaches this registry transparently.
Deploy an internal mirror registry - Use Harbor, Artifactory, or a similar registry over IPv6, configured to pull from runai.jfrog.io over IPv4. Point the cluster at the mirror through the container runtime config and NVIDIA Run:ai Helm image-registry overrides. Choose this option for air-gapped or strictly controlled networks.
gcr.io, quay.io, and docker.io are reachable over IPv6 directly.
Metric store
Push NVIDIA Run:ai cluster metrics to NVIDIA Run:ai control plane's metric store
NVIDIA Run:ai cluster system nodes
NVIDIA Run:ai control plane FQDN
443
Container Registry
Pull NVIDIA Run:ai images and Helm chart for installation
Single strategy supports both NVIDIA Run:ai and third-party workloads. Using mixed strategy can only be done using third-party workloads. For more details on NVIDIA Run:ai and third-party workloads, see Introduction to workloads.
- if some or all of your clusters run on the cloud (or even on-premise) but any of your clusters uses different physical locations or different topologies (e.g. racks), you probably want to segment your resources per region/zone/topology to be able to control where to run your workloads, how much quota to assign to specific environments (per project, per department), even if all those locations are all using the same hardware type. This methodology can help in optimizing the performance of your workloads because of the superior performance of local computing such as the locality of distributed workloads, local storage etc.
Explainability and predictability - large environments are complex to understand, this becomes even more complex when an environment is loaded. To maintain users’ satisfaction and their understanding of the resources state, as well as to keep predictability of your workload chances to get scheduled, segmenting your cluster into smaller pools may significantly help.
Scale - NVIDIA Run:ai implementation of node pools has many benefits, one of the main of them is scale. Each node pool has its own Scheduler instance, therefore allowing the cluster to handle more nodes and schedule workloads faster when segmented into node pools vs. one large cluster. To allow your workloads to use any resource within a cluster that is split to node pools, a second-level Scheduler is in charge of scheduling workloads between node pools according to your preferences and resource availability.
Prevent mutual exclusion - Some AI workloads consume CPU-only resources, to prevent those workloads from consuming the CPU resources of GPU nodes and thus block GPU workloads from using those nodes, it is recommended to group CPU-only nodes into a dedicated node pool(s) and assign a quota for CPU projects to CPU node-pools only while keeping GPU node-pools with zero quota and optionally “best-effort” over quota access for CPU-only projects.
Mapping Your Organization
Based on Individuals
Based on Business Units
Based on the Organizational Structure
Mapping Your Resources
Grouping Your Resources
Grouping Examples
Assigning Your Resources
Assigning Users to Projects and Departments
Scopes in an Organization
Note
When a scope is selected, the very same unit, including all of its subordinates (both existing and any future subordinates, if added), are selected as well.
Under the Payload section validate the value of the user’s attributes
Validate the user’s email attribute is mapped correctly
Validate the configured Client Secret match the Client Secret value in the OAuthclient Kubernetes object.
Advanced: Look for the specific error message in the URL address
If it exists in the IDP, it allows researcher containers to start with the Linux User UID. Used to map access to network resources such as file systems to users. The IDP attribute must be of type integer.
Linux Group ID
GID
If it exists in the IDP, it allows researcher containers to start with the Linux Group GID. The IDP attribute must be of type integer.
Supplementary Groups
SUPPLEMENTARYGROUPS
If it exists in the IDP, it allows researcher containers to start with the relevant Linux supplementary groups. The IDP attribute must be a list of integers.
Email
email
Defines the user attribute in the IDP holding the user's email address, which is the user identifier in NVIDIA Run:ai
User first name
firstName
Used as the user’s first name appearing in the NVIDIA Run:ai platform
User last name
lastName
Used as the user’s last name appearing in the NVIDIA Run:ai platform
Fairshare = deserved quota + over quota = 6 +10 = 16 GPUs. Similarly, fairshare is also calculated for CPU and CPU memory. The Scheduler can grant a project more resources than its fairshare if the Scheduler finds resources not required by other projects that may deserve those resources.
The type of the event. Possible values: Create, Update, Delete, Login
Event ID
Internal event ID, can be used for support purposes
Status
The outcome of the logged operation. Possible values: Succeeded, Failed
Entity type
The type of the logged business object.
Entity name
The name of logged business object.
Entity ID
The system's internal id of the logged business object.
URL
The endpoint or address that was accessed during the logged event.
HTTP Method
The HTTP operation method used for the request. Possible values include standard HTTP methods such as GET, POST, PUT, DELETE, indicating what kind of action was performed on the specified URL.
Replace this placeholder with the actual name of the node
Result: The node is no longer part of the Kubernetes cluster. If you plan to bring the node back later, it must be rejoined to the cluster using the steps outlined in the next section.
Type
The type of the report – e.g., consumption
Created by
The user who created the report
Creation time
The timestamp of when the report was created
Collection period
The period in which the data was collected
Processing...
The report is being created
Smaller quota requirements - Enables more precise and often smaller quota requirements for the end user.
Sharing a GPU Between Inference/Interactive Workloads and Training Workloads
Serving Inference Warm Models with GPU Memory Swap
How GPU Memory Swap Works
Multi-GPU Memory Swap
Deployment Considerations
Enabling and Configuring GPU Memory Swap
Configuring System Reserved GPU Resources
Preventing Your Workloads from Getting Swapped
What Happens when the CPU Reserved Memory for GPU Swap is Exhausted?
Set tenantsManager.config.adminUsername=<ADMIN_EMAIL> to the administrator's email address.
Set tenantsManager.config.adminPassword=<ADMIN_PASSWORD> to the initial administrator password. The password must meet the following requirements:
Minimum Length: Passwords must be at least 8 characters long.
Digits: Must contain at least 1 numeric digit (0-9).
Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).
Run the following command from the root of the extracted software artifacts directory:
For example:
Note: Use the --dry-run flag to gain an understanding of what is being installed before the actual installation.
Prerequisites
Make sure you have extracted the software artifacts as described in the Preparations section. The helm chart is located in the chart folder of the extracted directory.
Prerequisites
Make sure you have extracted the software artifacts as described in the Preparations section. The helm chart is located in the chart folder of the extracted directory.
Bin-pack - The Scheduler places as many workloads as possible in each CPU and node to use fewer resources and maximize CPU and node vacancy.
Spread - The Scheduler spreads workloads across as many CPUs and nodes as possible to minimize the load and maximize the available resources per workload.
For more information, see preinstall diagnostics. To run the preinstall diagnostics tool, download the latest version, and run:
chmod+x./preinstall-diagnostics-<platform>&&
In an air-gapped deployment, the diagnostics image is saved, pushed, and pulled manually from the organization's registry.
#Save the image locallydockersave--output
Run the binary with the --image parameter to modify the diagnostics image to be used:
chmod+x./preinstall-diagnostics-darwin-arm64&&\
NVIDIA Run:ai requires Helm 3.14 or later. To install Helm, see Installing Helm. If you are installing an air-gapped version of NVIDIA Run:ai, the NVIDIA Run:ai tar file contains the helm binary.
A Kubernetes user with the cluster-admin role is required to ensure a successful installation, for more information, see Using RBAC authorization.
If you encounter an issue with the installation, try the troubleshooting scenario below.
If the NVIDIA Run:ai cluster installation failed, check the installation logs to identify the issue. Run the following script to print the installation logs:
If the NVIDIA Run:ai cluster installation completed, but the cluster status did not change its status to Connected, check the cluster troubleshooting scenarios.
Helm 4 defaults to when installing a new chart release, which can conflict with resources managed by the NVIDIA Run:ai operator. Append --server-side=false to your helm upgrade command. NVIDIA Run:ai clusters originally installed with Helm 3.x are unaffected.
Permissions
Installation
Note
To customize the installation based on your environment, see .
You can store the clientSecret as a Kubernetes secret within the cluster instead of using plain text. You can then configure the installation to use it by setting the
Kubernetes
Connected
Follow the steps below to add a new cluster.
Note: When adding a cluster for the first time, the New Cluster form automatically opens when you log in to the NVIDIA Run:ai platform. Other actions are prevented, until the cluster is created.
If this is your first cluster and you have completed the New Cluster form, start at step 3. Otherwise, start at step 1.
In the NVIDIA Run:ai platform, go to Resources
Air-gapped
Follow the steps below to add a new cluster.
Note: When adding a cluster for the first time, the New Cluster form automatically opens when you log in to the NVIDIA Run:ai platform. Other actions are prevented, until the cluster is created.
If this is your first cluster and you have completed the New Cluster form, start at step 3. Otherwise, start at step 1.
In the NVIDIA Run:ai platform, go to Resources
OpenShift
Connected
Follow the steps below to add a new cluster.
Note: When adding a cluster for the first time, the New Cluster form automatically opens when you log in to the NVIDIA Run:ai platform. Other actions are prevented, until the cluster is created.
If this is your first cluster and you have completed the New Cluster form, start at step 3. Otherwise, start at step 1.
In the NVIDIA Run:ai platform, go to Resources
Air-gapped
When creating a new cluster, select the OpenShift target platform.
Follow the steps below to add a new cluster.
Note: When adding a cluster for the first time, the New Cluster form automatically opens when you log in to the NVIDIA Run:ai platform. Other actions are prevented, until the cluster is created.
If this is your first cluster and you have completed the New Cluster form, start at step 3. Otherwise, start at step 1.
To avoid losing access, removing the identity provider must be carried out by a local user.
Troubleshooting
Troubleshooting Scenarios
Error: "403 - Sorry, we can’t let you see this page. Something about permissions…"
Description: The authenticated user is missing permissions
Mitigation:
Validate either the user or its related group/s are assigned with
Error: "401 - We’re having trouble identifying your account because your email is incorrect or can’t be found."
Description: Authentication failed because email attribute was not found.
Mitigation:
Validate email attribute is available in the configured OIDC Scopes
Error: "Unexpected error when authenticating with identity provider"
Description: User authentication failed
Mitigation: Validate the the configured OIDC Scopes exist and match the Identity Provider’s available scopes
Advanced: Look for the specific error message in the URL address
Error: "Unexpected error when authenticating with identity provider (SSO sign-in is not available)"
Description: User authentication failed
Mitigation:
Validate the the configured OIDC scope exists in the Identity Provider
Error: "Client not found"
Description: OIDC Client ID was not found in the Identity Provider
Mitigation: Validate the the configured Client ID matches the Identity Provider Client ID
Request a GPU fraction (portion) using a percentage of a GPU and specify a Limit
Request a GPU memory size (GB, MB) and specify a Limit
When setting a GPU memory limit either as GPU fraction or GPU memory size, the Limit must be equal to or greater than the GPU fractional memory request. Both GPU fraction and GPU memory are translated into the actual requested memory size of the Request (guaranteed resources) and the Limit (burstable resources - non guaranteed).
For example, a user can specify a workload with a GPU fraction request of 0.25 GPU, and add a limit of up to 0.80 GPU. The NVIDIA Run:ai Scheduler schedules the workload to a node that can provide the GPU fraction request (0.25), and then assigns the workload to a GPU. The GPU scheduler monitors the workload and allows it to occupy memory between 0 to 0.80 of the GPU memory (based on the Limit), where only 0.25 of the GPU memory is guaranteed to that workload. The rest of the memory (from 0.25 to 0.8) is "loaned" to the workload, as long as it is not needed by other workloads.
NVIDIA Run:ai automatically manages the state changes between Request and Limit as well as the reverse (when the balance needs to be "returned"), updating the workloads' utilization vs. Request and Limit parameters in the metrics pane for each workload.
To guarantee fair quality of service between different workloads using the same GPU, NVIDIA Run:ai developed an extendable GPUOOMKiller (Out Of Memory Killer) component that guarantees the quality of service using Kubernetes semantics for resources of Request and Limit.
The OOMKiller capability requires adding CAP_KILL capabilities to the dynamic GPU fractions and to the NVIDIA Run:ai core scheduling module (toolkit daemon). This capability is enabled by default.
NVIDIA Run:ai also supports workload submission using multi-GPU dynamic fractions. Multi-GPU dynamic fractions work similarly to dynamic fractions on a single GPU workload, however, instead of a single GPU device, the NVIDIA Run:ai Scheduler allocates the same dynamic fraction pair (Request and Limit) on multiple GPU devices within the same node. For example, if practitioners develop a new model that uses 8 GPUs and requires 40GB of memory per GPU, but may want to burst out and consume up to the full GPU memory, they can allocate 8×40GB with multi-GPU fractions and a limit of 80GB (e.g. H100 GPU) instead of reserving the full memory of each GPU (e.g. 80GB). This leaves 40GB of GPU memory available on each of the 8 GPUs for other workloads within that node.This is useful during model development, where memory requirements are usually lower due to experimentation with smaller models or configurations.
This approach significantly improves GPU utilization and availability, enabling more precise and often smaller quota requirements for the end user. Time sharing where single GPUs can serve multiple workloads with dynamic fractions remains unchanged, only now, it serves multiple workloads using multi-GPUs per workload.
Using the compute resources asset, you can define the compute requirements by specifying your requested GPU portion or GPU memory, and set a Limit. You can then use the compute resource with any of the NVIDIA Run:ai workload types for single and multi-GPU dynamic fractions. In addition, you will be able to view the workloads' utilization vs. Request and Limit parameters in the metrics pane for each workload.
Single dynamic GPU fractions - Define the compute requirement to run 1 GPU device, by specifying either a fraction (percentage) of the overall memory or specifying the memory request (GB, MB) with a Limit. The limit must be equal to or greater than the GPU fractional memory request.
Multi-GPU dynamic fractions - Define the compute requirement to run multiple GPU devices, by specifying either a fraction (percentage) of the overall memory or specifying the memory request (GB, MB) with a Limit. The limit must be equal to or greater than the GPU fractional memory request.
To enable dynamic GPU fractions for workloads submitted via Kubernetes YAML, use the following annotations to define the GPU fraction configuration. You can configure either gpu-fraction or gpu-memory. You must also set the RUNAI_GPU_MEMORY_LIMIT environment variable in the first container to enforce the memory limit. This is the GPU consuming container. Make sure the default scheduler is set to runai-scheduler. See Using the Scheduler with third-party workloads for more details.
Variable
Input Format
Where to Set
gpu-fraction
A portion of GPU memory as a double-precision floating-point number. Example: 0.25, 0.75.
Pod annotation (metadata.annotations)
gpu-memory
Memory size in MiB. Example: 2500,4096. The gpu-memory values are always in MiB.
Pod annotation (metadata.annotations)
The following example YAML creates a pod that requests 2 GPU devices, each requesting 50% of memory (gpu-fraction: "0.5") and allows usage of up to 95% (RUNAI_GPU_MEMORY_LIMIT: "0.95") if available.
To view the available actions, go to the CLI v2 reference and run according to your workload.
To view the available actions, go to the API reference and run according to your workload.
Dynamic GPU fractions is enabled by default in the cluster. Disabling dynamic GPU fractions in removes the CAP_KILL capability.
Multi-GPU Dynamic Fractions
Setting Dynamic GPU Fractions
Note
Dynamic GPU fractions is disabled by default in the NVIDIA Run:ai UI. To use dynamic GPU fractions, it must be enabled by your Administrator, under General Settings → Resources → GPU resource optimization.
Note
When setting a workload with dynamic GPU fractions, (for example, when using it with GPU Request or GPU memory Limits), you practically make the workload burstable. This means it can use memory that is not guaranteed for that workload and is susceptible to an 'OOM Kill' signal if the actual owner of that memory requires it back. This applies to non-preemptive workloads as well. For that reason, it is recommended that you use dynamic GPU fractions with Interactive workloads running Notebooks. Notebook pods are not evicted when their GPU process is OOM Kill'ed. This behavior is the same as standard Kubernetes burstable CPU workloads.
Setting Dynamic GPU Fractions for Third-Party Workloads
Using CLI
Using API
Workload policies
Require non-root, set UID/GID, block overrides, use trusted images
NVIDIA Run:ai uses Role‑Based Access Control to define what each user, group, or application can do, and where. Roles are assigned within a scope, such as a project, department, or cluster, and permissions cover actions like viewing, creating, editing, or deleting entities. Unlike Kubernetes RBAC, NVIDIA Run:ai’s RBAC works across multiple clusters, giving you a single place to manage access rules. See Role Based Access Control (RBAC) for more details.
Assign the minimum required permissions to users, groups and applications.
Segment duties using organizational scopes to restrict roles to specific projects or departments.
Regularly audit access rules and remove unnecessary privileges, especially admin-level roles.
NVIDIA Run:ai predefined roles are automatically mapped to Kubernetes cluster roles (also predefined by NVIDIA Run:ai). This means administrators do not need to manually configure role mappings.
These cluster roles define permissions for the entities NVIDIA Run:ai manages and displays (such as workloads) and also apply to users who access cluster data directly through Kubernetes tools (for example, kubectl).
NVIDIA Run:ai supports several authentication methods to control platform access. You can use single sign-on (SSO) for unified enterprise logins, traditional username/password accounts if SSO isn’t an option, and API secret keys for automated application access. Authentication is mandatory for all interfaces, including the UI, CLI, and APIs, ensuring only verified users or applications can interact with your environment.
Administrators can also configure session timeout. This refers to the period of inactivity before a user is automatically logged out. Once the timeout is reached, the session ends and re‑authentication is required, helping protect against risks from unattended or abandoned sessions. See Authentication and authorization for more details.
Integrate corporate SSO for centralized identity management.
Enforce strong password policies for local accounts.
Set appropriate session timeout values to minimize idle session risk.
Prefer SSO to eliminate password management within NVIDIA Run:ai.
Configure the Kubernetes API server to validate tokens via NVIDIA Run:ai’s identity service, ensuring unified authentication across the platform. For more information, see Cluster authentication.
Workload policies allow administrators to define and enforce how AI workloads are submitted and controlled across projects and teams. With these policies, you can set clear rules and defaults for workload parameters such as which resources can be requested, required security settings, and which defaults should apply. Policies are enforced whether workloads are submitted via the UI, CLI, API or Kubernetes YAML, and can be scoped to specific projects, departments, or clusters for fine-grained control. See Policies and rules for more details.
Enforce containers to run as non-root by default. Define policies that set constraints and defaults for workload submissions, such as requiring non-root users or specifying minimum UID/GID. Example security fields in policies:
security.runAsNonRoot: true
security.runAsUid: 1000
Restrict runAsUid with canEdit: false to prevent users from overriding.
Require explicit user/group IDs for all workload containers.
Impose data source and resource usage limits through policies.
Use policy rules to prevent users from submitting non-compliant workloads.
Apply policies by organizational scope for nuanced control within departments or projects.
Map these policies to PodSecurityContext settings in Kubernetes, and enforce them with Pod Security Admission or Kyverno for stricter compliance.
NVIDIA Run:ai offers flexible controls for how namespaces and resources are created and managed within your clusters. When a new project is set up, you can choose whether Kubernetes namespaces are created automatically, and whether users are auto-assigned to those projects. There are also options to manage how secrets are propagated across namespaces and to enable or disable resource limit enforcement using Kubernetes LimitRange objects. See Advanced cluster configurations for more details.
Require admin approval for namespace creation to avoid sprawl.
Limit secret propagation to essential cases only.
Use Kubernetes LimitRanges and ResourceQuotas alongside NVIDIA Run:ai policies for layered resource control.
Regularly audit and remove unused namespaces, secrets, and workloads.
NVIDIA Run:ai provides flexible options to control access to tools and serving endpoints. Access can be defined during workload submission or updated later, ensuring that only the intended users or groups can interact with the resource.
When configuring an endpoint or tool, users can select from the following access levels:
Public - Everyone within the network can access with no authentication (serving endpoints).
All authenticated users - Access is granted to anyone in the organization who can log in (NVIDIA Run:ai or SSO).
Specific groups - Access is restricted to members of designated identity provider groups.
Specific users - Access is restricted to individual users by email or username.
By default, network exposure is restricted, and access must be explicitly granted. Model endpoints automatically inherit RBAC and workload policy controls, ensuring consistent enforcement of role- and scope-based permissions across the platform. Administrators can also limit who can deploy, view, or manage endpoints, and should open network access only when required.
Define explicit roles for model management/use.
Restrict endpoint access to authorized users, groups and applications.
Monitor and audit endpoint access logs.
Use Kubernetes NetworkPolicies to limit inter-pod and external traffic to model-serving pods. Pair with NVIDIA Run:ai RBAC for end-to-end control.
A secure deployment is the foundation on which all other controls rest, and NVIDIA Run:ai’s installation procedures are built to align with organizational policies such as OpenShift Security Context Constraints (SCC). See Advanced cluster configurations for more details.
Deploy NVIDIA Run:ai cluster following secure installation guides (including IT compliance mandates such as SCC for OpenShift).
Run regular security scans and patch/update NVIDIA Run:ai deployments promptly when vulnerabilities are reported.
Regularly review and update all security policies, both at the NVIDIA Run:ai and Kubernetes levels, to adapt to evolving risks.
NVIDIA Run:ai supports SaaS and self-hosted modes to satisfy a range of data security needs. The self-hosted mode keeps all models, logs, and user data entirely within your infrastructure; SaaS requires careful review of what (minimal) data is transmitted for platform operations and analytics. See for more details.
Use the self-hosted mode when full control over the environment is required - including deployment and day-2 operations such as upgrades, monitoring, backup, and metadata restore.
Ensure transmission to the NVIDIA Run:ai cloud is scoped (in SaaS mode) and aligns with organization policy.
Encrypt secrets and sensitive resources; control secret propagation.
Document and audit data flows for regulatory alignment.
Access control (RBAC)
Enforce least privilege, segment roles by scope, audit regularly
Authentication and sessions management
Use SSO, token-based authentication, strong passwords, limit idle time
Access Control (RBAC)
Best Practices
Kubernetes Connection
Authentication and Session Management
Best Practices
Kubernetes Connection
Workload Policies: Enforcing Security at Submission
Best Practices
Kubernetes Connection
Managing Namespace and Resource Creation
Best Practices
Tools and Serving Endpoint Access Control
Best Practices
Kubernetes Connection
Secure Installation and Maintenance
Compliance and Data Privacy
The project has an assigned quota of at least 0.5 GPU.
Browse to the provided NVIDIA Run:ai user interface and log in with your credentials.
Log in using the following command. You will be prompted to enter your username and password:
runailogin--help
Log in using the following command. You will be prompted to enter your username and password:
runailogin
To use the API, you will need to obtain a token as shown in .
Go to the Workload manager → Workloads
Click +NEW WORKLOAD and select Workspace
Select under which cluster to create the workload
Select the project in which your workspace will run
Select Start from scratch to launch a new workspace quickly
Enter a name for the workspace (if the name already exists in the project, you will be requested to submit a different name)
Click CONTINUE
In the next step:
Select the 'jupyter-lab' environment for your workspace (Image URL: jupyter/scipy-notebook)
If the 'jupyter-lab' is not displayed in the gallery, follow the below steps:
Click +NEW ENVIRONMENT
Select the 'small-fraction' compute resource for your workspace (GPU % of devices: 10)
If 'small-fraction' is not displayed in the gallery, follow the below steps:
Click +NEW COMPUTE RESOURCE
Click CREATE WORKSPACE
Copy the following command to your terminal. Make sure to update the below with the name of your project and workload. For more details, see :
Copy the following command to your terminal. Make sure to update the below with the name of your project and workload. For more details, see :
Copy the following command to your terminal. Make sure to update the below parameters. For more details, see API:
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Select the newly created workspace with the Jupyter application that you want to connect to
Click CONNECT
Select the Jupyter tool. The selected tool is opened in a new tab on your browser.
To connect to the Jupyter Notebook, browse directly to https://<COMPANY-URL>/<PROJECT-NAME>/<WORKLOAD-NAME>
To connect to the Jupyter Notebook, browse directly to https://<COMPANY-URL>/<PROJECT-NAME>/<WORKLOAD-NAME>
To connect to the Jupyter Notebook, browse directly to https://<COMPANY-URL>/<PROJECT-NAME>/<WORKLOAD-NAME>
Manage and monitor your newly created workload using the Workloads table.
The policy name which is a combination of the policy scope and the policy type
Type
The policy type is per NVIDIA Run:ai workload type. This allows administrators to set different policies for each .
Status
Representation of the policy lifecycle (one of the following - "Creating…", "Updating…", "Deleting…", Ready or Failed)
Scope
The scope the policy affects. Click the name of the scope to view the organizational tree diagram. You can only view the parts of the organizational tree for which you have permission to view.
Created by
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Refresh - Click REFRESH to update the table with the latest data
To create a new policy:
Click +NEW POLICY
Select a scope
Select the workload type
Click +POLICY YAML
In the YAML editor type or paste a YAML policy with defaults and rules.
You can utilize the following references and examples:
Click SAVE POLICY
Select the policy you want to edit
Click EDIT
Update the policy and click APPLY
Click SAVE POLICY
Listed below are issues that might occur when creating or editing a policy via the YAML Editor:
Issue
Message
Mitigation
Cluster connectivity issues
There's no communication from cluster "cluster_name". Actions may be affected, and the data may be stale.
Verify that you are on a network that has been allowed access to the cluster. Reach out to your cluster administrator for instructions on verifying the issue.
Policy can't be applied due to a rule that is occupied by a different policy
Field "field_name" already has rules in cluster: "cluster_id"
Remove the rule from the new policy or adjust the old policy for the specific rule.
To view a policy:
Select the policy for which you want to view its policies.
Click VIEW POLICY
In the Policy form per workload section, view the workload rules and defaults:
Parameter
The workload submission parameter that Rules and Defaults are applied to
Type (applicable for data sources only)
The data source type (Git, S3, nfs, pvc etc.)
Default
The default value of the Parameter
Rule
Set up constraint on workload policy field
Source
The origin of the applied policy (cluster, department or project)
Select the policy you want to delete
Click DELETE
On the dialog, click DELETE to confirm the deletion
Go to the Policies API reference to view the available actions.
Workload Policies Table
Note
Workload policies are disabled by default. If you cannot see Workload policies in the menu, then it must be enabled by your administrator, under General settings → Workloads → Policies
Customizing the Table View
Adding a Policy
Editing a Policy
Troubleshooting
Viewing a Policy
Note
Some of the rules and defaults may be derived from policies of a parent cluster and/or department. You can see the source of each rule in the policy form. For more information, check the .
Deleting a Policy
Using API
Control Plane System Requirements
The NVIDIA Run:ai control plane is a Kubernetes application. This section explains the required hardware and software system requirements for the NVIDIA Run:ai control plane. Before you start, make sure to review the Installation overview.
Installer Machine
The machine running the installation script (typically the Kubernetes master) must have:
At least 50GB of free space
Docker installed
3.14 or later
The following hardware requirements are for the control plane system nodes. By default, all NVIDIA Run:ai control plane services run on all available nodes.
x86 – Supported for both Kubernetes and OpenShift deployments.
ARM – Supported for Kubernetes only. ARM is currently not supported for OpenShift.
This configuration is the minimum requirement you need to install and use NVIDIA Run:ai control plane:
Component
Required Capacity
If NVIDIA Run:ai control plane is planned to be installed on the same Kubernetes cluster as the NVIDIA Run:ai cluster, make sure the cluster are considered in addition to the NVIDIA Run:ai control plane hardware requirements.
The following software requirements must be fulfilled.
Any Linux operating system supported by both Kubernetes and NVIDIA GPU Operator
Internal tests are being performed on Ubuntu 22.04 and CoreOS for OpenShift.
Nodes are required to be synchronized by time using NTP (Network Time Protocol) for proper system functionality.
NVIDIA Run:ai control plane requires Kubernetes. The following Kubernetes distributions are supported:
Vanilla Kubernetes
OpenShift Container Platform (OCP)
NVIDIA Base Command Manager (BCM)
Elastic Kubernetes Engine (EKS)
For existing Kubernetes control plane, see the following Kubernetes version support matrix for the latest NVIDIA Run:ai releases:
NVIDIA Run:ai version
Supported Kubernetes versions
Supported OpenShift versions
For information on supported versions of managed Kubernetes, it's important to consult the release notes provided by your Kubernetes service provider. There, you can confirm the specific version of the underlying Kubernetes platform supported by the provider, ensuring compatibility with NVIDIA Run:ai. For an up-to-date end-of-life statement see or .
The NVIDIA Run:ai control plane uses a namespace or project (OpenShift) called runai-backend. Use the following to create the namespace/project:
The NVIDIA Run:ai control plane requires a default storage class to create persistent volume claims for NVIDIA Run:ai storage. The storage class, as per Kubernetes standards, controls the reclaim behavior, whether the NVIDIA Run:ai persistent data is saved or deleted when the NVIDIA Run:ai control plane is deleted.
The NVIDIA Run:ai control plane requires to be installed.
OpenShift, RKE and RKE2 come with a pre-installed ingress controller.
Internal tests are being performed on NGINX, Rancher NGINX, OpenShift Router, and Istio.
Make sure that a default ingress controller is set.
There are many ways to install and configure different ingress controllers. The following shows a simple example to install and configure NGINX ingress controller using :
You must have a Fully Qualified Domain Name (FQDN) to install the NVIDIA Run:ai control plane (ex: runai.mycorp.local). This cannot be an IP. The FQDN must be resolvable within the organization's private network.
You must have a TLS certificate that is associated with the FQDN for HTTPS access. Create a named runai-backend-tls in the runai-backend namespace and include the path to the TLS --cert and its corresponding private --key by running the following:
NVIDIA Run:ai uses the OpenShift default Ingress router for serving. The TLS certificate configured for this router must be issued by a trusted CA. For more details, see the OpenShift documentation on .
A local certificate authority serves as the root certificate for organizations that cannot use publicly trusted certificate authority. Follow the below steps to configure the local certificate authority.
In air-gapped environments, you must configure and install the local CA's public key in the Kubernetes cluster. This is required for the installation to succeed:
Add the public key to the runai-backend namespace:
When installing the control plane, make sure the following flag is added to the helm command --set global.customCA.enabled=true. See .
The NVIDIA Run:ai control plane installation includes a default PostgreSQL database. However, you may opt to use an existing PostgreSQL database if you have specific requirements or preferences as detailed in . Note that only PostgreSQL version 16 is supported.
Set Up SSO with SAML
Single Sign-On (SSO) is an authentication scheme, allowing users to log in with a single pair of credentials to multiple, independent software systems.
Before your start, make sure you have the SAML XML Metadata available from your identity provider.
Setup
Adding the Identity Provider
Go to General settings
Open the Security section and click +IDENTITY PROVIDER
Select Custom SAML 2.0
Select either From computer or From URL
From computer - Click the Metadata XML file field, then select your file for upload
From URL - In the Metadata XML URL field, enter the URL to the XML Metadata file
Copy the Redirect URL and Entity ID to be used in your identity provider
(Optional) Enter the user attributes and their value in the identity provider as shown in the below table
Click SAVE
Attribute
Default value in NVIDIA Run:ai
Description
Open the NVIDIA Run:ai platform as an admin
Add to an SSO user defined in the IDP
Open the NVIDIA Run:ai platform in an incognito browser tab
On the sign-in page click CONTINUE WITH SSO.
You can view the identity provider details and edit its configuration:
Go to General settings
Open the Security section
On the identity provider box, click Edit identity provider
You can edit either the metadata file or the user attributes
You can remove the identity provider configuration:
Go to General settings
Open the Security section
On the identity provider card, click Remove identity provider
In the dialog, click
You can download the XML file to view the identity provider settings:
Go to General settings
Open the Security section
On the identity provider card, click Download metadata XML file
If testing the setup was unsuccessful, try the different troubleshooting scenarios according to the error you received. If an error still occurs, check the .
Nodes
This section explains the procedure for managing Nodes.
Nodes are Kubernetes elements automatically discovered by the NVIDIA Run:ai platform. Once a node is discovered by the NVIDIA Run:ai platform, an associated instance is created in the Nodes table, administrators can view the Node's relevant information, and NVIDIA Run:ai scheduler can use the node for Scheduling.
Nodes Table
The Nodes table can be found under Resources in the NVIDIA Run:ai platform.
The Nodes table displays a list of predefined nodes available to users in the NVIDIA Run:ai platform.
Note
It is not possible to create additional nodes, or edit, or delete existing nodes.
Only users with relevant permissions can view the table.
The Nodes table consists of the following columns:
Column
Description
Click one of the values in the GPU devices column, to view the list of GPU devices and their parameters.
Column
Description
Click one of the values in the Pod(s) column, to view the list of pods and their parameters.
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Click a row in the Nodes table and then click the Show details button at the upper right side of the action bar. The details screen appears, presenting the following metrics graphs:
GPU utilization - Per GPU graph and an average of all GPUs graph, all on the same chart, along an adjustable period allows you to see the trends of all GPUs compute utilization (percentage of GPU compute) in this node.
GPU memory utilization - Per GPU graph and an average of all GPUs graph, all on the same chart, along an adjustable period allows you to see the trends of all GPUs memory usage (percentage of the GPU memory) in this node.
CPU compute utilization - The average of all CPUs' cores compute utilization graph, along an adjustable period allows you to see the trends of CPU compute utilization (percentage of CPU compute) in this node.
To view the available actions, go to the API reference.
Integrations
Integration Support
Support for third-party integrations varies. When noted below, the integration is supported out of the box with NVIDIA Run:ai. For other integrations, our Customer Success team has prior experience assisting customers with setup. In many cases, the NVIDIA Enterprise Support Portal may include additional reference documentation provided on an as-is basis.
Tool
Category
NVIDIA Run:ai support details
Additional Information
Apache Airflow
Kubernetes has several built-in resources that encapsulate running Pods. These are called and should not be confused with .
Examples of such resources are a Deployment that manages a stateless application, or a Job that runs tasks to completion.
A NVIDIA Run:ai workload encapsulates all the resources needed to run and creates/deletes them together. Since NVIDIA Run:ai is an open platform, it allows the scheduling of any Kubernetes Workflow.
For more information, see .
GPU Fractions
To submit a workload with GPU resources in Kubernetes, you typically need to specify an integer number of GPUs. However, workloads often require diverse GPU memory and compute requirements or even use GPUs intermittently depending on the application (such as inference workloads, training workloads or notebooks at the model-creation phase). Additionally, GPUs are becoming increasingly powerful, offering more processing power and larger memory capacity for applications. Despite the increasing model sizes, the increasing capabilities of GPUs allow them to be effectively shared among multiple users or applications.
NVIDIA Run:ai's GPU fractions provide an agile and easy-to-use method to share a GPU or multiple GPUs across workloads. With GPU fractions, you can divide the GPU/s memory into smaller chunks and share the GPU/s compute resources between different workloads and users, resulting in higher GPU utilization and more efficient resource allocation.
Benefits of GPU Fractions
Utilizing GPU fractions to share GPU resources among multiple workloads provides numerous advantages for both platform administrators and practitioners, including improved efficiency, resource optimization, and enhanced user experience.
For the AI practitioner:
Reduced wait time - Workloads with smaller GPU requests are more likely to be scheduled quickly, minimizing delays in accessing resources.
Increased workload capacity - More workloads can be run using the same admin-defined GPU and available unused resources - .
For the platform administrator:
Improved GPU utilization - Sharing GPUs across workloads increases the utilization of individual GPUs, resulting in better overall platform efficiency.
Higher resource availability - More users gain access to GPU resources, ensuring better distribution.
When planning the quota distribution for your and , using fractions gives the platform administrator the ability to allocate more precise quota per project and department, assuming the usage of GPU fractions or enforcing it with or templates.
For example, in an organization with a department budgeted for two nodes of 8×H100 GPUs and a team of 32 researchers:
Allocating 0.5 GPU per researcher ensures all researchers have access to GPU resources.
Using fractions enables researchers to run smaller workloads intermittently within their quota or go over their quota by using temporary over quota resources with higher resource demanding workloads.
Using GPUs for notebook-based model development, where GPUs are not continuously active and can be shared among multiple users.
For more details on mapping your organization and resources, see .
When a workload is submitted, the Scheduler finds a node with a GPU that can satisfy the requested GPU portion or GPU memory, then it schedules the pod to that node. The NVIDIA Run:ai GPU fractions logic, running locally on each NVIDIA Run:ai worker node, allocates the requested memory size on the selected GPU. Each pod uses a its own separate virtual memory address space. NVIDIA Run:ai's GPU fractions logic enforces the requested memory size, so no workload can use more than requested, and no workload can run over another workload's memory. This gives users the experience of a 'logical GPU' per workload.
While requires administrative work to configure every MIG slice, where a slice is a fixed chunk of memory, GPU fractions allow dynamic and fully flexible allocation of GPU memory chunks. By default, GPU fractions use NVIDIA's time-slicing to share the GPU compute runtime. You can also use the which allows dynamic and fully flexible splitting of the GPU compute time.
NVIDIA Run:ai GPU fractions are agile and dynamic allowing a user to allocate and free GPU fractions during the runtime of the system, at any size between zero to the maximum GPU portion (100%) or memory size (up to the maximum memory size of a GPU).
The NVIDIA Run:ai Scheduler can work alongside other schedulers. In order to avoid collisions with other schedulers, the NVIDIA Run:ai Scheduler creates special reservation pods. Once a workload is submitted requesting a fraction of a GPU, NVIDIA Run:ai will create a pod in a dedicated runai-reservation namespace with the full GPU as a resource, allowing other schedulers to understand that the GPU is reserved.
NVIDIA Run:ai also supports workload submission using multi-GPU fractions. Multi-GPU fractions work similarly to single-GPU fractions, however, the NVIDIA Run:ai Scheduler allocates the same fraction size on multiple GPU devices within the same node. For example, if practitioners develop a new model that uses 8 GPUs and requires 40GB of memory per GPU, they can allocate 8×40GB with multi-GPU fractions instead of reserving the full memory of each GPU (e.g. 80GB). This leaves 40GB of GPU memory available on each of the 8 GPUs for other workloads within that node.
Time sharing where single GPUs can serve multiple workloads with fractions remains unchanged, only now, it serves multiple workloads using multi-GPUs per workload, single-GPU per workload, or a mix of both.
Selecting a GPU portion using percentages as units does not guarantee the exact memory size. This means 50% of an A-100-40GB is 20GB while 50% of an A-100-80 is 40GB. To have better control over the exact allocated memory, specify the exact memory size i.e. 40GB.
Using NVIDIA Run:ai GPU fractions controls the memory split (i.e. 0.5 GPU means 50% of the GPU memory) but not the compute (processing time). To split the compute time, see .
NVIDIA Run:ai GPU fractions and cannot be used on the same node.
Using the asset, you can define the compute requirements by specifying your requested GPU portion or GPU memory, and use it with any of the for single GPU and multi-GPU fractions.
Single-GPU fractions - Define the compute requirement to run 1 GPU device, by specifying either a fraction (percentage) of the overall memory or a memory request (GB, MB).
Multi-GPU fractions - Define the compute requirement to run multiple GPU devices, by specifying either a fraction (percentage) of the overall memory or a memory request (GB, MB).
To enable GPU fractions for workloads submitted via Kubernetes YAML, use the following annotations to define the GPU fraction configuration. You can configure either gpu-fraction or gpu-memory. Make sure the default scheduler is set to runai-scheduler. See for more details.
Variable
Input Format
Where to Set
The following example YAML creates a pod that requests 2 GPU devices, each requesting 50% of memory (gpu-fraction: "0.5") .
To view the available actions, go to the or the and run according to your workload.
To view the available actions, go to the and run according to your workload.
Cluster Authentication
To allow users to securely submit workloads using kubectl, you must configure the Kubernetes API server to authenticate users via the NVIDIA Run:ai identity provider. This is done by adding OpenID Connect (OIDC) flags to the Kubernetes API server configuration on each cluster.
It is possible to schedule Seldon Core workloads with the NVIDIA Run:ai Scheduler.
Spark
Orchestration
Community Support
It is possible to schedule Spark workflows with the NVIDIA Run:ai Scheduler.
S3
Storage
Supported
NVIDIA Run:ai communicates with S3 by defining a data source asset
TensorBoard
Experiment tracking
Supported
NVIDIA Run:ai comes with a preset TensorBoard Environment asset
TensorFlow
Training
Supported
NVIDIA Run:ai provides out of the box support for submitting TensorFlow workloads via API, CLI or UI. See Distributed training for more details.
Triton
Orchestration
Supported
Usage via docker base image
VScode
Development
Supported
Containers created by NVIDIA Run:ai can be accessed via Visual Studio Code. You can automatically launch Visual Studio code web from the NVIDIA Run:ai console.
The number of GPU devices to allocate using the specified gpu-fraction or gpu-memory value. Set this annotation only if you want to request multiple GPU devices.
Pod annotation (metadata.annotations)
RUNAI_GPU_MEMORY_LIMIT
To use for gpu-fraction - Specify a double-precision floating-point number. Example: 0.95
To use for gpu-memory - Specify a Kubernetes resource quantity format. Example: 500000000, 2500M
The limit must be equal to or greater than the GPU fractional memory request.
Under the Payload section validate the values of the user’s attribute
Validate the user’s email attribute is mapped correctly
Validate the configured Client Secret match the Client Secret in the Identity Provider
Advanced: Look for the specific error message in the URL address
If it exists in the IDP, it allows Researcher containers to start with the Linux User UID. Used to map access to network resources such as file systems to users. The IDP attribute must be of type integer.
Linux Group ID
GID
If it exists in the IDP, it allows Researcher containers to start with the Linux Group GID. The IDP attribute must be of type integer.
Supplementary Groups
SUPPLEMENTARYGROUPS
If it exists in the IDP, it allows Researcher containers to start with the relevant Linux supplementary groups. The IDP attribute must be a list of integers.
Email
email
Defines the user attribute in the IDP holding the user's email address, which is the user identifier in NVIDIA Run:ai
User first name
firstName
Used as the user’s first name appearing in the NVIDIA Run:ai user interface
User last name
lastName
Used as the user’s last name appearing in the NVIDIA Run:ai user interface
The total amount of GPU memory installed on this node. For example, if the number is 640GB and the number of GPU devices is 8, then each GPU is installed with 80GB of memory (assuming the node is assembled of homogenous GPU devices)
Allocated GPUs
The total allocation of GPU devices in units of GPUs (decimal number). For example, if 3 GPUs are 50% allocated, the field prints out the value 1.50. This value represents the portion of GPU memory consumed by all running pods using this node
Used GPU memory
The actual amount of memory (in GB or MB) used by pods running on this node.
GPU compute utilization
The average compute utilization of all GPU devices in this node
GPU memory utilization
The average memory utilization of all GPU devices in this node
CPU (Cores)
The number of CPU cores installed on this node
CPU memory
The total amount of CPU memory installed on this node
Allocated CPU (Cores)
The number of CPU cores allocated by pods running on this node (decimal number, e.g. a pod allocating 350 mili-cores shows an allocation of 0.35 cores).
Allocated CPU memory
The total amount of CPU memory allocated by pods running on this node (in GB or MB)
Used CPU memory
The total amount of actually used CPU memory by pods running on this node. Pods may allocate memory but not use all of it, or go beyond their CPU memory allocation if using Limit > Request for CPU memory (burstable workload)
CPU compute utilization
The utilization of all CPU compute resources on this node (percentage)
CPU memory utilization
The utilization of all CPU memory resources on this node (percentage)
Used swap CPU memory
The amount of CPU memory (in GB or MB) used for GPU swap memory (* future)
Pod(s)
List of pods running on this node, click the field to view details (described below in this article)
Memory utilization
The portion of the GPU memory that is being used by applications (percentage)
Idle time
The elapsed time since the GPU was used (i.e. the GPU is being idle for 'Idle time')
Workload
The workload name the pod belongs to. Clicking this field takes you to the Workloads table filtered by this workload name
Image
The full path of the image used by the main container of this pod
Creation time
The pod's creation date and time
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
Show/Hide details - Click to view additional information on the selected row
CPU memory utilization - The utilization of all CPUs memory in a single graph, along an adjustable period allows you to see the trends of CPU memory utilization (percentage of CPU memory) in this node.
CPU memory usage - The usage of all CPUs memory in a single graph, along an adjustable period allows you to see the trends of CPU memory usage (in GB or MB of CPU memory) in this node.
For GPUs charts - Click the GPU legend on the right-hand side of the chart, to activate or deactivate any of the GPU lines.
You can click the date picker to change the presented period
You can use your mouse to mark a sub-period in the graph for zooming in, and use the 'Reset zoom' button to go back to the preset period
Changes in the period affect all graphs on this screen.
Node
The Kubernetes name of the node
Status
The state of the node. Nodes in the Ready state are eligible for scheduling. If the state is Not ready then the main reason appears in parenthesis on the right side of the state field. Hovering the state lists the reasons why a node is Not ready.
Node pool
The name of the associated node pool. By default, every node in the NVIDIA Run:ai platform is associated with the default node pool, if no other node pool is associated
GPU type
The GPU model, for example, H100, or V100
GPU devices
Index
The GPU index, read from the GPU hardware. The same index is used when accessing the GPU directly
Used memory
The amount of memory used by pods and drivers using the GPU (in GB or MB)
Compute utilization
The portion of time the GPU is being used by applications (percentage)
Pod
The Kubernetes name of the pod. Usually name of the pod is made of the name of the parent workload if there is one, and an index for unique for that pod instance within the workload
Status
The state of the pod. In steady state this should be Running and the amount of time the pod is running
Project
The NVIDIA Run:ai project name the pod belongs to. Clicking this field takes you to the Projects table filtered by this project name
GPU Devices for Node
Pods Associated with Node
Note
This column is only viewable if your role in the NVIDIA Run:ai platform gives you read access to workloads, even if you are allowed to view workloads, you can only view the workloads within your allowed scope. This means, there might be more pods running on this node than appear in the list your are viewing.
The number of GPU devices installed on the node. Clicking this field pops up a dialog with details per GPU (described below in this article)
Google Kubernetes Engine (GKE)
Azure Kubernetes Service (AKS)
Oracle Kubernetes Engine (OKE)
Rancher Kubernetes Engine (RKE1)
Rancher Kubernetes Engine 2 (RKE2)
v2.19
1.28 to 1.31
4.12 to 4.17
v2.20 (latest)
1.29 to 1.32
4.14 to 4.17
CPU
10 cores
Memory
12GB
Disk space
110GB
v2.17
1.27 to 1.29
4.12 to 4.15
v2.18
1.28 to 1.30
Note
If you are installing an air-gapped version of NVIDIA Run:ai, the NVIDIA Run:ai software artifacts include the Helm binary.
Hardware Requirements
Architecture
Note
The control plane does not support CPU nodes with ARM64k architecture. To designate nodes to NVIDIA Run:ai system services, follow the instructions as described in System nodes.
NVIDIA Run:ai Control Plane - System Nodes
Note
To designate nodes to NVIDIA Run:ai system services, follow the instructions as described in System nodes.
Software Requirements
Operating System
Network Time Protocol
Kubernetes Distribution
Note
The latest release of the NVIDIA Run:ai control plane supports Kubernetes 1.30 to 1.32 and OpenShift 4.14 to 4.18
NVIDIA Run:ai Namespace
Default Storage Class
Note
Default storage class applies for Kubernetes only.
Note
For a simple (non-production) storage class example see Kubernetes Local Storage Class. The storage class will set the directory /opt/local-path-provisioner to be used across all nodes as the path for provisioning persistent volumes. Then set the new storage class as default:
Kubernetes Ingress Controller
Note
Installing ingress controller applies for Kubernetes only.
Vanilla Kubernetes
Run the following commands:
For cloud deployments, both the internal IP and external IP are required.
For on-prem deployments, only the external IP is needed.
Managed Kubernetes (EKS, GKE, AKS)
Run the following commands:
Oracle Kubernetes Engine (OKE)
Run the following commands:
Fully Qualified Domain Name (FQDN)
Note
Fully Qualified Domain Name applies for Kubernetes only.
kubectl create secret tls runai-backend-tls -n runai-backend \
--cert /path/to/fullchain.pem \ # Replace /path/to/fullchain.pem with the actual path to your TLS certificate
--key /path/to/private.pem # Replace /path/to/private.pem with the actual path to your private key
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm upgrade -i nginx-ingress ingress-nginx/ingress-nginx \
--namespace nginx-ingress --create-namespace \
--set controller.kind=DaemonSet \
--set controller.service.externalIPs="{<INTERNAL-IP>,<EXTERNAL-IP>}" # Replace <INTERNAL-IP> and <EXTERNAL-IP> with the internal and external IP addresses of one of the nodes
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Linux Group ID
GID
If it exists in the IDP, it allows Researcher containers to start with the Linux Group GID. The IDP attribute must be of type integer.
Supplementary Groups
SUPPLEMENTARYGROUPS
If it exists in the IDP, it allows Researcher containers to start with the relevant Linux supplementary groups. The IDP attribute must be a list of integers.
Email
email
Defines the user attribute in the IDP holding the user's email address, which is the user identifier in NVIDIA Run:ai.
User first name
firstName
Used as the user’s first name appearing in the NVIDIA Run:ai platform.
User last name
lastName
Used as the user’s last name appearing in the NVIDIA Run:ai platform.
You are redirected to the identity provider sign in page
In the identity provider sign-in page, log in with the SSO user who you granted with access rules
If you are unsuccessful signing-in to the identity provider, follow the Troubleshooting section below
You can view the identity provider URL, identity provider entity ID, and the certificate expiration date
REMOVE
to confirm the action
User role groups
GROUPS
If it exists in the IDP, it allows you to assign NVIDIA Run:ai role groups via the IDP. The IDP attribute must be a list of strings.
Linux User ID
UID
Testing the Setup
Editing the Identity Provider
Removing the Identity Provider
Note
To avoid losing access, removing the identity provider must be carried out by a local user.
Downloading the XML Metadata File
Troubleshooting
Troubleshooting Scenarios
Error: "Invalid signature in response from identity provider"
Description: After trying to log in, the following message is received in the NVIDIA Run:ai login page.
Mitigation:
Go to the General settings menu
Open the Security section
In the identity provider box, check for a "Certificate expired” error
If it is expired, update the SAML metadata file to include a valid certificate
Error: "401 - We’re having trouble identifying your account because your email is incorrect or can’t be found."
Description: Authentication failed because email attribute was not found.
Mitigation: Validate the user’s email attribute is mapped correctly
Error: "403 - Sorry, we can’t let you see this page. Something about permissions…"
Description: The authenticated user is missing permissions
Mitigation:
Validate either the user or its related group/s are assigned with access rules
Validate the user’s groups attribute is mapped correctly
Advanced:
Open the Chrome DevTools: Right-click on page → Inspect → Network tab
Navigate to the Clusters page to trigger an API request
In the Network tab, find the request to the clusters API
In the request headers, copy the value of the Authorization header (the token starts with
Advanced Troubleshooting
Validating the SAML request
The SAML login flow can be separated into two parts:
NVIDIA Run:ai redirects to the IDP for log-ins using a SAML Request
On successful log-in, the IDP redirects back to NVIDIA Run:ai with a SAML Response
Validate the SAML Request to ensure the SAML flow works as expected:
Go to the NVIDIA Run:ai login screen
Open the Chrome Network inspector: Right-click → Inspect on the page → Network tab
On the sign-in page click CONTINUE WITH SSO.
Once redirected to the Identity Provider, search in the Chrome network inspector for an HTTP request showing the SAML Request. Depending on the IDP url, this would be a request to the IDP domain name. For example,
If it exists in the IDP, it allows Researcher containers to start with the Linux User UID. Used to map access to network resources such as file systems to users. The IDP attribute must be of type integer.
Enhanced workload throughput - More workloads can be served per GPU, ensuring maximum output from existing hardware.
Optimized scheduling - Smaller and dynamic resource allocations gives the Scheduler a higher chance of finding GPU resources for incoming workloads.
gpu-fraction-num-devices
The number of GPU devices to allocate using the specified gpu-fraction or gpu-memory value. Set this annotation only if you want to request multiple GPU devices.
Pod annotation (metadata.annotations)
gpu-fraction
A portion of GPU memory as a double-precision floating-point number. Example: 0.25, 0.75.
Pod annotation (metadata.annotations)
gpu-memory
Memory size in MiB. Example: 2500,4096. The gpu-memory values are always in MiB.
Splitting a GPU into fractions may generate some fragmentation of the GPU memory. The Scheduler will try to consolidate GPU resources where feasible (i.e. preemptible workloads).
Using bin-pack as a scheduling placement strategy can also reduce GPU fragmentation.
Using ensures that even small unused fragments of GPU memory are utilized by workloads.
In the next Section, the NVIDIA Run:ai cluster installation steps will be presented.
Follow the installation instructions and run the commands provided on your Kubernetes cluster.
On the second tab of the cluster wizard, when copying the helm command for installation, you will need to use the pre-provided installation file instead of using helm repositories. As such:
Do not add the helm repository and do not run helm repo update.
Instead, edit the helm upgrade command.
Replace runai/runai-cluster with ./chart/runai-cluster-<VERSION>.tgz (the Helm chart located in the chart folder of the extracted software artifacts).
Run the following command from the root of the extracted software artifacts directory:
Click DONE
The cluster is displayed in the table with the status Waiting to connect. Once installation is complete, the cluster status changes to Connected.
Tip: Use the --dry-run flag to gain an understanding of what is being installed before the actual installation.
Click +NEW CLUSTER
Enter a unique name for your cluster
Optional: Choose the NVIDIA Run:ai cluster version (latest, by default)
Enter the Cluster URL
Click Continue
Installing NVIDIA Run:ai cluster
In the next Section, the NVIDIA Run:ai cluster installation steps will be presented.
Follow the installation instructions and run the commands provided on your Kubernetes cluster.
Click DONE
The cluster is displayed in the table with the status Waiting to connect. Once installation is complete, the cluster status changes to Connected.
In the NVIDIA Run:ai platform, go to Resources
Click +NEW CLUSTER
Enter a unique name for your cluster
Optional: Choose the NVIDIA Run:ai cluster version (latest, by default)
Enter the Cluster URL
Click Continue
Installing NVIDIA Run:ai cluster
In the next Section, the NVIDIA Run:ai cluster installation steps will be presented.
Follow the installation instructions and run the commands provided on your Kubernetes cluster.
On the second tab of the cluster wizard, when copying the helm command for installation, you will need to use the pre-provided installation file instead of using helm repositories. As such:
Do not add the helm repository and do not run helm repo update.
Instead, edit the helm upgrade command.
Replace runai/runai-cluster with ./chart/runai-cluster-<VERSION>.tgz (the Helm chart located in the chart folder of the extracted software artifacts).
Make sure you have extracted the software artifacts as described in the Preparations section. The helm chart is located in the chart folder of the extracted directory.
These flags must be configured in the API server startup parameters for each cluster in your environment.
Kubernetes Distribution-Specific Configuration
Note
Azure Kubernetes Service (AKS) is not supported.
For other Kubernetes distributions, refer to specific instructions in the documentation.
Vanilla Kubernetes
Locate the Kubernetes API server configuration file. For vanilla Kubernetes, the configuration file is typically located at: /etc/kubernetes/manifests/kube-apiserver.yaml.
Edit the file. Under the command section, add the .
Verify that the changes have been applied. After saving the file, the API server should automatically restart since it's managed as a static pod. Confirm that the kube-apiserver-<master-node-name> pod in the kube-system namespace has restarted and is running with the new configuration. You can run the following command to check the pod status:
OpenShift Container Platform (OCP)
No additional configuration is required.
Rancher Kubernetes Engine (RKE1)
Edit the cluster.yml file used by RKE1. If you're using the Rancher UI, follow the instructions here.
Configure the OIDC provider for username-password authentication. Make sure to use the :
Or, configure the OIDC provider for single-sign-on. Make sure to use the :
Update the runaiconfig with the Anthos Identity Service endpoint. First, get the external IP of the gke-oidc-envoy service:
Then, patch the runaiconfig to use this endpoint. Replace the below with the actual IP address of the gke-oidc-envoy service:
Elastic Kubernetes Engine (EKS)
In the AWS Console, under EKS, find your cluster.
Go to Configuration and then to Authentication.
Associate a new identity provider. Use the .
The process can take up to 30 minutes.
NVIDIA Base Command Manager (BCM)
While it is possible to edit the manifest files directly on the control plane nodes (as described in the Vanilla Kubernetes instructions), the BCM preferred method is to make changes through the kubeadm configmap. This ensures that kubeadm can always regenerate the manifest files correctly — for example, when adding new control plane nodes or upgrading Kubernetes.
Warning
If you previously modified /etc/kubernetes/manifests/kube-apiserver.yaml directly on the nodes, those changes may be overwritten the next time cm-kubeadm-manage is used or when Kubernetes is upgraded. Use the configmap method below to ensure your OIDC flags persist.
Propagate the configmap changes to the control plane nodes:
For each control plane node, regenerate the API server manifest:
Validate the changes by confirming the API server pod is using the OIDC flags:
Expected output:
Once confirmed, proceed to the next control plane node and repeat until all nodes are updated.
Advanced Control Plane Configurations
Helm Chart Values
The NVIDIA Run:ai control plane installation can be customized to support your environment via Helm values files or Helm install flags. Make sure to restart the relevant NVIDIA Run:ai pods so they can fetch the new configurations.
Key
Change
Description
global.ingress.ingressClass
Ingress class
The NVIDIA Run:ai control plane chart includes multiple sub-charts of third-party components:
Data store - (postgresql)
Metrics Store - (thanos)
Identity & Access Management - (keycloakx)
If you have opted to connect to an , refer to the additional configurations table below. Adjust the following parameters based on your connection details:
The keycloakx.adminUser can only be set during the initial installation. The admin password can be changed later through the Keycloak UI, but you must also update the keycloakx.adminPassword value in the Helm chart using helm upgrade. See for more details.
Key
Change
Description
You can change the Keycloak admin password after deployment by performing the following steps:
Open the Keycloak UI at: https://<runai-domain>/auth
Sign in with your existing admin credentials as configured in your Helm values
Go to Users and select admin (or your admin username)
Key
Change
Description
Key
Change
Description
Introduction to Workloads
NVIDIA Run:ai enhances visibility and simplifies management, by monitoring, presenting and orchestrating all AI workloads in the clusters it is installed. Workloads are the fundamental building blocks for consuming resources, enabling AI practitioners such as researchers, data scientists and engineers to efficiently support the entire life cycle of an AI initiative.
Workloads Across the AI Life Cycle
A typical AI initiative progresses through several key stages, each with distinct workloads and objectives. With NVIDIA Run:ai, research and engineering teams can host and manage all these workloads to achieve the following:
Data preparation: Aggregating, cleaning, normalizing, and labeling data to prepare for training.
Training: Conducting resource-intensive model development and iterative performance optimization.
Fine-tuning: Adapting pre-trained models to domain-specific data sets while balancing efficiency and performance.
Inference: Deploying models for real-time or batch predictions with a focus on low latency and high throughput.
Monitoring and optimization: Ensuring ongoing performance by addressing data drift, usage patterns, and retraining as needed.
A workload runs in the cluster, is associated with a namespace, and operates to fulfill its targets, whether that is running to completion for a , allocating resources for in an integrated development environment (IDE)/notebook, or serving requests in production.
The workload, defined by the AI practitioner, consists of:
Container images: This includes the application, its dependencies, and the runtime environment.
Compute resources: CPU, GPU, and RAM to execute efficiently and address the workload’s needs.
Data sets: The data needed for processing, such as training data sets or input from external databases.
NVIDIA Run:ai’s core mission is to optimize AI resource usage at scale. This is achieved through efficient of all cluster workloads using the NVIDIA Run:ai . The Scheduler allows the prioritization of workloads across different departments and projects within the organization at large scales, based on the resource distribution set by the system administrator.
NVIDIA Run:ai workloads: These workloads are submitted via the NVIDIA Run:ai platform. They are represented by Kubernetes Custom Resource Definitions (CRDs) and APIs. When using , a complete Workload and Scheduling Policy solution is offered for administrators to ensure optimizations, governance and security standards are applied.
Third-party workloads: These workloads are submitted via third-party applications that use the NVIDIA Run:ai Scheduler. The NVIDIA Run:ai platform manages and monitors these workloads. They enable seamless integrations with external tools, allowing teams and individuals flexibility. See .
Different types of workloads have different levels of support. Understanding what capabilities are needed before selecting the workload type to work with is important. The table below details the level of support for each workload type in NVIDIA Run:ai. NVIDIA Run:ai workloads are fully supported with all of NVIDIA Run:ai advanced features and capabilities. While third-party workloads are partially supported. The list of capabilities can change between different NVIDIA Run:ai versions.
Functionality
NVIDIA Run:ai Workspace
NVIDIA Run:ai Training - Standard
NVIDIA Run:ai Training - distributed
NVIDIA Run:ai Inference
Third-party workloads
Compute Resources
This article explains what compute resources are and how to create and use them.
Compute resources are one type of workload asset. A compute resource is a template that simplifies how workloads are submitted and can be used by AI practitioners when they submit their workloads.
A compute resource asset is a preconfigured building block that encapsulates all the specifications of compute requirements for the workload including:
GPU devices and GPU memory
CPU memory and CPU compute
The Compute resource table can be found under Workload manager in the NVIDIA Run:ai UI.
The Compute resource table provides a list of all the compute resources defined in the platform and allows you to manage them.
The Compute resource table consists of the following columns:
Column
Description
Click one of the values in the Workload(s) column to view the list of workloads and their parameters.
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
To add a new compute resource:
Go to the Compute resource table
Click +NEW COMPUTE RESOURCE
Select under which cluster to create the compute resource
Select a
To edit a compute resource:
Select the compute resource you want to edit
Click Edit
Click SAVE COMPUTE RESOURCE
To copy an existing compute resource:
Select the compute resource you want to copy
Click MAKE A COPY
Enter a name for the compute resource. The name must be unique.
Select the compute resource you want to delete
Click DELETE
On the dialog, click DELETE to confirm
Go to the API reference to view the available actions.
Departments
This section explains the procedure for managing departments
Departments are a grouping of projects. By grouping projects into a department, you can set quota limitations to a set of projects, create policies that are applied to the department, and create assets that can be scoped to the whole department or a partial group of descendent projects
For example, in an academic environment, a department can be the Physics Department grouping various projects (AI Initiatives) within the department, or grouping projects where each project represents a single student.
The Departments table can be found under Organization in the NVIDIA Run:ai platform.
The Departments table lists all departments defined for a specific cluster and allows you to manage them. You can switch between clusters by selecting your cluster using the filter at the top.
The Departments table consists of the following columns:
Launching Workloads with Dynamic GPU Fractions
This quick start provides a step-by-step walkthrough for running a Jupyter Notebook with .
NVIDIA Run:ai's dynamic GPU fractions optimizes GPU utilization by enabling workloads to dynamically adjust their resource usage. It allows users to specify a guaranteed fraction of GPU memory and compute resources with a higher limit that can be dynamically utilized when additional resources are requested.
kubectl get clientconfig default -n kube-public -o yaml > login-config.yaml
yq -i e ".spec +={\"authentication\":[{\"name\":\"oidc\",\"oidc\":{\"clientID\":\"runai\",\"issuerURI\":\"$OIDC_ISSUER_URL\",\"kubectlRedirectURI\":\"http://localhost:8000/callback\",\"userClaim\":\"sub\",\"userPrefix\":\"-\"}}]}" login-config.yaml
kubectl apply -f login-config.yaml
kubectl get clientconfig default -n kube-public -o yaml > login-config.yaml
yq -i e ".spec +={\"authentication\":[{\"name\":\"oidc\",\"oidc\":{\"clientID\":\"runai\",\"issuerURI\":\"$OIDC_ISSUER_URL\",\"groupsClaim\":\"groups\",\"kubectlRedirectURI\":\"http://localhost:8000/callback\",\"userClaim\":\"sub\",\"userPrefix\":\"-\"}}]}" login-config.yaml
kubectl apply -f login-config.yaml
kubectl get svc -n anthos-identity-service
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
gke-oidc-envoy LoadBalancer 10.37.3.111 39.201.319.10 443:31545/TCP 12h
The content of the AssertionConsumerServiceURL is the same as the Redirect URI given when
Validate the response:
The user email under the <saml2:Subject> tag is the same as the logged-in user
Make sure that under the <saml2:AttributeStatement> tag, there is an Attribute named email (lowercase). This attribute is mandatory.
If other, optional user attributes (groups, firstName, lastName, uid, gid) are mapped make sure they also exist under <saml2:AttributeStatement> along with their respective values.
Overrides the DNS for Keycloak. This can be used to access access Keycloak externally to the cluster.
Open Credentials → Reset password
Set the new password and click Save
Update the keycloakx.adminPassword value using the helm upgrade command to match the password you set in the Keycloak UI
grafana.dbPassword
Grafana database password
Password for the Grafana database user.
grafana.admin.existingSecret
Grafana admin default credentials (secret)
Existing secret name with authentication credentials.
grafana.adminUser
Grafana username
Override the NVIDIA Run:ai default user name for accessing Grafana.
grafana.adminPassword
Grafana password
Override the NVIDIA Run:ai default password for accessing Grafana.
NVIDIA Run:ai uses NGINX as the default ingress controller. If your cluster has a different ingress controller, you can configure the ingress class to be created by NVIDIA Run:ai.
global.ingress.tlsSecretName
TLS secret name
NVIDIA Run:ai requires the creation of a secret with domain certificate. If the runai-backend namespace already had such a secret, you can set the secret name here
Set NVIDIA Run:ai and 3rd party services' resources
disableIstioSidecarInjection.enabled
Disable Istio sidecar injection
Disable the automatic injection of Istio sidecars across the entire NVIDIA Run:ai Control Plane services.
global.affinity
System nodes
Sets the system nodes where the NVIDIA Run:ai control plane services are scheduled.
global.customCA.enabled
Certificate authority
Enables the use of a custom Certificate Authority (CA) in your deployment. When set to true, the system is configured to trust a user-provided CA certificate for secure communication.
postgresql.enabled
PostgreSQL installation
If set to false, PostgreSQL will not be installed.
global.postgresql.auth.host
PostgreSQL host
Hostname or IP address of the PostgreSQL server.
thanos.receive.persistence.storageClass
Storage class
The installation is configured to work with a specific storage class instead of the default one.
keycloakx.adminUser
User name of the internal identity provider administrator
Defines the username for the Keycloak administrator. This can only be set during the initial installation.
keycloakx.adminPassword
Password of the internal identity provider administrator
Defines the password for the Keycloak administrator.
grafana.db.existingSecret
Grafana database connection credentials (secret)
Existing secret name with authentication credentials.
Specific workload-aware visibility, so that different pods are identified and treated as a single workload (for example GPU utilization, workload view, dashboards).
The amount of GPU memory per requested device that is granted to each pod of the workload that uses this compute resource
CPU memory request
The minimum amount of CPU memory per pod of the workload that uses this compute resource
CPU memory limit
The maximum amount of CPU memory per pod of the workload that uses this compute resource
CPU compute request
The minimum number of CPU cores per pod of the workload that uses this compute resource
CPU compute limit
The maximum number of CPU cores per pod of the workload that uses this compute resource
Scope
The of this compute resource within the organizational tree. Click the name of the scope to view the organizational tree diagram
Workload(s)
The list of workloads associated with the compute resource
Template(s)
The list of workload templates that use this compute resource
Created by
The name of the user who created the compute resource
Creation time
The timestamp of when the compute resource was created
Last updated
The timestamp of when the compute resource was last updated
Cluster
The cluster that the compute resource is associated with
Enter a name for the compute resource. The name must be unique.
Optional: Provide a description of the essence of the compute resource
Set the resource types needed within a single node
(the NVIDIA Run:ai scheduler tries to match a single node that complies with the compute resource for each of the workload's pods)
GPU
GPU devices per pod - The number of devices (physical GPUs) per pod. For example, if you requested 3 devices per pod and the running workload using this compute resource consists of 3 pods, there are 9 physical GPU devices used in total.
Note
When setting it to zero, the workload using this computer resource neither requests nor uses GPU resources while running.
You can set any number of GPU devices and specify the memory requirement to any portion size (1..100), or memory size value using GB or MB units per device.
GPU memory per device
Select the memory request format
% (of device) - Fraction of a GPU device's memory
MB (memory size) - An explicit GPU memory unit
CPU
CPU compute per pod
Select the units for the CPU compute (Cores / Millicores)
Optional: More settings
Increase shared memory size
When enabled, the shared memory size available to the pod is increased from the default 64MB to the node's total available memory or the CPU memory limit, if set above.
Set extended resource(s)
Click +EXTENDED RESOURCES to add resource/quantity pairs. For more information on how to set extended resources, see the Extended resources and Quantity guides
Click CREATE COMPUTE RESOURCE
Update the compute resource and click
CREATE COMPUTE RESOURCE
Compute resource
The name of the compute resource
Description
A description of the essence of the compute resource
GPU devices request per pod
The number of requested physical devices per pod of the workload that uses this compute resource
Workload
The workload that uses the compute resource
Type
Workspace/Training/Inference
Status
Represents the workload lifecycle. See the full list of workload status.
Compute Resource Table
Workloads Associated with the Compute Resource
Customizing the Table View
Adding a New Compute Resource
Note
It is also possible to add compute resources directly when creating a specific workspace, training or inference workloads.
Editing a Compute Resource
Note
The already bound workload that is using this asset will not be affected.
Copying a Compute Resource
Deleting a Compute Resource
Note
The already bound workload that is using this asset will not be affected.
The node pools associated with this department. By default, all node pools within a cluster are associated with each department. Administrators can change the node pools' quota parameters for a department. Click the values under this column to view the list of node pools with their parameters (as described below)
GPU quota
GPU quota associated with the department
Click one of the values of Node pool(s) with quota column, to view the list of node pools and their parameters
Column
Description
Node pool
The name of the node pool is given by the administrator during node pool creation. All clusters have a default node pool created automatically by the system and named 'default'.
GPU quota
The amount of GPU quota the administrator dedicated to the department for this node pool (floating number, e.g. 2.3 means 230% of a GPU capacity)
CPU (Cores)
The amount of CPU (cores) quota the administrator has dedicated to the department for this node pool (floating number, e.g. 1.3 Cores = 1300 mili-cores). The 'unlimited' value means the CPU (Cores) quota is not bound and workloads using this node pool can use as many CPU (Cores) resources as they need (if available)
Click one of the values of the Subject(s) column, to view the list of subjects and their parameters. This column is only viewable if your role in the NVIDIA Run:ai system affords you those permissions.
Column
Description
Subject
A user, SSO group, or application assigned with a role in the scope of this department
Type
The type of subject assigned to the access rule (user, SSO group, or application).
Scope
The scope of this department within the organizational tree. Click the name of the scope to view the organizational tree diagram, you can only view the parts of the organizational tree for which you have permission to view.
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
To create a new Department:
Click +NEW DEPARTMENT
Select a scope.
By default, the field contains the scope of the current UI context cluster, viewable at the top left side of your screen. You can change the current UI context cluster by clicking the 'Cluster: cluster-name' field and applying another cluster as the UI context. Alternatively, you can choose another cluster within the '+ New Department' form by clicking the organizational tree icon on the right side of the scope field, opening the organizational tree and selecting one of the available clusters.
Enter a name for the department. Department names must start with a letter and can only contain lower case latin letters, numbers or a hyphen ('-').
Under Quota Management, select a quota for the department. The Quota management section may contain different fields depending on pre-created system configuration. Possible system configurations are:
Existence of Node Pools
CPU Quota - Allow setting a quota for CPU resources.
When no node pools are configured, you can set the following quota parameters:
GPU Devices
The number of GPUs you want to allocate for this department (decimal number). This quota is consumed by the department's subordinated project.
CPUs (cores) (when CPU quota is set)
The number of CPU cores you want to allocate for this department (decimal number). This quota is consumed by the department's subordinated projects
CPUs memory (when CPU quota is set)
The amount of CPU memory you want to allocate for this department (in Megabytes or Gigabytes). This quota is consumed by the department's subordinated projects
When node pools are enabled, it is possible to set the above quota parameters for each node-pool separately.
In addition, you can decide whether to allow a department to go over quota. Allowing over quota at the department level means that one department can receive more resources than its quota when not required by other departments. If the over quota is disabled, workloads running under subordinated projects are not able to use more resources than the department's quota, but each project can still go over quota (if enabled at the project level) up to the department's quota.
Unlimited CPU(Cores) and CPU memory quotas are an exception - in this case, workloads of subordinated projects can consume available resources up to the physical limitation of the cluster or any of the node pools.
Example of Quota management:
Click CREATE DEPARTMENT
To create a new access rule for a department:
Select the department you want to add an access rule for
Click ACCESS RULES
Click +ACCESS RULE
Select a subject
Select or enter the subject identifier:
User Email for a local user created in NVIDIA Run:ai or for SSO user as recognized by the IDP
Group name as recognized by the IDP
Select a role
Click SAVE RULE
Click CLOSE
To delete an access rule from a department:
Select the department you want to remove an access rule from
Click ACCESS RULES
Find the access rule you would like to delete
Click on the trash icon
Click CLOSE
Select the Department you want to edit
Click EDIT
Update the Department and click SAVE
To view the policy of a department:
Select the department for which you want to view its policies.
This option is only active if the department has defined policies in place.
Click VIEW POLICY and select the workload type for which you want to view the policies:
a. Workspace workload type policy with its set of rules
b. Training workload type policies with its set of rules
In the Policy form, view the workload rules that are enforcing your department for the selected workload type as well as the defaults:
Parameter - The workload submission parameter that Rule and Default is applied on
Type (applicable for data sources only) - The data source type (Git, S3, nfs, pvc etc.)
Default - The default value of the Parameter
Rule - Set up constraints on workload policy fields
Source - The origin of the applied policy (cluster, department or project)
Select the department you want to delete
Click DELETE
On the dialog, click DELETE to confirm the deletion
Select the department you want to review
Click REVIEW
Review and click CLOSE
To view the available actions, go to the Departments API reference.
Departments Table
Note
Departments are disabled, by default. If you cannot see Departments in the menu, then it must be enabled by your Administrator, under General settings → Resources → Departments
Node Pools with Quota Associated with the Department
Subjects Authorized for the Project
Note
A role given in a certain scope, means the role applies to this scope and any descendant scopes in the organizational tree.
Customizing the Table View
Adding a New Department
Adding an Access Rule to a Department
Deleting an Access Rule from a Department
Editing a Department
Viewing a Department's Policy
Note
The policy affecting the department consists of rules and defaults. Some of these rules and defaults may be derived from the policies of a parent cluster (source). You can see the source of each rule in the policy form.
A policy set for a department affects all subordinated projects and their workloads, according to the policy workload type
Deleting a Department
Note
Deleting a department permanently deletes its subordinated projects, any assets created in the scope of this department, and any of its subordinated projects such as compute resources, environments, data sources, templates, and credentials. However, workloads running within the department's subordinated projects, or the policies defined for this department or its subordinated projects - remain intact and running.
Reviewing a Department
Using API
The project has an assigned quota of at least 0.5 GPU.
Dynamic GPU fractions is enabled.
Browse to the provided NVIDIA Run:ai user interface and log in with your credentials.
Run the below --help command to obtain the login options and log in according to your setup:
runailogin--help
To use the API, you will need to obtain a token as shown in API authentication.
Go to the Workload manager → Workloads
Click +NEW WORKLOAD and select Workspace
Select under which cluster to create the workload
Select the project in which your workspace will run
Select Start from scratch to launch a new workspace quickly
Enter a name for the workspace (if the name already exists in the project, you will be requested to submit a different name)
Click CONTINUE
In the next step:
Create an environment for your workspace
Click +NEW ENVIRONMENT
Enter a name for the environment. The name must be unique.
Create a new “request-limit” compute resource
Click +NEW COMPUTE RESOURCE
Enter a name for the compute resource. The name must be unique.
Click CREATE WORKSPACE
Copy the following command to your terminal. Make sure to update the below with the name of your project and workload. For more details, see :
Copy the following command to your terminal. Make sure to update the below parameters. For more details, see API:
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Go to the Workload manager → Workloads
Click +NEW WORKLOAD and select Workspace
Select the cluster where the previous workspace was created
Select the project where the previous workspace was created
Select Start from scratch to launch a new workspace quickly
Enter a name for the workspace (if the name already exists in the project, you will be requested to submit a different name)
Click CONTINUE
In the next step:
Select the environment created in
Select the compute resource created in
Click CREATE WORKSPACE
Copy the following command to your terminal. Make sure to update the below with the name of your project and workload. For more details, see :
Copy the following command to your terminal. Make sure to update the below parameters. For more details, see API:
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Select the newly created workspace with the Jupyter application that you want to connect to
Click CONNECT
Select the Jupyter tool. The selected tool is opened in a new tab on your browser.
Open a terminal and use the watch nvidia-smi to get a constant reading of the memory consumed by the pod. Note that the number shown in the memory box is the Limit and not the Request or Guarantee.
Open the file Untitled.ipynb and move the frame so you can see both tabs
Execute both cells in Untitled.ipynb. This will consume about 3 GB of GPU memory and be well below the 4GB of the GPU Memory Request value.
In the second cell, edit the value after --image-size from 100 to 200 and run the cell. This will increase the GPU memory utilization to about 11.5 GB which is above the Request value.
To connect to the Jupyter Notebook, browse directly to https://<COMPANY-URL>/<PROJECT-NAME>/<WORKLOAD-NAME>
Open a terminal and use the watch nvidia-smi to get a constant reading of the memory consumed by the pod. Note that the number shown in the memory box is the Limit and not the Request or Guarantee.
Open the file Untitled.ipynb
To connect to the Jupyter Notebook, browse directly to https://<COMPANY-URL>/<PROJECT-NAME>/<WORKLOAD-NAME>
Open a terminal and use the watch nvidia-smi to get a constant reading of the memory consumed by the pod. Note that the number shown in the memory box is the Limit and not the Request or Guarantee.
Open the file Untitled.ipynb
Manage and monitor your newly created workload using the Workloads table.
Dynamic GPU fractions is disabled by default in the NVIDIA Run:ai UI. To use dynamic GPU fractions, it must be enabled by your Administrator, under General Settings → Resources → GPU resource optimization.
The NVIDIA Run:ai v2.20 What's new provides a detailed summary of the latest features, enhancements, and updates introduced in this version. They serve as a guide to help users, administrators, and researchers understand the new capabilities and how to leverage them for improved workload management, resource optimization, and more.
Important
For a complete list of deprecations, see . Deprecated features and capabilities will be available for two versions ahead of the notification.
AI Practitioners
Workloads - Workspaces and Training
Stop/run actions for distributed workloads - You can now stop and run distributed workloads from the UI, CLI, and API. Scheduling rules for training workloads also apply to distributed workloads. This enhances control over distributed workloads, enabling greater flexibility and resource management. From cluster v2.20 onward
Visibility into idle GPU devices - Idle GPU devices are now displayed in the UI and API showing the number of allocated GPU devices that have been idle for more than 5 minutes. This provides better visibility into resource utilization, enabling more efficient workload management.
Configurable workload completion with multiple runs - You can now define the number of runs a training workload must complete to be considered finished directly in the UI, API, and CLI v2. Running training workloads multiple times improves the reliability and validity of training results. Additionally, you can configure how many runs can be scheduled in parallel, helping to significantly reduce training time and simplifying the process of managing jobs that require multiple runs. See for more details. From cluster v2.20 onward
Configurable grace period for workload preemption - You can now set a grace period in the UI, API and CLI v2 providing a buffer time for preempted workloads to reach a safe checkpoint before being forcibly preempted for and training workloads. The grace period can be configured between 0 seconds and 5 minutes. This aims to minimize data loss and avoid unnecessary retraining, ensuring the latest checkpoints are saved. From cluster v2.20 onward
Pod deletion policy for terminal workloads - You can now specify which pods should be deleted when a distributed workload reaches a terminal state (completed/failed) using cleanPodPolicy in CLI v2 and API. This enhancement provides greater control over resource cleanup and helps maintain a more organized and efficient cluster environment. See for more details.
Instructions for environment variables - You can now add instructions to environment variables when creating new environments via the UI and API. In addition, NVIDIA Run:ai's environments now include default instructions. Adding instructions provides guidance enabling anyone using the environment to set the environment variable values correctly. From cluster v2.20 onward
Enhanced environments and compute resource management - The action bar now contains "Make a Copy" and "Edit" while the "Rename" option has been removed. A new "Last Updated" column has also been added for easier tracking of asset modifications. From cluster v2.20 onward
User applications for API authentication - You can now create your own applications for API integrations with NVIDIA Run:ai. Each application includes client credentials which can be used to obtain an authentication token to utilize for subsequent API calls. See for more details. From cluster v2.20 onward
Support for multiple fractional GPUs in a single workload - NVIDIA Run:ai now supports submitting workloads that utilize multiple fractional GPUs within a single workload using the UI and CLI. This feature enhances GPU utilization, increases scheduling probability in shorter timeframes, and allows workloads to consume only the memory they need. It maximizes quota usage and enables more workloads to share the same GPUs effectively. See and for more details. Beta for Dynamic FractionsFrom cluster v2.20 onward
Support for GPU memory swap with multiple GPUs per workload - NVIDIA Run:ai now supports GPU memory swap for workloads utilizing multiple GPUs. By leveraging GPU memory swap, you can maximize GPU utilization and serve more workloads using the same hardware. The swap scheduler on each node ensures that all GPUs of a distributed model run simultaneously, maintaining synchronization across GPUs. Workload configurations combine swap settings with multi-GPU dynamic fractions, providing flexibility and efficiency for managing large-scale workloads. See
Support for Windows OS - CLI v2 now supports Windows operating systems, enabling you to leverage the full capabilities of the CLI. From cluster v2.18 onward
Unified training command structure - Unified the distributed command into the training command to align with the NVIDIA Run:ai UI. The training command now includes a new sub-command to support distributed workloads, ensuring a more consistent and streamlined user experience across both the CLI v2 and UI.
Enhanced visibility into rolling updates for inference workloads - NVIDIA Run:ai now provides a phase message that provides detailed insights into the current state of the update, by hovering over the workload's status. This helps users to monitor and manage updates more effectively. See for more details. From cluster v2.20 onward
Inference serving endpoint configuration - You can now define an inference serving endpoint directly within the environment using the NVIDIA Run:ai UI. From cluster v2.19 onward
New Reports view for analytics - The new Reports enables generating and organizing large data in a structured, CSV-formatted layout. With this feature, you can monitor resource consumption, identify trends, and make informed decisions to optimize their AI workloads with greater efficiency. From cluster v2.20 onward
Client credentials for applications - Applications now use client credentials - Client ID and Client secret - to obtain an authentication token, aligned with . See for more details. From cluster v2.20 onward
Enhanced metric graphs for node pools - Enhanced metric graphs in the DETAILS tab for node pools by aligning these graphs with the dashboard and the node pools API. As part of this improvement, the following columns have been removed from the .
Node GPU Allocation
GPU Utilization Distribution
Enhanced project deletion - Deleting a will now attempt to delete the project's associated workloads and assets, allowing better management of your organization's assets. From cluster v2.20 onward
Enhanced resource prioritization for projects and departments - NVIDIA Run:ai has introduced advanced prioritization capabilities to manage resources between projects or between departments more effectively using the and APIs. From cluster v2.20 onward
This feature allows administrators to:
Added policy-based default field values - Administrators can now set default values for fields that are automatically calculated based on the values of other fields using . This ensures that critical fields in the workload submission form are populated automatically if not provided by the user. From cluster v2.20 onward
This feature supports various field types:
Integer fields (e.g., cpuCoresRequest),
Improved control over data source and storage class visibility - NVIDIA Run:ai now provides administrators with the ability to control the visibility of data source types and storage in the UI. Data source types that are restricted by policy will no longer appear during workload submission or when creating new data source assets. Additionally, administrators can configure storage classes as internal using the Storage class configuration API. From cluster v2.20 onward
Added email notifications API - Email notifications can now be configured via API in addition to the UI, enabling integration with external tools. See API for more details.
Support for ARM-Based Grace-Hopper Superchip (GH200) - NVIDIA Run:ai now supports the ARM-based Grace-Hopper Superchip (GH200). Due to a limitation in version 2.20 with ARM64, the NVIDIA Run:ai control plane services must be scheduled on non-ARM based CPU nodes. This limitation will be addressed in a future release. See for more details. From cluster v2.20 onward
NVIDIA Run:ai now supports Kubernetes version 1.32.
NVIDIA Run:ai now supports OpenShift version 4.17.
Kubernetes version 1.28 is no longer supported.
OpenShift versions 4.12 to 4.13 are no longer supported.
Exclude nodes in mixed node clusters - NVIDIA Run:ai now allows you to exclude specific nodes in a mixed node cluster using the nodeSelectorTerms flag. See for more details. From cluster v2.20 onward
Advanced configuration options for cluster services - Introduced new cluster configuration options for setting node affinity and tolerations for NVIDIA Run:ai cluster services. These configuration ensure that the NVIDIA Run:ai cluster services are scheduled on the desired nodes. See for more details. From cluster v2.20 onward
Added two new NVIDIA Run:ai built-in alerts for Kubernetes nodes hosting GPU workloads. The notifies when the node's health and readiness cannot be determined, and the warns when the node has insufficient memory to support current or upcoming workloads. From cluster v2.20 onward
Additional metrics and telemetry are available via the API. For more details, see :
Metrics (over time)
Project
The Dynamic MIG deprecation process started in version 2.19. NVIDIA Run:ai supports standard MIG profiles as detailed in .
Before upgrading to version 2.20, workloads submitted with Dynamic MIG and their associated node configurations must be removed
In version 2.20, MIG was removed from the NVIDIA Run:ai UI under compute resources.
In Q2/25 all 'Dynamic MIG' APIs and CLI commands will be fully deprecated. (it will fail)
CLI V1 is deprecated and no new features will be developed for it. It will remain available for use for the next two releases to ensure a smooth transition for all users. We recommend switching to CLI v2, which provides feature parity, backwards compatibility, and ongoing support for new enhancements. CLI v2 is designed to deliver a more robust, efficient, and user-friendly experience.
Starting with version 2.20, the legacy Jobs view will be discontinued in favor of the more advanced Workloads view. The legacy submission form will still be accessible via the Workload manager view for a smoother transition.
Deprecating appID and appSecret parameters used for . It will remain available for use for the next two releases. To create application tokens, use your client credentials - Client ID and Client secret.
Policy YAML Examples
This article provides examples of:
Creating a new rule within a policy
Best practices for adding sections to a policy
A full example of a whole policy
Creating a New Rule Within a Policy
This example shows how to add a new limitation to the GPU usage for workloads of type workspace:
Check the fields documentation and select the field(s) that are most relevant for GPU usage.
Search the field in the . For example, gpuDevicesRequest appears under the Compute fields sub-table and appears as follow:
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Use the value type of the gpuDevicesRequest field indicated in the table - "integer" and navigate to the Value types table to view the possible rules that can be applied to this value type -
for integer, the options are:
canEdit
required
Node Pools
This section explains the procedure for managing Node pools.
Node pools assist in managing heterogeneous resources effectively. A node pool is a NVIDIA Run:ai construct representing a set of nodes grouped into a bucket of resources using a predefined node label (e.g. NVIDIA GPU type) or an administrator-defined node label (any key/value pair).
Typically, the grouped nodes share a common feature or property, such as GPU type or other HW capability (such as Infiniband connectivity), or represent a proximity group (i.e. nodes interconnected via a local ultra-fast switch). Researchers and ML Engineers would typically use node pools to run specific workloads on specific resource types.
In the NVIDIA Run:ai Platform a user with the System administrator role can create, view, edit, and delete node pools. Creating a new node pool creates a new instance of the NVIDIA Run:ai Scheduler. Workloads submitted to a node pool are scheduled using the node pool's designated scheduler instance.
Once created, the new node pool is automatically assigned to all projects and departments with a quota of zero GPU resources, unlimited CPU resources, and over quota enabled (medium weight if over quota weight is enabled). This allows any project and department to use any node pool when over quota is enabled, even if the administrator has not assigned a quota for a specific node pool within that project or department.
When submitting a new , users can add a prioritized list of node pools. The node pool selector picks one node pool at a time (according to the prioritized list) and the designated node pool scheduler instance handles the submission request and tries to match the requested resources within that node pool. If the scheduler cannot find resources to satisfy the submitted workload, the node pool selector moves the request to the next node pool in the prioritized list, if no node pool satisfies the request, the node pool selector starts from the first node pool again until one of the node pools satisfies the request.
The Node pools table can be found under Resources in the NVIDIA Run:ai platform.
The Node pools table lists all the node pools defined in the NVIDIA Run:ai platform and allows you to manage them.
The Node pools table consists of the following columns:
Column
Description
Click one of the values in the Workload(s) column, to view the list of workloads and their parameters.
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Select a row in the Node pools table and then click Show details in the upper-right corner of the action bar. The details window appears, presenting metrics graphs for the whole node pool:
Node GPU allocation - This graph shows an overall sum of the Allocated, Unallocated, and Total number of GPUs for this node pool, over time. From observing this graph, you can learn about the occupancy of GPUs in this node pool, over time.
GPU Utilization Distribution - This graph shows the distribution of GPU utilization in this node pool over time. Observing this graph, you can learn how many GPUs are utilized up to 25%, 25%-50%, 50%-75%, and 75%-100%. This information helps to understand how many available resources you have in this node pool, and how well those resources are utilized by comparing the allocation graph to the utilization graphs, over time.
GPU Utilization - This graph shows the average GPU utilization in this node pool over time. Comparing this graph with the GPU Utilization Distribution helps to understand the actual distribution of GPU occupancy over time.
To create a new node pool:
Click +NEW NODE POOL
Enter a name for the node pool.
Node pools names must start with a letter and can only contain lowercase Latin letters, numbers or a hyphen ('-')
Enter the node pool label:
The node pool controller will use this node-label key-value pair to match nodes into this node pool.
The administrator can use a preset node label, such as the nvidia.com/gpu.product that labels the GPU type, or configure any other node label (e.g. faculty=physics).
To assign a label to nodes you want to group into a node pool, set a node label on each node:
Obtain the list of nodes and their current labels by copying the following to your terminal:
Annotate a specific node with a new label by copying the following to your terminal:
Most cloud providers allow you to configure node labels at the node pool level. You can apply labels when creating a cluster, creating a node pool, or by editing an existing node pool.
Ensure that each node is labeled using the Kubernetes label format. This label ensures that workloads are scheduled correctly based on node pool definitions:
Refer to the provider-specific documentation below for guidance on how to configure node pool labels:
Select the node pool you want to edit
Click EDIT
Update the node pool and click SAVE
Select the node pool you want to delete
Click DELETE
On the dialog, click DELETE to confirm the deletion
To view the available actions, go to the API reference.
Clusters
This section explains the procedure to view and manage Clusters.
The Cluster table provides a quick and easy way to see the status of your cluster.
The Clusters table can be found under Resources in the NVIDIA Run:ai platform.
The clusters table provides a list of the clusters added to NVIDIA Run:ai platform, along with their status.
The clusters table consists of the following columns:
Column
Credentials
This section explains what credentials are and how to create and use them.
Credentials are that simplify the complexities of Kubernetes secrets. They consist of and mask sensitive access information, such as passwords, tokens, and access keys, which are necessary for gaining access to various resources.
Credentials are crucial for the security of AI workloads and the resources they require, as they restrict access to authorized users, verify identities, and ensure secure interactions. By enforcing the protection of sensitive data, credentials help organizations comply with industry regulations, fostering a secure environment overall.
Essentially, credentials enable AI practitioners to access relevant protected resources, such as private data sources and Docker images, thereby streamlining the workload submission process.
The Credentials table can be found under Workload manager in the NVIDIA Run:ai User interface.
The Credentials table provides a list of all the credentials defined in the platform and allows you to manage them.
Environments
This section explains what environments are and how to create and use them.
Environments are one type of . An environment consists of a configuration that simplifies how workloads are submitted and can be used by AI practitioners when they submit their workloads.
An environment asset is a preconfigured building block that encapsulates aspects for the workload such as:
The sum of all projects' GPU quotas associated with this department
Project(s)
List of projects associated with this department
Subject(s)
The users, SSO groups, or applications with access to the project. Click the values under this column to view the list of subjects with their parameters (as described below). This column is only viewable if your role in NVIDIA Run:ai platform allows you those permissions.
Allocated GPUs
The total number of GPUs allocated by successfully scheduled workloads in projects associated with this department
GPU allocation ratio
The ratio of Allocated GPUs to GPU quota. This number reflects how well the department's GPU quota is utilized by its descendant projects. A number higher than 100% means the department is using over quota GPUs. A number lower than 100% means not all projects are utilizing their quotas. A quota becomes allocated once a workload is successfully scheduled.
Creation time
The timestamp for when the department was created
Workload(s)
The list of workloads under projects associated with this department. Click the values under this column to view the list of workloads with their resource parameters (as described below)
Cluster
The cluster that the department is associated with
CPU memory
The amount of CPU memory quota the administrator has dedicated to the department for this node pool (floating number, in MB or GB). The 'unlimited' value means the CPU memory quota is not bounded and workloads using this node pool can use as much CPU memory resource as they need (if available).
Allocated GPUs
The total amount of GPUs allocated by workloads using this node pool under projects associated with this department. The number of allocated GPUs may temporarily surpass the GPU quota of the department if over quota is used.
Allocated CPU (Cores)
The total amount of CPUs (cores) allocated by workloads using this node pool under all projects associated with this department. The number of allocated CPUs (cores) may temporarily surpass the CPUs (Cores) quota of the department if over quota is used.
Allocated CPU memory
The actual amount of CPU memory allocated by workloads using this node pool under all projects associated with this department. The number of Allocated CPU memory may temporarily surpass the CPU memory quota if over quota is used.
Role
The role assigned to the subject, in this department's scope
Authorized by
The user who granted the access rule
Last updated
The last time the access rule was updated
GB (memory size) - An explicit GPU memory unit
Set the memory Request - The minimum amount of GPU memory that is provisioned per device. This means that any pod of a running workload that uses this compute resource, receives this amount of GPU memory for each device(s) the pod utilizes
Optional: Set the memory Limit - The maximum amount of GPU memory that is provisioned per device. This means that any pod of a running workload that uses this compute resource, receives at most this amount of GPU memory for each device(s) the pod utilizes. To set a Limit, first enable the limit toggle. The limit value must be equal to or higher than the request.
Note
GPU memory limit is disabled by default. If you cannot see Limit in the compute resource form, then it must be enabled by your Administrator, under General settings → Resources → GPU resource optimization.
When a Limit
Set the CPU compute Request - The minimum amount of CPU compute that is provisioned per pod. This means that any pod of a running workload that uses this compute resource, receives this amount of CPU compute for each pod.
Optional: Set the CPU compute Limit - The maximum amount of CPU compute that is provisioned per pod. This means that any pod of a running workload that uses this compute resource, receives at most this amount of CPU compute. To set a Limit, first enable the limit toggle. The limit value must be equal to or higher than the request. By default, the limit is set to “Unlimited” - which means the pod may consume all the node's free CPU compute resources.
CPU memory per pod
Select the units for the CPU memory (MB / GB)
Set the CPU memory Request - The minimum amount of CPU memory that is provisioned per pod. This means that any pod of a running workload that uses this compute resource, receives this amount of CPU memory for each pod.
Optional: Set the CPU memory Limit - The maximum amount of CPU memory that is provisioned per pod. This means that any pod of a running workload that uses this compute resource, receives at most this amount of CPU memory. To set a Limit, first enable the limit toggle. The limit value must be equal to or higher than the request. By default, the limit is set to “Unlimited” which means the pod may consume all the node's free CPU memory resources.
Enter the Image URL - gcr.io/run-ai-lab/pytorch-example-jupyter
Tools - Set the connection for your tool
Click +TOOL
Select Jupyter tool from the list
Set the runtime settings for the environment
Click +COMMAND
Enter command - start-notebook.sh
Enter arguments - --NotebookApp.base_url=/${RUNAI_PROJECT}/${RUNAI_JOB_NAME} --NotebookApp.token=''
Note: If is enabled on the cluster, enter the --NotebookApp.token='' only.
Click CREATE ENVIRONMENT
The newly created environment will be selected automatically
Set GPU devices per pod - 1
Set GPU memory per device
Select GB- Fraction of a GPU device's memory
Set the memory Request - 4GB (the workload will allocate 4GB of the GPU memory)
Toggle Limit and set to 12
Optional: set the CPU compute per pod - 0.1 cores (default)
Optional: set the CPU memory per pod - 100 MB (default)
Select More settings and toggle Increase shared memory size
Click CREATE COMPUTE RESOURCE
The newly created compute resource will be selected automatically
<PROJECT-ID> - The ID of the Project the workload is running on. You can get the Project ID via the Get Projects API.
<CLUSTER-UUID> - The unique identifier of the Cluster. You can get the Cluster UUID via the Get Clusters API.
toolType will show the Jupyter icon when connecting to the Jupyter tool via the user interface.
toolName will show when connecting to the Jupyter tool via the user interface.
<PROJECT-ID> - The ID of the Project the workload is running on. You can get the Project ID via the Get Projects API.
<CLUSTER-UUID> - The unique identifier of the Cluster. You can get the Cluster UUID via the Get Clusters API.
toolType will show the Jupyter icon when connecting to the Jupyter tool via the user interface.
toolName will show when connecting to the Jupyter tool via the user interface.
and move the frame so you can see both tabs
Execute both cells in Untitled.ipynb. This will consume about 3 GB of GPU memory and be well below the 4GB of the GPU Memory Request value.
In the second cell, edit the value after --image-size from 100 to 200 and run the cell. This will increase the GPU memory utilization to about 11.5 GB which is above the Request value.
and move the frame so you can see both tabs
Execute both cells in Untitled.ipynb. This will consume about 3 GB of GPU memory and be well below the 4GB of the GPU Memory Request value.
In the second cell, edit the value after --image-size from 100 to 200 and run the cell. This will increase the GPU memory utilization to about 11.5 GB which is above the Request value.
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Note
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Enhanced data sources and credentials tables - Added a new "Kubernetes name" column to data sources and credentials tables for visibility into Kubernetes resource associations. The credentials table now includes an "Environments" column displaying the environments associated with the credential. From cluster v2.20 onward
. BetaFrom cluster v2.20 onward
New command for Kubernetes access - Added a new CLI v2 command, runai kubeconfig set, allowing users to set the kubeconfig file with NVIDIA Run:ai authorization token. This enhancement enables users to gain access to the Kubernetes cluster, simplifying authentication and integration with NVIDIA Run:ai-managed environments. For more details, see Add NVIDIA Run:ai authorization to kubeconfig.
Added view workload labels - You can now view the labels associated with a workload when using the CLI v2 runai workload describe command for all workload types. This enhancement provides better visibility into workload metadata.
Persistent token management for Hugging Face models - NVIDIA Run:ai allows users to save their Hugging Face tokens persistently as part of their credentials within the NVIDIA Run:ai UI. Once saved, tokens can be easily selected from a list of stored credentials, removing the need to manually enter them each time. This enhancement improves the process of deploying Hugging Face models, making it more efficient and user-friendly. See Deploy inference workloads from Hugging Face for more details. From cluster v2.13 onward
Deploy and manage NVIDIA NIM models in inference workloads - NVIDIA Run:ai now supports NVIDIA NIM models, enabling you to easily deploy and manage these models when submitting inference workloads. You can select a NIM model and leverage NVIDIA's hardware optimizations directly through the NVIDIA Run:ai UI. This feature also allows you to take advantage of NVIDIA Run:ai capabilities such as autoscaling and GPU fractioning. See Deploy inference workloads with NVIDIA NIM for more details.
Customizable autoscaling plans for inference workloads - NVIDIA Run:ai allows advanced users practicing autoscaling for inference workloads to fine-tune their autoscaling plans using the Update inference spec API. This feature enables you to achieve optimal behavior to meet fluctuating request demands. ExperimentalFrom cluster v2.20 onward
GPU Utilization
GPU Memory Utilization
CPU Utilization
CPU Memory Utilization
Prioritize resource allocation and reclaim between different projects and departments.
Prioritize projects within the same department.
Set priorities per node-pool for both projects and departments.
Implement distinct SLAs by assigning strict priority levels to over-quota resources.
Updated over quota naming - Renamed over quota priority to over quota weight to reflect its actual functionality.
Number fields (e.g., gpuPortionRequest),
Quantity fields (e.g., gpuMemoryRequest)
global.affinity
global.tolerations
daemonSetsTolerations
Added Argo workflows auto-pod grouping - Introduced a new cluster configuration option, gangScheduleArgoWorkflow, to modify the default behavior for grouping ArgoWorkflow pods, allowing you to prevent pods from being grouped into a single pod-group. See Advanced cluster configurations for more details. Cluster v2.20 and v2.18
Added cloud auto-scaling for memory fractions - NVIDIA Run:ai now supports auto-scaling for workloads using memory fractions in cloud environments. Using gpuMemoryToFractionRatio configuration option allows a failed scheduling attempt for a memory fractions workload to create NVIDIA Run:ai scaling pods, triggering the auto-scaler. See Advanced cluster configurations for more details. From cluster v2.19 onward
Added stale gang eviction timeout for improved stability - NVIDIA Run:ai has introduced a default timeout of 60 seconds for gang eviction in gang scheduling workloads using defaultStalenessGracePeriod. This timeout allows both the workload controller and the scheduler sufficient time to remediate the workload, improving the stability of large training jobs. See Advanced cluster configurations for more details. From cluster v2.18 onward
Added custom labels for built-in alerts - Administrators can now add their own custom labels to the built-in alerts from Prometheus by setting spec.prometheus.additionalAlertLabels in their cluster. See Advanced cluster configurations for mode details. From cluster v2.20 onward
Enhanced configuration flexibility for cluster replica management - Administrators can now use the spec.global.replicaCount to manage replicas for NVIDIA Run:ai services. See See Advanced cluster configurations for more details. From cluster v2.20 onward
Proceed to the Rule Type table, select the required rule for the limitation of the field - for example "max" and use the examples syntax to indicate the maximum GPU device requested.
List of nodes included in this node pool. Click the field to view details (the details are in the article).
GPU devices
The total number of GPU devices installed into nodes included in this node pool. For example, a node pool that includes 12 nodes each with 8 GPU devices would show a total number of 96 GPU devices.
GPU memory
The total amount of GPU memory included in this node pool. The total amount of GPU memory installed in nodes included in this node pool. For example, a node pool that includes 12 nodes, each with 8 GPU devices, and each device with 80 GB of memory would show a total memory amount of 7.68 TB.
Allocated GPUs
The total allocation of GPU devices in units of GPUs (decimal number). For example, if 3 GPUs are 50% allocated, the field prints out the value 1.50. This value represents the portion of GPU memory consumed by all running pods using this node pool. 'Allocated GPUs' can be larger than 'Projects' GPU quota' if over quota is used by workloads, but not larger than GPU devices.
GPU resource optimization ratio
Shows the Node Level Scheduler mode.
CPUs (Cores)
The number of CPU cores installed on nodes included in this node
CPU memory
The total amount of CPU memory installed on nodes using this node pool
Allocated CPUs (Cores)
The total allocation of CPU compute in units of Cores (decimal number). This value represents the amount of CPU cores consumed by all running pods using this node pool. 'Allocated CPUs' can be larger than 'Projects' GPU quota' if over quota is used by workloads, but not larger than CPUs (Cores).
Allocated CPU memory
The total allocation of CPU memory in units of TB/GB/MB (decimal number). This value represents the amount of CPU memory consumed by all running pods using this node pool. 'Allocated CPUs' can be larger than 'Projects' CPU memory quota' if over quota is used by workloads, but not larger than CPU memory.
GPU placement strategy
Sets the Scheduler strategy for the assignment of pods requesting both GPU and CPU resources to nodes, which can be either Bin-pack or Spread. By default, Bin-Pack is used, but can be changed to Spread by editing the node pool. When set to Bin-pack the scheduler will try to fill nodes as much as possible before using empty or sparse nodes, when set to spread the scheduler will try to keep nodes as sparse as possible by spreading workloads across as many nodes as it succeeds.
CPU placement strategy
Sets the Scheduler strategy for the assignment of pods requesting only CPUresources to nodes, which can be either Bin-pack or Spread. By default, Bin-Pack is used, but can be changed to Spread by editing the node pool. When set to Bin-pack the scheduler will try to fill nodes as much as possible before using empty or sparse nodes, when set to spread the scheduler will try to keep nodes as sparse as possible by spreading workloads across as many nodes as it succeeds.
Last update
The date and time when the node pool was last updated
Creation time
The date and time when the node pool was created
Workload(s)
List of workloads running on nodes included in this node pool, click the field to view details (described below in this article)
Created by
The User or Application created this workload
Running/requested pods
The number of running pods out of the number of requested pods within this workload.
Creation time
The workload's creation date and time
Allocated GPU compute
The total amount of GPU compute allocated by this workload. A workload with 3 Pods, each allocating 0.5 GPU, will show a value of 1.5 GPUs for the workload.
Allocated GPU memory
The total amount of GPU memory allocated by this workload. A workload with 3 Pods, each allocating 20GB, will show a value of 60 GB for the workload.
Allocated CPU compute (cores)
The total amount of CPU compute allocated by this workload. A workload with 3 Pods, each allocating 0.5 Core, will show a value of 1.5 Cores for the workload.
Allocated CPU memory
The total amount of CPU memory allocated by this workload. A workload with 3 Pods, each allocating 5 GB of CPU memory, will show a value of 15 GB of CPU memory for the workload.
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
Show/Hide details - Click to view additional information on the selected row
GPU Memory Utilization - This graph shows the average GPU memory utilization in this node pool over time, for example an average of all nodes' GPU memory utilization over time.
CPU Utilization - This graph shows the average CPU utilization in this node pool over time, for example, an average of all nodes' CPU utilization over time.
CPU Memory Utilization - This graph shows the average CPU memory utilization in this node pool over time, for example an average of all nodes' CPU memory utilization over time.
Key is the unique identifier of a node label.
The key must fit the following regular expression: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?/?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$
The administrator can put an automatically preset label such as the nvidia.com/gpu.product that labels the GPU type or any other key from a node label.
Value is the value of that label identifier (key). The same key may have different values, in this case, they are
considered as different labels.
Value must fit the following regular expression: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
A node pool is defined by a single key-value pair. You must not use different labels that are set on the same node by
different node pools, this situation may lead to unexpected results.
Set the GPU placement strategy:
Bin-pack - Place as many workloads as possible in each GPU and node to use fewer resources and maximize GPU and node vacancy.
Spread Spread workloads across as many GPUs and nodes as possible to minimize the load and maximize the available resources per workload.
GPU workloads are workloads that request both GPU and CPU resources
Set the CPU placement strategy:
Bin-pack - Place as many workloads as possible in each CPU and node to use fewer resources and maximize CPU and node vacancy.
Spread - Spread workloads across as many CPUs and nodes as possible to minimize the load and maximize the available resources per workload.
CPU workloads are workloads that request purely CPU resources
Click CREATE NODE POOL
Node pool
The node pool name, set by the administrator during its creation (the node pool name cannot be changed after its creation).
Status
Node pool status. A 'Ready' status means the scheduler can use this node pool to schedule workloads. 'Empty' status means no nodes are currently included in that node pool.
Label key
Label value
The node pool controller will use this node-label key-value pair to match nodes into this node pool.
Workload
The name of the workload. If the workloads' type is one of the recognized types (for example: Pytorch, MPI, Jupyter, Ray, Spark, Kubeflow, and many more), an appropriate icon is printed.
Type
The NVIDIA Run:ai platform type of the workload - Workspace, Training, or Inference
Status
The state of the workload. The Workloads state is described in the NVIDIA Run:ai workloads section
kubectl get nodes --show-labels
kubectl label node <node-name> <key>=<value>
run.ai/type=<TYPE_VALUE>
Node Pools Table
Note
By default, the NVIDIA Run:ai platform includes a single node pool named 'default'. When no other node pool is defined, all existing and new nodes are associated with the 'default' node pool. When deleting a node pool, if no other node pool matches any of the nodes' labels, the node will be included in the default node pool.
Workloads Associated with the Node Pool
Note
This column is only viewable if your role in the NVIDIA Run:ai platform gives you read access to workloads, even if you are allowed to view workloads, you can only view the workloads within your allowed scope. This means, there might be more pods running on this node than appear in the list your are viewing.
Customizing the Table View
Show/Hide Details
Adding a New Node Pool
Labeling Nodes for Node Pool Grouping
Labeling Nodes via Cloud Providers
Editing a Node Pool
Deleting a Node Pool
Note
The default node pool cannot be deleted. When deleting a node pool, if no other node pool matches any of the nodes' labels, the node will be included in the default node pool.
A dialog appears: Make sure to carefully read the message before removing
Click REMOVE to confirm the removal.
Go to the Clusters API reference to view the available actions.
Before starting, make sure you have access to the Kubernetes cluster where NVIDIA Run:ai is deployed with the necessary permissions
Clusters Table
Cluster status
Customizing the Table View
Adding a New Cluster
Removing a Cluster
Using API
Troubleshooting
Troubleshooting Scenarios
Cluster disconnected
Description: When the cluster's status is 'disconnected', there is no communication from the cluster services reaching the NVIDIA Run:ai Platform. This may be due to networking issues or issues with NVIDIA Run:ai services.
Mitigation:
Check NVIDIA Run:ai's services status:
Cluster has service issues
Description: When a cluster's status is 'Has service issues`, it means that one or more NVIDIA Run:ai services running in the cluster are not available.
Mitigation:
Verify non-functioning services
Cluster is waiting to connect
Description: When the cluster's status is 'waiting to connect', it means that no communication from the cluster services reaches the NVIDIA Run:ai Platform. This may be due to networking issues or issues with NVIDIA Run:ai services.
Mitigation:
Check NVIDIA Run:ai's services status
Cluster is missing prerequisites
Description: When a cluster's status displays Missing prerequisites, it indicates that at least one of the Mandatory Prerequisites has not been fulfilled. In such cases, NVIDIA Run:ai services may not function properly.
Mitigation:
If you have ensured that all prerequisites are installed and the status still shows missing prerequisites, follow these steps:
The Credentials table comprises the following columns:
Column
Description
Credential
The name of the credential
Description
A description of the credential
Type
The type of credential, e.g., Docker registry
The following table describes the credentials' condition and whether they were created successfully for the selected scope.
Status
Description
No issues found
No issues were found while creating the credential (this status may change while propagating the credential to the selected scope)
Issues found
Issues found while propagating the credential
Issues found
Failed to access the cluster
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Download table - Click MORE and then click 'Download as CSV'. Export to CSV is limited to 20,000 rows.
Refresh - Click REFRESH to update the table with the latest data
These credentials allow users to authenticate and pull images from a Docker registry, enabling access to containerized applications and services.
After creating the credential, it is used automatically when pulling images.
Select a .
Access key
These credentials are unique identifiers used to authenticate and authorize access to cloud services or APIs, ensuring secure communication between applications. They typically consist of two parts:
An access key ID
A secret access key
Username & password
These credentials require a username and corresponding password to access various resources, ensuring that only authorized users can log in.
The purpose of this credential type is to allow access to restricted data.
Select a
Generic secret
These credentials are a flexible option that consists of multiple keys & values and can store various sensitive information, such as API keys or configuration data, to be used securely within applications.
The purpose of this credential type is to allow access to restricted data.
Select a
Editing a Credential
Deleting a Credential
Note
Credentials cannot be deleted if they are being used by a workload and template.
Using Credentials
Access Private Data Sources
Use Directly Within the Container
Creating Secrets in Advance
Cluster Scope
Department Scope
Project Scope
Using API
The type of workload it serves
The Environments table can be found under Workload manager in the NVIDIA Run:ai platform.
The Environment table provides a list of all the environment defined in the platform and allows you to manage them.
The Environments table consists of the following columns:
Column
Description
Environment
The name of the environment
Description
A description of the environment
Scope
The of this environment within the organizational tree. Click the name of the scope to view the organizational tree diagram
Click one of the values in the tools column to view the list of tools and their connection type.
Column
Description
Tool name
The name of the tool or application AI practitioner can set up within the environment. For more information, see .
Connection type
The method by which you can access and interact with the running workload. It's essentially the "doorway" through which you can reach and use the tools the workload provide. (E.g node port, external URL, etc)
Click one of the values in the Workload(s) column to view the list of workloads and their parameters.
Column
Description
Workload
The workload that uses the environment
Type
The workload type (Workspace/Training/Inference)
Status
Represents the workload lifecycle. See the full list of )
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
When installing NVIDIA Run:ai, you automatically get the environments created by NVIDIA Run:ai to ease up the onboarding process and support different use cases out of the box.
These environments are created at the scope of the account.
Enter a name for the environment. The name must be unique.
Optional: Provide a description of the essence of the environment
Enter the Image URL
If a token or secret is required to pull the image, it is possible to create it via . These credentials are automatically used once the image is pulled (which happens when the workload is submitted)
Set the image pull policy - the condition for when to pull the image from the registry
Set the workload architecture:
Standard
Only standard workloads can use the environment. A standard workload consists of a single process.
Distributed
Only distributed workloads can use the environment. A distributed workload consists of multiple processes working together. These processes can run on different nodes.
Set the workload type:
Workspace
Training
Inference
Optional: Set the connection for your tool(s). The tools must be configured in the image. When submitting a workload using the environment, it is possible to connect to these tools
Select the tool from the list (the available tools varies from IDE, experiment tracking, and more, including a custom tool for your choice)
Select the connection type
Optional: Set a command and arguments for the container running the pod
When no command is added, the default command of the image is used (the image entrypoint)
The command can be modified while submitting a workload using the environment
Optional: Set the environment variable(s)
Click +ENVIRONMENT VARIABLE
Enter a name
Optional: Set the container's working directory to define where the container's process starts running. When left empty, the default directory is used.
Optional: Set where the UID, GID and supplementary groups are taken from, this can be:
From the image
From the IdP token (only available in an SSO installations)
Optional: Select Linux capabilities - Grant certain privileges to a container without granting all the privileges of the root user.
Click CREATE ENVIRONMENT
To edit an environment:
Select the environment you want to edit
Click Edit
Click SAVE ENVIRONMENT
To copy an existing environment:
Select the environment you want to copy
Click MAKE A COPY
Enter a name for the environment. The name must be unique.
Update the environment and click CREATE ENVIRONMENT
To delete an environment:
Select the environment you want to delete
Click DELETE
On the dialog, click DELETE to confirm
Go to the Environment API reference to view the available actions.
It is also possible to add environments directly when creating a specific , or workloads.
Editing an Environment
Note
The already bound workload that is using this asset will not be affected.
llm-server and chatbot-ui environments cannot be edited.
Copying an Environment
Deleting an Environment
Note
The already bound workload that is using this asset will not be affected.
Using API
Advanced Cluster Configurations
Advanced cluster configurations can be used to tailor your NVIDIA Run:ai cluster deployment to meet specific operational requirements and optimize resource management. By fine-tuning these settings, you can enhance functionality, ensure compatibility with organizational policies, and achieve better control over your cluster environment. This article provides guidance on implementing and managing these configurations to adapt the NVIDIA Run:ai cluster to your unique needs.
After the NVIDIA Run:ai cluster is installed, you can adjust various settings to better align with your organization's operational needs and security requirements.
Modify Cluster Configurations
Advanced cluster configurations in NVIDIA Run:ai are managed through the runaiconfigKubernetes Custom Resource. To edit the cluster configurations, run:
kubectl edit runaiconfig runai -n runai
To see the full runaiconfig object structure, use:
kubectl get crds/runaiconfigs.run.ai -n runai -o yaml
Configurations
The following configurations allow you to enable or disable features, control permissions, and customize the behavior of your NVIDIA Run:ai cluster:
Key
Description
NVIDIA Run:ai cluster includes many different services. To simplify resource management, the configuration structure allows you to configure the containers CPU / memory resources for each service individually or group of services together.
Service Group
Description
NVIDIA Run:ai containers
Apply the following configuration in order to change resources request and limit for a group of services:
Or, apply the following configuration in order to change resources request and limit for each service individually:
For resource recommendations, see .
By default, all NVIDIA Run:ai containers are deployed with a single replica. Some services support multiple replicas for redundancy and performance.
To simplify configuring replicas, a global replicas configuration can be set and is applied to all supported services:
This can be overwritten for specific services (if supported). Services without the replicas configuration does not support replicas:
The Prometheus instance in NVIDIA Run:ai is used for metrics collection and alerting.
The configuration scheme follows the official and supports additional custom configurations. The PrometheusSpec schema is available using the spec.prometheus.spec configuration.
A common use case using the PrometheusSpec is for metrics retention. This prevents metrics loss during potential connectivity issues and can be achieved by configuring local temporary metrics retention. For more information, see :
In addition to the PrometheusSpec schema, some custom NVIDIA Run:ai configurations are also available:
Additional labels – Set additional labels for NVIDIA Run:ai's sent by Prometheus.
Log level configuration – Configure the logLevel setting for the Prometheus container.
To include or exclude specific nodes from running workloads within a cluster managed by NVIDIA Run:ai, use the nodeSelectorTerms flag. For additional details, see .
Label the nodes using the below:
key: Label key (e.g., zone, instance-type).
operator: Operator defining the inclusion/exclusion condition (In, NotIn, Exists, DoesNotExist).
values: List of values for the key when using In or NotIn.
The below example shows how to include NVIDIA GPUs only and exclude all other GPU types in a cluster with mixed nodes, based on product type GPU label:
For air-gapped environments, when working with a , it is required to replace the default sidecar images in order to use the Git and S3 data source integrations. Use the following configurations:
Over Quota, Fairness and Preemption
This quick start provides a step-by-step walkthrough of the core scheduling concepts - , , and . It demonstrates the simplicity of resource provisioning and how the system eliminates bottlenecks by allowing users or teams to exceed their resource quota when free GPUs are available.
Over quota - In this scenario, team-a runs two training workloads and team-b runs one. Team-a has a quota of 3 GPUs and is over quota by 1 GPU, while team-b has a quota of 1 GPU. The system allows this over quota usage as long as there are available GPUs in the cluster.
Fairness and preemption - Since the cluster is already at full capacity, when team-b launches a new b2 workload requiring 1 GPU , team-a can no longer remain over quota. To maintain fairness, the preempts workload a1 (1 GPU), freeing up resources for team-b.
MEMORY_QUOTA
GPU_ALLOCATION
CPU_ALLOCATION
MEMORY_ALLOCATION
GPU_ALLOCATION_NON_PREEMPTIBLE
CPU_ALLOCATION_NON_PREEMPTIBLE
MEMORY_ALLOCATION_NON_PREEMPTIBLE
is set and is bigger than the
Request
, the Scheduler allows each pod to reach the maximum amount of GPU memory in an opportunistic manner (only upon availability).
If the GPU memory Limit is bigger that the Request, the pod is prone to be killed by the NVIDIA Run:ai toolkit (out of memory signal). The greater the difference between the GPU memory used and the request, the higher the risk of being killed.
If GPU resource optimization is turned off, the minimum and maximum are in fact equal.
Note
If the CPU Memory Limit is bigger that the Request, the pod is prone to be killed by the operating system (out of memory signal). The greater the difference between the CPU memory used and the request, the higher the risk of being killed.
NVIDIA Run:ai uses NGINX as the default ingress controller. If your cluster has a different ingress controller, you can configure the ingress class to be created by NVIDIA Run:ai.
spec.global.subdomainSupport(boolean)
Allows the creation of subdomains for ingress endpoints, enabling access to workloads via unique subdomains on the . For details, see .
Default: false
Prevents users within the same project from deleting workloads created by others. This enhances workload ownership security and ensures better collaboration by restricting unauthorized modifications or deletions.
Default: false
spec.project-controller.createNamespaces(boolean)
Allows Kubernetes namespace creation for new projects
Default: true
A scaling-pod requesting a single GPU device will be created for every 1 to 10 pods requesting fractional GPU memory (1/gpuMemoryToFractionRatio). This value represents the ratio (0.1-0.9) of fractional GPU memory (any size) to GPU fraction (portion) conversion.
Default: 0.1
Sets a default memory limit based on the number of GPUs requested when no memory limit is specified
Default: NO DEFAULT
WorkloadServices
Containers associated with submitting NVIDIA Run:ai workloads
WorkloadController,
JobController
spec.global.affinity(object)
Sets the system nodes where NVIDIA Run:ai system-level services are scheduled. Using global.affinity will overwrite the node roles set using the Administrator CLI (runai-adm).
Default: Prefer to schedule on nodes that are labeled with node-role.kubernetes.io/runai-system
Make sure you have access to the Kubernetes cluster with permissions to view pods
Copy and paste the following command to verify that NVIDIA Run:ai's services are running:
kubectl get pods -n runai | grep -E 'runai-agent|cluster-sync|assets-sync'
If any of the services are not running, see the 'cluster has service issues' scenario.
Check the network connection
Open your terminal
Make sure you have access to the Kubernetes cluster with permissions to create pods
Copy and paste the following command to create a connectivity check pod:
Replace <control-plane-endpoint> with the URL of the Control Plane in your environment. If the pod fails to connect to the Control Plane, check for potential network policies
Check and modify the network policies
Open your terminal
Copy and paste the following command to check the existence of network policies:
kubectl get networkpolicies -n runai
Review the policies to ensure that they allow traffic from the NVIDIA Run:ai namespace to the Control Plane. If necessary, update the policies to allow the required traffic
Example of allowing traffic:
Check infrastructure-level configurations:
Ensure that firewall rules and security groups allow traffic between your Kubernetes cluster and the Control Plane
Verify required ports and protocols:
Check NVIDIA Run:ai services logs
Open your terminal
Make sure you have access to the Kubernetes cluster with permissions to view logs
Copy and paste the following commands to view the logs of the NVIDIA Run:ai services:
Try to identify the problem from the logs. If you cannot resolve the issue, continue to the next step.
Diagnosing internal network issues:
NVIDIA Run:ai operates on Kubernetes, which uses its internal subnet and DNS services for communication between pods and services. If you find connectivity issues in the logs, the problem might be related to Kubernetes' internal networking.
To diagnose DNS or connectivity issues, you can start a debugging {{glossary.Pod}} with networking utilities:
Copy the following command to your terminal, to start a pod with networking tools:
kubectl run -i --tty netutils --image=dersimn/netutils -- bash
This command creates an interactive pod (netutils) where you can use networking commands like ping, curl, nslookup, etc., to troubleshoot network issues.
Use this pod to perform network resolution tests and other diagnostics to identify any DNS or connectivity problems within your Kubernetes {{glossary.Cluster}}.
Make sure you have access to the Kubernetes cluster with permissions to view pods
Copy and paste the following command to verify that NVIDIA Run:ai's services are running:
kubectl get pods -n runai | grep -E 'runai-agent|cluster-sync|assets-sync'
If any of the services are not running, see the 'cluster has service issues' scenario.
Check the network connection
Open your terminal
Make sure you have access to the Kubernetes cluster with permissions to create pods
Copy and paste the following command to create a connectivity check pod:
Replace <control-plane-endpoint> with the URL of the Control Plane in your environment. If the pod fails to connect to the Control Plane, check for potential network policies:
Check and modify the network policies
Open your terminal
Copy and paste the following command to check the existence of network policies:
kubectl get networkpolicies -n runai
Review the policies to ensure that they allow traffic from the NVIDIA Run:ai namespace to the Control Plane. If necessary, update the policies to allow the required traffic
Example of allowing traffic:
Check infrastructure-level configurations:
Ensure that firewall rules and security groups allow traffic between your Kubernetes cluster and the Control Plane
Verify required ports and protocols:
Ensure that the necessary ports and protocols for NVIDIA Run:ai's services are not blocked by any firewalls or security groups
Check NVIDIA Run:ai services logs
Open your terminal
Make sure you have access to the Kubernetes cluster with permissions to view logs
Copy and paste the following commands to view the logs of the NVIDIA Run:ai services:
Try to identify the problem from the logs. If you cannot resolve the issue, continue to the next step
The NVIDIA Run:ai version installed on the cluster
Kubernetes distribution
The flavor of Kubernetes distribution
Kubernetes version
The version of Kubernetes installed
NVIDIA Run:ai cluster UUID
The unique ID of the cluster
Service issues
At least one of the services is not working properly. You can view the list of nonfunctioning services for more information. See troubleshooting scenarios.
Connected
The NVIDIA Run:ai cluster is connected, and all NVIDIA Run:ai services are running.
You have created two projects - team-a and team-b - or have them created for you.
Each project has an assigned quota of 2 GPUs.
Browse to the provided NVIDIA Run:ai user interface and log in with your credentials.
Log in using the following command. You will be prompted to enter your username and password:
runailogin--help
Log in using the following command. You will be prompted to enter your username and password:
runailogin
To use the API, you will need to obtain a token as shown in .
Go to the Workload Manager → Workloads
Click +NEW WORKLOAD and select Training
Select under which cluster to create the workload
Select the project named team-a
Under Workload architecture, select Standard
Select Start from scratch to launch a new training quickly
Enter a1 as the workload name
Click CONTINUE
In the next step:
Create a new environment
Click +NEW ENVIRONMENT
Enter a name for the environment. The name must be unique.
Select the 'one-gpu' compute resource for your workload (GPU devices: 1 )
If 'one-gpu' is not displayed in the gallery, follow the below steps:
Click +NEW COMPUTE RESOURCE
Click CREATE TRAINING
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. Make sure to update the following parameters. For more details, see API.
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Go to the Workload Manager → Workloads
Click +NEW WORKLOAD and select Training
Select the cluster where the previous training workload was created
Select the project named team-a
Under Workload architecture, select Standard
Select Start from scratch to launch a new training quickly
Enter a2 as the workload name
Click CONTINUE
In the next step:
Select the environment created in
Select the 'two-gpus' compute resource for your workload (GPU devices: 2)
If 'two-gpus' is not displayed in the gallery, follow the below steps:
Click +NEW COMPUTE RESOURCE
Click CREATE TRAINING
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. Make sure to update the following parameters. For more details, see API.
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Go to the Workload Manager → Workloads
Click +NEW WORKLOAD and select Training
Select the cluster where the previous training was created
Select the project named team-b
Under Workload architecture, select Standard
Select Start from scratch to launch a new training quickly
Enter b1 as the workload name
Click CONTINUE
In the next step:
Create a new environment
Click +NEW ENVIRONMENT
Enter a name for the environment. The name must be unique.
Select the 'one-gpu' compute resource for your workload (GPU devices: 1 )
If 'one-gpu' is not displayed in the gallery, follow the below steps:
Click +NEW COMPUTE RESOURCE
Click CREATE TRAINING
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. Make sure to update the following parameters. For more details, see API.
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
System status after run:
System status after run:
~ runai workload list -A
Workload Type Status Project Running/Req.Pods GPU Alloc.
────────────────────────────────────────────────────────────────────────────
a2 Training Running team-a 1/1 2.00
b1 Training Running team-b 1/1 1.00
a1 Training. Running team-a 0/1 1.00
System status after run:
~ runai list -A
Workload Type Status Project Running/Req.Pods GPU Alloc.
────────────────────────────────────────────────────────────────────────────
a2 Training Running team-a 1/1 2.00
b1 Training Running team-b 1/1 1.00
a1 Training. Running team-a 0/1 1.00
System status after run:
curl --location 'https://<COMPANY-URL>/api/v1/workloads' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <TOKEN>' \ #<TOKEN> is the API access token obtained in Step 1.
--data ''
Go to the Workload Manager → Workloads
Click +NEW WORKLOAD and select Training
Select the cluster where the previous training was created
Select the project named team-b
Under Workload architecture, select Standard
Select Start from scratch to launch a new training quickly
Enter b2 as the workload name
Click CONTINUE
In the next step:
Select the environment created in
Select the compute resource created in
Click CREATE TRAINING
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. For more details, see :
Copy the following command to your terminal. Make sure to update the following parameters. For more details, see API.
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Workloads status after run:
Workloads status after run:
~ runai workload list -A
Workload Type Status Project Running/Req.Pods GPU Alloc.
────────────────────────────────────────────────────────────────────────────
a2 Training Running team-a 1/1 2.00
b1 Training Running team-b 1/1 1.00
b2 Training Running team-b 1/1 1.00
a1 Training. Pending team-a 0/1 1.00
Workloads status after run:
~ runai list -A
Workload Type Status Project Running/Req.Pods GPU Alloc.
────────────────────────────────────────────────────────────────────────────
a2 Training Running team-a 1/1 2.00
b1 Training Running team-b 1/1 1.00
b2 Training Running team-b 1/1 1.00
a1 Training. Pending team-a 0/1 1.00
Workloads status after run:
curl --location 'https://<COMPANY-URL>/api/v1/workloads' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <TOKEN>' \ #<TOKEN> is the API access token obtained in Step 1.
--data ''
Manage and monitor your newly created workload using the Workloads table.
Step 2: Submitting the First Training Workload (team-a)
Step 3: Submitting the Second Training Workload (team-a)
Step 4: Submitting the First Training Workload (team-b)
Over Quota Status
Step 5: Submitting the Second Training Workload (team-b)
Basic Fairness and Preemption Status
Next Steps
Projects
This section explains the procedure to manage Projects.
Researchers submit AI workloads. To streamline resource allocation and prioritize work, NVIDIA Run:ai introduces the concept of Projects. Projects are the tool to implement resource allocation policies as well as the segregation between different initiatives. A project may represent a team, an individual, or an initiative that shares resources or has a specific resource quota. Projects may be aggregated in NVIDIA Run:ai departments.
For example, you may have several people involved in a specific face-recognition initiative collaborating under one project named "face-recognition-2024". Alternatively, you can have a project per person in your team, where each member receives their own quota.
Projects Table
The Projects table can be found under Organization in the NVIDIA Run:ai platform.
The Projects table provides a list of all projects defined for a specific cluster, and allows you to manage them. You can switch between clusters by selecting your cluster using the filter at the top.
The Projects table consists of the following columns:
Column
Description
Click one of the values of Node pool(s) with quota column, to view the list of node pools and their parameters
Column
Description
Click one of the values in the Subject(s) column, to view the list of subjects and their parameters. This column is only viewable, if your role in the NVIDIA Run:ai system affords you those permissions.
Column
Description
Click one of the values of Workload(s) column, to view the list of workloads and their parameters
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
To create a new Project:
Click +NEW PROJECT
Select a scope, you can only view clusters if you have permission to do so - within the scope of the roles assigned to you
Enter a name for the project
Project names must start with a letter and can only contain lower case Latin letters, numbers or a hyphen ('-')
When no node pools are configured, you can set the same parameters but it is for the whole project, instead of per node pool. After node pools are created, you can set the above parameters for each node-pool separately.
Set as required.
Click CREATE PROJECT
To create a new access rule for a project:
Select the project you want to add an access rule for
Click ACCESS RULES
Click +ACCESS RULE
Select a subject
To delete an access rule from a project:
Select the project you want to remove an access rule from
Click ACCESS RULES
Find the access rule you want to delete
Click on the trash icon
To edit a project:
Select the project you want to edit
Click EDIT
Update the Project and click SAVE
To view the policy of a project:
Select the project for which you want to view its . This option is only active for projects with defined policies in place.
Click VIEW POLICY and select the workload type for which you want to view the policies:
a. Workspace workload type policy with its set of rules
b. Training workload type policies with its set of rules
In the Policy form, view the workload rules that are enforcing your project for the selected workload type as well as the defaults:
To delete a project:
Select the project you want to delete
Click DELETE
On the dialog, click DELETE to confirm
To view the available actions, go to the API reference.
Launching Workloads with GPU Memory Swap
This quick start provides a step-by-step walkthrough for running multiple LLMs (inference workload) on a single GPU using .
GPU memory swap expands the GPU physical memory to the CPU memory, allowing NVIDIA Run:ai to place and run more workloads on the same GPU physical hardware. This provides a smooth workload context switching between GPU memory and CPU memory, eliminating the need to kill workloads when the memory requirement is larger than what the GPU physical memory can provide.
Before you start, make sure:
You have created a or have one created for you.
Workloads
This section explains the procedure for managing workloads.
The Workloads table can be found under Workload manager in the NVIDIA Run:ai platform.
The workloads table provides a list of all the workloads scheduled on the NVIDIA Run:ai , and allows you to manage them.
The Workloads table consists of the following columns:
Column
Description
Data Sources
This section explains what data sources are and how to create and use them.
Data sources are a type of and represent a location where data is actually stored. They may represent a remote data location, such as NFS, Git, or S3, or a Kubernetes local resource, such as PVC, ConfigMap, HostPath, or Secret.
This configuration simplifies the mapping of the data into the workload’s file system and handles the mounting process during workload creation for reading and writing. These data sources are reusable and can be easily integrated and used by AI practitioners while submitting workloads across various scopes.
The data sources table can be found under Workload manager in the NVIDIA Run:ai platform.
The data sources table provides a list of all the data sources defined in the platform and allows you to manage them.
The data sources table comprises the following columns:
fair - each pod gets an exact time slice according to its memory fraction value and any unused GPU compute time is split evenly between the running pods.
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Note
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Note
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Note
The above API snippet runs with NVIDIA Run:ai clusters of 2.18 and above only.
Node pool(s) with quota
The node pools associated with the project. By default, a new project is associated with all node pools within its associated cluster. Administrators can change the node pools' quota parameters for a project. Click the values under this column to view the list of node pools with their parameters (as described below)
Subject(s)
The users, SSO groups, or applications with access to the project. Click the values under this column to view the list of subjects with their parameters (as described below). This column is only viewable if your role in the NVIDIA Run:ai platform allows you those permissions.
Allocated GPUs
The total number of GPUs allocated by successfully scheduled workloads under this project
GPU allocation ratio
The ratio of Allocated GPUs to GPU quota. This number reflects how well the project's GPU quota is utilized by its descendent workloads. A number higher than 100% indicates the project is using over quota GPUs.
GPU quota
The GPU quota allocated to the project. This number represents the sum of all node pools' GPU quota allocated to this project.
Allocated CPUs (Core)
The total number of CPU cores allocated by workloads submitted within this project. (This column is only available if the CPU Quota setting is enabled, as described below).
Allocated CPU Memory
The total number of CPUs allocated by successfully scheduled workloads under this project. (This column is only available if the CPU Quota setting is enabled, as described below).
CPU quota (Cores)
CPU quota allocated to this project. (This column is only available if the CPU Quota setting is enabled, as described below). This number represents the sum of all node pools' CPU quota allocated to this project. The 'unlimited' value means the CPU (cores) quota is not bounded and workloads using this project can use as many CPU (cores) resources as they need (if available).
CPU memory quota
CPU memory quota allocated to this project. (This column is only available if the CPU Quota setting is enabled, as described below). This number represents the sum of all node pools' CPU memory quota allocated to this project. The 'unlimited' value means the CPU memory quota is not bounded and workloads using this Project can use as much CPU memory resources as they need (if available).
CPU allocation ratio
The ratio of Allocated CPUs (cores) to CPU quota (cores). This number reflects how much the project's 'CPU quota' is utilized by its descendent workloads. A number higher than 100% indicates the project is using over quota CPU cores.
CPU memory allocation ratio
The ratio of Allocated CPU memory to CPU memory quota. This number reflects how well the project's 'CPU memory quota' is utilized by its descendent workloads. A number higher than 100% indicates the project is using over quota CPU memory.
Node affinity of training workloads
The list of NVIDIA Run:ai node-affinities. Any training workload submitted within this project must specify one of those NVIDIA Run:ai node affinities, otherwise it is not submitted.
Node affinity of interactive workloads
The list of NVIDIA Run:ai node-affinities. Any interactive (workspace) workload submitted within this project must specify one of those NVIDIA Run:ai node affinities, otherwise it is not submitted.
Idle time limit of training workloads
The time in days:hours:minutes after which the project stops a training workload not using its allocated GPU resources.
Idle time limit of preemptible workloads
The time in days:hours:minutes after which the project stops a preemptible interactive (workspace) workload not using its allocated GPU resources.
Idle time limit of non preemptible workloads
The time in days:hours:minutes after which the project stops a non-preemptible interactive (workspace) workload not using its allocated GPU resources..
Interactive workloads time limit
The duration in days:hours:minutes after which the project stops an interactive (workspace) workload
Training workloads time limit
The duration in days:hours:minutes after which the project stops a training workload
Creation time
The timestamp for when the project was created
Workload(s)
The list of workloads associated with the project. Click the values under this column to view the list of workloads with their resource parameters (as described below).
Cluster
The cluster that the project is associated with
CPU memory
The amount of CPU memory quota the administrator has dedicated to the project for this node pool (floating number, in MB or GB). The 'unlimited' value means the CPU memory quota is not bounded and workloads using this node pool can use as much CPU memory resource as they need (if available).
Allocated GPUs
The actual amount of GPUs allocated by workloads using this node pool under this project. The number of allocated GPUs may temporarily surpass the GPU quota if over quota is used.
Allocated CPU (Cores)
The actual amount of CPUs (cores) allocated by workloads using this node pool under this project. The number of allocated CPUs (cores) may temporarily surpass the CPUs (Cores) quota if over quota is used.
Allocated CPU memory
The actual amount of CPU memory allocated by workloads using this node pool under this Project. The number of Allocated CPU memory may temporarily surpass the CPU memory quota if over quota is used.
Order of priority
The default order in which the Scheduler uses node-pools to schedule a workload. This is used only if the order of priority of node pools is not set in the workload during submission, either by an admin policy or the user. An empty value means the node pool is not part of the project's default list, but can still be chosen by an admin policy or the user during workload submission
Role
The role assigned to the subject, in this project's scope
Authorized by
The user who granted the access rule
Last updated
The last time the access rule was updated
Created by
The subject that created this workload
Running/ requested pods
The number of running pods out of the number of requested pods for this workload. e.g. a distributed workload requesting 4 pods but may be in a state where only 2 are running and 2 are pending
Creation time
The date and time the workload was created
GPU compute request
The amount of GPU compute requested (floating number, represents either a portion of the GPU compute, or the number of whole GPUs requested)
GPU memory request
The amount of GPU memory requested (floating number, can either be presented as a portion of the GPU memory, an absolute memory size in MB or GB, or a MIG profile)
CPU memory request
The amount of CPU memory requested (floating number, presented as an absolute memory size in MB or GB)
CPU compute request
The amount of CPU compute requested (floating number, represents the number of requested Cores)
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
Namespace associated with Project
Each project has an associated (Kubernetes) namespace in the cluster.
All workloads under this project use this namespace.
By default, NVIDIA Run:ai creates a namespace based on the Project name (in the form of runai-<name>)
Alternatively, you can choose an existing namespace created for you by the cluster administrator
In the Quota management section, you can set the quota parameters and prioritize resources
Order of priority
This column is displayed only if more than one node pool exists. The default order in which the Scheduler uses node pools to schedule a workload. This means the Scheduler first tries to allocate resources using the highest priority node pool, then the next in priority, until it reaches the lowest priority node pool list, then the Scheduler starts from the highest again. The Scheduler uses the Project list of prioritized node pools, only if the order of priority of node pools is not set in the workload during submission, either by an admin policy or by the user. Empty value means the node pool is not part of the Project's default node pool priority list, but a node pool can still be chosen by the admin policy or a user during workload submission
Node pool
This column is displayed only if more than one node pool exists. It represents the name of the node pool.
GPU devices
The number of GPUs you want to allocate for this project in this node pool (decimal number).
CPUs (Cores)
This column is displayed only if CPU quota is enabled via the General settings.
Represents the number of CPU cores you want to allocate for this project in this node pool (decimal number).
CPU memory
This column is displayed only if CPU quota is enabled via the General settings.
The amount of CPU memory you want to allocate for this project in this node pool (in Megabytes or Gigabytes).
Over quota / Over quota weight - If over quota weight is enabled via the General settings then over quota weight is presented, otherwise over quota is presented
Over quota
When enabled, the project can use non-guaranteed overage resources above its quota in this node pool. The amount of the non-guaranteed overage resources for this project is calculated proportionally to the project quota in this node pool. When disabled, the project cannot use more resources than the guaranteed quota in this node pool.
Over quota weight - Represents a weight used to calculate the amount of non-guaranteed overage resources a project can get on top of its quota in this node pool. All unused resources are split between projects that require the use of overage resources:
Select or enter the subject identifier:
User Email for a local user created in NVIDIA Run:ai or for SSO user as recognized by the IDP
Group name as recognized by the IDP
Application name as created in NVIDIA Run:ai
Select a role
Click SAVE RULE
Click CLOSE
Click CLOSE
Parameter - The workload submission parameter that Rules and Defaults are applied to
Type (applicable for data sources only) - The data source type (Git, S3, nfs, pvc etc.)
Default - The default value of the Parameter
Rule - Set up constraints on workload policy fields
Source - The origin of the applied policy (cluster, department or project)
Project
The name of the project
Department
The name of the parent department. Several projects may be grouped under a department.
Status
The Project creation status. Projects are manifested as Kubernetes namespaces. The project status represents the Namespace creation status.
Node pool
The name of the node pool is given by the administrator during node pool creation. All clusters have a default node pool created automatically by the system and named 'default'.
GPU quota
The amount of GPU quota the administrator dedicated to the project for this node pool (floating number, e.g. 2.3 means 230% of GPU capacity).
CPU (Cores)
The amount of CPUs (cores) quota the administrator has dedicated to the project for this node pool (floating number, e.g. 1.3 Cores = 1300 mili-cores). The 'unlimited' value means the CPU (Cores) quota is not bounded and workloads using this node pool can use as many CPU (Cores) resources as they require, (if available).
Subject
A user, SSO group, or application assigned with a role in the scope of this Project
Type
The type of subject assigned to the access rule (user, SSO group, or application)
Scope
The scope of this project in the organizational tree. Click the name of the scope to view the organizational tree diagram, you can only view the parts of the organizational tree for which you have permission to view.
Workload
The name of the workload, given during its submission. Optionally, an icon describing the type of workload is also visible
Type
The type of the workload, e.g. Workspace, Training, Inference
Status
The state of the workload and time elapsed since the last status change
Node Pools with Quota Associated with the Project
Subjects Authorized for the Project
Workloads Associated with the Project
Customizing the Table View
Adding a New Project
Note
Setting the quota to 0 (either GPU, CPU, or CPU memory) and the over quota to 'disabled' or over quota weight to 'none' means the project is blocked from using those resources on this node pool.
Adding an Access Rule to a Project
Deleting an Access Rule from a Project
Editing a Project
Viewing a Project's Policy
Note
The policy affecting the project consists of rules and defaults. Some of these rules and defaults may be derived from policies of a parent cluster and/or department (source). You can see the source of each rule in the policy form.
Deleting a Project
Note
Clusters < v2.20
Deleting a project does not delete its associated namespace, any of the workloads running using this namespace, or the policies defined for this project. However, any assets created in the scope of this project such as compute resources, environments, data sources, templates and credentials, are permanently deleted from the system.
Clusters >=v2.20
Deleting a project does not delete its associated namespace, but will attempt to delete it's associated workloads and assets. Any assets created in the scope of this project such as compute resources, environments, data sources, templates and credentials, are permanently deleted from the system.
Copy the following command to your terminal. Make sure to update the below parameters. For more details, see API:
<COMPANY-URL> - The link to the NVIDIA Run:ai user interface
<TOKEN> - The API access token obtained in
Select the newly created workspace that you want to connect to
Click CONNECT
Select the ChatbotUI tool. The selected tool is opened in a new tab on your browser.
Query both workspaces simultaneously and see them both responding. The one on CPU RAM at the time will take longer as it switches back to the GPU and vice versa.
To connect to the ChatbotUI tool, browse directly to https://<COMPANY-URL>/<PROJECT-NAME>/<WORKLOAD-NAME>
Query both workspaces simultaneously and see them both responding. The one on CPU RAM at the time will take longer as it switches back to the GPU and vice versa.
Manage and monitor your newly created workloads using the Workloads table.
Dynamic GPU fractions is disabled by default in the NVIDIA Run:ai UI. To use dynamic GPU fractions, it must be enabled by your Administrator, under General Settings → Resources → GPU resource optimization.
Step 1: Logging In
Step 2: Submitting the First Inference Workload
Step 3: Submitting the Second Inference Workload
Step 4: Submitting the First Workspace
Step 5: Submitting the Second Workspace
Step 6: Connecting to ChatbotUI
Next Steps
Workload
The name of the workload
Type
The workload type
Preemptible
Is the workload (Yes/no)
Status
The different in a workload lifecycle
Project
The following table describes the different phases in a workload life cycle. The UI provides additional details for some of the below workload statuses which can be viewed by clicking the icon next to the status.
Status
Description
Entry Condition
Exit Condition
Creating
Workload setup is initiated in the cluster. Resources and pods are now provisioning.
A workload is submitted
A multi-pod group is created
Pending
Click one of the values in the Running/requested pods column, to view the list of pods and their parameters.
Column
Description
Pod
Pod name
Status
Pod lifecycle stages
Node
The node on which the pod resides
A connection refers to the method by which you can access and interact with the running workloads. It is essentially the "doorway" through which you can reach and use the applications (tools) these workloads provide.
Click one of the values in the Connection(s) column, to view the list of connections and their parameters. Connections are network interfaces that communicate with the application running in the workload. Connections are either the URL the application exposes or the IP and the port of the node that the workload is running on.
Column
Description
Name
The name of the application running on the workload
Connection type
The network connection type selected for the workload
Access
Who is authorized to use this connection (everyone, specific groups/users)
Click one of the values in the Data source(s) column to view the list of data sources and their parameters.
Column
Description
Data source
The name of the data source mounted to the workload
Type
The
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
Refresh - Click REFRESH to update the table with the latest data
Show/Hide details - Click to view additional information on the selected row
Click a row in the Workloads table and then click the SHOW DETAILS button at the upper-right side of the action bar. The details pane appears, presenting the following tabs:
Displays the workload status over time. It displays events describing the workload lifecycle and alerts on notable events. Use the filter to search through the history for specific events.
GPU utilization
Per GPU graph and an average of all GPUs graph, all on the same chart, along an adjustable period allows you to see the trends of all GPUs compute utilization (percentage of GPU compute) in this node.
GPU memory utilization
Per GPU graph and an average of all GPUs graph, all on the same chart, along an adjustable period allows you to see the trends of all GPUs memory usage (percentage of the GPU memory) in this node.
CPU compute utilization
The average of all CPUs' cores compute utilization graph, along an adjustable period allows you to see the trends of CPU compute utilization (percentage of CPU compute) in this node.
CPU memory utilization
The utilization of all CPUs memory in a single graph, along an adjustable period allows you to see the trends of CPU memory utilization (percentage of CPU memory) in this node.
CPU memory usage
The usage of all CPUs memory in a single graph, along an adjustable period allows you to see the trends of CPU memory usage (in GB or MB of CPU memory) in this node.
For GPUs charts - Click the GPU legend on the right-hand side of the chart, to activate or deactivate any of the GPU lines.
You can click the date picker to change the presented period
You can use your mouse to mark a sub-period in the graph for zooming in, and use Reset zoom to go back to the preset period
Changes in the period affect all graphs on this screen.
Workload events are ordered in chronological order. The logs contain events from the workload's lifecycle to help monitor and debug issues.
Before starting, make sure you have created a project or have one created for you to work with workloads.
To create a new workload:
Click +NEW WORKLOAD
Select a workload type - Follow the links below to view the step-by-step guide for each workload type:
Workspace - Used for data preparation and model-building tasks.
- Used for standard training tasks of all sorts
- Used for distributed tasks of all sorts
- Used for inference and serving tasks
Job (legacy). This type is displayed only if enabled by your Administrator, under General settings → Workloads → Workload policies
Click CREATE WORKLOAD
Stopping a workload kills the workload pods and releases the workload resources.
Select the workload you want to stop
Click STOP
Running a workload spins up new pods and resumes the workload work after it was stopped.
Select the workload you want to run again
Click RUN
To connect to an application running in the workload (for example, Jupyter Notebook)
Select the workload you want to connect
Click CONNECT
Select the tool from the drop-down list
The selected tool is opened in a new tab on your browser
Select the workload you want to delete
Click DELETE
On the dialog, click DELETE to confirm the deletion
Select the workload you want to copy and edit
Click COPY & EDIT
Update the workload and click CREATE WORKLOAD
Go to the Workloads API reference to view the available actions.
To understand the condition of the workload, review the workload status in the Workload table. For more information, see check the workload's event history.
Listed below are a number of known issues when working with workloads and how to fix them:
Issue
Mediation
Cluster connectivity issues (there are issues with your connection to the cluster error message)
Verify that you are on a network that has been granted access to the cluster.
Reach out to your cluster admin for instructions on verifying this.
If you are an admin, see the section in the cluster documentation
Workload in "Initializing" status for some time
Check that you have access to the Container image registry.
Check the statuses of the pods in the .
Check the event history for more details
Workload has been pending for some time
Check that you have the required quota.
Check the project's available quota in the project dialog.
Check that all services needed to run are bound to the workload.
Logs are available only while the workload is in a non-terminal state. Once the workload completes or fails, logs are no longer accessible.
Adding a New Workload
Stopping a Workload
Running a Workload
Connecting to a Workload
Deleting a Workload
Note
Once a workload is deleted you can view it in the Deleted tab in the workloads view. This tab is displayed only if enabled by your Administrator, under General settings → Workloads → Deleted workloads
Copy & Edit a Workload
Using API
Troubleshooting
Column
Description
Data source
The name of the data source
Description
A description of the data source
Type
The type of data source connected – e.g., S3 bucket, PVC, or others
The following table describes the data sources' condition and whether they were created successfully for the selected scope.
Status
Description
No issues found
No issues were found while creating the data source
Issues found
Issues were found while propagating the data source credentials
Issues found
The data source couldn’t be created at the cluster
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
Download table - Click MORE and then click ‘Download as CSV’. Export to CSV is limited to 20,000 rows.
Refresh - Click REFRESH to update the table with the latest data
To create a new data source:
Click +NEW DATA SOURCE
Select the data source type from the list. Follow the step-by-step guide for each data source type:
To edit a data source:
Select the data source from the table
Click Rename to provide it with a new name
Click Copy & Edit to make any changes to the data source
To delete a data source:
Select the data source you want to delete
Click DELETE
Confirm you want to delete the data source
Add PVCs in advance to be used when creating a PVC-type data source via the NVIDIA Run:ai UI.
The actions taken by the admin are based on the scope (cluster, department or project) that the admin wants for data source of type PVC. Follow the steps below for each required scope:
Locate the PVC in the NVIDIA Run:ai namespace (runai)
Provide NVIDIA Run:ai with visibility and authorization to share the PVC to your selected scope by implementing the following label: run.ai/cluster-wide: "true”
The PVC is now displayed for that scope in the list of existing PVCs.
Locate the PVC in the NVIDIA Run:ai namespace (runai)
To authorize NVIDIA Run:ai to use the PVC, label it: run.ai/department: "id"
The PVC is now displayed for that scope in the list of existing PVCs.
Locate the PVC in the project’s namespace.
The PVC is now displayed for that scope in the list of existing PVCs.
Add ConfigMaps in advance to be used when creating a ConfigMap-type data source via the NVIDIA Run:ai UI.
Locate the ConfigMap in the NVIDIA Run:ai namespace (runai)
To authorize NVIDIA Run:ai to use the ConfigMap, label it: run.ai/cluster-wide: "true”
The ConfigMap must have a label of run.ai/resource: <resource-name>
The ConfigMap is now displayed for that scope in the list of existing ConfigMaps.
Locate the ConfigMap in the NVIDIA Run:ai namespace (runai)
To authorize NVIDIA Run:ai to use the ConfigMap, label it: run.ai/department: "<department-id>"
The ConfigMap must have a label of run.ai/resource: <resource-name>
The ConfigMap is now displayed for that scope in the list of existing ConfigMaps.
Locate the ConfigMap in the project’s namespace
The ConfigMap must have a label of run.ai/resource: <resource-name>
The ConfigMap is now displayed for that scope in the list of existing ConfigMaps.
To view the available actions, go to the Data sources API reference.
A Network File System () is a Kubernetes concept used for sharing storage in the cluster among different pods. Like a PVC, the NFS volume’s content remains preserved, even outside the lifecycle of a single pod. However, unlike PVCs, which abstract storage management, NFS provides a method for network-based file sharing. The NFS volume can be pre-populated with data and can be mounted by multiple pod writers simultaneously. At NVIDIA Run:ai, an NFS-type data source is an abstraction that is mapped directly to a Kubernetes NFS volume. This integration allows multiple workloads under various scopes to mount and present the NFS data source.
Select the cluster under which to create this data source
PVC
A Persistent Volume Claim () is a Kubernetes concept used for managing storage in the cluster, which can be provisioned by an administrator or dynamically by Kubernetes using a StorageClass. PVCs allow users to request specific sizes and access modes (read/write once, read-only many).
NVIDIA Run:ai ensures that data remains consistent and accessible across various scopes and workloads, beyond the lifecycle of individual pods, which is efficient while working with large datasets typically associated with AI projects.
Select the cluster under which to create this data source
S3 Bucket
The data source enables the mapping of a remote S3 bucket into the workload’s file system. Similar to a PVC, this mapping remains accessible across different workload executions, extending beyond the lifecycle of individual pods. However, unlike PVCs, data stored in an S3 bucket resides remotely, which may lead to decreased performance during the execution of heavy machine learning workloads. As part of the NVIDIA Run:ai connection to the S3 bucket, you can create in order to access and map private buckets.
Select the cluster under which to create this data source
Git
A Git-type data source is a NVIDIA Run:ai integration, that enables code to be copied from a Git branch into a dedicated folder in the container. It is mainly used to provide the workload with the latest code repository. As part of the integration with Git, in order to access private repositories, you can add predefined credentials to the data source mapping.
Select the cluster under which to create this data source
Host path
A volume is a Kubernetes concept that enables mounting a host path file or a directory on the workload’s file system. Like a PVC, the host path volume’s data persists across workloads under various scopes. It also enables data serving from the hosting node.
Select the cluster under which to create this data source
Select a
ConfigMap
A data source is a NVIDIA Run:ai abstraction for the Kubernetes ConfigMap concept. The ConfigMap is used mainly for storage that can be mounted on the workload container for non-confidential data. It is usually represented in key-value pairs (e.g., environment variables, command-line arguments etc.). It allows you to decouple environment-specific system configurations from your container images, so that your applications are easily portable. ConfigMaps must be created on the cluster prior to being used within the NVIDIA Run:ai system.
Select the cluster under which to create this data source
Secret
A secret-type data source enables the mapping of a credential into the workload’s file system. Credentials are a workload asset that simplify the complexities of Kubernetes . The credentials mask sensitive access information, such as passwords, tokens, and access keys, which are necessary for gaining access to various resources.
Select the cluster under which to create this data source
Note
It is also possible to add data sources directly when creating a specific , or workloads.
Editing a Data Source
Deleting a Data Source
Note
It is not possible to delete a data source being used by an existing workload or template.
Creating PVCs in Advance
Cluster Scope
Note
This step is also relevant for creating the data source of type PVC via API
Department Scope
Project Scope
Creating ConfigMaps in Advance
Cluster Scope
Department Scope
Project Scope
Using API
Medium
The default value. The Admin can change the default to any of the following values: High, Low, Lowest, or None.
None
When set, the project cannot use more resources than the guaranteed quota in this node pool.
Lowest
over quota weight 'lowest' has a unique behavior, because its weight is 0, it can only use over quota (unused overage) resources if no other project needs them, and any project with a higher over quota weight can snap the average resources at any time.
Check the event history for more details.
The project in which the workload runs
Department
The department that the workload is associated with. This column is visible only if the department toggle is enabled by your administrator.
Created by
The user who created the workload
Running/requested pods
The number of running pods out of the requested
Creation time
The timestamp of when the workload was created
Completion time
The timestamp the workload reached a terminal state (failed/completed)
Connection(s)
The method by which you can access and interact with the running workload. It's essentially the "doorway" through which you can reach and use the tools the workload provide. (E.g node port, external URL, etc). Click one of the values in the column to view the list of connections and their parameters.
Data source(s)
Data resources used by the workload
Environment
The environment used by the workload
Workload architecture
Standard or distributed. A standard workload consists of a single process. A distributed workload consists of multiple processes working together. These processes can run on different nodes.
GPU compute request
Amount of GPU devices requested
GPU compute allocation
Amount of GPU devices allocated
GPU memory request
Amount of GPU memory Requested
GPU memory allocation
Amount of GPU memory allocated
Idle GPU devices
The number of allocated GPU devices that have been idle for more than 5 minutes
CPU compute request
Amount of CPU cores requested
CPU compute allocation
Amount of CPU cores allocated
CPU memory request
Amount of CPU memory requested
CPU memory allocation
Amount of CPU memory allocated
Cluster
The cluster that the workload is associated with
Workload is queued and awaiting resource allocation
A pod group exists
All pods are scheduled
Initializing
Workload is retrieving images, starting containers, and preparing pods
All pods are scheduled
All pods are initialized or a failure to initialize is detected
Running
Workload is currently in progress with all pods operational
All pods initialized (all containers in pods are ready)
Workload completion or failure
Degraded
Pods may not align with specifications, network services might be incomplete, or persistent volumes may be detached. Check your logs for specific details.
Pending - All pods are running but have issues.
Running - All pods are running with no issues.
Running - All resources are OK.
Completed - Workload finished with fewer resources
Failed - Workload failure or user-defined rules.
Deleting
Workload and its associated resources are being decommissioned from the cluster
Deleting the workload
Resources are fully deleted
Stopped
Workload is on hold and resources are intact but inactive
Stopping the workload without deleting resources
Transitioning back to the initializing phase or proceeding to deleting the workload
Failed
Image retrieval failed or containers experienced a crash. Check your logs for specific details
An error occurs preventing the successful completion of the workload
Terminal state
Completed
Workload has successfully finished its execution
The workload has finished processing without errors
Terminal state
Node pool
The node pool in which the pod resides (applicable if node pools are enabled)
Image
The pod's main image
GPU compute allocation
Amount of GPU devices allocated for the pod
GPU memory allocation
Amount of GPU memory allocated for the pod
Address
The connection URL
Copy button
Copy URL to clipboard
Connect button
Enabled only for supported tools
PVCs created using the K8s API or kubectl are not visible or mountable in NVIDIA Run:ai
This is by design.
Create a new data source of type PVC in the NVIDIA Run:ai UI
In the Data mount section, select Existing PVC
Select the PVC you created via the K8S API
You are now able to select and mount this PVC in your NVIDIA Run:ai submitted workloads.
Enter a name for the data source. The name must be unique.
Optional: Provide a description of the data source
Select PVC:
Existing PVC
This option is relevant when the purpose is to create a PVC-type data source based on an existing PVC in the cluster
Select a PVC from the list - (The list is empty if no existing PVCs were created in advance)
New PVC - creates a new PVC in the cluster. New PVCs are not added to the Existing PVCs list.
When creating a PVC-type data source and selecting the ‘New PVC’ option, the PVC is immediately created in the cluster (even if no workload has requested this PVC).
Select the storage class
None - Proceed without defining a storage class
Custom storage class - This option applies when selecting a storage class based on existing storage classes.
To add new storage classes to the storage class list, and for additional information, check Kubernetes storage classes
Select the access mode(s) (multiple modes can be selected)
Read-write by one node - The volume can be mounted as read-write by a single node.
Read-only by many nodes - The volume can be mounted as read-only by many nodes.
Read-write by many nodes - The volume can be mounted as read-write by many nodes.
Set the claim size and its units
Select the volume mode
File system (default) - allows the volume to be mounted as a filesystem, enabling the usage of directories and files.
Block - exposes the volume as a block storage, which can be formatted or used by applications directly without a filesystem.
Set the data target location
container path
Optional: Prevent data modification - When enabled, the data will be mounted with read-only permission.
Click CREATE DATA SOURCE
After the data source is created, check its status to monitor its proper creation across the selected scope.
Enter a name for the data source. The name must be unique.
Optional: Provide a description of the data source
Set the data origin
Select the credential
To add new credentials, and for additional information, check the Credentials article.
Set the data target location
container path
Click CREATE DATA SOURCE
After the data source is created, check its status to monitor its proper creation across the selected scope.
Status
The different lifecycle phases and representation of the data source condition
Scope
The scope of the data source within the organizational tree. Click the scope name to view the organizational tree diagram
Kubernetes name
The unique name of the data sources Kubernetes name as it appears in the cluster
Workload(s)
The list of existing workloads that use the data source
Template(s)
The list of workload templates that use the data source
Created by
The user who created the data source
Creation time
The timestamp for when the data source was created
Cluster
The cluster that the data source is associated with
Creating…
The data source is being created
No status / “-”
When the data source’s scope is an account, the current version of the cluster is not up to date, or the asset is not a cluster-syncing entity, the status can’t be displayed
Note
S3 data sources are not supported for custom inference workloads.
The NVIDIA Run:ai cluster is a Kubernetes application. This section explains the required hardware and software system requirements for the NVIDIA Run:ai cluster.
The system requirements needed depend on where the control plane and cluster are installed. The following applies to Kubernetes only:
If you are installing the first cluster and control plane on separate Kubernetes clusters, the Kubernetes ingress controller and are required.
The following hardware requirements are for the Kubernetes cluster nodes. By default, all NVIDIA Run:ai cluster services run on all available nodes. For production deployments, you may want to set , to separate between system and worker nodes, reduce downtime and save CPU cycles on expensive GPU Machines.
x86 – Supported for both Kubernetes and OpenShift deployments.
ARM – Supported for Kubernetes only. ARM is currently not supported for OpenShift.
This configuration is the minimum requirement you need to install and use NVIDIA Run:ai cluster.
Component
Required Capacity
The NVIDIA Run:ai cluster supports x86 and ARM CPUs, and any NVIDIA GPUs supported by the NVIDIA GPU Operator. The list of supported GPUs depends on the version of the NVIDIA GPU Operator installed in the cluster. NVIDIA Run:ai supports GPU Operator versions 22.9 to 25.3.
For the list of supported GPU models, see . To install the GPU Operator, see .
The following configuration represents the minimum hardware requirements for installing and operating the NVIDIA Run:ai cluster on worker nodes. Each node must meet these specifications:
Component
Required Capacity
NVIDIA Run:ai workloads must be able to access data from any worker node in a uniform way, to access training data and code as well as save checkpoints, weights, and other machine-learning-related artifacts.
Typical protocols are Network File Storage (NFS) or Network-attached storage (NAS). NVIDIA Run:ai cluster supports both, for more information see .
The following software requirements must be fulfilled on the Kubernetes cluster.
Any Linux operating system supported by both Kubernetes and NVIDIA GPU Operator
NVIDIA Run:ai cluster on Google Kubernetes Engine (GKE) supports both Ubuntu and Container Optimized OS (COS). COS is supported only with NVIDIA GPU Operator 24.6 or newer, and NVIDIA Run:ai cluster version 2.19 or newer.
NVIDIA Run:ai cluster on Elastic Kubernetes Service (EKS) does not support Bottlerocket or Amazon Linux.
NVIDIA Run:ai cluster requires Kubernetes. The following Kubernetes distributions are supported:
Vanilla Kubernetes
OpenShift Container Platform (OCP)
NVIDIA Base Command Manager (BCM)
Elastic Kubernetes Engine (EKS)
For existing Kubernetes clusters, see the following Kubernetes version support matrix for the latest NVIDIA Run:ai cluster releases:
NVIDIA Run:ai version
Supported Kubernetes versions
Supported OpenShift versions
For information on supported versions of managed Kubernetes, it's important to consult the release notes provided by your Kubernetes service provider. There, you can confirm the specific version of the underlying Kubernetes platform supported by the provider, ensuring compatibility with NVIDIA Run:ai. For an up-to-date end-of-life statement see or .
NVIDIA Run:ai supports the following . Make sure your Kubernetes cluster is configured with one of these runtimes:
(default in Kubernetes)
(default in OpenShift)
NVIDIA Run:ai supports restricted policy for (PSA) on OpenShift only. Other Kubernetes distributions are only supported with privileged policy.
For NVIDIA Run:ai on OpenShift to run with PSA restricted policy:
Label the runai namespace as described in with the following labels:
The workloads submitted through NVIDIA Run:ai should comply with the restrictions of PSA restricted policy. This can be enforced using Policies.
The NVIDIA Run:ai must be installed in a namespace or project (OpenShift) called runai. Use the following to create the namespace/project:
NVIDIA Run:ai cluster requires to be installed on the Kubernetes cluster.
OpenShift, RKE and RKE2 come pre-installed ingress controller.
Internal tests are being performed on NGINX, Rancher NGINX, OpenShift Router, and Istio.
Make sure that a default ingress controller is set.
There are many ways to install and configure different ingress controllers. A simple example to install and configure NGINX ingress controller using :
You must have a Fully Qualified Domain Name (FQDN) to install the NVIDIA Run:ai cluster (ex: runai.mycorp.local). This cannot be an IP. The domain name must be accessible inside the organization's private network.
In order to make inference serving endpoints available externally to the cluster, configure a wildcard DNS record (*.runai-inference.mycorp.local) that resolves to the cluster’s public IP address, or to the cluster's load balancer IP address in on-prem environments. This ensures each inference workload receives a unique subdomain under the wildcard domain.
Kubernetes - You must have a TLS certificate that is associated with the FQDN for HTTPS access. Create a named runai-cluster-domain-tls-secret in the runai namespace and include the path to the TLS --cert and its corresponding private --key by running the following:
OpenShift - NVIDIA Run:ai uses the OpenShift default Ingress router for serving. The TLS certificate configured for this router must be issued by a trusted CA. For more details, see the OpenShift documentation on .
Kubernetes - For serving inference endpoints over HTTPS, NVIDIA Run:ai requires a dedicated wildcard TLS certificate that matches the fully qualified domain name (FQDN) used for inference. This certificate ensures secure external access to inference workloads:
OpenShift - A wildcard TLS certificate for inference is not required. OpenShift Routes handle TLS termination for inference endpoints using the platform’s built-in routing and certificate management.
A local certificate authority serves as the root certificate for organizations that cannot use publicly trusted certificate authority. Follow the below steps to configure the local certificate authority.
In air-gapped environments, you must configure and install the local CA's public key in the Kubernetes cluster. This is required for the installation to succeed:
Add the public key to the required namespace:
When installing the cluster, make sure the following flag is added to the helm command --set global.customCA.enabled=true. See .
NVIDIA Run:ai Cluster requires NVIDIA GPU Operator to be installed on the Kubernetes Cluster, supports version 22.9 to 25.3. Information on how to download the GPU Operator for air-gapped installation can be found in the .
See the , followed by notes below:
Use the default gpu-operator namespace . Otherwise, you must specify the target namespace using the flag runai-operator.config.nvidiaDcgmExporter.namespace as described in customized cluster installation.
NVIDIA drivers may already be installed on the nodes. In such cases, use the NVIDIA GPU Operator flags --set driver.enabled=false. is one such example as it comes bundled with NVIDIA Drivers.
For troubleshooting information, see the .
NVIDIA Run:ai Cluster requires Prometheus to be installed on the Kubernetes cluster.
OpenShift comes pre-installed with prometheus
For RKE2 see instructions to install Prometheus
There are many ways to install Prometheus. A simple example to install the community using , run the following commands:
Additional NVIDIA Run:ai capabilities, Distributed Training and Inference require additional Kubernetes applications (frameworks) to be installed on the cluster.
Distributed training enables training of AI models over multiple nodes. This requires installing a distributed training framework on the cluster. The following frameworks are supported:
There are several ways to install each framework. A simple method of installation example is the which includes TensorFlow, PyTorch, and XGBoost.
It is recommended to use Kubeflow Training Operator v1.8.1, and MPI Operator v0.6.0 or later for compatibility with advanced workload capabilities, such as and .
To install the Kubeflow Training Operator for TensorFlow, PyTorch, and XGBoost frameworks, run the following command:
To install the MPI Operator for MPI v2, run the following command:
Inference enables serving of AI models. This requires the framework to be installed on the cluster and supports Knative versions 1.11 to 1.16.
Follow the instructions or run:
Once installed, follow the below steps:
Create the knative-serving namespace:
Create a YAML file named knative-serving.yaml and replace the placeholder FQDN with your wildcard inference domain (for example, runai-inference.mycorp.local
NVIDIA Run:ai allows for autoscaling a deployment according to the below metrics:
Latency (milliseconds)
Throughput (requests/sec)
Concurrency (requests)
Using a custom metric (for example, Latency) requires installing the . Use the following command to install. Make sure to update the {VERSION} in the below command with a .
NVIDIA Run:ai cluster on Oracle Kubernetes Engine (OKE) supports only Ubuntu.
Internal tests are being performed on Ubuntu 22.04 and CoreOS for OpenShift.
Google Kubernetes Engine (GKE)
Azure Kubernetes Service (AKS)
Oracle Kubernetes Engine (OKE)
Rancher Kubernetes Engine (RKE1)
Rancher Kubernetes Engine 2 (RKE2)
v2.19
1.28 to 1.31
4.12 to 4.17
v2.20 (latest)
1.29 to 1.32
4.14 to 4.17
For distribution-specific additional instructions see below:
):
Apply the changes:
kubectl apply -f knative-serving.yaml
Configure NGINX to proxy requests to Kourier / Knative and handle TLS termination using the wildcard certificate. Create a YAML file named knative-ingress.yaml and replace the FQDN placeholders with your wildcard inference domain:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: knative-serving
namespace: knative-serving
spec:
ingressClassName: nginx
rules:
- host: '*.runai-inference.mycorp.local' # replace with the wildcard FQDN for Inference
http:
paths:
- backend:
service:
name: kourier
port:
number: 80
path: /
pathType: Prefix
tls:
- hosts:
- '*.runai-inference.mycorp.local' # replace with the wildcard FQDN for Inference
secretName: runai-cluster-inference-tls-secret
kubectl create secret tls runai-cluster-domain-tls-secret -n runai \
--cert /path/to/fullchain.pem \ # Replace /path/to/fullchain.pem with the actual path to your TLS certificate
--key /path/to/private.pem # Replace /path/to/private.pem with the actual path to your private key
kubectl create secret tls runai-cluster-inference-tls-secret -n knative-serving \
--cert /path/to/fullchain.pem \ # Replace /path/to/fullchain.pem with the actual path to your TLS certificate
--key /path/to/private.pem # Replace /path/to/private.pem with the actual path to your private key
To designate nodes to NVIDIA Run:ai system services, follow the instructions as described in System nodes.
NVIDIA Run:ai Cluster - Worker Nodes
Note
NVIDIA DGX Spark and NVIDIA Jetson are not supported.
Note
To designate nodes to NVIDIA Run:ai workloads, follow the instructions as described in Worker nodes.
Shared Storage
Software Requirements
Operating System
Kubernetes Distribution
Note
The latest release of the NVIDIA Run:ai cluster supports Kubernetes 1.30 to 1.32 and OpenShift 4.14 to 4.18
Container Runtime
Kubernetes Pod Security Admission
NVIDIA Run:ai Namespace
Kubernetes Ingress Controller
Vanilla Kubernetes
Run the following commands:
For cloud deployments, both the internal IP and external IP are required.
For on-prem deployments, only the external IP is needed.
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm upgrade -i nginx-ingress ingress-nginx/ingress-nginx \
--namespace nginx-ingress --create-namespace \
--set controller.kind=DaemonSet \
--set controller.service.externalIPs="{<INTERNAL-IP>,<EXTERNAL-IP>}" # Replace <INTERNAL-IP> and <EXTERNAL-IP> with the internal and external IP addresses of one of the nodes
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install nginx-ingress ingress-nginx/ingress-nginx \
--namespace ingress-nginx --create-namespace \
--set controller.service.annotations.oci.oraclecloud.com/load-balancer-type=nlb \
--set controller.service.annotations.oci-network-load-balancer.oraclecloud.com/is-preserve-source=True \
--set controller.service.annotations.oci-network-load-balancer.oraclecloud.com/security-list-management-mode=None \
--set controller.service.externalTrafficPolicy=Local \
--set controller.service.annotations.oci-network-load-balancer.oraclecloud.com/subnet=<SUBNET-ID> # Replace <SUBNET-ID> with the subnet ID of one of your cluster
Fully Qualified Domain Name (FQDN)
Note
Fully Qualified Domain Name applies to Kubernetes only.
Wildcard FQDN for Inference
TLS Certificate
Wildcard TLS Certificate - Inference
Local Certificate Authority
Note
When using a custom CA, sidecar containers used for S3 or Git integrations do not automatically inherit the CA configured at the cluster level. See Git and S3 sidecar containers for more details.
NVIDIA GPU Operator
OpenShift Container Platform (OCP)
The Node Feature Discovery (NFD) Operator is a prerequisite for the NVIDIA GPU Operator in OpenShift. Install the NFD Operator using the Red Hat OperatorHub catalog in the OpenShift Container Platform web console. For more information, see Installing the Node Feature Discovery (NFD) Operator.
Elastic Kubernetes Service (EKS)
When setting-up the cluster, do not install the NVIDIA device plug-in (we want the NVIDIA GPU Operator to install it instead).
When using the eksctl tool to create a cluster, use the flag --install-nvidia-plugin=false to disable the installation.
For GPU nodes, EKS uses an AMI which already contains the NVIDIA drivers. As such, you must use the GPU Operator flags: --set driver.enabled=false.
Google Kubernetes Engine (GKE)
Before installing the GPU Operator:
Create the gpu-operator namespace by running:
kubectl create ns gpu-operator
Create the following file:
Run:
Rancher Kubernetes Engine 2 (RKE2)
Make sure to specify the CONTAINERD_CONFIG option exactly as outlined in the documentation and custom configuration guide, using the path /var/lib/rancher/rke2/agent/etc/containerd/config.toml.tmpl. Do not create the file manually if it does not already exist. The GPU Operator will handle this configuration during deployment.
Oracle Kubernetes Engine (OKE)
During cluster setup, create a nodepool, and set initial_node_labels to include oci.oraclecloud.com/disable-gpu-device-plugin=true which disables the NVIDIA GPU device plugin.
For GPU nodes, OKE defaults to Oracle Linux, which is incompatible with NVIDIA drivers. To resolve this, use a custom Ubuntu image instead.
Prometheus
Note
Installing Prometheus applies to Kubernetes only.
Additional Software Requirements
Distributed Training
Note
If you require both the MPI Operator and Kubeflow Training Operator, follow the steps below:
Install the Kubeflow Training Operator as described above.
Disable and delete MPI v1 in the Kubeflow Training Operator by running:
This section explains how to configure NVIDIA Run:ai to generate health alerts and to connect these alerts to alert-management systems within your organization. Alerts are generated for NVIDIA Run:ai clusters.
Alert Infrastructure
NVIDIA Run:ai uses Prometheus for externalizing metrics and providing visibility to end-users. The NVIDIA Run:ai Cluster installation includes Prometheus or can connect to an existing Prometheus instance used in your organization. The alerts are based on the Prometheus AlertManager. Once installed, it is enabled by default.
This document explains how to:
Configure alert destinations - triggered alerts send data to specified destinations
Understand the out-of-the-box cluster alerts, provided by NVIDIA Run:ai
Add additional custom alerts
A Kubernetes cluster with the necessary permissions
Up and running NVIDIA Run:ai environment, including Prometheus Operator
command-line tool installed and configured to interact with the cluster
Use the steps below to set up monitoring alerts.
Verify that the Prometheus Operator Deployment is running. Copy the following command and paste it in your terminal, where you have access to the Kubernetes cluster. In your terminal, you can see an output indicating the deployment's status, including the number of replicas and their current state.
Verify that Prometheus instances are running. Copy the following command and paste it in your terminal. You can see the Prometheus instance(s) listed along with their status:
In each of the steps in this section, copy the content of the code snippet to a new YAML file (e.g., step1.yaml).
Copy the following command to your terminal, to apply the YAML file to the cluster:
Copy the following command to your terminal to create the AlertManager CustomResource, to enable AlertManager:
Copy the following command to your terminal to validate that the AlertManager instance has started:
Open the terminal on your local machine or another machine that has access to your Kubernetes cluster.
Copy and paste the following command in your terminal to edit the Prometheus configuration for the runai namespace. This command opens the Prometheus configuration file in your default text editor (usually vi or nano):
Set out below are the various alert destinations.
In each step, copy the contents of the code snippets to a new file and apply it to the cluster using kubectl apply -f.
Add your smtp password as a secret:
Replace the relevant smtp details with your own, then apply the alertmanagerconfig using kubectl apply:
Save and exit the editor. The configuration is automatically reloaded.
Prometheus AlertManager provides a structured way to connect to alert-management systems. There are built-in plugins for popular systems such as PagerDuty and OpsGenie, including a generic Webhook.
Use to get a unique URL.
Use the upgrade cluster instructions to modify the values file:
Edit the values file to add the following, and replace <WEB-HOOK-URL> with the URL from :
Verify that you are receiving alerts on the , in the left pane:
A NVIDIA Run:ai cluster comes with several built-in alerts. Each alert notifies on a specific functionality of a NVIDIA Run:ai’s entity. There is also a single, inclusive alert: NVIDIA Run:ai Critical Problems, which aggregates all component-based alerts into a single cluster health test.
You can add additional alerts from NVIDIA Run:ai. Alerts are triggered by using the Prometheus query language with any NVIDIA Run:ai metric.
To create an alert, follow these steps using Prometheus query language with NVIDIA Run:ai Metrics:
Modify Values File: Use the upgrade cluster instructions to modify the values file.
Add Alert Structure: Incorporate alerts according to the structure outlined below. Replace placeholders <ALERT-NAME>, <ALERT-SUMMARY-TEXT>, <PROMQL-EXPRESSION>, <optional: duration s/m/h>, and <critical/warning> with appropriate values for your alert, as described below:
Copy the following command to your terminal to validate that the Prometheus operator has created a Service for AlertManager:
Copy and paste the following text to your terminal to change the configuration file:
Delete the prometheus pod to reset the pod's settings:
kubectl delete pod prometheus-runai-0 -n runai
Save the changes and exit the text editor.
Troubleshooting/Mitigation
To diagnose issues with the cluster-sync pod, follow these steps:
Paste the following command to your terminal, to receive detailed information about thecluster-sync deployment:kubectl describe deployment cluster-sync -n runai
Check the Logs: Use the following command to view the logs of the cluster-sync
Troubleshooting/Mitigation
To diagnose issues with the runai-agent pod, follow these steps:
Describe the Deployment: Run the following command to get detailed information about the runai-agent deployment:kubectl describe deployment runai-agent -n runai
Check the Logs: Use the following command to view the logs of the runai-agent
Troubleshooting/Mitigation
Add more memory resources to the container. If the issue persists, contact NVIDIA Run:ai
Troubleshooting/Mitigation
Add more memory resources to the container. If the issue persists, contact NVIDIA Run:ai
Troubleshooting/Mitigation
Paste this into your terminal:kubectl logs -n NAMESPACE POD_NAMEReplace NAMESPACE and POD_NAME with the relevant pod information from the previous step. Check the logs for any standout issues and verify that the container has sufficient resources. If you need further assistance, contact NVIDIA Run:ai
Troubleshooting/Mitigation
Add more CPU resources to the container. If the issue persists, please contact NVIDIA Run:ai.
Troubleshooting/Mitigation
Paste the following command to your terminal, where daemonsetX is the problematic daemonset from the pervious step: kubectl describe daemonsetX -n runai on the relevant deamonset(s) from the previous step. The next step is to look for the specific error which prevents it from creating pods. Possible reasons might be:
Node Resource Constraints: The nodes in the cluster may lack sufficient resources (CPU, memory, etc.) to accommodate new pods from the daemonset.
Node Selector or Affinity Rules: The daemonset may have node selector or affinity rules that are not matching with any nodes currently available in the cluster, thus preventing pod creation.
Troubleshooting/Mitigation
Paste the following commands to your terminal, to receive detailed information about the problematic deployment:kubectl describe deployment <DEPLOYMENT_NAME> -n runai kubectl describe deployment <DEPLOYMENT_NAME> -n runai-backend
Paste the following commands to your terminal, to check the replicaset details associated with the deployment:kubectl describe replicaset <REPLICASET_NAME> -n runai kubectl describe replicaset <REPLICASET_NAME> -n runai-backend
Troubleshooting/Mitigation
Once errors in the log have been identified, follow these steps to mitigate the issue: The error messages in the logs should provide detailed information about the problem.
Read through them to understand the nature of the issue. If the logs indicate which project failed to reconcile, you can further investigate by checking the status of that specific project.
Run the following command, replacing <PROJECT_NAME> with the name of the problematic project:kubectl get project <PROJECT_NAME> -o yaml
Troubleshooting/Mitigation
Once you've identified the problematic stateful sets, follow these steps to mitigate the issue:
Describe the stateful set to get detailed information on why it cannot create pods. Replace X with the name of the stateful set:kubectl describe statefulset X -n runai-backend
Review the description output to understand the root cause of the issue. Look for events or error messages that explain why the pods are not being created.
<ALERT-NAME>: Choose a descriptive name for your alert, such as HighCPUUsage or LowMemory.
<ALERT-SUMMARY-TEXT>: Provide a brief summary of what the alert signifies, for example, High CPU usage detected or Memory usage below threshold.
<PROMQL-EXPRESSION>: Construct a Prometheus query (PROMQL) that defines the conditions under which the alert should trigger. This query should evaluate to a boolean value (1 for alert, 0 for no alert).
<optional: duration s/m/h>: Optionally, specify a duration in seconds (s), minutes (m), or hours (h) that the alert condition should persist before triggering an alert. If not specified, the alert triggers as soon as the condition is met.
<critical/warning>: Assign a severity level to the alert, indicating its importance. Choose between critical for severe issues requiring immediate attention, or warning for less critical issues that still need monitoring.
kubectl get deployment kube-prometheus-stack-operator -n monitoring
The cluster-sync Pod in the runai namespace might not be functioning properly
Impact
Possible impact - no info/partial info from the cluster is being synced back to the control-plane
Severity
Critical
Diagnosis
kubectl get pod -n runai to see if the cluster-sync pod is running
Meaning
The runai-agent pod may be too loaded, is slow in processing data (possible in very big clusters), or the runai-agent pod itself in the runai namespace may not be functioning properly.
Impact
Possible impact - no info/partial info from the control-plane is being synced in the cluster
Severity
Critical
Diagnosis
Run: kubectl get pod -n runai And see if the runai-agent pod is running.
Meaning
Runai container is using more than 90% of its Memory limit
Impact
The container might run out of memory and crash.
Severity
Critical
Diagnosis
Calculate the memory usage, this is performed by pasting the following to your terminal: container_memory_usage_bytes{namespace=~"runai
Meaning
Runai container is using more than 80% of its memory limit
Impact
The container might run out of memory and crash
Severity
Warning
Diagnosis
Calculate the memory usage, this can be done by pasting the following to your terminal: container_memory_usage_bytes{namespace=~"runai
Meaning
Runai container has restarted more than twice in the last 10 min
Impact
The container might become unavailable and impact the NVIDIA Run:ai system
Severity
Warning
Diagnosis
To diagnose the issue and identify the problematic pods, paste this into your terminal: kubectl get pods -n runai kubectl get pods -n runai-backendOne or more of the pods have a restart count >= 2.
Meaning
runai container is using more than 80% of its CPU limit
Impact
This might cause slowness in the operation of certain NVIDIA Run:ai features.
Severity
Warning
Diagnosis
Paste the following query to your terminal in order to calculate the CPU usage: rate(container_cpu_usage_seconds_total{namespace=~"runai
Meaning
One of the critical NVIDIA Run:ai alerts is currently active
Impact
Impact is based on the active alert
Severity
Critical
Diagnosis
Check NVIDIA Run:ai alerts in Prometheus to identify any active critical alerts
Meaning
The Kubernetes node hosting GPU workloads is in an unknown state, and its health and readiness cannot be determined.
Impact
This may interrupt GPU workload scheduling and execution.
Severity
Critical - Node is either unschedulable or has unknown status. The node is in one of the following states:
Ready=Unknown: The control plane cannot communicate with the node.
Ready=False: The node is not healthy.
Unschedulable=True: The node is marked as unschedulable.
Diagnosis
Check the node's status using kubectl describe node, verify Kubernetes API server connectivity, and inspect system logs for GPU-specific or node-level errors.
Meaning
The Kubernetes node hosting GPU workloads has insufficient memory to support current or upcoming workloads.
Impact
GPU workloads may fail to schedule, experience degraded performance, or crash due to memory shortages, disrupting dependent applications.
Severity
Critical - Node is using more than 90% of its memory.
Warning - Node is using more than 80% of its memory.
Diagnosis
Use kubectl top node to assess memory usage, identify memory-intensive pods, consider resizing the node or optimizing memory usage in affected pods.
Meaning
There are currently 0 available pods for the runai daemonset on the relevant node
Impact
No fractional GPU workloads support
Severity
Critical
Diagnosis
Paste the following command to your terminal: kubectl get daemonset -n runai-backend In the result of this command, identify the daemonset(s) that don’t have any running pods
Meaning
Runai deployment has one or more unavailable pods
Impact
When this happens, there may be scale issues. Additionally, new versions cannot be deployed, potentially resulting in missing features.
Severity
Critical
Diagnosis
Paste the following commands to your terminal, in order to get the status of the deployments in the runai and runai-backend namespaces:kubectl get deployment -n runai kubectl get deployment -n runai-backendIdentify any deployments that have missing pods. Look for discrepancies in the DESIRED and AVAILABLE columns. If the number of AVAILABLE pods is less than the DESIRED pods, it indicates that there are missing pods.
Meaning
The project-controller in runai namespace had errors while reconciling projects
Impact
Some projects might not be in the “Ready” state. This means that they are not fully operational and may not have all the necessary components running or configured correctly.
Severity
Critical
Diagnosis
Retrieve the logs for the project-controller deployment by pasting the following command in your terminal:kubectl logs deployment/project-controller -n runai Carefully examine the logs for any errors or warning messages. These logs help you understand what might be going wrong with the project controller.
Meaning
Runai statefulset has no available pods
Impact
Absence of Metrics Database Unavailability
Severity
Critical
Diagnosis
To diagnose the issue, follow these steps:
Check the status of the stateful sets in the runai-backend namespace by running the following command:kubectl get statefulset -n runai-backend
Identify any stateful sets that have no running pods. These are the ones that might be causing the problem.
Analyze the Logs and Pod Details: From the information provided by the logs and the deployment details, attempt to identify the reason why the cluster-sync pod is not functioning correctly
Check Connectivity: Ensure there is a stable network connection between the cluster and the NVIDIA Run:ai Control Plane. A connectivity issue may be the root cause of the problem.
Contact Support: If the network connection is stable and you are still unable to resolve the issue, contact NVIDIA Run:ai support for further assistance
deployment:
kubectl logs deployment/runai-agent -n runai
Analyze the Logs and Pod Details: From the information provided by the logs and the deployment details, attempt to identify the reason why the runai-agent pod is not functioning correctly. There may be a connectivity issue with the control plane.
Check Connectivity: Ensure there is a stable network connection between the runai-agent and the control plane. A connectivity issue may be the root cause of the problem.
Consider Cluster Load: If the runai-agent appears to be functioning properly but the cluster is very large and heavily loaded, it may take more time for the agent to process data from the control plane.
Adjust Alert Threshold: If the cluster load is causing the alert to fire, you can adjust the threshold at which the alert triggers. The default value is 0.05. You can try changing it to a lower value (e.g., 0.045 or 0.04). To edit the value, paste the following in your terminal:kubectl edit runaiconfig -n runai/. In the editor, navigate to: spec: prometheus: agentPullPushRateMinForAlert . If the agentPullPushRateMinForAlert value does not exist, add it under spec -> prometheus .
Paste the following commands to your terminal to retrieve the logs for the deployment to identify any errors or issues:kubectl logs deployment/<DEPLOYMENT_NAME> -n runai kubectl logs deployment/<DEPLOYMENT_NAME> -n runai-backend
From the logs and the detailed information provided by the describe commands, analyze the reasons why the deployment is unable to create pods. Look for common issues such as:
Resource constraints (CPU, memory)
Misconfigured deployment settings or replicasets
Node selector or affinity rules preventing pod scheduling
If the issue persists, contact NVIDIA Run:ai.
Review the status section in the YAML output. This section describes the current state of the project and provide insights into what might be causing the failure. If the issue persists, contact NVIDIA Run:ai.
If you're unable to resolve the issue based on the information gathered, contact NVIDIA Run:ai support for further assistance.
Metrics are numeric measurements recorded over time that are emitted from the NVIDIA Run:ai cluster and telemetry is a numeric measurement recorded in real-time when emitted from the NVIDIA Run:ai cluster.
Scopes
NVIDIA Run:ai provides control-plane API which supports and aggregates analytics at various levels.
Level
Description
Cluster
A cluster is a set of nodes pools and nodes. With Cluster metrics, metrics are aggregated at the Cluster level. In the NVIDIA Run:ai user interface, metrics are available in the Overview dashboard.
Metric name in API
Applicable API endpoint
Metric name in UI per grid
Applicable UI grid
NVIDIA provides extended metrics as shown here . To enable these metrics, please contact NVIDIA Run:ai customer support.
Metric name in API
Applicable API endpoint
Metric name in UI
Applicable UI table
Metric
Applicable API endpoint
Metric name in UI
Applicable UI table
CPU_LIMIT_CORES
CPU limit
CPU_MEMORY_LIMIT_BYTES
CPU memory limit
CPU_MEMORY_REQUEST_BYTES
CPU memory request
CPU_MEMORY_USAGE_BYTES
CPU memory usage
CPU_MEMORY_UTILIZATION
CPU memory utilization
CPU_REQUEST_CORES
CPU request
CPU_USAGE_CORES
CPU usage
CPU_UTILIZATION
CPU compute utilization
CPU utilization
and
GPU_ALLOCATION
GPU devices (allocated)
GPU_MEMORY_REQUEST_BYTES
GPU memory request
GPU_MEMORY_USAGE_BYTES
GPU memory usage
GPU_MEMORY_USAGE_BYTES_PER_GPU
GPU memory usage per GPU
GPU_MEMORY_UTILIZATION
GPU memory utilization
GPU_MEMORY_UTILIZATION_PER_GPU
GPU memory utilization per GPU
GPU_QUOTA
Quota
GPU_UTILIZATION
GPU compute utilization
GPU_UTILIZATION_PER_GPU
GPU utilization per GPU
TOTAL_GPU
GPU devices total
Total GPUs
TOTAL_GPU_NODES
GPU_UTILIZATION_DISTRIBUTION
GPU utilization distribution
UNALLOCATED_GPU
GPU devices (unallocated)
Unallocated GPUs
CPU_QUOTA_MILLICORES
CPU_MEMORY_QUOTA_MB
CPU_ALLOCATION_MILLICORES
CPU_MEMORY_ALLOCATION_MB
POD_COUNT
RUNNING_POD_COUNT
GPU FP32 engine activity
GPU_FP64_ENGINE_ACTIVITY_PER_GPU
GPU FP64 engine activity
GPU_GRAPHICS_ENGINE_ACTIVITY_PER_GPU
Graphics engine activity
GPU_MEMORY_BANDWIDTH_UTILIZATION_PER_GPU
GPU_NVLINK_RECEIVED_BANDWIDTH_PER_GPU
GPU_NVLINK_TRANSMITTED_BANDWIDTH_PER_GPU
GPU_PCIE_RECEIVED_BANDWIDTH_PER_GPU
GPU_PCIE_TRANSMITTED_BANDWIDTH_PER_GPU
GPU_SM_ACTIVITY_PER_GPU
GPU SM activity
GPU_SM_OCCUPANCY_PER_GPU
GPU SM occupancy
GPU_TENSOR_ACTIVITY_PER_GPU
GPU tensor activity
Allocated GPUs
GPU_allocation
READY_GPU_NODES
Ready / Total GPU nodes
READY_GPUS
Ready / Total GPU devices
TOTAL_GPU_NODES
Ready / Total GPU nodes
TOTAL_GPUS
Ready / Total GPU devices
IDLE_ALLOCATED_GPUS
Idle allocated GPU devices
FREE_GPUS
Free GPU devices
TOTAL_CPU_CORES
CPU (Cores)
USED_CPU_CORES
ALLOCATED_CPU_CORES
Allocated CPU cores
TOTAL_GPU_MEMORY_BYTES
GPU memory
USED_GPU_MEMORY_BYTES
Used GPU memory
TOTAL_CPU_MEMORY_BYTES
CPU memory
USED_CPU_MEMORY_BYTES
Used CPU memory
ALLOCATED_CPU_MEMORY_BYTES
Allocated CPU memory
GPU_QUOTA
GPU quota
CPU_QUOTA
MEMORY_QUOTA
GPU_ALLOCATION_NON_PREEMPTIBLE
CPU_ALLOCATION_NON_PREEMPTIBLE
MEMORY_ALLOCATION_NON_PREEMPTIBLE
Node
Data is aggregated at the node level.
Node pool
Data is aggregated at the node pool level.
Workload
Data is aggregated at the workload level. In some workloads, e.g. with distributed workloads, these metrics aggregate data from all worker pods.
Pod
The basic unit of execution.
Project
The basic organizational unit. Projects are the tool to implement resource allocation policies as well as the segregation between different initiatives.
This section provides details on all hotfixes available for version 2.20. Hotfixes are critical updates released between our major and minor versions to address specific issues or vulnerabilities. These updates ensure the system remains secure, stable, and optimized without requiring a full version upgrade.
Version
Date (MM/DD/YYYY)
Internal ID
Description
2.20.82
02/15/2026
RUN-36555
Fixed a security vulnerability related to CVE-2024-56171 with severity HIGH.
2.20.79
02/05/2026
RUN-35420
Fixed a security vulnerability related to CVE-2024-25621 with severity HIGH.
2.20.79
02/05/2026
RUN-35425
Fixed a security vulnerability related to CVE-2025-23266 with severity HIGH.
2.20.79
02/05/2026
RUN-35511
Fixed an issue where an incorrect FQDN used during certificate generation caused errors.
2.20.79
02/05/2026
RUN-35922
Fixed a security vulnerability related to CVE-2026-0861 with severity HIGH.
2.20.79
02/05/2026
RUN-35421
Fixed a security vulnerability related to CVE-2025-15284 with severity HIGH.
2.20.78
01/13/2026
RUN-34678
Fixed a security vulnerability related to CVE-2025-58183 with severity HIGH.
2.20.78
01/13/2026
RUN-34858
Fixed a security vulnerability related to CVE-2024-25621 with severity HIGH.
2.20.78
01/13/2026
RUN-34932
Fixed a security vulnerability related to CVE-2025-58754 with severity HIGH.
2.20.77
12/22/2025
RUN-34680
Fixed a security vulnerability related to CVE-2025-58183 with severity HIGH.
2.20.76
12/17/2025
RUN-33806
Fixed an issue where containers ran as root instead of a non-privileged user.
2.20.74
12/10/2025
RUN-31856
Fixed a security vulnerability related to CVE-2025-47907 with severity HIGH.
2.20.74
12/10/2025
RUN-33780
Fixed an issue where apps with the “Viewer” role could not access node metrics, even when they had read permissions at the cluster scope.
2.20.74
12/10/2025
RUN-33862
Fixed an issue where the workloads service could enter a CrashLoopBackOff during upgrade.
2.20.72
11/20/2025
RUN-31738
Fixed an issue where GPU fraction requests were not applied when submitting distributed workloads.
2.20.72
11/20/2025
RUN-28762
Fixed an issue with inference workload ownership protection.
2.20.72
11/20/2025
RUN-32400
Fixed a security vulnerability related to CVE-2025-53547 with severity HIGH.
2.20.72
11/20/2025
RUN-32572
Fixed an issue where the RunaiAgentPullRateLow and RunaiAgentClusterInfoPushRateLow Prometheus alerts were firing incorrectly without cause.
2.20.72
11/20/2025
RUN-32889
Fixed an issue where idle GPU timeout rules were incorrectly applied to preemptible workspaces.
2.20.70
11/19/2025
RUN-31803
Fixed an issue where the Quota management dashboard occasionally displayed incorrect GPU quota values.
2.20.70
11/19/2025
RUN-32945
Fixed a security vulnerability related to CVE-2025-58754 with severity HIGH.
2.20.70
11/19/2025
RUN-33006
Fixed an issue in the CLI installer where the PATH was not configured for all shells. The installer now correctly configures PATH for both zsh and bash.
2.20.70
11/19/2025
RUN-33613
Fixed missing validations for CPU resources when the CPU quota feature flag was disabled, which caused project and department updates to skip required CPU checks.
2.20.70
11/19/2025
RUN-33947
Fixed an issue where SMTP configurations using the “none” option still sent empty username/password fields. Added the auth_none type to ensure no credentials are sent for passwordless SMTP servers.
2.20.69
10/16/2025
RUN-31422
Fixed an issue where updating project resources created through the deprecated Projects API did not work correctly.
2.20.69
10/16/2025
RUN-31995
Fixed a security vulnerability related to CVE-2025-22868 with severity HIGH.
2.20.69
10/16/2025
RUN-32146
Fixed a security vulnerability related to CVE-2025-5914 with severity HIGH.
2.20.69
10/16/2025
RUN-32730
Fixed an issue where incorrect average GPU utilization per project and workload type was displayed in the Projects view charts and tables.
2.20.69
10/16/2025
RUN-32789
Fixed an issue in CLI v2 where the --master-extended-resource flag had no effect in MPI training workloads.
2.20.68
04/09/2025
RUN-32057
Fixed an issue where inference ownership protection did not work correctly.
2.20.67
09/03/2025
RUN-31383
Fixed a security vulnerability related to CVE-2025-7783 with severity HIGH.
2.20.67
09/03/2025
RUN-31571
Fixed a security vulnerability related to CVE-2025-6965 with severity HIGH.
2.20.67
09/03/2025
RUN-31625
Fixed a security vulnerability related to CVE-2025-7425 with severity HIGH.
2.20.67
09/03/2025
RUN-31852
Fixed a security vulnerability related to CVE-2025-47907 with severity HIGH.
2.20.67
09/03/2025
RUN-31996
Fixed a security vulnerability related to CVE-2025-22868 with severity HIGH.
2.20.63
08/14/2025
RUN-31358
Fixed an issue where enabling enableWorkloadOwnershipProtection for inference workloads caused newly submitted workloads to get stuck.
2.20.63
08/14/2025
RUN-31483
Fixed an issue which would apply the GPU value of the workload's pod with the wrong value if a default was set in the policy.
2.20.63
08/14/2025
RUN-31792
Fixed a security vulnerability related to CVE-2025-7425 with severity HIGH.
2.20.63
08/14/2025
RUN-31855
Fixed a security vulnerability related to CVE-2025-47907 with severity HIGH.
2.20.63
08/14/2025
RUN-31864
Fixed a security vulnerability related to CVE-2025-22868 with severity HIGH.
2.20.62
08/05/2025
RUN-28394
Fixed an issue where the "Get Role by ID" API returned an "insufficient permissions" error for system administrator.
2.20.60
08/01/2025
RUN-29092
Fixed an issue where project quota could not be changed due to scheduling rules being set to 0 instead of null.
2.20.60
08/01/2025
RUN-30746
Fixed an issue where workloads could not be scheduled if the combined length of the project name and node pool name was excessively long.
2.20.60
08/01/2025
RUN-31039
Fixed a base image security vulnerability in libxml2 related to CVE-2025-49796 with severity HIGH.
2.20.60
08/01/2025
RUN-31263
Fixed an issue where setting defaults for servingPort fields failed and incorrectly required the container port default as well.
2.20.60
08/01/2025
RUN-31265
Fixed a security vulnerability related to CVE-2025-30749 with severity HIGH.
2.20.60
08/01/2025
RUN-31305
Fixed a security vulnerability related to CVE-2025-22868 with severity HIGH.
2.20.59
07/14/2025
RUN-28377
Fixed an issue where the CLI cache folder was created in a location where the user might not have sufficient permissions, leading to failures. The cache folder is now created in the same directory as the config file.
2.20.58
07/14/2025
RUN-28189
Fixed a security vulnerability in github.com.golang-jwt.jwt.v5 related to CVE-2025-30204 with severity HIGH.
2.20.57
07/13/2025
RUN-30713
Fixed an issue where configuring an incorrect Auth URL during CLI installation could lead to connectivity issues. To prevent this, the option to set the Auth URL during installation has been removed. The install script now automatically sets the control plane URL based on the script's source.
2.20.56
07/08/2025
RUN-30673
Fixed an issue where users with create permissions on one scope and read-only permissions on another were incorrectly allowed to create projects in both scopes.
2.20.56
07/08/2025
RUN-29879
Fixed an issue where updating the ClusterPolicy did not apply changes to the binder configuration unless the component was manually restarted.
2.20.56
07/08/2025
RUN-29113
Fixed a security vulnerability in DOMPurify related to CVE-2024-24762 with severity HIGH.
2.20.53
06/29/2025
RUN-25883
Fixed a security vulnerability in io.netty:netty-handler related to CVE-2025-24970 with severity HIGH.
2.20.53
06/29/2025
RUN-29049
Fixed a security vulnerability in github.com.golang.org.x.crypto related to CVE-2025-22869 with severity HIGH.
2.20.53
06/29/2025
RUN-30674
Fixed an issue where, on rare occasions, running the runai upgrade command deleted all files in the current directory.
2.20.52
06/24/2025
RUN-29768
Fixed an issue where the Get token request returned a 500 error when the email mapper failed.
2.20.52
06/24/2025
RUN-29143
Fixed an issue where nodes could become unschedulable when workloads were submitted to a different node pool.
2.20.51
06/24/2025
RUN-29323
Fixed an issue where Prometheus failed to send metrics for OpenShift.
2.20.49
06/11/2025
RUN-29548
Fixed an issue in CLI v2 where the update server did not receive the terminal size during exec commands requiring TTY support. The terminal size is now set once upon session creation, ensuring proper behavior for interactive sessions.
2.20.49
06/11/2025
RUN-26361
Fixed an issue where Prometheus remote-write credentials were not properly updated on OpenShift clusters.
2.20.46
05/26/2025
RUN-28286
Fixed an issue where CPU-only workloads incorrectly triggered idle timeout notifications intended for GPU workloads.
2.20.46
05/26/2025
RUN-28851
Fixed an issue in CLI v2 where the port-forward command terminated SSH connections after 15–30 seconds due to an idle timeout.
2.20.45
05/21/2025
RUN-28608
Fixed an issue where users with the ML Engineer role were unable to delete multiple inference jobs at once.
2.20.44
05/20/2025
RUN-28665
Fixed an issue where using serving port authorization fields in the Create Inference API on unsupported clusters did not return an error.
2.20.43
05/15/2025
RUN-27295
Fixed an issue in CLI v2 where the --node-type flag for inference workloads was not properly propagated to the pod specification.
2.20.43
05/15/2025
RUN-27375
Fixed an issue where projects were not visible in the legacy job submission form, preventing users from selecting a target project.
2.20.43
05/15/2025
RUN-27841
Fixed an issue where workloads without a memory request failed validation in the workload-controller webhook.
2.20.42
05/13/2025
RUN-27514
Fixed an issue with incorrect calculation of the ALLOCATED_CPU_MEMORY_BYTES telemetry metric.
2.20.42
05/13/2025
RUN-27521
Fixed an issue where disabling CPU quota in the General settings did not remove existing CPU quotas from projects and departments.
2.20.42
05/13/2025
RUN-28380
Fixed a security vulnerability in github.com.golang.org.x.crypto related to CVE-2025-22869 with severity HIGH.
2.20.41
05/06/2025
RUN-28241
Fixed a security vulnerability in github.com.golang-jwt.jwt.v5 related to CVE-2025-30204 with severity HIGH.
2.20.41
05/06/2025
RUN-28097
Fixed an issue where the ALLOCATED_GPU_COUNT_PER_GPU metric displayed incorrect data for fractional pods.
2.20.41
05/06/2025
RUN-28006
Fixed an issue where tokens became invalid for the API server after one hour.
2.20.41
05/06/2025
RUN-27638
Fixed a security vulnerability in axios related to CVE-2025-27152 with severity HIGH.
2.20.40
04/30/2025
RUN-27837
Fixed an issue where a node pool’s placement strategy stopped functioning correctly after being edited.
2.20.40
04/30/2025
RUN-27628
Fixed an issue where a node pool could remain stuck in Updating status in certain cases.
2.20.40
04/30/2025
RUN-27893
Fixed an issue where workloads submitted with an invalid node port range would get stuck in Creating status.
2.20.39
04/24/2025
RUN-26359
Fixed an issue in CLI v2 where using the --toleration option required incorrect mandatory fields.
2.20.39
04/24/2025
RUN-27088
Fixed a security vulnerability in tar-fs related to CVE-2024-12905 with severity HIGH.
2.20.39
04/24/2025
RUN-26608
Fixed an issue by adding a flag to the cli config set command and the CLI install script, allowing users to set a cache directory.
2.20.39
04/24/2025
RUN-27247
Fixed security vulnerabilities in Spring framework used by db-mechanic service - CVE-2021-27568, CVE-2021-44228, CVE-2022-22965, CVE-2023-20873, CVE-2024-22243, CVE-2024-22259 and CVE-2024-22262.
2.20.39
04/24/2025
RUN-27309
Fixed an issue where workloads configured with a multi node pool setup could fail to schedule on a specific node pool in the future after an initial scheduling failure, even if sufficient resources later became available.
2.20.37
04/14/2025
RUN-27233
Fixed an issue where PVCs were unexpectedly deleted. A validation request is now performed before deletion to ensure the PVC asset has already been removed from the system.
2.20.36
04/09/2025
RUN-24016
Fixed an issue where workloads could be submitted with non-positive memory quantity values.
2.20.36
04/09/2025
RUN-27075
Fixed an issue where, in some cases, creating a project through the API with partial parameters would return an error when the "Limit projects from exceeding department quota" setting was enabled.
2.20.36
04/09/2025
RUN-27159
Fixed an issue where allocated GPU memory for workloads was presented in MB but the value was in MiB.
2.20.36
04/09/2025
RUN-27196
Fixed an issue where workloads could be submitted with invalid memory quantity values.
2.20.35
04/03/2025
RUN-26878
Fixed an issue where, in some cases, previous inference request errors caused subsequent successful requests to report latency as NaN (Not a Number) instead of the actual value. As a result, these requests were not displayed in the UI latency graph, and the API returned NaN.
2.20.34
04/02/2025
RUN-26671
Fixed an issue where compute resource assets configured with multiple whole GPUs (e.g., 3 GPUs at 100%) were incorrectly submitted as a single GPU.
2.20.34
04/03/2025
RUN-27035
Fixed an issue where, on very rare occasions, a small subset of metrics was missing.
2.20.33
03/31/2025
RUN-26955
Fixed an issue where duplicate results appeared in some cases for node metrics.
2.20.32
03/26/2025
RUN-25985
Fixed a bug that caused the deletion of a workload in the UI to fail when ownership protection was enabled and the workload was originally created via the CLI.
2.20.32
03/26/2025
RUN-26641
Fixed an issue where CLI usage could be blocked even when the CLI version and control plane version were aligned.
2.20.31
03/25/2025
RUN-26324
Fixed an issue in the documentation where the toleration name was incorrectly marked as mandatory. Also fixed an issue in CLI v2 where the required fields were incorrect: name is no longer mandatory, and key is now required.
2.20.29
03/20/2025
RUN-26062
Fixed an issue where a new API, intended for clusters running version 2.18 and above, was not disabled for older clusters, causing unintended workload operations — such as creation, deletion, resumption, or stoppage — after upgrading from versions below 2.18 to 2.18 or higher.
2.20.29
03/20/2025
RUN-26691
Fixed a security vulnerability in axios related to CVE-2025-27152 with severity HIGH.
2.20.29
03/20/2025
RUN-26772
Fixed an issue where a GET request for a non-existent workload returned an unexpected response format.
2.20.28
03/17/2025
RUN-26630
Fixed an issue that prevented updating tenant-scoped data sources.
2.20.28
03/17/2025
RUN-26688
Fixed an issue where node pools could get stuck in Updating state.
2.20.28
03/17/2025
RUN-26684
Fixed an issue where default node pools were deleted.
2.20.26
03/09/2025
RUN-25987
Updated all workload APIs to accurately reflect that both creating and deleting workloads return a 202 status code in the API documentation.
2.20.26
03/09/2025
RUN-26240
CLI v2: Fixed an issue in the install script, where setting the install path environment variable did not install all the files in the correct path.
2.20.26
03/09/2025
RUN-26479
CLI v2: Fixed an issue where using the wrong workload type in the workload describe command did not display an error.
2.20.25
03/06/2025
RUN-26253
CLI v2 list project now supports limit and offset flags.
2.20.25
03/06/2025
RUN-26310
Fixed an issue where Docker registry credentials/secrets were not found when adding environment variables.
2.20.25
03/06/2025
RUN-26355
Fixed an issue where collecting metrics on distributed workloads did not start properly.
2.20.25
03/06/2025
RUN-26356
Fixed an issue where Lowest for over quota weight did not appear as 0.
2.20.25
03/06/2025
RUN-26272
Fixed an issue where connecting to the SMTP server without credentials was not allowed.
2.20.25
03/06/2025
RUN-26249
Fixed an issue where creating a policy with the fields tty and stdin resulted in a validation error.
2.20.25
03/06/2025
RUN-26308
CLI v2: Fixed several text mismatches in runai training list --help and deprecated messages.
2.20.24
02/28/2025
RUN-26304
Fixed an issue where quota numbers were incorrectly displayed in the reclaim message.
2.20.24
02/28/2025
RUN-25984
Fixed an issue where api/v1/me/password was missing a validation message when changing a password.
2.20.23
02/27/2025
RUN-25895
Fixed an issue where projects that were updated due to changes in their department override fields were not always updated in the cluster.
2.20.23
02/27/2025
RUN-25969
Fixed an issue where the UI incorrectly rejected valid toleration key inputs during validation checks.
2.20.23
02/27/2025
RUN-25982
CLI v2: Fixed an issue where interactive mode did not return an error for invalid control plane/Authentication URLs and timeout duration.
2.20.23
02/27/2025
RUN-26135
Fixed an issue which prevented enabling/disabling email notifications.
2.20.23
02/27/2025
RUN-26178
Fixed an issue where the upgrade to 2.20 failed to migrate departments and projects if the job to validate the default department to clusters ran first.
2.20.23
02/27/2025
RUN-26248
CLI v2: Fixed an issue where submitting an interactive workload with attach was not possible after the workload started running.
2.20.22
02/20/2025
RUN-23048
Improved error handling to display meaningful messages from the CLI upgrade command.
2.20.22
02/20/2025
RUN-25323
Fixed an issue in CLI v2 where “stopping the workload” event was missing when workloads reached the project’s running time limit.
2.20.22
02/20/2025
RUN-25511
Fixed an issue where deleting a workload in CLI v2 caused an error due to a missing response body. The CLI now correctly receives and handles the expected response body.
2.20.22
02/20/2025
RUN-25552
Fixed an issue where clicking on "View Access Rules" in the Users table displayed only the first group if a user belonged to multiple groups.
2.20.22
02/20/2025
RUN-25571
Reduced memory consumption to improve stability and increase scaling.
2.20.22
02/20/2025
RUN-25659
CLI v2: Fixed an issue where min and max replicas were able to be submitted using TensorFlow.
2.20.22
02/20/2025
RUN-25946
Fixed an issue where the Update Inference Spec API did not enforce a minimum cluster version returning a 400 Bad Request for versions below 2.19.
2.20.22
02/20/2025
RUN-25921
Fixed an issue where the Workspaces, Trainings and Distributed APIs did not enforce a minimum cluster version returning a 400 Bad Request for versions below 2.18.
2.20.21
02/20/2025
RUN-25730
Fixed an issue where upgrading from 2.19 to 2.20 caused workspaces to be deleted if the project was recreated during the upgrade.
2.20.20
02/20/2025
RUN-25912
Fixed an issue where pod terminations in PyTorch jobs did not apply the back-off limit attribute causing jobs to fail.
2.20.19
02/20/2025
RUN-25249
Fixed an issue where submitting a workload using a yaml file with a port but without service type would use ClusterIP as the default service type. If no host port is provided, the target port will be used as the host.
2.20.19
02/20/2025
RUN-25558
Fixed a memory issue when handling external workloads (deployments, ray etc.) which when scaled caused ETCD memory to increase.
2.20.18
02/03/2025
RUN-24700
CLI v2: Workload describe command no longer requires type or framework flags.
2.20.17
01/30/2025
RUN-25534
Fixed range of generated reports to 30 days.
2.20.17
01/30/2025
RUN-25466
Fixed an issue where an environment variable with the value SECRET was not valid as only SECRET:xxx was accepted.
2.20.16
01/28/2025
RUN-24858
Fixed High vulnerability CVE-2024-56344 for third party open source 'systeminformation'.
2.20.16
01/28/2025
RUN-25405
CLI v1: Fixed an issue where the generated PVC was not created properly.
2.20.15
01/24/2025
RUN-24354
Fixed an issue where migrating workloads failed due to slow network connection.
2.20.14
01/23/2025
RUN-24754
Fixed an issue where the status of training and interactive workloads was not updated correctly.
2.20.14
01/23/2025
RUN-24838
Fixed an issue where an environment asset could not be created if it included an environment variable with no value specified.
2.20.11
01/21/2025
RUN-25303
Fixed an issue where submitting with the --attach flag was supported only in a workspace workload.
2.20.11
01/21/2025
RUN-25291
Fixed a security vulnerability in golang.org/x/net v0.33.0 with CVE-2024-45338 with severity HIGH.
2.20.10
01/20/2025
RUN-25234
Fixed an authentication issue in CLI V1.
2.20.9
01/19/2025
RUN-25032
Fixed an issue where inference workloads with large container sizes skipped the Initializing state.
2.20.9
01/19/2025
RUN-24752
Fixed an issue where a workload would move to a failed state when created with a custom NodePort that was already allocated.
2.20.9
01/19/2025
RUN-25031
Fixed an issue in the Templates form where existing credentials in the environment variables section were not displayed.
2.20.5
01/14/2025
RUN-25061
Fixed a security vulnerability in github.com.go-git.go-git.v5 with CVE CVE-2025-21613 with severity HIGH.
Roles
This section explains the available roles in the NVIDIA Run:ai platform.
A role is a set of permissions that can be assigned to a subject in a scope. A permission is a set of actions (View, Edit, Create and Delete) over a NVIDIA Run:ai entity (e.g. projects, workloads, users).
Roles Table
The Roles table can be found under Access in the NVIDIA Run:ai platform.
The Roles table displays a list of roles available to users in the NVIDIA Run:ai platform. It is not possible to create additional roles or edit or delete existing roles.
The Roles table consists of the following columns:
Column
Description
Filter - Click ADD FILTER, select the column to filter by, and enter the filter values
Search - Click SEARCH and type the value to search by
Sort - Click each column header to sort by
Column selection - Click COLUMNS and select the columns to display in the table
To review a role click the role name on the table
In the role form review the following:
Role name
The name of the role
NVIDIA Run:ai supports the following roles and their permissions. Under each role is a detailed list of the actions that the role assignee is authorized to perform for each entity.
Go to the API reference to view the available actions.
Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows.
Entity
A system-managed object that can be viewed, edited, created or deleted by a user based on their assigned role and scope
Actions
The actions that the role assignee is authorized to perform for each entity
View - If checked, an assigned user with this role can view instances of this type of entity within their defined scope
Edit - If checked, an assigned user with this role can change the settings of an instance of this type of entity within their defined scope
Create - If checked, an assigned user with this role can create new instances of this type of entity within their defined scope
Delete - If checked, an assigned user with this role can delete instances of this type of entity within their defined scope
Role
The name of the role
Created by
The name of the role creator
Creation time
The timestamp when the role was created
Customizing the Table View
Reviewing a Role
Roles in NVIDIA Run:ai
Compute resource administrator
Entity
View
Edit
Create
Delete
Credentials administrator
Entity
View
Edit
Create
Delete
Data source administrator
Entity
View
Edit
Create
Delete
Data volume administrator
Entity
View
Edit
Create
Delete
Department administrator
Entity
View
Edit
Create
Delete
Department viewer
Entity
View
Edit
Create
Delete
Account
Editor
Entity
View
Edit
Create
Delete
Account
Environment administrator
Entity
View
Edit
Create
Delete
L1 researcher
Entity
View
Edit
Create
Delete
Account
L2 researcher
Entity
View
Edit
Create
Delete
Account
ML engineer
Entity
View
Edit
Create
Delete
Account
Research manager
Entity
View
Edit
Create
Delete
Account
System administrator
Entity
View
Edit
Create
Delete
Account
Template administrator
Entity
View
Edit
Create
Delete
Viewer
Entity
View
Edit
Create
Delete
Account
Permitted workloads
When assigning a role with either one, all or any combination of the View, Edit, Create and Delete permissions for workloads, the subject has permissions to manage not only NVIDIA Run:ai workloads (Workspace, Training, Inference), but also a list of 3rd party workloads:
A workload policy is an end-to-end solution for AI managers and administrators to control and simplify how workloads are submitted, setting best practices, enforcing limitations, and standardizing processes for AI projects within their organization.
This article explains the policy YAML fields and the possible rules and defaults that can be set for each field.
Policy YAML Fields - Reference Table
The policy fields are structured in a similar format to the workload API fields. The following tables represent a structured guide designed to help you understand and configure policies in a YAML format. It provides the fields, descriptions, defaults and rules for each workload type.
Click the link to view the value type of each field.
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Fields
Description
Value type
Supported NVIDIA Run:ai workload type
Each field has a specific value type. The following value types are supported.
Value type
Description
Supported rule type
Defaults
Workload fields of type itemized have multiple instances, however in comparison to objects, each can be referenced by a key field. The key field is defined for each field.
Consider the following workload spec:
In this example, extendedResources have two instances, each has two attributes: resource (the key attribute) and quantity.
In policy, the defaults and rules for itemized fields have two sub sections:
Instances: default items to be added to the policy or rules which apply to an instance as a whole.
Attributes: defaults for attributes within an item or rules which apply to attributes within each item.
Consider the following example:
Assume the following workload submission is requested:
The effective policy for the above mentioned workload has the following extendedResources instances:
Resource
Source of the instance
Quantity
Source of the attribute quantity
A workload submission request cannot exclude the default/cpu resource, as this key is included in the locked rules under the instances section. {#a-workload-submission-request-cannot-exclude-the-default/cpu-resource,-as-this-key-is-included-in-the-locked-rules-under-the-instances-section.}
Rule types
Description
Supported value types
For each field of a specific policy, you can specify both rules and defaults. A policy spec consists of the following sections:
Rules
Defaults
Imposed Assets
Rules set up constraints on workload policy fields. For example, consider the following policy:
Such a policy restricts the maximum value for gpuDeviceRequests to 8, and the minimal value for runAsUid, provided in the security section to 500.
The defaults section is used for providing defaults for various workload fields. For example, consider the following policy:
Assume a submission request with the following values:
Image: ubuntu
runAsUid: 501
The effective workload that runs has the following set of values:
Field
Value
Source
Default instances of a storage field can be provided using a datasource containing the details of this storage instance. To add such instances in the policy, specify those asset IDs in the imposedAssets section of the policy.
Assets with references to credential assets (for example: private S3, containing reference to an AccessKey asset) cannot be used as imposedAssets.
Workspace
Standard training
Distributed training
environmentVariables
Set of environmentVariables to populate the container running the workspace
Workspace
Standard training
Distributed training
image
Specifies the image to use when creating the container running the workload
Workspace
Standard training
Distributed training
imagePullPolicy
Specifies the pull policy of the image when starting t a container running the created workload. Options are: Always, Never, or IfNotPresent
Workspace
Standard training
Distributed training
workingDir
Container’s working directory. If not specified, the container runtime default is used, which might be configured in the container image
Workspace
Standard training
Distributed training
nodeType
Nodes (machines) or a group of nodes on which the workload runs
Workspace
Standard training
Distributed training
nodePools
A prioritized list of node pools for the scheduler to run the workspace on. The scheduler always tries to use the first node pool before moving to the next one when the first is not available.
Workspace
Standard training
Distributed training
annotations
Set of annotations to populate into the container running the workspace
Workspace
Standard training
Distributed training
labels
Set of labels to populate into the container running the workspace
Workspace
Standard training
Distributed training
terminateAfterPreemtpion
Indicates whether the job should be terminated, by the system, after it has been preempted
Workspace
Standard training
Distributed training
autoDeletionTimeAfterCompletionSeconds
Specifies the duration after which a finished workload (Completed or Failed) is automatically deleted. If this field is set to zero, the workload becomes eligible to be deleted immediately after it finishes.
Workspace
Standard training
Distributed training
backoffLimit
Specifies the number of retries before marking a workload as failed
Workspace
Standard training
Distributed training
cleanPodPolicy
Specifies which pods will be deleted when the workload reaches a terminal state (completed/failed). The policy can be one of the following values:
Running - Only pods still running when a job completes (for example, parameter servers) will be deleted immediately. Completed pods will not be deleted so that the logs will be preserved. (Default for MPI)
All - All (including completed) pods will be deleted immediately when the job finishes.
Distributed training
completions
Used with Hyperparameter Optimization. Specifies the number of successful pods the job should reach to be completed. The Job is marked as successful once the specified amount of pods has succeeded.
Standard training
parallelism
Used with Hyperparameters Optimization. Specifies the maximum desired number of pods the workload should run at any given time.
Standard training
exposedUrls
Specifies a set of exported URL (e.g. ingress) from the container running the created workload.
Workspace
Standard training
Distributed training
relatedUrls
Specifies a set of URLs related to the workload. For example, a URL to an external server providing statistics or logging about the workload.
Workspace
Standard training
Distributed training
PodAffinitySchedulingRule
Indicates if we want to use the Pod affinity rule as: the “hard” (required) or the “soft” (preferred) option. This field can be specified only if PodAffinity is set to true.
Workspace
Standard training
Distributed training
podAffinityTopology
Specifies the Pod Affinity Topology to be used for scheduling the job. This field can be specified only if PodAffinity is set to true.
Workspace
Standard training
Distributed training
ports
Specifies a set of ports exposed from the container running the created workload. More information in Ports fields below.
Workspace
Standard training
Distributed training
probes
Specifies the ReadinessProbe to use to determine if the container is ready to accept traffic. More information in below
-
Workspace
Standard training
Distributed training
tolerations
Toleration rules which apply to the pods running the workload. Toleration rules guide (but do not require) the system to which node each pod can be scheduled to or evicted from, based on matching between those rules and the set of taints defined for each Kubernetes node.
Workspace
Standard training
Distributed training
priorityClass
Priority class of the workload. The values for workspace are build (default) or interactive-preemptible. For training only, use train. Enum: "build", "train", "interactive-preemptible"
Workspace
storage
Contains all the fields related to storage configurations. More information in below.
-
Workspace
Standard training
Distributed training
security
Contains all the fields related to security configurations. More information in below.
-
Workspace
Standard training
Distributed training
compute
Contains all the fields related to compute configurations. More information in below.
-
Workspace
Standard training
Distributed training
tty
Whether this container should allocate a TTY for itself, also requires 'stdin' to be true
Workspace
Standard training
Distributed training
stdin
Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF
Workspace
Standard training
Distributed training
numWorkers
The number of workers that will be allocated for running the workload.
Distributed training
distributedFramework
The distributed training framework used in the workload.
Enum: "MPI" "PyTorch" "TF" "XGBoost"
Distributed training
slotsPerWorker
Specifies the number of slots per worker used in hostfile. Defaults to 1. (applicable only for MPI)
Distributed training (MPI only)
minReplicas
The lower limit for the number of worker pods to which the training job can scale down. (applicable only for PyTorch)
Distributed training (PyTorch only)
maxReplicas
The upper limit for the number of worker pods that can be set by the autoscaler. Cannot be smaller than MinReplicas. (applicable only for PyTorch)
Distributed training (PyTorch only)
Workspace
Standard training
Distributed training
external
The external port which allows a connection to the container port. If not specified, the port is auto-generated by the system.
Workspace
Standard training
Distributed training
toolType
The tool type that runs on this port.
Workspace
Standard training
Distributed training
toolName
A name describing the tool that runs on this port.
Workspace
Standard training
Distributed training
Workspace
Standard training
Distributed training
seccompProfileType
Indicates which kind of seccomp profile is applied to the container. The options are:
RuntimeDefault - the container runtime default profile should be used
Unconfined - no profile should be applied
Workspace
Standard training
Distributed training
runAsNonRoot
Indicates that the container must run as a non-root user.
Workspace
Standard training
Distributed training
readOnlyRootFilesystem
If true, mounts the container's root filesystem as read-only.
Workspace
Standard training
Distributed training
runAsUid
Specifies the Unix user id with which the container running the created workload should run.
Workspace
Standard training
Distributed training
runasGid
Specifies the Unix Group ID with which the container should run.
Workspace
Standard training
Distributed training
supplementalGroups
Comma separated list of groups that the user running the container belongs to, in addition to the group indicated by runAsGid.
Workspace
Standard training
Distributed training
allowPrivilegeEscalation
Allows the container running the workload and all launched processes to gain additional privileges after the workload starts
Workspace
Standard training
Distributed training
hostIpc
Whether to enable hostIpc. Defaults to false.
Workspace
Standard training
Distributed training
hostNetwork
Whether to enable host network.
Workspace
Standard training
Distributed training
Workspace
Standard training
Distributed training
cpuMemoryRequest
The amount of CPU memory to allocate for this workload (1G, 20M, .etc). The workload receives at least this amount of memory. Note that the workload is not scheduled unless the system can guarantee this amount of memory to the workload
Workspace
Standard training
Distributed training
cpuMemoryLimit
Limitations on the CPU memory to allocate for this workload (1G, 20M, .etc). The system guarantees that this workload is not be able to consume more than this amount of memory. The workload receives an error when trying to allocate more memory than this limit.
Workspace
Standard training
Distributed training
largeShmRequest
A large /dev/shm device to mount into a container running the created workload (shm is a shared file system mounted on RAM).
Workspace
Standard training
Distributed training
gpuRequestType
Sets the unit type for GPU resources requests to either portion, memory or mig profile. Only if gpuDeviceRequest = 1, the request type can be stated as portion, memory or migProfile.
Workspace
Standard training
Distributed training
migProfile (Deprecated)
Specifies the memory profile to be used for workload running on NVIDIA Multi-Instance GPU (MIG) technology.
Workspace
Standard training
Distributed training
gpuPortionRequest
Specifies the fraction of GPU to be allocated to the workload, between 0 and 1. For backward compatibility, it also supports the number of gpuDevices larger than 1, currently provided using the gpuDevices field.
Workspace
Standard training
Distributed training
gpuDeviceRequest
Specifies the number of GPUs to allocate for the created workload. Only if gpuDeviceRequest = 1, the gpuRequestType can be defined.
Workspace
Standard training
Distributed training
gpuPortionLimit
When a fraction of a GPU is requested, the GPU limit specifies the portion limit to allocate to the workload. The range of the value is from 0 to 1.
Workspace
Standard training
Distributed training
gpuMemoryRequest
Specifies GPU memory to allocate for the created workload. The workload receives this amount of memory. Note that the workload is not scheduled unless the system can guarantee this amount of GPU memory to the workload.
Workspace
Standard training
Distributed training
gpuMemoryLimit
Specifies a limit on the GPU memory to allocate for this workload. Should be no less than the gpuMemory.
Workspace
Standard training
Distributed training
extendedResources
Specifies values for extended resources. Extended resources are third-party devices (such as high-performance NICs, FPGAs, or InfiniBand adapters) that you want to allocate to your Job.
Workspace
Standard training
Distributed training
Workspace
Standard training
Distributed training
Details of the git repository and items mapped to it.
Workspace
Standard training
Distributed training
Specifies persistent volume claims to mount into a container running the created workload.
Workspace
Standard training
Distributed training
Specifies NFS volume to mount into the container running the workload.
Workspace
Standard training
Distributed training
Specifies S3 buckets to mount into the container running the workload.
Workspace
Standard training
Distributed training
configMapVolumes
Specifies ConfigMaps to mount as volumes into a container running the created workload.
Workspace
Standard training
Distributed training
secretVolume
Set of secret volumes to use in the workload. A secret volume maps a secret resource in the cluster to a file-system mount point within the container running the workload.
Workspace
Standard training
Distributed training
canEdit
required
options
abc
Itemized
An ordered collection of items (objects), which can be of different types (all items in the list are of the same type). For further information see the chapter below the table.
canAdd
locked
See below
Integer
An Integer is a whole number without a fractional component.
canEdit
required
min
max
100
Number
Capable of having non-integer values
canEdit
required
min
defaultFrom
10.3
Quantity
Holds a string composed of a number and a unit representing a quantity
canEdit
required
min
max
5M
Array
Set of values that are treated as one, as opposed to Itemized in which each item can be referenced separately.
canEdit
required
node-a
node-b
node-c
Submission request
3
The default of the quantity attribute from the attributes section
added/memory
Submission request
5M
Submission request
canEdit
Whether the submission request can modify the policy default for this field. In this example, it is assumed that the policy has default for imagePullPolicy. As canEdit is set to false, submission requests are not able to alter this default.
required
When set to true, the workload must have a value for this field. The value can be obtained from policy defaults. If no value specified in the policy defaults, a value must be specified for this field in the submission request.
min
The minimal value for the field
max
The maximal value for the field
step
The allowed gap between values for this field. In this example the allowed values are: 1, 3, 5, 7
options
Set of allowed values for this field
defaultFrom
Set a default value for a field that will be calculated based on the value of another field
security.runAsNonRoot
true
Policy defaults
security.runAsUid
501
Submission request
args
When set, contains the arguments sent along with the command. These override the entry point of the image in the created workload
Instructs the system to create a temporary home directory for the user within the container. Data stored in this directory is not saved when the container exists. When the runAsUser flag is set to true, this flag defaults to true as well
container
The port that the container running the workload exposes.
CPU units to allocate for the created workload (0.5, 1, .etc). The workload receives at least this amount of CPU. Note that the workload is not scheduled unless the system can guarantee this amount of CPUs to the workload.
Set of items that the workload is unable to modify or exclude. In this example, a workload policy default is given to HOME and USER, that the submission request cannot modify or exclude from the workload.
It is possible to specify a rule for each field, which states if a submission request is allowed to change the policy default for that given field, for example:
If this policy is applied, the submission request above fails, as it attempts to change the value of secuirty.runAsUid from 500 (the policy default) to 501 (the value provided in the submission request), which is forbidden due to canEdit rule set to false for this field.
Imposed Assets
Specifies the default service exposure method for ports. the default shall be used for ports which do not specify service type. Options are: LoadBalancer, NodePort or ClusterIP. For more information see the guide.
The capabilities field allows adding a set of unix capabilities to the container running the workload. Capabilities are Linux distinct privileges traditionally associated with superuser which can be independently enabled and disabled
Limitations on the number of CPUs consumed by the workload (0.5, 1, .etc). The system guarantees that this workload is not able to consume more than this amount of CPUs.
Maps a folder to a file-system mount point within the container running the workload.
A sequence of characters used to represent text. It can include letters, numbers, symbols, and spaces
added/cpu
timeoutSeconds
Number of seconds after which the probe times out
successThreshold
Minimum consecutive successes for the probe to be considered successful after having failed
failureThreshold
When a probe fails, the number of times to try before giving up
readOnly
Force the volume to be mounted with read-only permissions. Defaults to false
mountPath
The path that the host volume is mounted to when in use. Enum:
"None"
"HostToContainer"
mountPropagation
Share this volume mount with other containers. If set to HostToContainer, this volume mount receives all subsequent mounts that are mounted to this volume or any of its subdirectories. In case of multiple hostPath entries, this field should have the same value for all of them.
path
Local path within the workspace to which the S3 bucket is mapped
secretName
Optional name of Kubernetes secret that holds your git username and password
username
If secretName is provided, this field should contain the key, within the provided Kubernetes secret, which holds the value of your git username. Otherwise, this field should specify your git username in plain text (example: myuser).
path
Local path within the workspace to which the PVC bucket is mapped
readonly
Permits read only from the PVC, prevents additions or modifications to its content
ReadwriteOnce
Requesting claim that can be mounted in read/write mode to exactly 1 host. If none of the modes are specified, the default is readWriteOnce.
size
Requested size for the PVC. Mandatory when existing PVC is false
storageClass
Storage class name to associate with the PVC. This parameter may be omitted if there is a single storage class in the system, or you are using the default storage class. Further details at .
readOnlyMany
Requesting claim that can be mounted in read-only mode to many hosts
readWriteMany
Requesting claim that can be mounted in read/write mode to many hosts
readOnly
Whether to force the NFS export to be mounted with read-only permissions
nfsServer
The hostname or IP address of the NFS server
url
The URL of the S3 service provider. The default is the URL of the Amazon AWS S3 service
None - No pods will be deleted when the job completes. It will keep running pods that consume GPU, CPU and memory over time. It is recommended to set to None only for debugging and obtaining logs from running pods. (Default for PyTorch)