# Install the Control Plane

## System and Network Requirements <a href="#system-and-network-requirements" id="system-and-network-requirements"></a>

Before installing the NVIDIA Run:ai control plane, validate that the [system requirements](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/install-using-helm/cp-system-requirements) and [network requirements ](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/install-using-helm/network-requirements)are met. For air-gapped environments, make sure you have the [software artifacts ](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/preparations#software-artifacts)prepared.

## Permissions

As part of the installation, you will be required to install the NVIDIA Run:ai control plane [Helm chart](https://helm.sh/). The Helm charts require Kubernetes administrator permissions. You can review the exact objects that are created by the charts using the `--dry-run` on both helm charts.

## Installation

{% hint style="info" %}
**Note**

* To customize the installation based on your environment, see [Advanced control plane configurations](https://run-ai-docs.nvidia.com/self-hosted/2.22/infrastructure-setup/advanced-setup/control-plane-config).
* PostgreSQL and Keycloakx are installed with default usernames and passwords. To change the default credentials, see [Additional third-party configurations](https://run-ai-docs.nvidia.com/self-hosted/2.22/infrastructure-setup/advanced-setup/control-plane-config#additional-third-party-configurations).
  {% endhint %}

### NVIDIA Run:ai version

It’s recommended to install the latest NVIDIA Run:ai release. If you need to install a specific version, you can browse the available versions using the following commands:

<details>

<summary>Connected</summary>

Run the following command:

```bash
helm search repo -l runai-backend
```

</details>

<details>

<summary>Air-gapped</summary>

Run the following command to browse all available air-gapped packages using the token provided by NVIDIA Run:ai.

To download and extract a specific version, and to upload the container images to your private registry, see the [Preparations](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/install-using-helm/preparations) section.

```bash
curl -H "Authorization: Bearer <token>" "https://runai.jfrog.io/artifactory/api/storage/runai-airgapped-prod/?list"
```

</details>

### Kubernetes

<details>

<summary>Connected</summary>

Run the following command and update the values as described below:

1. Replace `global.domain=<DOMAIN>` with the one obtained [here](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/cp-system-requirements#fully-qualified-domain-name-fqdn):
2. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
3. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

```bash
helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \ 
    --set global.domain=<DOMAIN> \
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>"
```

For example:

<pre class="language-shellscript"><code class="lang-shellscript"><strong>helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
</strong>helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \ 
    --set global.domain=runai.mycorp.local \
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!"
</code></pre>

**Note:** Use the `--dry-run` flag to gain an understanding of what is being installed before the actual installation.

</details>

<details>

<summary>Air-gapped</summary>

To run the following command, make sure to replace the following. The `custom-env.yaml` is created when [preparing the installation script](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/install-using-helm/preparations):

1. `control-plane-<VERSION>.tgz` - The NVIDIA Run:ai control plane version
2. `global.domain=<DOMAIN>` - The domain name set [here](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/cp-system-requirements#fully-qualified-domain-name-fqdn)
3. `global.customCA.enabled=true` as described [here](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/cp-system-requirements#local-certificate-authority)
4. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
5. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

```shellscript
helm upgrade -i runai-backend control-plane-<VERSION>.tgz \
    --set global.domain=<DOMAIN> \ 
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>" \
    -n runai-backend -f custom-env.yaml
```

For example:

```shellscript
helm upgrade -i runai-backend control-plane-<VERSION>.tgz \
    --set global.domain=<DOMAIN> \ 
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!" \
    -n runai-backend -f custom-env.yaml
```

**Note:** Use the `--dry-run` flag to gain an understanding of what is being installed before the actual installation.

</details>

### OpenShift

<details>

<summary>Connected</summary>

Run the following command and update the values as described below:

1. The `<OPENSHIFT-CLUSTER-DOMAIN>` is the subdomain configured for the OpenShift cluster
2. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
3. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

```shellscript
helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \
    --set global.domain=runai.apps.<OPENSHIFT-CLUSTER-DOMAIN> \ 
    --set global.config.kubernetesDistribution=openshift \
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>" 
```

For example:

```shellscript
helm repo add runai-backend https://runai.jfrog.io/artifactory/cp-charts-prod
helm repo update
helm upgrade -i runai-backend -n runai-backend runai-backend/control-plane \
    --set global.domain=runai.apps.mycorp.local \ 
    --set global.config.kubernetesDistribution=openshift \
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!" 
```

</details>

<details>

<summary>Air-gapped</summary>

To run the following command, make sure to replace the following. The `custom-env.yaml` is created when [preparing the installation script:](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/preparations#software-artifacts)

1. `control-plane-<VERSION>.tgz` - The NVIDIA Run:ai control plane version
2. `<OPENSHIFT-CLUSTER-DOMAIN>` - The domain configured for the OpenShift cluster. To find out the OpenShift cluster domain, run `oc get routes -A`
3. `global.customCA.enabled=true` as described [here](https://run-ai-docs.nvidia.com/self-hosted/2.22/getting-started/installation/cp-system-requirements#local-certificate-authority)
4. Set `tenantsManager.config.adminUsername=<ADMIN_EMAIL>` to the administrator's email address.
5. Set `tenantsManager.config.adminPassword=<ADMIN_PASSWORD>` to the initial administrator password. The password must meet the following requirements:
   * Minimum Length: Passwords must be at least 8 characters long.
   * Digits: Must contain at least 1 numeric digit (0-9).
   * Lowercase Characters: Must contain at least 1 lowercase letter (a-z).
   * Uppercase Characters: Must contain at least 1 uppercase letter (A-Z).
   * Special Characters: Must contain at least 1 special character (e.g., !, @, #, $).

```bash
helm upgrade -i runai-backend ./control-plane-<VERSION>.tgz -n runai-backend \
    --set global.domain=runai.apps.<OPENSHIFT-CLUSTER-DOMAIN> \ 
    --set global.config.kubernetesDistribution=openshift \
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=<ADMIN_EMAIL> \
    --set tenantsManager.config.adminPassword="<ADMIN_PASSWORD>" \
    -f custom-env.yaml 
```

For example:

```shellscript
helm upgrade -i runai-backend ./control-plane-<VERSION>.tgz -n runai-backend \
    --set global.domain=runai.apps.mycorp.local \ 
    --set global.config.kubernetesDistribution=openshift \
    --set global.customCA.enabled=true \ 
    --set tenantsManager.config.adminUsername=email@local.com \
    --set tenantsManager.config.adminPassword="myPassw0rd\!" \
    -f custom-env.yaml 
```

**Note:** Use the `--dry-run` flag to gain an understanding of what is being installed before the actual installation.

</details>

## Connect to NVIDIA Run:ai User Interface

1. Open your browser and go to:

{% tabs %}
{% tab title="Kubernetes" %}
`https://<DOMAIN>`
{% endtab %}

{% tab title="OpenShift" %}
`https://runai.apps.<OpenShift-DOMAIN>`
{% endtab %}
{% endtabs %}

2. Log in using the administrator credentials provided during installation. It is recommended to change the password after the first login.