[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-nvidia-osmo-deploy":3,"mdc-8qntas-key":37,"related-org-nvidia-osmo-deploy":3366,"related-repo-nvidia-osmo-deploy":3525},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":35,"mdContent":36},"osmo-deploy","deploy OSMO to Kubernetes clusters","How to deploy OSMO to a Kubernetes cluster on Azure (AKS), AWS (EKS), MicroK8s (single-node), or any kubectl-reachable cluster (BYO). Use this skill whenever the user asks to install, deploy, set up, or stand up OSMO; whenever they ask to provision an OSMO cluster; whenever they mention deploy-osmo-minimal.sh, deploy-k8s.sh, or \"OSMO helm install\"; whenever they ask to wire up workflow storage (MinIO \u002F Azure Blob \u002F S3); or whenever they ask to add a GPU pool to an OSMO cluster, install KAI scheduler, install the NVIDIA GPU Operator, or run the post-install smoke tests. Targets OSMO 6.3 (ConfigMap mode).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},"nvidia","NVIDIA","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fnvidia.png",[12,16,19,20,23],{"name":13,"slug":14,"type":15},"Azure","azure","tag",{"name":17,"slug":18,"type":15},"Deployment","deployment",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Kubernetes","kubernetes",{"name":24,"slug":25,"type":15},"AWS","aws",192,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FOSMO","2026-07-14T05:33:24.181591","Apache-2.0",40,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":34},[],"The developer-first platform for scaling complex Physical AI workloads across heterogeneous compute—unifying training GPUs, simulation clusters, and edge devices in a simple YAML","https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FOSMO\u002Ftree\u002FHEAD\u002Fskills\u002Fosmo-deploy","---\nname: osmo-deploy\ndescription: >\n  How to deploy OSMO to a Kubernetes cluster on Azure (AKS), AWS (EKS), MicroK8s\n  (single-node), or any kubectl-reachable cluster (BYO). Use this skill whenever\n  the user asks to install, deploy, set up, or stand up OSMO; whenever they ask\n  to provision an OSMO cluster; whenever they mention deploy-osmo-minimal.sh,\n  deploy-k8s.sh, or \"OSMO helm install\"; whenever they ask to wire up workflow\n  storage (MinIO \u002F Azure Blob \u002F S3); or whenever they ask to add a GPU pool to\n  an OSMO cluster, install KAI scheduler, install the NVIDIA GPU Operator, or\n  run the post-install smoke tests. Targets OSMO 6.3 (ConfigMap mode).\nlicense: Apache-2.0\ncompatibility: >\n  REQUIRES OSMO >= 6.3 (ConfigMap mode). Earlier 6.2 CLI-write mode is NOT\n  supported (runtime signal: helm install fails or chart attempts\n  `osmo config update` and gets HTTP 409). The default \"latest\" channel\n  may resolve to a 6.2 release — explicitly pin OSMO_CHART_VERSION +\n  OSMO_IMAGE_TAG + OSMO_CLI_REF to a 6.3.x release; use\n  `--list-chart-versions` to discover the latest available tags. See\n  \"Picking chart, image, and CLI versions\". Also requires kubectl, helm,\n  jq, and the osmo CLI on PATH (the deploy script will install osmo from\n  GitHub if missing). Cloud providers also need terraform >= 1.9 plus\n  az login (Azure) or aws configure (AWS). MicroK8s provider requires\n  Ubuntu 22.04 + sudo; --gpu requires NVIDIA driver >= 525.\nmetadata:\n  author: nvidia\n  version: \"1.0.0\"\n---\n\n# OSMO Deploy\n\n## When to Use This Skill\n\nActivate when the user asks to install, deploy, set up, stand up, or provision OSMO; when they reference `deploy-osmo-minimal.sh` \u002F `deploy-k8s.sh` \u002F \"OSMO helm install\"; when they ask to wire up workflow storage (MinIO \u002F Azure Blob \u002F S3); or when they ask to add a GPU pool, install KAI Scheduler, install the NVIDIA GPU Operator, or run post-install smoke tests on an OSMO cluster.\n\nDo **not** activate for general OSMO usage questions (running workflows, CLI usage, troubleshooting a running deployment) — those belong to the `osmo-user` skill.\n\n**This skill requires OSMO >= 6.3 (ConfigMap mode).** Earlier 6.2 CLI-write mode is not supported — the chart's HTTP 409 on `osmo config update` is the runtime signal that the cluster landed on 6.2. If the default `latest` channel still resolves to a 6.2 release, the deploy with no env-var pins lands on the unsupported variant. You MUST set the three version pins to a 6.3.x release before invoking the script — see \"Picking chart, image, and CLI versions\" below. Run `--list-chart-versions` to discover the latest available tags.\n\n## Workflow\n\nThe canonical entry point is [scripts\u002Fdeploy-osmo-minimal.sh](..\u002F..\u002Fdeployments\u002Fscripts\u002Fdeploy-osmo-minimal.sh) under `osmo\u002Fexternal\u002Fdeployments\u002F`. Run from inside that directory:\n\n```bash\ncd osmo\u002Fexternal\u002Fdeployments\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider \u003Cazure|aws|microk8s|byo> [options]\n```\n\nThe script orchestrates these phases:\n\n1. **Cluster bootstrap** (provider-specific): Terraform for Azure\u002FAWS, snap install + addons for MicroK8s, no-op for BYO\n2. **Cluster-agnostic dependencies**: KAI Scheduler + NVIDIA GPU Operator + (optional) MinIO — each idempotent (auto-skips when already present)\n3. **Storage configuration**: K8s Secrets + Helm values fragment for `services.configs.workflow.workflow_*.credential.secretName`\n4. **OSMO Helm install**: single `service` release (the 6.3 chart bundles router + UI) + `backend-operator` release. Static base values come from [values\u002Fservice.yaml](..\u002F..\u002Fdeployments\u002Fvalues\u002Fservice.yaml) and [values\u002Fbackend-operator.yaml](..\u002F..\u002Fdeployments\u002Fvalues\u002Fbackend-operator.yaml); per-cluster overrides ride on `--set`; auto-detected fragments (`pod-monitor-on.yaml` when prometheus-operator CRDs exist, `gpu-pool.yaml` when GPU nodes exist) and the storage fragment are layered with additional `-f` flags.\n5. **Idempotent backend-operator token mint** (replaces the old placeholder fallback)\n6. **Smoke tests**: `verify-hello.yaml` (CPU) + `verify-gpu.yaml` (GPU; skipped under `--no-gpu`)\n7. **Persistent port-forward watchdogs**: `osmo-gateway:9000` (gateway-aware target — falls back to `osmo-service` when the gateway is disabled) and `osmo-ui:3000`\n\n## Picking a provider\n\n| Provider | When to use |\n|---|---|\n| `azure` | Cloud install on Azure AKS with managed PostgreSQL + Redis. Optional GPU node pool + Blob storage account when `--gpu-node-pool` and `storage_account_enabled=true`. |\n| `aws` | Cloud install on AWS EKS with RDS + ElastiCache. Optional GPU node group via `--gpu-node-pool`. |\n| `microk8s` | Single-node K8s on a local Ubuntu box. The script bootstraps MicroK8s itself (snapd, addons, optional NVIDIA addon). |\n| `byo` | A cluster you already have. Skips bootstrap and TF entirely. Required env vars: `POSTGRES_HOST POSTGRES_USERNAME POSTGRES_PASSWORD POSTGRES_DB_NAME REDIS_HOST REDIS_PORT REDIS_PASSWORD` (`IS_PRIVATE_CLUSTER` optional, defaults to false). |\n\n## Required user inputs (ask these BEFORE invoking the script)\n\nWhen the user asks to deploy OSMO without supplying every flag\u002Fenv, prompt for these inputs first. Map answers to env vars (or `--flag` equivalents) and only then invoke `deploy-osmo-minimal.sh`.\n\n**Universal prompts (every provider):**\n\n1. **\"Do you need GPUs?\"** (yes\u002Fno)\n   - If **no** → set `TF_GPU_NODE_POOL_ENABLED=false`, skip prompts 2-4.\n   - If **yes** → continue.\n2. **\"How many GPUs?\"** — expect a positive integer. Set `TF_GPU_COUNT=\u003Cn>` and `TF_GPU_NODE_POOL_ENABLED=true`.\n3. **\"What kind of GPU?\"** — expect an Azure VM SKU (e.g. `Standard_NC40ads_H100_v5`) or AWS instance type (e.g. `p4d.24xlarge`). If the user gives an informal name (`H100`, `A10`, `T4`), translate to the canonical SKU: `H100 → Standard_NC40ads_H100_v5`, `A10 → Standard_NV36ads_A10_v5`, `T4 → Standard_NC4as_T4_v3` on Azure. Set `TF_GPU_VM_SIZE=\u003Csku>`. Default to `Standard_NC40ads_H100_v5` on Azure \u002F `p4d.24xlarge` on AWS if the user leaves it blank.\n4. **\"What region do you have availability?\"** — accept a specific region OR `idk`.\n   - If `idk` → call `.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --find-gpu-region \"$TF_GPU_VM_SIZE\" \"$TF_GPU_COUNT\"`. The script iterates `TF_REGION_CANDIDATES` (env-overridable; default covers H100-likely Azure regions: `eastus2 swedencentral westus3 southcentralus westeurope`) and prints the first region whose quota fits. Set `TF_REGION` to that. Exits non-zero if no candidate has quota — surface the error to the user with a suggestion to expand `TF_REGION_CANDIDATES`.\n   - If user names a region → set `TF_REGION` to it directly.\n\n**Azure-only prompts (provider=azure, when not already supplied via flags\u002Fenv):**\n\n4. **\"Azure subscription ID?\"** — if not set via `--subscription-id` or `TF_SUBSCRIPTION_ID`, default to `$(az account show --query id -o tsv)` and ask the user to confirm or override.\n5. **\"Resource group name?\"** — if not set via `--resource-group` or `TF_RESOURCE_GROUP`. The deploy preflight auto-creates the group (tagged `osmo-deploy-managed=true`) when `TF_RESOURCE_GROUP` is set and the group doesn't already exist — so the agent should pass the chosen name and let the script handle creation. Check with `az group show -n \u003Crg>` if you want to see whether it pre-exists; create manually with `az group create -n \u003Crg> -l \u003Cregion>` only if you want the group to outlive future `terraform destroy` runs.\n\n**AWS-only prompts:** AWS region (`--aws-region`) and profile (`--aws-profile`) — defaults `us-west-2` \u002F `default` are usually fine; only re-prompt if the user explicitly didn't pick a region.\n\nOnce these are collected, invoke the script in `--non-interactive` mode with the answers passed as env vars (or `--flag` equivalents) — that avoids the script re-asking the same questions and keeps the agent's prompts as the single source of truth.\n\n## Picking chart, image, and CLI versions\n\n**This skill requires OSMO >= 6.3 (ConfigMap mode). Pinning all three env vars below is mandatory, not optional.**\n\nThe script's default behavior (no env vars set) resolves to:\n- `OSMO_CHART_VERSION` empty → helm picks the latest **stable** chart in repo\n- `OSMO_IMAGE_TAG=latest` → most recent **GA** image\n- `OSMO_CLI_REF=main` → bootstraps the **latest GA** CLI via the upstream `install.sh`\n\nIf the latest GA is still on 6.2, leaving any of these at default lands you on the unsupported CLI-write-mode variant. The Helm install fails (e.g. on Ingress validation), or the CLI's wire format doesn't match the service, or the chart attempts `osmo config update` and gets HTTP 409 in ConfigMap mode.\n\n### Required: discover + pin all three to a 6.3.x release\n\n```bash\n# Step 1: discover the latest available 6.3.x chart\u002Fimage\u002FCLI tags\n# (passes --devel so prerelease RCs appear).\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --list-chart-versions\n\n# Step 2: pin all three env vars to the same release before invoking the deploy.\n#   - Use the latest non-prerelease 6.3.x release if one exists.\n#   - Otherwise pin to the latest 6.3.x prerelease RC.\nexport OSMO_CHART_VERSION=\u003Cchart version from step 1>\nexport OSMO_IMAGE_TAG=\u003Cmatching app\u002Fimage tag>\nexport OSMO_CLI_REF=\u003Cmatching CLI release tag>\n```\n\nThe chart version + image\u002Fapp tag + CLI tag are published together as a release pair. Match them — don't mix.\n\n### Why each pin matters (each is independently required)\n\n- **`OSMO_CHART_VERSION`** — helm's \"latest\" resolution can roll forward unexpectedly. Pinning a specific 6.3.x chart prevents both (a) accidentally landing on a 6.2 chart and (b) drifting between deploys.\n- **`OSMO_IMAGE_TAG`** — must match the chart's expected app version. The chart's templates assume specific image entrypoints and env contracts that change across minor releases.\n- **`OSMO_CLI_REF`** — the `osmo` CLI's wire format (auth, workflow submit\u002Fget, configmap loading) must match the service. A CLI from a different minor version often connects but fails at the first non-trivial call. The deploy script's `install_osmo_cli_if_missing` honors `OSMO_CLI_REF` by downloading the matching installer directly to `$HOME\u002F.local\u002Fbin` (no sudo); override the destination via `OSMO_CLI_TARGET`.\n\n### Prerelease vs release within 6.3.x\n\nBoth stable and prerelease 6.3.x versions are published to `nvidia\u002Fosmo`. Prerelease tags (`*-prerelease-rc*`) are hidden from `helm search` by default — that's why `--list-chart-versions` passes `--devel`. The pinning workflow above is identical either way.\n\n## Storage backends\n\nUse `--storage-backend {auto|minio|azure-blob|s3|byo|none}`:\n\n- **auto** (default): probes BYO env vars → microk8s minio addon → existing minio service → osmo AWS TF `s3_bucket` output → osmo Azure TF `storage_account` output\n- **minio**: in-cluster S3. On microk8s, uses the `minio` addon; otherwise installs the bitnami MinIO chart\n- **azure-blob**: Azure Blob Storage Account. Reads `STORAGE_ACCOUNT`\u002F`STORAGE_KEY` env vars first, falls back to osmo Azure TF outputs\n- **s3**: AWS S3 with static credentials. Reads `STORAGE_BUCKET`\u002F`STORAGE_ACCESS_KEY_ID`\u002F`STORAGE_ACCESS_KEY` env vars first, falls back to osmo AWS TF outputs (when `s3_bucket_enabled=true`). For IAM-role-based auth (IRSA), use `--backend byo --auth-method workload-identity` instead.\n- **byo**: caller provides credentials via env (`STORAGE_ACCESS_KEY_ID`, `STORAGE_ACCESS_KEY`, `STORAGE_ENDPOINT`, optional `STORAGE_REGION`, `STORAGE_OVERRIDE_URL`). No resources created.\n- **none**: skip storage entirely (manual configuration later)\n\nIn static-auth mode the helper writes K8s Secrets (`osmo-workflow-{data,log,app}-cred`) and a Helm values fragment that the chart consumes via `services.configs.workflow.workflow_*.credential.secretName`. There are **no** `osmo config update` or `osmo credential set` CLI calls — those return HTTP 409 in 6.3 ConfigMap mode.\n\n## Auth modes (`--auth-method`)\n\n`--auth-method {static|workload-identity}` controls how OSMO services authenticate to the cloud storage backend.\n\n- **static** (default): K8s Secrets carry static cloud credentials (account keys \u002F connection strings \u002F S3 access keys). Works with every backend.\n- **workload-identity**: No K8s Secrets. OSMO services use the cluster's federated identity:\n  - `azure-blob` + WI = AKS Workload Identity (UAMI + federated credential)\n  - `byo` + WI = AWS IRSA (IAM role + EKS OIDC trust policy)\n  - `minio` + WI = **not supported** (MinIO has no cloud-vendor IdP)\n\n> ⚠ **Workload identity mode requires caller-provisioned cloud-side identity.** The deploy scripts do **not** create the UAMI \u002F IAM role, attach RBAC, or create the federated credential — those are owned by the caller (typically the platform\u002Fsecurity team). The script does the K8s-side wiring (SA annotation + pod labels for the AKS WI mutating webhook + DefaultDataCredential values fragment) and surfaces a prominent prerequisite checklist before any work begins. If prerequisites aren't met, OSMO will start successfully but workflows will fail at runtime with 401\u002F403 from the storage backend.\n\n### Azure Workload Identity prerequisites\n\n```bash\n# 1. AKS cluster has OIDC issuer + Workload Identity addons\naz aks update -g \u003Crg> -n \u003Ccluster> --enable-oidc-issuer --enable-workload-identity\n\n# 2. Provision UAMI\naz identity create -g \u003Crg> -n osmo-data-uami\n\n# 3. Grant Storage Blob Data Contributor on the storage account\naz role assignment create \\\n  --role \"Storage Blob Data Contributor\" \\\n  --assignee \u003CUAMI-principal-id> \\\n  --scope \u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F\u003Crg>\u002Fproviders\u002FMicrosoft.Storage\u002FstorageAccounts\u002F\u003Caccount>\n\n# 4. Federate UAMI to the chart's ServiceAccount (default name: osmo-minimal)\naz identity federated-credential create \\\n  --name osmo-osmo-minimal \\\n  --identity-name osmo-data-uami \\\n  --resource-group \u003Crg> \\\n  --issuer \"$(az aks show -g \u003Crg> -n \u003Ccluster> --query oidcIssuerProfile.issuerUrl -o tsv)\" \\\n  --subject \"system:serviceaccount:osmo-minimal:osmo-minimal\"\n\n# 5. Run deploy with WI\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider byo \\\n  --storage-backend azure-blob --auth-method workload-identity \\\n  --workload-identity-client-id \"$(az identity show -g \u003Crg> -n osmo-data-uami --query clientId -o tsv)\"\n```\n\n### AWS IRSA prerequisites\n\n```bash\n# 1. EKS cluster has an OIDC identity provider (most clusters already do)\naws eks describe-cluster --name \u003Ccluster> --query \"cluster.identity.oidc.issuer\"\n\n# 2. Create IAM role with S3 access + EKS OIDC trust policy\n#    Trust policy admits: system:serviceaccount:osmo-minimal:osmo-minimal\n\n# 3. Run deploy with WI\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider byo \\\n  --storage-backend byo --auth-method workload-identity \\\n  --workload-identity-role-arn arn:aws:iam::\u003Cacct>:role\u002Fosmo-data-access\n```\n\n## NFS storage account (`--with-nfs-storage`, azure only)\n\nPass `--with-nfs-storage` on Azure when a downstream skill on the cluster needs an Azure Files Premium NFS-backed `ReadWriteMany` StorageClass. The canonical consumer is NIM Operator multi-node inference (its NIMCache + shared-model volumes are RWX-only per https:\u002F\u002Fdocs.nvidia.com\u002Fnim-operator\u002Flatest\u002Fmulti-node.html); other RWX users (shared data caches, KServe RWX models) need it too.\n\nWhat osmo provisions: a Premium FileStorage Azure Storage Account (VNet-restricted, output as `nfs_storage_account`) and the four AKS role assignments `file.csi.azure.com` needs to dynamically provision NFS file shares against it — Network Contributor on the VNet, on the AKS NSG, and on the database NSG, plus Storage Account Contributor scoped to the NFS SA. Without all four, dynamic PVC provisioning fails with `LinkedAuthorizationFailed`.\n\nWhat osmo does NOT provision: the StorageClass manifest, the default-SC swap, or any consumer-specific PVC. Those belong to the consumer skill (per separation of concerns — osmo doesn't own RWX, the consumers do). The consumer reads `terraform output -raw nfs_storage_account` to learn the SA name and uses it to render its own StorageClass against `file.csi.azure.com` with `protocol: nfs`.\n\nCost note: Premium FileStorage SAs bill on provisioned capacity (~$0.16\u002FGiB-month, 100 GiB minimum). Opt in only when a downstream consumer needs RWX.\n\nWithout the flag (default): no NFS SA is created. RWX PVCs created later sit `Pending` forever — the AKS default `managed-csi` \u002F `default` classes only support RWO. The error is the consumer's to surface.\n\n## Customizing values\n\nHand-editable static values live in [deployments\u002Fvalues\u002F](..\u002F..\u002Fdeployments\u002Fvalues\u002F):\n\n- `service.yaml` — base values for the service chart (router + UI bundled)\n- `backend-operator.yaml` — base values for the backend-operator chart\n- `gpu-pool.yaml` — opt-in fragment, layered when GPU nodes are detected\n- `pod-monitor-on.yaml` — opt-in fragment, layered when prometheus-operator CRDs are detected\n\nPer-cluster values (PG\u002FRedis hosts, image registry\u002Ftag, NGC pull secret name, namespace) are **not** in those files — they're injected at install time via `--set` so users can edit the YAML for things that don't change per-cluster. `service.yaml` mirrors the [docs minimal-deploy reference](..\u002F..\u002Fdocs\u002Fdeployment_guide\u002Fappendix\u002Fdeploy_minimal.rst). See the [values README](..\u002F..\u002Fdeployments\u002Fvalues\u002FREADME.md) for layering details.\n\n> **Security note**: `service.yaml` ships with the gateway's OAuth2 Proxy + authz disabled (matching the docs minimal example). The gateway then trusts client-supplied `x-osmo-{user,roles,allowed-pools}` headers. Do **not** expose this gateway to untrusted networks. For production deploys, use the standard deployment guide path which keeps OAuth2 + authz enabled.\n\n## Common invocations\n\n```bash\n# Azure with GPU pool + Blob storage\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider azure --gpu-node-pool --storage-backend azure-blob\n\n# AWS, CPU only\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider aws --no-gpu\n\n# Single-node MicroK8s on a fresh Ubuntu box (with GPU)\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider microk8s --gpu --storage-backend minio\n\n# Existing cluster (orion-cluster-azure, etc.) — caller exports DB\u002FRedis env vars first\nexport POSTGRES_HOST=... REDIS_HOST=...   # (full list above)\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider byo --storage-backend azure-blob\n\n# Tear down\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider \u003Cx> --destroy\n```\n\n## Idempotency contract\n\nEvery cluster-agnostic install is safe to no-op when its target is already present (CRD checks for KAI, multi-signal detection for GPU Operator, addon\u002Frelease detection for MinIO). This makes the script safe to layer on top of clusters that already have these components installed (e.g. when an upstream skill provisioned the cluster + KAI + GPU Operator first). Re-runs are also safe — backend-operator tokens are reused if a non-placeholder value already exists in `osmo-operator-token`.\n\n## Troubleshooting\n\n- **`osmo CLI not found`**: the script will install from GitHub on first run; if it fails, install manually then re-run.\n- **Pod failures**: `kubectl logs -n osmo-minimal -l app=osmo-service`\n- **Smoke test failures**: GPU smoke depends on the GPU Operator being healthy + a node labeled `nvidia.com\u002Fgpu.present=true`; `kubectl describe node` to verify\n- **Stop port-forward watchdogs**: `pkill -f 'osmo-pf-watchdog:'`\n- **Private AKS clusters**: use `az aks command invoke` for kubectl access; the script sets `IS_PRIVATE_CLUSTER=true` automatically when detected\n\n## Reference\n\n- Helpers under [scripts\u002F](..\u002F..\u002Fdeployments\u002Fscripts\u002F):\n  `install-kai-scheduler.sh`, `install-gpu-operator.sh`, `install-minio.sh`,\n  `configure-storage.sh` (+ `storage\u002F{minio,azure-blob,s3,byo}.sh`),\n  `port-forward.sh`, `verify.sh`, `microk8s\u002Finstall.sh`\n- Workflows under [workflows\u002F](..\u002F..\u002Fdeployments\u002Fworkflows\u002F):\n  `verify-hello.yaml`, `verify-gpu.yaml`\n- Documentation: https:\u002F\u002Fnvidia.github.io\u002FOSMO\u002Fmain\u002Fdeployment_guide\u002F\n",{"data":38,"body":42},{"name":4,"description":6,"license":29,"compatibility":39,"metadata":40},"REQUIRES OSMO >= 6.3 (ConfigMap mode). Earlier 6.2 CLI-write mode is NOT supported (runtime signal: helm install fails or chart attempts `osmo config update` and gets HTTP 409). The default \"latest\" channel may resolve to a 6.2 release — explicitly pin OSMO_CHART_VERSION + OSMO_IMAGE_TAG + OSMO_CLI_REF to a 6.3.x release; use `--list-chart-versions` to discover the latest available tags. See \"Picking chart, image, and CLI versions\". Also requires kubectl, helm, jq, and the osmo CLI on PATH (the deploy script will install osmo from GitHub if missing). Cloud providers also need terraform >= 1.9 plus az login (Azure) or aws configure (AWS). MicroK8s provider requires Ubuntu 22.04 + sudo; --gpu requires NVIDIA driver >= 525.\n",{"author":8,"version":41},"1.0.0",{"type":43,"children":44},"root",[45,53,60,83,104,138,144,166,253,258,448,454,583,589,608,616,863,871,972,1013,1033,1039,1047,1052,1115,1127,1134,1289,1294,1300,1382,1388,1432,1438,1451,1625,1665,1678,1689,1752,1774,1780,2413,2419,2605,2619,2648,2676,2703,2708,2735,2741,2753,2798,2839,2872,2878,3123,3129,3141,3147,3246,3252,3360],{"type":46,"tag":47,"props":48,"children":49},"element","h1",{"id":4},[50],{"type":51,"value":52},"text","OSMO Deploy",{"type":46,"tag":54,"props":55,"children":57},"h2",{"id":56},"when-to-use-this-skill",[58],{"type":51,"value":59},"When to Use This Skill",{"type":46,"tag":61,"props":62,"children":63},"p",{},[64,66,73,75,81],{"type":51,"value":65},"Activate when the user asks to install, deploy, set up, stand up, or provision OSMO; when they reference ",{"type":46,"tag":67,"props":68,"children":70},"code",{"className":69},[],[71],{"type":51,"value":72},"deploy-osmo-minimal.sh",{"type":51,"value":74}," \u002F ",{"type":46,"tag":67,"props":76,"children":78},{"className":77},[],[79],{"type":51,"value":80},"deploy-k8s.sh",{"type":51,"value":82}," \u002F \"OSMO helm install\"; when they ask to wire up workflow storage (MinIO \u002F Azure Blob \u002F S3); or when they ask to add a GPU pool, install KAI Scheduler, install the NVIDIA GPU Operator, or run post-install smoke tests on an OSMO cluster.",{"type":46,"tag":61,"props":84,"children":85},{},[86,88,94,96,102],{"type":51,"value":87},"Do ",{"type":46,"tag":89,"props":90,"children":91},"strong",{},[92],{"type":51,"value":93},"not",{"type":51,"value":95}," activate for general OSMO usage questions (running workflows, CLI usage, troubleshooting a running deployment) — those belong to the ",{"type":46,"tag":67,"props":97,"children":99},{"className":98},[],[100],{"type":51,"value":101},"osmo-user",{"type":51,"value":103}," skill.",{"type":46,"tag":61,"props":105,"children":106},{},[107,112,114,120,122,128,130,136],{"type":46,"tag":89,"props":108,"children":109},{},[110],{"type":51,"value":111},"This skill requires OSMO >= 6.3 (ConfigMap mode).",{"type":51,"value":113}," Earlier 6.2 CLI-write mode is not supported — the chart's HTTP 409 on ",{"type":46,"tag":67,"props":115,"children":117},{"className":116},[],[118],{"type":51,"value":119},"osmo config update",{"type":51,"value":121}," is the runtime signal that the cluster landed on 6.2. If the default ",{"type":46,"tag":67,"props":123,"children":125},{"className":124},[],[126],{"type":51,"value":127},"latest",{"type":51,"value":129}," channel still resolves to a 6.2 release, the deploy with no env-var pins lands on the unsupported variant. You MUST set the three version pins to a 6.3.x release before invoking the script — see \"Picking chart, image, and CLI versions\" below. Run ",{"type":46,"tag":67,"props":131,"children":133},{"className":132},[],[134],{"type":51,"value":135},"--list-chart-versions",{"type":51,"value":137}," to discover the latest available tags.",{"type":46,"tag":54,"props":139,"children":141},{"id":140},"workflow",[142],{"type":51,"value":143},"Workflow",{"type":46,"tag":61,"props":145,"children":146},{},[147,149,156,158,164],{"type":51,"value":148},"The canonical entry point is ",{"type":46,"tag":150,"props":151,"children":153},"a",{"href":152},"..\u002F..\u002Fdeployments\u002Fscripts\u002Fdeploy-osmo-minimal.sh",[154],{"type":51,"value":155},"scripts\u002Fdeploy-osmo-minimal.sh",{"type":51,"value":157}," under ",{"type":46,"tag":67,"props":159,"children":161},{"className":160},[],[162],{"type":51,"value":163},"osmo\u002Fexternal\u002Fdeployments\u002F",{"type":51,"value":165},". Run from inside that directory:",{"type":46,"tag":167,"props":168,"children":173},"pre",{"className":169,"code":170,"language":171,"meta":172,"style":172},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cd osmo\u002Fexternal\u002Fdeployments\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider \u003Cazure|aws|microk8s|byo> [options]\n","bash","",[174],{"type":46,"tag":67,"props":175,"children":176},{"__ignoreMap":172},[177,195],{"type":46,"tag":178,"props":179,"children":182},"span",{"class":180,"line":181},"line",1,[183,189],{"type":46,"tag":178,"props":184,"children":186},{"style":185},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[187],{"type":51,"value":188},"cd",{"type":46,"tag":178,"props":190,"children":192},{"style":191},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[193],{"type":51,"value":194}," osmo\u002Fexternal\u002Fdeployments\n",{"type":46,"tag":178,"props":196,"children":198},{"class":180,"line":197},2,[199,205,210,216,220,225,229,233,238,242,247],{"type":46,"tag":178,"props":200,"children":202},{"style":201},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[203],{"type":51,"value":204},".\u002Fscripts\u002Fdeploy-osmo-minimal.sh",{"type":46,"tag":178,"props":206,"children":207},{"style":191},[208],{"type":51,"value":209}," --provider",{"type":46,"tag":178,"props":211,"children":213},{"style":212},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[214],{"type":51,"value":215}," \u003C",{"type":46,"tag":178,"props":217,"children":218},{"style":191},[219],{"type":51,"value":14},{"type":46,"tag":178,"props":221,"children":222},{"style":212},[223],{"type":51,"value":224},"|",{"type":46,"tag":178,"props":226,"children":227},{"style":201},[228],{"type":51,"value":25},{"type":46,"tag":178,"props":230,"children":231},{"style":212},[232],{"type":51,"value":224},{"type":46,"tag":178,"props":234,"children":235},{"style":201},[236],{"type":51,"value":237},"microk8s",{"type":46,"tag":178,"props":239,"children":240},{"style":212},[241],{"type":51,"value":224},{"type":46,"tag":178,"props":243,"children":244},{"style":201},[245],{"type":51,"value":246},"byo",{"type":46,"tag":178,"props":248,"children":250},{"style":249},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[251],{"type":51,"value":252},"> [options]\n",{"type":46,"tag":61,"props":254,"children":255},{},[256],{"type":51,"value":257},"The script orchestrates these phases:",{"type":46,"tag":259,"props":260,"children":261},"ol",{},[262,273,283,299,373,383,417],{"type":46,"tag":263,"props":264,"children":265},"li",{},[266,271],{"type":46,"tag":89,"props":267,"children":268},{},[269],{"type":51,"value":270},"Cluster bootstrap",{"type":51,"value":272}," (provider-specific): Terraform for Azure\u002FAWS, snap install + addons for MicroK8s, no-op for BYO",{"type":46,"tag":263,"props":274,"children":275},{},[276,281],{"type":46,"tag":89,"props":277,"children":278},{},[279],{"type":51,"value":280},"Cluster-agnostic dependencies",{"type":51,"value":282},": KAI Scheduler + NVIDIA GPU Operator + (optional) MinIO — each idempotent (auto-skips when already present)",{"type":46,"tag":263,"props":284,"children":285},{},[286,291,293],{"type":46,"tag":89,"props":287,"children":288},{},[289],{"type":51,"value":290},"Storage configuration",{"type":51,"value":292},": K8s Secrets + Helm values fragment for ",{"type":46,"tag":67,"props":294,"children":296},{"className":295},[],[297],{"type":51,"value":298},"services.configs.workflow.workflow_*.credential.secretName",{"type":46,"tag":263,"props":300,"children":301},{},[302,307,309,315,317,323,325,331,333,339,341,347,349,355,357,363,365,371],{"type":46,"tag":89,"props":303,"children":304},{},[305],{"type":51,"value":306},"OSMO Helm install",{"type":51,"value":308},": single ",{"type":46,"tag":67,"props":310,"children":312},{"className":311},[],[313],{"type":51,"value":314},"service",{"type":51,"value":316}," release (the 6.3 chart bundles router + UI) + ",{"type":46,"tag":67,"props":318,"children":320},{"className":319},[],[321],{"type":51,"value":322},"backend-operator",{"type":51,"value":324}," release. Static base values come from ",{"type":46,"tag":150,"props":326,"children":328},{"href":327},"..\u002F..\u002Fdeployments\u002Fvalues\u002Fservice.yaml",[329],{"type":51,"value":330},"values\u002Fservice.yaml",{"type":51,"value":332}," and ",{"type":46,"tag":150,"props":334,"children":336},{"href":335},"..\u002F..\u002Fdeployments\u002Fvalues\u002Fbackend-operator.yaml",[337],{"type":51,"value":338},"values\u002Fbackend-operator.yaml",{"type":51,"value":340},"; per-cluster overrides ride on ",{"type":46,"tag":67,"props":342,"children":344},{"className":343},[],[345],{"type":51,"value":346},"--set",{"type":51,"value":348},"; auto-detected fragments (",{"type":46,"tag":67,"props":350,"children":352},{"className":351},[],[353],{"type":51,"value":354},"pod-monitor-on.yaml",{"type":51,"value":356}," when prometheus-operator CRDs exist, ",{"type":46,"tag":67,"props":358,"children":360},{"className":359},[],[361],{"type":51,"value":362},"gpu-pool.yaml",{"type":51,"value":364}," when GPU nodes exist) and the storage fragment are layered with additional ",{"type":46,"tag":67,"props":366,"children":368},{"className":367},[],[369],{"type":51,"value":370},"-f",{"type":51,"value":372}," flags.",{"type":46,"tag":263,"props":374,"children":375},{},[376,381],{"type":46,"tag":89,"props":377,"children":378},{},[379],{"type":51,"value":380},"Idempotent backend-operator token mint",{"type":51,"value":382}," (replaces the old placeholder fallback)",{"type":46,"tag":263,"props":384,"children":385},{},[386,391,393,399,401,407,409,415],{"type":46,"tag":89,"props":387,"children":388},{},[389],{"type":51,"value":390},"Smoke tests",{"type":51,"value":392},": ",{"type":46,"tag":67,"props":394,"children":396},{"className":395},[],[397],{"type":51,"value":398},"verify-hello.yaml",{"type":51,"value":400}," (CPU) + ",{"type":46,"tag":67,"props":402,"children":404},{"className":403},[],[405],{"type":51,"value":406},"verify-gpu.yaml",{"type":51,"value":408}," (GPU; skipped under ",{"type":46,"tag":67,"props":410,"children":412},{"className":411},[],[413],{"type":51,"value":414},"--no-gpu",{"type":51,"value":416},")",{"type":46,"tag":263,"props":418,"children":419},{},[420,425,426,432,434,440,442],{"type":46,"tag":89,"props":421,"children":422},{},[423],{"type":51,"value":424},"Persistent port-forward watchdogs",{"type":51,"value":392},{"type":46,"tag":67,"props":427,"children":429},{"className":428},[],[430],{"type":51,"value":431},"osmo-gateway:9000",{"type":51,"value":433}," (gateway-aware target — falls back to ",{"type":46,"tag":67,"props":435,"children":437},{"className":436},[],[438],{"type":51,"value":439},"osmo-service",{"type":51,"value":441}," when the gateway is disabled) and ",{"type":46,"tag":67,"props":443,"children":445},{"className":444},[],[446],{"type":51,"value":447},"osmo-ui:3000",{"type":46,"tag":54,"props":449,"children":451},{"id":450},"picking-a-provider",[452],{"type":51,"value":453},"Picking a provider",{"type":46,"tag":455,"props":456,"children":457},"table",{},[458,477],{"type":46,"tag":459,"props":460,"children":461},"thead",{},[462],{"type":46,"tag":463,"props":464,"children":465},"tr",{},[466,472],{"type":46,"tag":467,"props":468,"children":469},"th",{},[470],{"type":51,"value":471},"Provider",{"type":46,"tag":467,"props":473,"children":474},{},[475],{"type":51,"value":476},"When to use",{"type":46,"tag":478,"props":479,"children":480},"tbody",{},[481,513,535,551],{"type":46,"tag":463,"props":482,"children":483},{},[484,493],{"type":46,"tag":485,"props":486,"children":487},"td",{},[488],{"type":46,"tag":67,"props":489,"children":491},{"className":490},[],[492],{"type":51,"value":14},{"type":46,"tag":485,"props":494,"children":495},{},[496,498,504,505,511],{"type":51,"value":497},"Cloud install on Azure AKS with managed PostgreSQL + Redis. Optional GPU node pool + Blob storage account when ",{"type":46,"tag":67,"props":499,"children":501},{"className":500},[],[502],{"type":51,"value":503},"--gpu-node-pool",{"type":51,"value":332},{"type":46,"tag":67,"props":506,"children":508},{"className":507},[],[509],{"type":51,"value":510},"storage_account_enabled=true",{"type":51,"value":512},".",{"type":46,"tag":463,"props":514,"children":515},{},[516,524],{"type":46,"tag":485,"props":517,"children":518},{},[519],{"type":46,"tag":67,"props":520,"children":522},{"className":521},[],[523],{"type":51,"value":25},{"type":46,"tag":485,"props":525,"children":526},{},[527,529,534],{"type":51,"value":528},"Cloud install on AWS EKS with RDS + ElastiCache. Optional GPU node group via ",{"type":46,"tag":67,"props":530,"children":532},{"className":531},[],[533],{"type":51,"value":503},{"type":51,"value":512},{"type":46,"tag":463,"props":536,"children":537},{},[538,546],{"type":46,"tag":485,"props":539,"children":540},{},[541],{"type":46,"tag":67,"props":542,"children":544},{"className":543},[],[545],{"type":51,"value":237},{"type":46,"tag":485,"props":547,"children":548},{},[549],{"type":51,"value":550},"Single-node K8s on a local Ubuntu box. The script bootstraps MicroK8s itself (snapd, addons, optional NVIDIA addon).",{"type":46,"tag":463,"props":552,"children":553},{},[554,562],{"type":46,"tag":485,"props":555,"children":556},{},[557],{"type":46,"tag":67,"props":558,"children":560},{"className":559},[],[561],{"type":51,"value":246},{"type":46,"tag":485,"props":563,"children":564},{},[565,567,573,575,581],{"type":51,"value":566},"A cluster you already have. Skips bootstrap and TF entirely. Required env vars: ",{"type":46,"tag":67,"props":568,"children":570},{"className":569},[],[571],{"type":51,"value":572},"POSTGRES_HOST POSTGRES_USERNAME POSTGRES_PASSWORD POSTGRES_DB_NAME REDIS_HOST REDIS_PORT REDIS_PASSWORD",{"type":51,"value":574}," (",{"type":46,"tag":67,"props":576,"children":578},{"className":577},[],[579],{"type":51,"value":580},"IS_PRIVATE_CLUSTER",{"type":51,"value":582}," optional, defaults to false).",{"type":46,"tag":54,"props":584,"children":586},{"id":585},"required-user-inputs-ask-these-before-invoking-the-script",[587],{"type":51,"value":588},"Required user inputs (ask these BEFORE invoking the script)",{"type":46,"tag":61,"props":590,"children":591},{},[592,594,600,602,607],{"type":51,"value":593},"When the user asks to deploy OSMO without supplying every flag\u002Fenv, prompt for these inputs first. Map answers to env vars (or ",{"type":46,"tag":67,"props":595,"children":597},{"className":596},[],[598],{"type":51,"value":599},"--flag",{"type":51,"value":601}," equivalents) and only then invoke ",{"type":46,"tag":67,"props":603,"children":605},{"className":604},[],[606],{"type":51,"value":72},{"type":51,"value":512},{"type":46,"tag":61,"props":609,"children":610},{},[611],{"type":46,"tag":89,"props":612,"children":613},{},[614],{"type":51,"value":615},"Universal prompts (every provider):",{"type":46,"tag":259,"props":617,"children":618},{},[619,664,688,781],{"type":46,"tag":263,"props":620,"children":621},{},[622,627,629],{"type":46,"tag":89,"props":623,"children":624},{},[625],{"type":51,"value":626},"\"Do you need GPUs?\"",{"type":51,"value":628}," (yes\u002Fno)\n",{"type":46,"tag":630,"props":631,"children":632},"ul",{},[633,653],{"type":46,"tag":263,"props":634,"children":635},{},[636,638,643,645,651],{"type":51,"value":637},"If ",{"type":46,"tag":89,"props":639,"children":640},{},[641],{"type":51,"value":642},"no",{"type":51,"value":644}," → set ",{"type":46,"tag":67,"props":646,"children":648},{"className":647},[],[649],{"type":51,"value":650},"TF_GPU_NODE_POOL_ENABLED=false",{"type":51,"value":652},", skip prompts 2-4.",{"type":46,"tag":263,"props":654,"children":655},{},[656,657,662],{"type":51,"value":637},{"type":46,"tag":89,"props":658,"children":659},{},[660],{"type":51,"value":661},"yes",{"type":51,"value":663}," → continue.",{"type":46,"tag":263,"props":665,"children":666},{},[667,672,674,680,681,687],{"type":46,"tag":89,"props":668,"children":669},{},[670],{"type":51,"value":671},"\"How many GPUs?\"",{"type":51,"value":673}," — expect a positive integer. Set ",{"type":46,"tag":67,"props":675,"children":677},{"className":676},[],[678],{"type":51,"value":679},"TF_GPU_COUNT=\u003Cn>",{"type":51,"value":332},{"type":46,"tag":67,"props":682,"children":684},{"className":683},[],[685],{"type":51,"value":686},"TF_GPU_NODE_POOL_ENABLED=true",{"type":51,"value":512},{"type":46,"tag":263,"props":689,"children":690},{},[691,696,698,704,706,712,714,720,722,728,729,735,737,743,744,750,751,757,759,765,767,772,774,779],{"type":46,"tag":89,"props":692,"children":693},{},[694],{"type":51,"value":695},"\"What kind of GPU?\"",{"type":51,"value":697}," — expect an Azure VM SKU (e.g. ",{"type":46,"tag":67,"props":699,"children":701},{"className":700},[],[702],{"type":51,"value":703},"Standard_NC40ads_H100_v5",{"type":51,"value":705},") or AWS instance type (e.g. ",{"type":46,"tag":67,"props":707,"children":709},{"className":708},[],[710],{"type":51,"value":711},"p4d.24xlarge",{"type":51,"value":713},"). If the user gives an informal name (",{"type":46,"tag":67,"props":715,"children":717},{"className":716},[],[718],{"type":51,"value":719},"H100",{"type":51,"value":721},", ",{"type":46,"tag":67,"props":723,"children":725},{"className":724},[],[726],{"type":51,"value":727},"A10",{"type":51,"value":721},{"type":46,"tag":67,"props":730,"children":732},{"className":731},[],[733],{"type":51,"value":734},"T4",{"type":51,"value":736},"), translate to the canonical SKU: ",{"type":46,"tag":67,"props":738,"children":740},{"className":739},[],[741],{"type":51,"value":742},"H100 → Standard_NC40ads_H100_v5",{"type":51,"value":721},{"type":46,"tag":67,"props":745,"children":747},{"className":746},[],[748],{"type":51,"value":749},"A10 → Standard_NV36ads_A10_v5",{"type":51,"value":721},{"type":46,"tag":67,"props":752,"children":754},{"className":753},[],[755],{"type":51,"value":756},"T4 → Standard_NC4as_T4_v3",{"type":51,"value":758}," on Azure. Set ",{"type":46,"tag":67,"props":760,"children":762},{"className":761},[],[763],{"type":51,"value":764},"TF_GPU_VM_SIZE=\u003Csku>",{"type":51,"value":766},". Default to ",{"type":46,"tag":67,"props":768,"children":770},{"className":769},[],[771],{"type":51,"value":703},{"type":51,"value":773}," on Azure \u002F ",{"type":46,"tag":67,"props":775,"children":777},{"className":776},[],[778],{"type":51,"value":711},{"type":51,"value":780}," on AWS if the user leaves it blank.",{"type":46,"tag":263,"props":782,"children":783},{},[784,789,791,797,799],{"type":46,"tag":89,"props":785,"children":786},{},[787],{"type":51,"value":788},"\"What region do you have availability?\"",{"type":51,"value":790}," — accept a specific region OR ",{"type":46,"tag":67,"props":792,"children":794},{"className":793},[],[795],{"type":51,"value":796},"idk",{"type":51,"value":798},".\n",{"type":46,"tag":630,"props":800,"children":801},{},[802,851],{"type":46,"tag":263,"props":803,"children":804},{},[805,806,811,813,819,821,827,829,835,837,843,845,850],{"type":51,"value":637},{"type":46,"tag":67,"props":807,"children":809},{"className":808},[],[810],{"type":51,"value":796},{"type":51,"value":812}," → call ",{"type":46,"tag":67,"props":814,"children":816},{"className":815},[],[817],{"type":51,"value":818},".\u002Fscripts\u002Fdeploy-osmo-minimal.sh --find-gpu-region \"$TF_GPU_VM_SIZE\" \"$TF_GPU_COUNT\"",{"type":51,"value":820},". The script iterates ",{"type":46,"tag":67,"props":822,"children":824},{"className":823},[],[825],{"type":51,"value":826},"TF_REGION_CANDIDATES",{"type":51,"value":828}," (env-overridable; default covers H100-likely Azure regions: ",{"type":46,"tag":67,"props":830,"children":832},{"className":831},[],[833],{"type":51,"value":834},"eastus2 swedencentral westus3 southcentralus westeurope",{"type":51,"value":836},") and prints the first region whose quota fits. Set ",{"type":46,"tag":67,"props":838,"children":840},{"className":839},[],[841],{"type":51,"value":842},"TF_REGION",{"type":51,"value":844}," to that. Exits non-zero if no candidate has quota — surface the error to the user with a suggestion to expand ",{"type":46,"tag":67,"props":846,"children":848},{"className":847},[],[849],{"type":51,"value":826},{"type":51,"value":512},{"type":46,"tag":263,"props":852,"children":853},{},[854,856,861],{"type":51,"value":855},"If user names a region → set ",{"type":46,"tag":67,"props":857,"children":859},{"className":858},[],[860],{"type":51,"value":842},{"type":51,"value":862}," to it directly.",{"type":46,"tag":61,"props":864,"children":865},{},[866],{"type":46,"tag":89,"props":867,"children":868},{},[869],{"type":51,"value":870},"Azure-only prompts (provider=azure, when not already supplied via flags\u002Fenv):",{"type":46,"tag":259,"props":872,"children":874},{"start":873},4,[875,909],{"type":46,"tag":263,"props":876,"children":877},{},[878,883,885,891,893,899,901,907],{"type":46,"tag":89,"props":879,"children":880},{},[881],{"type":51,"value":882},"\"Azure subscription ID?\"",{"type":51,"value":884}," — if not set via ",{"type":46,"tag":67,"props":886,"children":888},{"className":887},[],[889],{"type":51,"value":890},"--subscription-id",{"type":51,"value":892}," or ",{"type":46,"tag":67,"props":894,"children":896},{"className":895},[],[897],{"type":51,"value":898},"TF_SUBSCRIPTION_ID",{"type":51,"value":900},", default to ",{"type":46,"tag":67,"props":902,"children":904},{"className":903},[],[905],{"type":51,"value":906},"$(az account show --query id -o tsv)",{"type":51,"value":908}," and ask the user to confirm or override.",{"type":46,"tag":263,"props":910,"children":911},{},[912,917,918,924,925,931,933,939,941,946,948,954,956,962,964,970],{"type":46,"tag":89,"props":913,"children":914},{},[915],{"type":51,"value":916},"\"Resource group name?\"",{"type":51,"value":884},{"type":46,"tag":67,"props":919,"children":921},{"className":920},[],[922],{"type":51,"value":923},"--resource-group",{"type":51,"value":892},{"type":46,"tag":67,"props":926,"children":928},{"className":927},[],[929],{"type":51,"value":930},"TF_RESOURCE_GROUP",{"type":51,"value":932},". The deploy preflight auto-creates the group (tagged ",{"type":46,"tag":67,"props":934,"children":936},{"className":935},[],[937],{"type":51,"value":938},"osmo-deploy-managed=true",{"type":51,"value":940},") when ",{"type":46,"tag":67,"props":942,"children":944},{"className":943},[],[945],{"type":51,"value":930},{"type":51,"value":947}," is set and the group doesn't already exist — so the agent should pass the chosen name and let the script handle creation. Check with ",{"type":46,"tag":67,"props":949,"children":951},{"className":950},[],[952],{"type":51,"value":953},"az group show -n \u003Crg>",{"type":51,"value":955}," if you want to see whether it pre-exists; create manually with ",{"type":46,"tag":67,"props":957,"children":959},{"className":958},[],[960],{"type":51,"value":961},"az group create -n \u003Crg> -l \u003Cregion>",{"type":51,"value":963}," only if you want the group to outlive future ",{"type":46,"tag":67,"props":965,"children":967},{"className":966},[],[968],{"type":51,"value":969},"terraform destroy",{"type":51,"value":971}," runs.",{"type":46,"tag":61,"props":973,"children":974},{},[975,980,982,988,990,996,998,1004,1005,1011],{"type":46,"tag":89,"props":976,"children":977},{},[978],{"type":51,"value":979},"AWS-only prompts:",{"type":51,"value":981}," AWS region (",{"type":46,"tag":67,"props":983,"children":985},{"className":984},[],[986],{"type":51,"value":987},"--aws-region",{"type":51,"value":989},") and profile (",{"type":46,"tag":67,"props":991,"children":993},{"className":992},[],[994],{"type":51,"value":995},"--aws-profile",{"type":51,"value":997},") — defaults ",{"type":46,"tag":67,"props":999,"children":1001},{"className":1000},[],[1002],{"type":51,"value":1003},"us-west-2",{"type":51,"value":74},{"type":46,"tag":67,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":51,"value":1010},"default",{"type":51,"value":1012}," are usually fine; only re-prompt if the user explicitly didn't pick a region.",{"type":46,"tag":61,"props":1014,"children":1015},{},[1016,1018,1024,1026,1031],{"type":51,"value":1017},"Once these are collected, invoke the script in ",{"type":46,"tag":67,"props":1019,"children":1021},{"className":1020},[],[1022],{"type":51,"value":1023},"--non-interactive",{"type":51,"value":1025}," mode with the answers passed as env vars (or ",{"type":46,"tag":67,"props":1027,"children":1029},{"className":1028},[],[1030],{"type":51,"value":599},{"type":51,"value":1032}," equivalents) — that avoids the script re-asking the same questions and keeps the agent's prompts as the single source of truth.",{"type":46,"tag":54,"props":1034,"children":1036},{"id":1035},"picking-chart-image-and-cli-versions",[1037],{"type":51,"value":1038},"Picking chart, image, and CLI versions",{"type":46,"tag":61,"props":1040,"children":1041},{},[1042],{"type":46,"tag":89,"props":1043,"children":1044},{},[1045],{"type":51,"value":1046},"This skill requires OSMO >= 6.3 (ConfigMap mode). Pinning all three env vars below is mandatory, not optional.",{"type":46,"tag":61,"props":1048,"children":1049},{},[1050],{"type":51,"value":1051},"The script's default behavior (no env vars set) resolves to:",{"type":46,"tag":630,"props":1053,"children":1054},{},[1055,1073,1091],{"type":46,"tag":263,"props":1056,"children":1057},{},[1058,1064,1066,1071],{"type":46,"tag":67,"props":1059,"children":1061},{"className":1060},[],[1062],{"type":51,"value":1063},"OSMO_CHART_VERSION",{"type":51,"value":1065}," empty → helm picks the latest ",{"type":46,"tag":89,"props":1067,"children":1068},{},[1069],{"type":51,"value":1070},"stable",{"type":51,"value":1072}," chart in repo",{"type":46,"tag":263,"props":1074,"children":1075},{},[1076,1082,1084,1089],{"type":46,"tag":67,"props":1077,"children":1079},{"className":1078},[],[1080],{"type":51,"value":1081},"OSMO_IMAGE_TAG=latest",{"type":51,"value":1083}," → most recent ",{"type":46,"tag":89,"props":1085,"children":1086},{},[1087],{"type":51,"value":1088},"GA",{"type":51,"value":1090}," image",{"type":46,"tag":263,"props":1092,"children":1093},{},[1094,1100,1102,1107,1109],{"type":46,"tag":67,"props":1095,"children":1097},{"className":1096},[],[1098],{"type":51,"value":1099},"OSMO_CLI_REF=main",{"type":51,"value":1101}," → bootstraps the ",{"type":46,"tag":89,"props":1103,"children":1104},{},[1105],{"type":51,"value":1106},"latest GA",{"type":51,"value":1108}," CLI via the upstream ",{"type":46,"tag":67,"props":1110,"children":1112},{"className":1111},[],[1113],{"type":51,"value":1114},"install.sh",{"type":46,"tag":61,"props":1116,"children":1117},{},[1118,1120,1125],{"type":51,"value":1119},"If the latest GA is still on 6.2, leaving any of these at default lands you on the unsupported CLI-write-mode variant. The Helm install fails (e.g. on Ingress validation), or the CLI's wire format doesn't match the service, or the chart attempts ",{"type":46,"tag":67,"props":1121,"children":1123},{"className":1122},[],[1124],{"type":51,"value":119},{"type":51,"value":1126}," and gets HTTP 409 in ConfigMap mode.",{"type":46,"tag":1128,"props":1129,"children":1131},"h3",{"id":1130},"required-discover-pin-all-three-to-a-63x-release",[1132],{"type":51,"value":1133},"Required: discover + pin all three to a 6.3.x release",{"type":46,"tag":167,"props":1135,"children":1137},{"className":169,"code":1136,"language":171,"meta":172,"style":172},"# Step 1: discover the latest available 6.3.x chart\u002Fimage\u002FCLI tags\n# (passes --devel so prerelease RCs appear).\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --list-chart-versions\n\n# Step 2: pin all three env vars to the same release before invoking the deploy.\n#   - Use the latest non-prerelease 6.3.x release if one exists.\n#   - Otherwise pin to the latest 6.3.x prerelease RC.\nexport OSMO_CHART_VERSION=\u003Cchart version from step 1>\nexport OSMO_IMAGE_TAG=\u003Cmatching app\u002Fimage tag>\nexport OSMO_CLI_REF=\u003Cmatching CLI release tag>\n",[1138],{"type":46,"tag":67,"props":1139,"children":1140},{"__ignoreMap":172},[1141,1150,1158,1171,1180,1189,1198,1207,1237,1263],{"type":46,"tag":178,"props":1142,"children":1143},{"class":180,"line":181},[1144],{"type":46,"tag":178,"props":1145,"children":1147},{"style":1146},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1148],{"type":51,"value":1149},"# Step 1: discover the latest available 6.3.x chart\u002Fimage\u002FCLI tags\n",{"type":46,"tag":178,"props":1151,"children":1152},{"class":180,"line":197},[1153],{"type":46,"tag":178,"props":1154,"children":1155},{"style":1146},[1156],{"type":51,"value":1157},"# (passes --devel so prerelease RCs appear).\n",{"type":46,"tag":178,"props":1159,"children":1161},{"class":180,"line":1160},3,[1162,1166],{"type":46,"tag":178,"props":1163,"children":1164},{"style":201},[1165],{"type":51,"value":204},{"type":46,"tag":178,"props":1167,"children":1168},{"style":191},[1169],{"type":51,"value":1170}," --list-chart-versions\n",{"type":46,"tag":178,"props":1172,"children":1173},{"class":180,"line":873},[1174],{"type":46,"tag":178,"props":1175,"children":1177},{"emptyLinePlaceholder":1176},true,[1178],{"type":51,"value":1179},"\n",{"type":46,"tag":178,"props":1181,"children":1183},{"class":180,"line":1182},5,[1184],{"type":46,"tag":178,"props":1185,"children":1186},{"style":1146},[1187],{"type":51,"value":1188},"# Step 2: pin all three env vars to the same release before invoking the deploy.\n",{"type":46,"tag":178,"props":1190,"children":1192},{"class":180,"line":1191},6,[1193],{"type":46,"tag":178,"props":1194,"children":1195},{"style":1146},[1196],{"type":51,"value":1197},"#   - Use the latest non-prerelease 6.3.x release if one exists.\n",{"type":46,"tag":178,"props":1199,"children":1201},{"class":180,"line":1200},7,[1202],{"type":46,"tag":178,"props":1203,"children":1204},{"style":1146},[1205],{"type":51,"value":1206},"#   - Otherwise pin to the latest 6.3.x prerelease RC.\n",{"type":46,"tag":178,"props":1208,"children":1210},{"class":180,"line":1209},8,[1211,1217,1222,1227,1232],{"type":46,"tag":178,"props":1212,"children":1214},{"style":1213},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1215],{"type":51,"value":1216},"export",{"type":46,"tag":178,"props":1218,"children":1219},{"style":249},[1220],{"type":51,"value":1221}," OSMO_CHART_VERSION",{"type":46,"tag":178,"props":1223,"children":1224},{"style":212},[1225],{"type":51,"value":1226},"=\u003C",{"type":46,"tag":178,"props":1228,"children":1229},{"style":249},[1230],{"type":51,"value":1231},"chart version from step 1",{"type":46,"tag":178,"props":1233,"children":1234},{"style":212},[1235],{"type":51,"value":1236},">\n",{"type":46,"tag":178,"props":1238,"children":1240},{"class":180,"line":1239},9,[1241,1245,1250,1254,1259],{"type":46,"tag":178,"props":1242,"children":1243},{"style":1213},[1244],{"type":51,"value":1216},{"type":46,"tag":178,"props":1246,"children":1247},{"style":249},[1248],{"type":51,"value":1249}," OSMO_IMAGE_TAG",{"type":46,"tag":178,"props":1251,"children":1252},{"style":212},[1253],{"type":51,"value":1226},{"type":46,"tag":178,"props":1255,"children":1256},{"style":249},[1257],{"type":51,"value":1258},"matching app\u002Fimage tag",{"type":46,"tag":178,"props":1260,"children":1261},{"style":212},[1262],{"type":51,"value":1236},{"type":46,"tag":178,"props":1264,"children":1266},{"class":180,"line":1265},10,[1267,1271,1276,1280,1285],{"type":46,"tag":178,"props":1268,"children":1269},{"style":1213},[1270],{"type":51,"value":1216},{"type":46,"tag":178,"props":1272,"children":1273},{"style":249},[1274],{"type":51,"value":1275}," OSMO_CLI_REF",{"type":46,"tag":178,"props":1277,"children":1278},{"style":212},[1279],{"type":51,"value":1226},{"type":46,"tag":178,"props":1281,"children":1282},{"style":249},[1283],{"type":51,"value":1284},"matching CLI release tag",{"type":46,"tag":178,"props":1286,"children":1287},{"style":212},[1288],{"type":51,"value":1236},{"type":46,"tag":61,"props":1290,"children":1291},{},[1292],{"type":51,"value":1293},"The chart version + image\u002Fapp tag + CLI tag are published together as a release pair. Match them — don't mix.",{"type":46,"tag":1128,"props":1295,"children":1297},{"id":1296},"why-each-pin-matters-each-is-independently-required",[1298],{"type":51,"value":1299},"Why each pin matters (each is independently required)",{"type":46,"tag":630,"props":1301,"children":1302},{},[1303,1316,1330],{"type":46,"tag":263,"props":1304,"children":1305},{},[1306,1314],{"type":46,"tag":89,"props":1307,"children":1308},{},[1309],{"type":46,"tag":67,"props":1310,"children":1312},{"className":1311},[],[1313],{"type":51,"value":1063},{"type":51,"value":1315}," — helm's \"latest\" resolution can roll forward unexpectedly. Pinning a specific 6.3.x chart prevents both (a) accidentally landing on a 6.2 chart and (b) drifting between deploys.",{"type":46,"tag":263,"props":1317,"children":1318},{},[1319,1328],{"type":46,"tag":89,"props":1320,"children":1321},{},[1322],{"type":46,"tag":67,"props":1323,"children":1325},{"className":1324},[],[1326],{"type":51,"value":1327},"OSMO_IMAGE_TAG",{"type":51,"value":1329}," — must match the chart's expected app version. The chart's templates assume specific image entrypoints and env contracts that change across minor releases.",{"type":46,"tag":263,"props":1331,"children":1332},{},[1333,1342,1344,1350,1352,1358,1360,1365,1367,1373,1375,1381],{"type":46,"tag":89,"props":1334,"children":1335},{},[1336],{"type":46,"tag":67,"props":1337,"children":1339},{"className":1338},[],[1340],{"type":51,"value":1341},"OSMO_CLI_REF",{"type":51,"value":1343}," — the ",{"type":46,"tag":67,"props":1345,"children":1347},{"className":1346},[],[1348],{"type":51,"value":1349},"osmo",{"type":51,"value":1351}," CLI's wire format (auth, workflow submit\u002Fget, configmap loading) must match the service. A CLI from a different minor version often connects but fails at the first non-trivial call. The deploy script's ",{"type":46,"tag":67,"props":1353,"children":1355},{"className":1354},[],[1356],{"type":51,"value":1357},"install_osmo_cli_if_missing",{"type":51,"value":1359}," honors ",{"type":46,"tag":67,"props":1361,"children":1363},{"className":1362},[],[1364],{"type":51,"value":1341},{"type":51,"value":1366}," by downloading the matching installer directly to ",{"type":46,"tag":67,"props":1368,"children":1370},{"className":1369},[],[1371],{"type":51,"value":1372},"$HOME\u002F.local\u002Fbin",{"type":51,"value":1374}," (no sudo); override the destination via ",{"type":46,"tag":67,"props":1376,"children":1378},{"className":1377},[],[1379],{"type":51,"value":1380},"OSMO_CLI_TARGET",{"type":51,"value":512},{"type":46,"tag":1128,"props":1383,"children":1385},{"id":1384},"prerelease-vs-release-within-63x",[1386],{"type":51,"value":1387},"Prerelease vs release within 6.3.x",{"type":46,"tag":61,"props":1389,"children":1390},{},[1391,1393,1399,1401,1407,1409,1415,1417,1422,1424,1430],{"type":51,"value":1392},"Both stable and prerelease 6.3.x versions are published to ",{"type":46,"tag":67,"props":1394,"children":1396},{"className":1395},[],[1397],{"type":51,"value":1398},"nvidia\u002Fosmo",{"type":51,"value":1400},". Prerelease tags (",{"type":46,"tag":67,"props":1402,"children":1404},{"className":1403},[],[1405],{"type":51,"value":1406},"*-prerelease-rc*",{"type":51,"value":1408},") are hidden from ",{"type":46,"tag":67,"props":1410,"children":1412},{"className":1411},[],[1413],{"type":51,"value":1414},"helm search",{"type":51,"value":1416}," by default — that's why ",{"type":46,"tag":67,"props":1418,"children":1420},{"className":1419},[],[1421],{"type":51,"value":135},{"type":51,"value":1423}," passes ",{"type":46,"tag":67,"props":1425,"children":1427},{"className":1426},[],[1428],{"type":51,"value":1429},"--devel",{"type":51,"value":1431},". The pinning workflow above is identical either way.",{"type":46,"tag":54,"props":1433,"children":1435},{"id":1434},"storage-backends",[1436],{"type":51,"value":1437},"Storage backends",{"type":46,"tag":61,"props":1439,"children":1440},{},[1441,1443,1449],{"type":51,"value":1442},"Use ",{"type":46,"tag":67,"props":1444,"children":1446},{"className":1445},[],[1447],{"type":51,"value":1448},"--storage-backend {auto|minio|azure-blob|s3|byo|none}",{"type":51,"value":1450},":",{"type":46,"tag":630,"props":1452,"children":1453},{},[1454,1480,1497,1523,1571,1615],{"type":46,"tag":263,"props":1455,"children":1456},{},[1457,1462,1464,1470,1472,1478],{"type":46,"tag":89,"props":1458,"children":1459},{},[1460],{"type":51,"value":1461},"auto",{"type":51,"value":1463}," (default): probes BYO env vars → microk8s minio addon → existing minio service → osmo AWS TF ",{"type":46,"tag":67,"props":1465,"children":1467},{"className":1466},[],[1468],{"type":51,"value":1469},"s3_bucket",{"type":51,"value":1471}," output → osmo Azure TF ",{"type":46,"tag":67,"props":1473,"children":1475},{"className":1474},[],[1476],{"type":51,"value":1477},"storage_account",{"type":51,"value":1479}," output",{"type":46,"tag":263,"props":1481,"children":1482},{},[1483,1488,1490,1495],{"type":46,"tag":89,"props":1484,"children":1485},{},[1486],{"type":51,"value":1487},"minio",{"type":51,"value":1489},": in-cluster S3. On microk8s, uses the ",{"type":46,"tag":67,"props":1491,"children":1493},{"className":1492},[],[1494],{"type":51,"value":1487},{"type":51,"value":1496}," addon; otherwise installs the bitnami MinIO chart",{"type":46,"tag":263,"props":1498,"children":1499},{},[1500,1505,1507,1513,1515,1521],{"type":46,"tag":89,"props":1501,"children":1502},{},[1503],{"type":51,"value":1504},"azure-blob",{"type":51,"value":1506},": Azure Blob Storage Account. Reads ",{"type":46,"tag":67,"props":1508,"children":1510},{"className":1509},[],[1511],{"type":51,"value":1512},"STORAGE_ACCOUNT",{"type":51,"value":1514},"\u002F",{"type":46,"tag":67,"props":1516,"children":1518},{"className":1517},[],[1519],{"type":51,"value":1520},"STORAGE_KEY",{"type":51,"value":1522}," env vars first, falls back to osmo Azure TF outputs",{"type":46,"tag":263,"props":1524,"children":1525},{},[1526,1531,1533,1539,1540,1546,1547,1553,1555,1561,1563,1569],{"type":46,"tag":89,"props":1527,"children":1528},{},[1529],{"type":51,"value":1530},"s3",{"type":51,"value":1532},": AWS S3 with static credentials. Reads ",{"type":46,"tag":67,"props":1534,"children":1536},{"className":1535},[],[1537],{"type":51,"value":1538},"STORAGE_BUCKET",{"type":51,"value":1514},{"type":46,"tag":67,"props":1541,"children":1543},{"className":1542},[],[1544],{"type":51,"value":1545},"STORAGE_ACCESS_KEY_ID",{"type":51,"value":1514},{"type":46,"tag":67,"props":1548,"children":1550},{"className":1549},[],[1551],{"type":51,"value":1552},"STORAGE_ACCESS_KEY",{"type":51,"value":1554}," env vars first, falls back to osmo AWS TF outputs (when ",{"type":46,"tag":67,"props":1556,"children":1558},{"className":1557},[],[1559],{"type":51,"value":1560},"s3_bucket_enabled=true",{"type":51,"value":1562},"). For IAM-role-based auth (IRSA), use ",{"type":46,"tag":67,"props":1564,"children":1566},{"className":1565},[],[1567],{"type":51,"value":1568},"--backend byo --auth-method workload-identity",{"type":51,"value":1570}," instead.",{"type":46,"tag":263,"props":1572,"children":1573},{},[1574,1578,1580,1585,1586,1591,1592,1598,1600,1606,1607,1613],{"type":46,"tag":89,"props":1575,"children":1576},{},[1577],{"type":51,"value":246},{"type":51,"value":1579},": caller provides credentials via env (",{"type":46,"tag":67,"props":1581,"children":1583},{"className":1582},[],[1584],{"type":51,"value":1545},{"type":51,"value":721},{"type":46,"tag":67,"props":1587,"children":1589},{"className":1588},[],[1590],{"type":51,"value":1552},{"type":51,"value":721},{"type":46,"tag":67,"props":1593,"children":1595},{"className":1594},[],[1596],{"type":51,"value":1597},"STORAGE_ENDPOINT",{"type":51,"value":1599},", optional ",{"type":46,"tag":67,"props":1601,"children":1603},{"className":1602},[],[1604],{"type":51,"value":1605},"STORAGE_REGION",{"type":51,"value":721},{"type":46,"tag":67,"props":1608,"children":1610},{"className":1609},[],[1611],{"type":51,"value":1612},"STORAGE_OVERRIDE_URL",{"type":51,"value":1614},"). No resources created.",{"type":46,"tag":263,"props":1616,"children":1617},{},[1618,1623],{"type":46,"tag":89,"props":1619,"children":1620},{},[1621],{"type":51,"value":1622},"none",{"type":51,"value":1624},": skip storage entirely (manual configuration later)",{"type":46,"tag":61,"props":1626,"children":1627},{},[1628,1630,1636,1638,1643,1645,1649,1651,1656,1657,1663],{"type":51,"value":1629},"In static-auth mode the helper writes K8s Secrets (",{"type":46,"tag":67,"props":1631,"children":1633},{"className":1632},[],[1634],{"type":51,"value":1635},"osmo-workflow-{data,log,app}-cred",{"type":51,"value":1637},") and a Helm values fragment that the chart consumes via ",{"type":46,"tag":67,"props":1639,"children":1641},{"className":1640},[],[1642],{"type":51,"value":298},{"type":51,"value":1644},". There are ",{"type":46,"tag":89,"props":1646,"children":1647},{},[1648],{"type":51,"value":642},{"type":51,"value":1650}," ",{"type":46,"tag":67,"props":1652,"children":1654},{"className":1653},[],[1655],{"type":51,"value":119},{"type":51,"value":892},{"type":46,"tag":67,"props":1658,"children":1660},{"className":1659},[],[1661],{"type":51,"value":1662},"osmo credential set",{"type":51,"value":1664}," CLI calls — those return HTTP 409 in 6.3 ConfigMap mode.",{"type":46,"tag":54,"props":1666,"children":1668},{"id":1667},"auth-modes-auth-method",[1669,1671,1677],{"type":51,"value":1670},"Auth modes (",{"type":46,"tag":67,"props":1672,"children":1674},{"className":1673},[],[1675],{"type":51,"value":1676},"--auth-method",{"type":51,"value":416},{"type":46,"tag":61,"props":1679,"children":1680},{},[1681,1687],{"type":46,"tag":67,"props":1682,"children":1684},{"className":1683},[],[1685],{"type":51,"value":1686},"--auth-method {static|workload-identity}",{"type":51,"value":1688}," controls how OSMO services authenticate to the cloud storage backend.",{"type":46,"tag":630,"props":1690,"children":1691},{},[1692,1702],{"type":46,"tag":263,"props":1693,"children":1694},{},[1695,1700],{"type":46,"tag":89,"props":1696,"children":1697},{},[1698],{"type":51,"value":1699},"static",{"type":51,"value":1701}," (default): K8s Secrets carry static cloud credentials (account keys \u002F connection strings \u002F S3 access keys). Works with every backend.",{"type":46,"tag":263,"props":1703,"children":1704},{},[1705,1710,1712],{"type":46,"tag":89,"props":1706,"children":1707},{},[1708],{"type":51,"value":1709},"workload-identity",{"type":51,"value":1711},": No K8s Secrets. OSMO services use the cluster's federated identity:\n",{"type":46,"tag":630,"props":1713,"children":1714},{},[1715,1725,1735],{"type":46,"tag":263,"props":1716,"children":1717},{},[1718,1723],{"type":46,"tag":67,"props":1719,"children":1721},{"className":1720},[],[1722],{"type":51,"value":1504},{"type":51,"value":1724}," + WI = AKS Workload Identity (UAMI + federated credential)",{"type":46,"tag":263,"props":1726,"children":1727},{},[1728,1733],{"type":46,"tag":67,"props":1729,"children":1731},{"className":1730},[],[1732],{"type":51,"value":246},{"type":51,"value":1734}," + WI = AWS IRSA (IAM role + EKS OIDC trust policy)",{"type":46,"tag":263,"props":1736,"children":1737},{},[1738,1743,1745,1750],{"type":46,"tag":67,"props":1739,"children":1741},{"className":1740},[],[1742],{"type":51,"value":1487},{"type":51,"value":1744}," + WI = ",{"type":46,"tag":89,"props":1746,"children":1747},{},[1748],{"type":51,"value":1749},"not supported",{"type":51,"value":1751}," (MinIO has no cloud-vendor IdP)",{"type":46,"tag":1753,"props":1754,"children":1755},"blockquote",{},[1756],{"type":46,"tag":61,"props":1757,"children":1758},{},[1759,1761,1766,1768,1772],{"type":51,"value":1760},"⚠ ",{"type":46,"tag":89,"props":1762,"children":1763},{},[1764],{"type":51,"value":1765},"Workload identity mode requires caller-provisioned cloud-side identity.",{"type":51,"value":1767}," The deploy scripts do ",{"type":46,"tag":89,"props":1769,"children":1770},{},[1771],{"type":51,"value":93},{"type":51,"value":1773}," create the UAMI \u002F IAM role, attach RBAC, or create the federated credential — those are owned by the caller (typically the platform\u002Fsecurity team). The script does the K8s-side wiring (SA annotation + pod labels for the AKS WI mutating webhook + DefaultDataCredential values fragment) and surfaces a prominent prerequisite checklist before any work begins. If prerequisites aren't met, OSMO will start successfully but workflows will fail at runtime with 401\u002F403 from the storage backend.",{"type":46,"tag":1128,"props":1775,"children":1777},{"id":1776},"azure-workload-identity-prerequisites",[1778],{"type":51,"value":1779},"Azure Workload Identity prerequisites",{"type":46,"tag":167,"props":1781,"children":1783},{"className":169,"code":1782,"language":171,"meta":172,"style":172},"# 1. AKS cluster has OIDC issuer + Workload Identity addons\naz aks update -g \u003Crg> -n \u003Ccluster> --enable-oidc-issuer --enable-workload-identity\n\n# 2. Provision UAMI\naz identity create -g \u003Crg> -n osmo-data-uami\n\n# 3. Grant Storage Blob Data Contributor on the storage account\naz role assignment create \\\n  --role \"Storage Blob Data Contributor\" \\\n  --assignee \u003CUAMI-principal-id> \\\n  --scope \u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F\u003Crg>\u002Fproviders\u002FMicrosoft.Storage\u002FstorageAccounts\u002F\u003Caccount>\n\n# 4. Federate UAMI to the chart's ServiceAccount (default name: osmo-minimal)\naz identity federated-credential create \\\n  --name osmo-osmo-minimal \\\n  --identity-name osmo-data-uami \\\n  --resource-group \u003Crg> \\\n  --issuer \"$(az aks show -g \u003Crg> -n \u003Ccluster> --query oidcIssuerProfile.issuerUrl -o tsv)\" \\\n  --subject \"system:serviceaccount:osmo-minimal:osmo-minimal\"\n\n# 5. Run deploy with WI\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider byo \\\n  --storage-backend azure-blob --auth-method workload-identity \\\n  --workload-identity-client-id \"$(az identity show -g \u003Crg> -n osmo-data-uami --query clientId -o tsv)\"\n",[1784],{"type":46,"tag":67,"props":1785,"children":1786},{"__ignoreMap":172},[1787,1795,1869,1876,1884,1930,1937,1945,1971,1998,2028,2105,2113,2122,2147,2165,2183,2212,2280,2303,2311,2320,2341,2369],{"type":46,"tag":178,"props":1788,"children":1789},{"class":180,"line":181},[1790],{"type":46,"tag":178,"props":1791,"children":1792},{"style":1146},[1793],{"type":51,"value":1794},"# 1. AKS cluster has OIDC issuer + Workload Identity addons\n",{"type":46,"tag":178,"props":1796,"children":1797},{"class":180,"line":197},[1798,1803,1808,1813,1818,1822,1827,1832,1837,1842,1846,1851,1855,1859,1864],{"type":46,"tag":178,"props":1799,"children":1800},{"style":201},[1801],{"type":51,"value":1802},"az",{"type":46,"tag":178,"props":1804,"children":1805},{"style":191},[1806],{"type":51,"value":1807}," aks",{"type":46,"tag":178,"props":1809,"children":1810},{"style":191},[1811],{"type":51,"value":1812}," update",{"type":46,"tag":178,"props":1814,"children":1815},{"style":191},[1816],{"type":51,"value":1817}," -g",{"type":46,"tag":178,"props":1819,"children":1820},{"style":212},[1821],{"type":51,"value":215},{"type":46,"tag":178,"props":1823,"children":1824},{"style":191},[1825],{"type":51,"value":1826},"r",{"type":46,"tag":178,"props":1828,"children":1829},{"style":249},[1830],{"type":51,"value":1831},"g",{"type":46,"tag":178,"props":1833,"children":1834},{"style":212},[1835],{"type":51,"value":1836},">",{"type":46,"tag":178,"props":1838,"children":1839},{"style":191},[1840],{"type":51,"value":1841}," -n",{"type":46,"tag":178,"props":1843,"children":1844},{"style":212},[1845],{"type":51,"value":215},{"type":46,"tag":178,"props":1847,"children":1848},{"style":191},[1849],{"type":51,"value":1850},"cluste",{"type":46,"tag":178,"props":1852,"children":1853},{"style":249},[1854],{"type":51,"value":1826},{"type":46,"tag":178,"props":1856,"children":1857},{"style":212},[1858],{"type":51,"value":1836},{"type":46,"tag":178,"props":1860,"children":1861},{"style":191},[1862],{"type":51,"value":1863}," --enable-oidc-issuer",{"type":46,"tag":178,"props":1865,"children":1866},{"style":191},[1867],{"type":51,"value":1868}," --enable-workload-identity\n",{"type":46,"tag":178,"props":1870,"children":1871},{"class":180,"line":1160},[1872],{"type":46,"tag":178,"props":1873,"children":1874},{"emptyLinePlaceholder":1176},[1875],{"type":51,"value":1179},{"type":46,"tag":178,"props":1877,"children":1878},{"class":180,"line":873},[1879],{"type":46,"tag":178,"props":1880,"children":1881},{"style":1146},[1882],{"type":51,"value":1883},"# 2. Provision UAMI\n",{"type":46,"tag":178,"props":1885,"children":1886},{"class":180,"line":1182},[1887,1891,1896,1901,1905,1909,1913,1917,1921,1925],{"type":46,"tag":178,"props":1888,"children":1889},{"style":201},[1890],{"type":51,"value":1802},{"type":46,"tag":178,"props":1892,"children":1893},{"style":191},[1894],{"type":51,"value":1895}," identity",{"type":46,"tag":178,"props":1897,"children":1898},{"style":191},[1899],{"type":51,"value":1900}," create",{"type":46,"tag":178,"props":1902,"children":1903},{"style":191},[1904],{"type":51,"value":1817},{"type":46,"tag":178,"props":1906,"children":1907},{"style":212},[1908],{"type":51,"value":215},{"type":46,"tag":178,"props":1910,"children":1911},{"style":191},[1912],{"type":51,"value":1826},{"type":46,"tag":178,"props":1914,"children":1915},{"style":249},[1916],{"type":51,"value":1831},{"type":46,"tag":178,"props":1918,"children":1919},{"style":212},[1920],{"type":51,"value":1836},{"type":46,"tag":178,"props":1922,"children":1923},{"style":191},[1924],{"type":51,"value":1841},{"type":46,"tag":178,"props":1926,"children":1927},{"style":191},[1928],{"type":51,"value":1929}," osmo-data-uami\n",{"type":46,"tag":178,"props":1931,"children":1932},{"class":180,"line":1191},[1933],{"type":46,"tag":178,"props":1934,"children":1935},{"emptyLinePlaceholder":1176},[1936],{"type":51,"value":1179},{"type":46,"tag":178,"props":1938,"children":1939},{"class":180,"line":1200},[1940],{"type":46,"tag":178,"props":1941,"children":1942},{"style":1146},[1943],{"type":51,"value":1944},"# 3. Grant Storage Blob Data Contributor on the storage account\n",{"type":46,"tag":178,"props":1946,"children":1947},{"class":180,"line":1209},[1948,1952,1957,1962,1966],{"type":46,"tag":178,"props":1949,"children":1950},{"style":201},[1951],{"type":51,"value":1802},{"type":46,"tag":178,"props":1953,"children":1954},{"style":191},[1955],{"type":51,"value":1956}," role",{"type":46,"tag":178,"props":1958,"children":1959},{"style":191},[1960],{"type":51,"value":1961}," assignment",{"type":46,"tag":178,"props":1963,"children":1964},{"style":191},[1965],{"type":51,"value":1900},{"type":46,"tag":178,"props":1967,"children":1968},{"style":249},[1969],{"type":51,"value":1970}," \\\n",{"type":46,"tag":178,"props":1972,"children":1973},{"class":180,"line":1239},[1974,1979,1984,1989,1994],{"type":46,"tag":178,"props":1975,"children":1976},{"style":191},[1977],{"type":51,"value":1978},"  --role",{"type":46,"tag":178,"props":1980,"children":1981},{"style":212},[1982],{"type":51,"value":1983}," \"",{"type":46,"tag":178,"props":1985,"children":1986},{"style":191},[1987],{"type":51,"value":1988},"Storage Blob Data Contributor",{"type":46,"tag":178,"props":1990,"children":1991},{"style":212},[1992],{"type":51,"value":1993},"\"",{"type":46,"tag":178,"props":1995,"children":1996},{"style":249},[1997],{"type":51,"value":1970},{"type":46,"tag":178,"props":1999,"children":2000},{"class":180,"line":1265},[2001,2006,2010,2015,2020,2024],{"type":46,"tag":178,"props":2002,"children":2003},{"style":191},[2004],{"type":51,"value":2005},"  --assignee",{"type":46,"tag":178,"props":2007,"children":2008},{"style":212},[2009],{"type":51,"value":215},{"type":46,"tag":178,"props":2011,"children":2012},{"style":191},[2013],{"type":51,"value":2014},"UAMI-principal-i",{"type":46,"tag":178,"props":2016,"children":2017},{"style":249},[2018],{"type":51,"value":2019},"d",{"type":46,"tag":178,"props":2021,"children":2022},{"style":212},[2023],{"type":51,"value":1836},{"type":46,"tag":178,"props":2025,"children":2026},{"style":249},[2027],{"type":51,"value":1970},{"type":46,"tag":178,"props":2029,"children":2031},{"class":180,"line":2030},11,[2032,2037,2042,2047,2052,2057,2061,2066,2070,2074,2078,2082,2087,2091,2096,2101],{"type":46,"tag":178,"props":2033,"children":2034},{"style":191},[2035],{"type":51,"value":2036},"  --scope",{"type":46,"tag":178,"props":2038,"children":2039},{"style":191},[2040],{"type":51,"value":2041}," \u002Fsubscriptions\u002F",{"type":46,"tag":178,"props":2043,"children":2044},{"style":212},[2045],{"type":51,"value":2046},"\u003C",{"type":46,"tag":178,"props":2048,"children":2049},{"style":191},[2050],{"type":51,"value":2051},"su",{"type":46,"tag":178,"props":2053,"children":2054},{"style":249},[2055],{"type":51,"value":2056},"b",{"type":46,"tag":178,"props":2058,"children":2059},{"style":212},[2060],{"type":51,"value":1836},{"type":46,"tag":178,"props":2062,"children":2063},{"style":191},[2064],{"type":51,"value":2065},"\u002FresourceGroups\u002F",{"type":46,"tag":178,"props":2067,"children":2068},{"style":212},[2069],{"type":51,"value":2046},{"type":46,"tag":178,"props":2071,"children":2072},{"style":191},[2073],{"type":51,"value":1826},{"type":46,"tag":178,"props":2075,"children":2076},{"style":249},[2077],{"type":51,"value":1831},{"type":46,"tag":178,"props":2079,"children":2080},{"style":212},[2081],{"type":51,"value":1836},{"type":46,"tag":178,"props":2083,"children":2084},{"style":191},[2085],{"type":51,"value":2086},"\u002Fproviders\u002FMicrosoft.Storage\u002FstorageAccounts\u002F",{"type":46,"tag":178,"props":2088,"children":2089},{"style":212},[2090],{"type":51,"value":2046},{"type":46,"tag":178,"props":2092,"children":2093},{"style":191},[2094],{"type":51,"value":2095},"accoun",{"type":46,"tag":178,"props":2097,"children":2098},{"style":249},[2099],{"type":51,"value":2100},"t",{"type":46,"tag":178,"props":2102,"children":2103},{"style":212},[2104],{"type":51,"value":1236},{"type":46,"tag":178,"props":2106,"children":2108},{"class":180,"line":2107},12,[2109],{"type":46,"tag":178,"props":2110,"children":2111},{"emptyLinePlaceholder":1176},[2112],{"type":51,"value":1179},{"type":46,"tag":178,"props":2114,"children":2116},{"class":180,"line":2115},13,[2117],{"type":46,"tag":178,"props":2118,"children":2119},{"style":1146},[2120],{"type":51,"value":2121},"# 4. Federate UAMI to the chart's ServiceAccount (default name: osmo-minimal)\n",{"type":46,"tag":178,"props":2123,"children":2125},{"class":180,"line":2124},14,[2126,2130,2134,2139,2143],{"type":46,"tag":178,"props":2127,"children":2128},{"style":201},[2129],{"type":51,"value":1802},{"type":46,"tag":178,"props":2131,"children":2132},{"style":191},[2133],{"type":51,"value":1895},{"type":46,"tag":178,"props":2135,"children":2136},{"style":191},[2137],{"type":51,"value":2138}," federated-credential",{"type":46,"tag":178,"props":2140,"children":2141},{"style":191},[2142],{"type":51,"value":1900},{"type":46,"tag":178,"props":2144,"children":2145},{"style":249},[2146],{"type":51,"value":1970},{"type":46,"tag":178,"props":2148,"children":2150},{"class":180,"line":2149},15,[2151,2156,2161],{"type":46,"tag":178,"props":2152,"children":2153},{"style":191},[2154],{"type":51,"value":2155},"  --name",{"type":46,"tag":178,"props":2157,"children":2158},{"style":191},[2159],{"type":51,"value":2160}," osmo-osmo-minimal",{"type":46,"tag":178,"props":2162,"children":2163},{"style":249},[2164],{"type":51,"value":1970},{"type":46,"tag":178,"props":2166,"children":2168},{"class":180,"line":2167},16,[2169,2174,2179],{"type":46,"tag":178,"props":2170,"children":2171},{"style":191},[2172],{"type":51,"value":2173},"  --identity-name",{"type":46,"tag":178,"props":2175,"children":2176},{"style":191},[2177],{"type":51,"value":2178}," osmo-data-uami",{"type":46,"tag":178,"props":2180,"children":2181},{"style":249},[2182],{"type":51,"value":1970},{"type":46,"tag":178,"props":2184,"children":2186},{"class":180,"line":2185},17,[2187,2192,2196,2200,2204,2208],{"type":46,"tag":178,"props":2188,"children":2189},{"style":191},[2190],{"type":51,"value":2191},"  --resource-group",{"type":46,"tag":178,"props":2193,"children":2194},{"style":212},[2195],{"type":51,"value":215},{"type":46,"tag":178,"props":2197,"children":2198},{"style":191},[2199],{"type":51,"value":1826},{"type":46,"tag":178,"props":2201,"children":2202},{"style":249},[2203],{"type":51,"value":1831},{"type":46,"tag":178,"props":2205,"children":2206},{"style":212},[2207],{"type":51,"value":1836},{"type":46,"tag":178,"props":2209,"children":2210},{"style":249},[2211],{"type":51,"value":1970},{"type":46,"tag":178,"props":2213,"children":2215},{"class":180,"line":2214},18,[2216,2221,2226,2230,2235,2239,2244,2248,2253,2257,2262,2266,2271,2276],{"type":46,"tag":178,"props":2217,"children":2218},{"style":191},[2219],{"type":51,"value":2220},"  --issuer",{"type":46,"tag":178,"props":2222,"children":2223},{"style":212},[2224],{"type":51,"value":2225}," \"$(",{"type":46,"tag":178,"props":2227,"children":2228},{"style":201},[2229],{"type":51,"value":1802},{"type":46,"tag":178,"props":2231,"children":2232},{"style":191},[2233],{"type":51,"value":2234}," aks show -g ",{"type":46,"tag":178,"props":2236,"children":2237},{"style":212},[2238],{"type":51,"value":2046},{"type":46,"tag":178,"props":2240,"children":2241},{"style":191},[2242],{"type":51,"value":2243},"rg",{"type":46,"tag":178,"props":2245,"children":2246},{"style":212},[2247],{"type":51,"value":1836},{"type":46,"tag":178,"props":2249,"children":2250},{"style":191},[2251],{"type":51,"value":2252}," -n ",{"type":46,"tag":178,"props":2254,"children":2255},{"style":212},[2256],{"type":51,"value":2046},{"type":46,"tag":178,"props":2258,"children":2259},{"style":191},[2260],{"type":51,"value":2261},"cluster",{"type":46,"tag":178,"props":2263,"children":2264},{"style":212},[2265],{"type":51,"value":1836},{"type":46,"tag":178,"props":2267,"children":2268},{"style":191},[2269],{"type":51,"value":2270}," --query oidcIssuerProfile.issuerUrl -o tsv",{"type":46,"tag":178,"props":2272,"children":2273},{"style":212},[2274],{"type":51,"value":2275},")\"",{"type":46,"tag":178,"props":2277,"children":2278},{"style":249},[2279],{"type":51,"value":1970},{"type":46,"tag":178,"props":2281,"children":2283},{"class":180,"line":2282},19,[2284,2289,2293,2298],{"type":46,"tag":178,"props":2285,"children":2286},{"style":191},[2287],{"type":51,"value":2288},"  --subject",{"type":46,"tag":178,"props":2290,"children":2291},{"style":212},[2292],{"type":51,"value":1983},{"type":46,"tag":178,"props":2294,"children":2295},{"style":191},[2296],{"type":51,"value":2297},"system:serviceaccount:osmo-minimal:osmo-minimal",{"type":46,"tag":178,"props":2299,"children":2300},{"style":212},[2301],{"type":51,"value":2302},"\"\n",{"type":46,"tag":178,"props":2304,"children":2306},{"class":180,"line":2305},20,[2307],{"type":46,"tag":178,"props":2308,"children":2309},{"emptyLinePlaceholder":1176},[2310],{"type":51,"value":1179},{"type":46,"tag":178,"props":2312,"children":2314},{"class":180,"line":2313},21,[2315],{"type":46,"tag":178,"props":2316,"children":2317},{"style":1146},[2318],{"type":51,"value":2319},"# 5. Run deploy with WI\n",{"type":46,"tag":178,"props":2321,"children":2323},{"class":180,"line":2322},22,[2324,2328,2332,2337],{"type":46,"tag":178,"props":2325,"children":2326},{"style":201},[2327],{"type":51,"value":204},{"type":46,"tag":178,"props":2329,"children":2330},{"style":191},[2331],{"type":51,"value":209},{"type":46,"tag":178,"props":2333,"children":2334},{"style":191},[2335],{"type":51,"value":2336}," byo",{"type":46,"tag":178,"props":2338,"children":2339},{"style":249},[2340],{"type":51,"value":1970},{"type":46,"tag":178,"props":2342,"children":2344},{"class":180,"line":2343},23,[2345,2350,2355,2360,2365],{"type":46,"tag":178,"props":2346,"children":2347},{"style":191},[2348],{"type":51,"value":2349},"  --storage-backend",{"type":46,"tag":178,"props":2351,"children":2352},{"style":191},[2353],{"type":51,"value":2354}," azure-blob",{"type":46,"tag":178,"props":2356,"children":2357},{"style":191},[2358],{"type":51,"value":2359}," --auth-method",{"type":46,"tag":178,"props":2361,"children":2362},{"style":191},[2363],{"type":51,"value":2364}," workload-identity",{"type":46,"tag":178,"props":2366,"children":2367},{"style":249},[2368],{"type":51,"value":1970},{"type":46,"tag":178,"props":2370,"children":2372},{"class":180,"line":2371},24,[2373,2378,2382,2386,2391,2395,2399,2403,2408],{"type":46,"tag":178,"props":2374,"children":2375},{"style":191},[2376],{"type":51,"value":2377},"  --workload-identity-client-id",{"type":46,"tag":178,"props":2379,"children":2380},{"style":212},[2381],{"type":51,"value":2225},{"type":46,"tag":178,"props":2383,"children":2384},{"style":201},[2385],{"type":51,"value":1802},{"type":46,"tag":178,"props":2387,"children":2388},{"style":191},[2389],{"type":51,"value":2390}," identity show -g ",{"type":46,"tag":178,"props":2392,"children":2393},{"style":212},[2394],{"type":51,"value":2046},{"type":46,"tag":178,"props":2396,"children":2397},{"style":191},[2398],{"type":51,"value":2243},{"type":46,"tag":178,"props":2400,"children":2401},{"style":212},[2402],{"type":51,"value":1836},{"type":46,"tag":178,"props":2404,"children":2405},{"style":191},[2406],{"type":51,"value":2407}," -n osmo-data-uami --query clientId -o tsv",{"type":46,"tag":178,"props":2409,"children":2410},{"style":212},[2411],{"type":51,"value":2412},")\"\n",{"type":46,"tag":1128,"props":2414,"children":2416},{"id":2415},"aws-irsa-prerequisites",[2417],{"type":51,"value":2418},"AWS IRSA prerequisites",{"type":46,"tag":167,"props":2420,"children":2422},{"className":169,"code":2421,"language":171,"meta":172,"style":172},"# 1. EKS cluster has an OIDC identity provider (most clusters already do)\naws eks describe-cluster --name \u003Ccluster> --query \"cluster.identity.oidc.issuer\"\n\n# 2. Create IAM role with S3 access + EKS OIDC trust policy\n#    Trust policy admits: system:serviceaccount:osmo-minimal:osmo-minimal\n\n# 3. Run deploy with WI\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider byo \\\n  --storage-backend byo --auth-method workload-identity \\\n  --workload-identity-role-arn arn:aws:iam::\u003Cacct>:role\u002Fosmo-data-access\n",[2423],{"type":46,"tag":67,"props":2424,"children":2425},{"__ignoreMap":172},[2426,2434,2490,2497,2505,2513,2520,2528,2547,2570],{"type":46,"tag":178,"props":2427,"children":2428},{"class":180,"line":181},[2429],{"type":46,"tag":178,"props":2430,"children":2431},{"style":1146},[2432],{"type":51,"value":2433},"# 1. EKS cluster has an OIDC identity provider (most clusters already do)\n",{"type":46,"tag":178,"props":2435,"children":2436},{"class":180,"line":197},[2437,2441,2446,2451,2456,2460,2464,2468,2472,2477,2481,2486],{"type":46,"tag":178,"props":2438,"children":2439},{"style":201},[2440],{"type":51,"value":25},{"type":46,"tag":178,"props":2442,"children":2443},{"style":191},[2444],{"type":51,"value":2445}," eks",{"type":46,"tag":178,"props":2447,"children":2448},{"style":191},[2449],{"type":51,"value":2450}," describe-cluster",{"type":46,"tag":178,"props":2452,"children":2453},{"style":191},[2454],{"type":51,"value":2455}," --name",{"type":46,"tag":178,"props":2457,"children":2458},{"style":212},[2459],{"type":51,"value":215},{"type":46,"tag":178,"props":2461,"children":2462},{"style":191},[2463],{"type":51,"value":1850},{"type":46,"tag":178,"props":2465,"children":2466},{"style":249},[2467],{"type":51,"value":1826},{"type":46,"tag":178,"props":2469,"children":2470},{"style":212},[2471],{"type":51,"value":1836},{"type":46,"tag":178,"props":2473,"children":2474},{"style":191},[2475],{"type":51,"value":2476}," --query",{"type":46,"tag":178,"props":2478,"children":2479},{"style":212},[2480],{"type":51,"value":1983},{"type":46,"tag":178,"props":2482,"children":2483},{"style":191},[2484],{"type":51,"value":2485},"cluster.identity.oidc.issuer",{"type":46,"tag":178,"props":2487,"children":2488},{"style":212},[2489],{"type":51,"value":2302},{"type":46,"tag":178,"props":2491,"children":2492},{"class":180,"line":1160},[2493],{"type":46,"tag":178,"props":2494,"children":2495},{"emptyLinePlaceholder":1176},[2496],{"type":51,"value":1179},{"type":46,"tag":178,"props":2498,"children":2499},{"class":180,"line":873},[2500],{"type":46,"tag":178,"props":2501,"children":2502},{"style":1146},[2503],{"type":51,"value":2504},"# 2. Create IAM role with S3 access + EKS OIDC trust policy\n",{"type":46,"tag":178,"props":2506,"children":2507},{"class":180,"line":1182},[2508],{"type":46,"tag":178,"props":2509,"children":2510},{"style":1146},[2511],{"type":51,"value":2512},"#    Trust policy admits: system:serviceaccount:osmo-minimal:osmo-minimal\n",{"type":46,"tag":178,"props":2514,"children":2515},{"class":180,"line":1191},[2516],{"type":46,"tag":178,"props":2517,"children":2518},{"emptyLinePlaceholder":1176},[2519],{"type":51,"value":1179},{"type":46,"tag":178,"props":2521,"children":2522},{"class":180,"line":1200},[2523],{"type":46,"tag":178,"props":2524,"children":2525},{"style":1146},[2526],{"type":51,"value":2527},"# 3. Run deploy with WI\n",{"type":46,"tag":178,"props":2529,"children":2530},{"class":180,"line":1209},[2531,2535,2539,2543],{"type":46,"tag":178,"props":2532,"children":2533},{"style":201},[2534],{"type":51,"value":204},{"type":46,"tag":178,"props":2536,"children":2537},{"style":191},[2538],{"type":51,"value":209},{"type":46,"tag":178,"props":2540,"children":2541},{"style":191},[2542],{"type":51,"value":2336},{"type":46,"tag":178,"props":2544,"children":2545},{"style":249},[2546],{"type":51,"value":1970},{"type":46,"tag":178,"props":2548,"children":2549},{"class":180,"line":1239},[2550,2554,2558,2562,2566],{"type":46,"tag":178,"props":2551,"children":2552},{"style":191},[2553],{"type":51,"value":2349},{"type":46,"tag":178,"props":2555,"children":2556},{"style":191},[2557],{"type":51,"value":2336},{"type":46,"tag":178,"props":2559,"children":2560},{"style":191},[2561],{"type":51,"value":2359},{"type":46,"tag":178,"props":2563,"children":2564},{"style":191},[2565],{"type":51,"value":2364},{"type":46,"tag":178,"props":2567,"children":2568},{"style":249},[2569],{"type":51,"value":1970},{"type":46,"tag":178,"props":2571,"children":2572},{"class":180,"line":1265},[2573,2578,2583,2587,2592,2596,2600],{"type":46,"tag":178,"props":2574,"children":2575},{"style":191},[2576],{"type":51,"value":2577},"  --workload-identity-role-arn",{"type":46,"tag":178,"props":2579,"children":2580},{"style":191},[2581],{"type":51,"value":2582}," arn:aws:iam::",{"type":46,"tag":178,"props":2584,"children":2585},{"style":212},[2586],{"type":51,"value":2046},{"type":46,"tag":178,"props":2588,"children":2589},{"style":191},[2590],{"type":51,"value":2591},"acc",{"type":46,"tag":178,"props":2593,"children":2594},{"style":249},[2595],{"type":51,"value":2100},{"type":46,"tag":178,"props":2597,"children":2598},{"style":212},[2599],{"type":51,"value":1836},{"type":46,"tag":178,"props":2601,"children":2602},{"style":191},[2603],{"type":51,"value":2604},":role\u002Fosmo-data-access\n",{"type":46,"tag":54,"props":2606,"children":2608},{"id":2607},"nfs-storage-account-with-nfs-storage-azure-only",[2609,2611,2617],{"type":51,"value":2610},"NFS storage account (",{"type":46,"tag":67,"props":2612,"children":2614},{"className":2613},[],[2615],{"type":51,"value":2616},"--with-nfs-storage",{"type":51,"value":2618},", azure only)",{"type":46,"tag":61,"props":2620,"children":2621},{},[2622,2624,2629,2631,2637,2639,2646],{"type":51,"value":2623},"Pass ",{"type":46,"tag":67,"props":2625,"children":2627},{"className":2626},[],[2628],{"type":51,"value":2616},{"type":51,"value":2630}," on Azure when a downstream skill on the cluster needs an Azure Files Premium NFS-backed ",{"type":46,"tag":67,"props":2632,"children":2634},{"className":2633},[],[2635],{"type":51,"value":2636},"ReadWriteMany",{"type":51,"value":2638}," StorageClass. The canonical consumer is NIM Operator multi-node inference (its NIMCache + shared-model volumes are RWX-only per ",{"type":46,"tag":150,"props":2640,"children":2644},{"href":2641,"rel":2642},"https:\u002F\u002Fdocs.nvidia.com\u002Fnim-operator\u002Flatest\u002Fmulti-node.html",[2643],"nofollow",[2645],{"type":51,"value":2641},{"type":51,"value":2647},"); other RWX users (shared data caches, KServe RWX models) need it too.",{"type":46,"tag":61,"props":2649,"children":2650},{},[2651,2653,2659,2661,2667,2669,2675],{"type":51,"value":2652},"What osmo provisions: a Premium FileStorage Azure Storage Account (VNet-restricted, output as ",{"type":46,"tag":67,"props":2654,"children":2656},{"className":2655},[],[2657],{"type":51,"value":2658},"nfs_storage_account",{"type":51,"value":2660},") and the four AKS role assignments ",{"type":46,"tag":67,"props":2662,"children":2664},{"className":2663},[],[2665],{"type":51,"value":2666},"file.csi.azure.com",{"type":51,"value":2668}," needs to dynamically provision NFS file shares against it — Network Contributor on the VNet, on the AKS NSG, and on the database NSG, plus Storage Account Contributor scoped to the NFS SA. Without all four, dynamic PVC provisioning fails with ",{"type":46,"tag":67,"props":2670,"children":2672},{"className":2671},[],[2673],{"type":51,"value":2674},"LinkedAuthorizationFailed",{"type":51,"value":512},{"type":46,"tag":61,"props":2677,"children":2678},{},[2679,2681,2687,2689,2694,2696,2702],{"type":51,"value":2680},"What osmo does NOT provision: the StorageClass manifest, the default-SC swap, or any consumer-specific PVC. Those belong to the consumer skill (per separation of concerns — osmo doesn't own RWX, the consumers do). The consumer reads ",{"type":46,"tag":67,"props":2682,"children":2684},{"className":2683},[],[2685],{"type":51,"value":2686},"terraform output -raw nfs_storage_account",{"type":51,"value":2688}," to learn the SA name and uses it to render its own StorageClass against ",{"type":46,"tag":67,"props":2690,"children":2692},{"className":2691},[],[2693],{"type":51,"value":2666},{"type":51,"value":2695}," with ",{"type":46,"tag":67,"props":2697,"children":2699},{"className":2698},[],[2700],{"type":51,"value":2701},"protocol: nfs",{"type":51,"value":512},{"type":46,"tag":61,"props":2704,"children":2705},{},[2706],{"type":51,"value":2707},"Cost note: Premium FileStorage SAs bill on provisioned capacity (~$0.16\u002FGiB-month, 100 GiB minimum). Opt in only when a downstream consumer needs RWX.",{"type":46,"tag":61,"props":2709,"children":2710},{},[2711,2713,2719,2721,2727,2728,2733],{"type":51,"value":2712},"Without the flag (default): no NFS SA is created. RWX PVCs created later sit ",{"type":46,"tag":67,"props":2714,"children":2716},{"className":2715},[],[2717],{"type":51,"value":2718},"Pending",{"type":51,"value":2720}," forever — the AKS default ",{"type":46,"tag":67,"props":2722,"children":2724},{"className":2723},[],[2725],{"type":51,"value":2726},"managed-csi",{"type":51,"value":74},{"type":46,"tag":67,"props":2729,"children":2731},{"className":2730},[],[2732],{"type":51,"value":1010},{"type":51,"value":2734}," classes only support RWO. The error is the consumer's to surface.",{"type":46,"tag":54,"props":2736,"children":2738},{"id":2737},"customizing-values",[2739],{"type":51,"value":2740},"Customizing values",{"type":46,"tag":61,"props":2742,"children":2743},{},[2744,2746,2752],{"type":51,"value":2745},"Hand-editable static values live in ",{"type":46,"tag":150,"props":2747,"children":2749},{"href":2748},"..\u002F..\u002Fdeployments\u002Fvalues\u002F",[2750],{"type":51,"value":2751},"deployments\u002Fvalues\u002F",{"type":51,"value":1450},{"type":46,"tag":630,"props":2754,"children":2755},{},[2756,2767,2778,2788],{"type":46,"tag":263,"props":2757,"children":2758},{},[2759,2765],{"type":46,"tag":67,"props":2760,"children":2762},{"className":2761},[],[2763],{"type":51,"value":2764},"service.yaml",{"type":51,"value":2766}," — base values for the service chart (router + UI bundled)",{"type":46,"tag":263,"props":2768,"children":2769},{},[2770,2776],{"type":46,"tag":67,"props":2771,"children":2773},{"className":2772},[],[2774],{"type":51,"value":2775},"backend-operator.yaml",{"type":51,"value":2777}," — base values for the backend-operator chart",{"type":46,"tag":263,"props":2779,"children":2780},{},[2781,2786],{"type":46,"tag":67,"props":2782,"children":2784},{"className":2783},[],[2785],{"type":51,"value":362},{"type":51,"value":2787}," — opt-in fragment, layered when GPU nodes are detected",{"type":46,"tag":263,"props":2789,"children":2790},{},[2791,2796],{"type":46,"tag":67,"props":2792,"children":2794},{"className":2793},[],[2795],{"type":51,"value":354},{"type":51,"value":2797}," — opt-in fragment, layered when prometheus-operator CRDs are detected",{"type":46,"tag":61,"props":2799,"children":2800},{},[2801,2803,2807,2809,2814,2816,2821,2823,2829,2831,2837],{"type":51,"value":2802},"Per-cluster values (PG\u002FRedis hosts, image registry\u002Ftag, NGC pull secret name, namespace) are ",{"type":46,"tag":89,"props":2804,"children":2805},{},[2806],{"type":51,"value":93},{"type":51,"value":2808}," in those files — they're injected at install time via ",{"type":46,"tag":67,"props":2810,"children":2812},{"className":2811},[],[2813],{"type":51,"value":346},{"type":51,"value":2815}," so users can edit the YAML for things that don't change per-cluster. ",{"type":46,"tag":67,"props":2817,"children":2819},{"className":2818},[],[2820],{"type":51,"value":2764},{"type":51,"value":2822}," mirrors the ",{"type":46,"tag":150,"props":2824,"children":2826},{"href":2825},"..\u002F..\u002Fdocs\u002Fdeployment_guide\u002Fappendix\u002Fdeploy_minimal.rst",[2827],{"type":51,"value":2828},"docs minimal-deploy reference",{"type":51,"value":2830},". See the ",{"type":46,"tag":150,"props":2832,"children":2834},{"href":2833},"..\u002F..\u002Fdeployments\u002Fvalues\u002FREADME.md",[2835],{"type":51,"value":2836},"values README",{"type":51,"value":2838}," for layering details.",{"type":46,"tag":1753,"props":2840,"children":2841},{},[2842],{"type":46,"tag":61,"props":2843,"children":2844},{},[2845,2850,2851,2856,2858,2864,2866,2870],{"type":46,"tag":89,"props":2846,"children":2847},{},[2848],{"type":51,"value":2849},"Security note",{"type":51,"value":392},{"type":46,"tag":67,"props":2852,"children":2854},{"className":2853},[],[2855],{"type":51,"value":2764},{"type":51,"value":2857}," ships with the gateway's OAuth2 Proxy + authz disabled (matching the docs minimal example). The gateway then trusts client-supplied ",{"type":46,"tag":67,"props":2859,"children":2861},{"className":2860},[],[2862],{"type":51,"value":2863},"x-osmo-{user,roles,allowed-pools}",{"type":51,"value":2865}," headers. Do ",{"type":46,"tag":89,"props":2867,"children":2868},{},[2869],{"type":51,"value":93},{"type":51,"value":2871}," expose this gateway to untrusted networks. For production deploys, use the standard deployment guide path which keeps OAuth2 + authz enabled.",{"type":46,"tag":54,"props":2873,"children":2875},{"id":2874},"common-invocations",[2876],{"type":51,"value":2877},"Common invocations",{"type":46,"tag":167,"props":2879,"children":2881},{"className":169,"code":2880,"language":171,"meta":172,"style":172},"# Azure with GPU pool + Blob storage\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider azure --gpu-node-pool --storage-backend azure-blob\n\n# AWS, CPU only\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider aws --no-gpu\n\n# Single-node MicroK8s on a fresh Ubuntu box (with GPU)\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider microk8s --gpu --storage-backend minio\n\n# Existing cluster (orion-cluster-azure, etc.) — caller exports DB\u002FRedis env vars first\nexport POSTGRES_HOST=... REDIS_HOST=...   # (full list above)\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider byo --storage-backend azure-blob\n\n# Tear down\n.\u002Fscripts\u002Fdeploy-osmo-minimal.sh --provider \u003Cx> --destroy\n",[2882],{"type":46,"tag":67,"props":2883,"children":2884},{"__ignoreMap":172},[2885,2893,2924,2931,2939,2960,2967,2975,3005,3012,3020,3056,3079,3086,3094],{"type":46,"tag":178,"props":2886,"children":2887},{"class":180,"line":181},[2888],{"type":46,"tag":178,"props":2889,"children":2890},{"style":1146},[2891],{"type":51,"value":2892},"# Azure with GPU pool + Blob storage\n",{"type":46,"tag":178,"props":2894,"children":2895},{"class":180,"line":197},[2896,2900,2904,2909,2914,2919],{"type":46,"tag":178,"props":2897,"children":2898},{"style":201},[2899],{"type":51,"value":204},{"type":46,"tag":178,"props":2901,"children":2902},{"style":191},[2903],{"type":51,"value":209},{"type":46,"tag":178,"props":2905,"children":2906},{"style":191},[2907],{"type":51,"value":2908}," azure",{"type":46,"tag":178,"props":2910,"children":2911},{"style":191},[2912],{"type":51,"value":2913}," --gpu-node-pool",{"type":46,"tag":178,"props":2915,"children":2916},{"style":191},[2917],{"type":51,"value":2918}," --storage-backend",{"type":46,"tag":178,"props":2920,"children":2921},{"style":191},[2922],{"type":51,"value":2923}," azure-blob\n",{"type":46,"tag":178,"props":2925,"children":2926},{"class":180,"line":1160},[2927],{"type":46,"tag":178,"props":2928,"children":2929},{"emptyLinePlaceholder":1176},[2930],{"type":51,"value":1179},{"type":46,"tag":178,"props":2932,"children":2933},{"class":180,"line":873},[2934],{"type":46,"tag":178,"props":2935,"children":2936},{"style":1146},[2937],{"type":51,"value":2938},"# AWS, CPU only\n",{"type":46,"tag":178,"props":2940,"children":2941},{"class":180,"line":1182},[2942,2946,2950,2955],{"type":46,"tag":178,"props":2943,"children":2944},{"style":201},[2945],{"type":51,"value":204},{"type":46,"tag":178,"props":2947,"children":2948},{"style":191},[2949],{"type":51,"value":209},{"type":46,"tag":178,"props":2951,"children":2952},{"style":191},[2953],{"type":51,"value":2954}," aws",{"type":46,"tag":178,"props":2956,"children":2957},{"style":191},[2958],{"type":51,"value":2959}," --no-gpu\n",{"type":46,"tag":178,"props":2961,"children":2962},{"class":180,"line":1191},[2963],{"type":46,"tag":178,"props":2964,"children":2965},{"emptyLinePlaceholder":1176},[2966],{"type":51,"value":1179},{"type":46,"tag":178,"props":2968,"children":2969},{"class":180,"line":1200},[2970],{"type":46,"tag":178,"props":2971,"children":2972},{"style":1146},[2973],{"type":51,"value":2974},"# Single-node MicroK8s on a fresh Ubuntu box (with GPU)\n",{"type":46,"tag":178,"props":2976,"children":2977},{"class":180,"line":1209},[2978,2982,2986,2991,2996,3000],{"type":46,"tag":178,"props":2979,"children":2980},{"style":201},[2981],{"type":51,"value":204},{"type":46,"tag":178,"props":2983,"children":2984},{"style":191},[2985],{"type":51,"value":209},{"type":46,"tag":178,"props":2987,"children":2988},{"style":191},[2989],{"type":51,"value":2990}," microk8s",{"type":46,"tag":178,"props":2992,"children":2993},{"style":191},[2994],{"type":51,"value":2995}," --gpu",{"type":46,"tag":178,"props":2997,"children":2998},{"style":191},[2999],{"type":51,"value":2918},{"type":46,"tag":178,"props":3001,"children":3002},{"style":191},[3003],{"type":51,"value":3004}," minio\n",{"type":46,"tag":178,"props":3006,"children":3007},{"class":180,"line":1239},[3008],{"type":46,"tag":178,"props":3009,"children":3010},{"emptyLinePlaceholder":1176},[3011],{"type":51,"value":1179},{"type":46,"tag":178,"props":3013,"children":3014},{"class":180,"line":1265},[3015],{"type":46,"tag":178,"props":3016,"children":3017},{"style":1146},[3018],{"type":51,"value":3019},"# Existing cluster (orion-cluster-azure, etc.) — caller exports DB\u002FRedis env vars first\n",{"type":46,"tag":178,"props":3021,"children":3022},{"class":180,"line":2030},[3023,3027,3032,3037,3042,3046,3051],{"type":46,"tag":178,"props":3024,"children":3025},{"style":1213},[3026],{"type":51,"value":1216},{"type":46,"tag":178,"props":3028,"children":3029},{"style":249},[3030],{"type":51,"value":3031}," POSTGRES_HOST",{"type":46,"tag":178,"props":3033,"children":3034},{"style":212},[3035],{"type":51,"value":3036},"=",{"type":46,"tag":178,"props":3038,"children":3039},{"style":249},[3040],{"type":51,"value":3041},"... REDIS_HOST",{"type":46,"tag":178,"props":3043,"children":3044},{"style":212},[3045],{"type":51,"value":3036},{"type":46,"tag":178,"props":3047,"children":3048},{"style":249},[3049],{"type":51,"value":3050},"...   ",{"type":46,"tag":178,"props":3052,"children":3053},{"style":1146},[3054],{"type":51,"value":3055},"# (full list above)\n",{"type":46,"tag":178,"props":3057,"children":3058},{"class":180,"line":2107},[3059,3063,3067,3071,3075],{"type":46,"tag":178,"props":3060,"children":3061},{"style":201},[3062],{"type":51,"value":204},{"type":46,"tag":178,"props":3064,"children":3065},{"style":191},[3066],{"type":51,"value":209},{"type":46,"tag":178,"props":3068,"children":3069},{"style":191},[3070],{"type":51,"value":2336},{"type":46,"tag":178,"props":3072,"children":3073},{"style":191},[3074],{"type":51,"value":2918},{"type":46,"tag":178,"props":3076,"children":3077},{"style":191},[3078],{"type":51,"value":2923},{"type":46,"tag":178,"props":3080,"children":3081},{"class":180,"line":2115},[3082],{"type":46,"tag":178,"props":3083,"children":3084},{"emptyLinePlaceholder":1176},[3085],{"type":51,"value":1179},{"type":46,"tag":178,"props":3087,"children":3088},{"class":180,"line":2124},[3089],{"type":46,"tag":178,"props":3090,"children":3091},{"style":1146},[3092],{"type":51,"value":3093},"# Tear down\n",{"type":46,"tag":178,"props":3095,"children":3096},{"class":180,"line":2149},[3097,3101,3105,3109,3114,3118],{"type":46,"tag":178,"props":3098,"children":3099},{"style":201},[3100],{"type":51,"value":204},{"type":46,"tag":178,"props":3102,"children":3103},{"style":191},[3104],{"type":51,"value":209},{"type":46,"tag":178,"props":3106,"children":3107},{"style":212},[3108],{"type":51,"value":215},{"type":46,"tag":178,"props":3110,"children":3111},{"style":249},[3112],{"type":51,"value":3113},"x",{"type":46,"tag":178,"props":3115,"children":3116},{"style":212},[3117],{"type":51,"value":1836},{"type":46,"tag":178,"props":3119,"children":3120},{"style":191},[3121],{"type":51,"value":3122}," --destroy\n",{"type":46,"tag":54,"props":3124,"children":3126},{"id":3125},"idempotency-contract",[3127],{"type":51,"value":3128},"Idempotency contract",{"type":46,"tag":61,"props":3130,"children":3131},{},[3132,3134,3140],{"type":51,"value":3133},"Every cluster-agnostic install is safe to no-op when its target is already present (CRD checks for KAI, multi-signal detection for GPU Operator, addon\u002Frelease detection for MinIO). This makes the script safe to layer on top of clusters that already have these components installed (e.g. when an upstream skill provisioned the cluster + KAI + GPU Operator first). Re-runs are also safe — backend-operator tokens are reused if a non-placeholder value already exists in ",{"type":46,"tag":67,"props":3135,"children":3137},{"className":3136},[],[3138],{"type":51,"value":3139},"osmo-operator-token",{"type":51,"value":512},{"type":46,"tag":54,"props":3142,"children":3144},{"id":3143},"troubleshooting",[3145],{"type":51,"value":3146},"Troubleshooting",{"type":46,"tag":630,"props":3148,"children":3149},{},[3150,3164,3179,3205,3220],{"type":46,"tag":263,"props":3151,"children":3152},{},[3153,3162],{"type":46,"tag":89,"props":3154,"children":3155},{},[3156],{"type":46,"tag":67,"props":3157,"children":3159},{"className":3158},[],[3160],{"type":51,"value":3161},"osmo CLI not found",{"type":51,"value":3163},": the script will install from GitHub on first run; if it fails, install manually then re-run.",{"type":46,"tag":263,"props":3165,"children":3166},{},[3167,3172,3173],{"type":46,"tag":89,"props":3168,"children":3169},{},[3170],{"type":51,"value":3171},"Pod failures",{"type":51,"value":392},{"type":46,"tag":67,"props":3174,"children":3176},{"className":3175},[],[3177],{"type":51,"value":3178},"kubectl logs -n osmo-minimal -l app=osmo-service",{"type":46,"tag":263,"props":3180,"children":3181},{},[3182,3187,3189,3195,3197,3203],{"type":46,"tag":89,"props":3183,"children":3184},{},[3185],{"type":51,"value":3186},"Smoke test failures",{"type":51,"value":3188},": GPU smoke depends on the GPU Operator being healthy + a node labeled ",{"type":46,"tag":67,"props":3190,"children":3192},{"className":3191},[],[3193],{"type":51,"value":3194},"nvidia.com\u002Fgpu.present=true",{"type":51,"value":3196},"; ",{"type":46,"tag":67,"props":3198,"children":3200},{"className":3199},[],[3201],{"type":51,"value":3202},"kubectl describe node",{"type":51,"value":3204}," to verify",{"type":46,"tag":263,"props":3206,"children":3207},{},[3208,3213,3214],{"type":46,"tag":89,"props":3209,"children":3210},{},[3211],{"type":51,"value":3212},"Stop port-forward watchdogs",{"type":51,"value":392},{"type":46,"tag":67,"props":3215,"children":3217},{"className":3216},[],[3218],{"type":51,"value":3219},"pkill -f 'osmo-pf-watchdog:'",{"type":46,"tag":263,"props":3221,"children":3222},{},[3223,3228,3230,3236,3238,3244],{"type":46,"tag":89,"props":3224,"children":3225},{},[3226],{"type":51,"value":3227},"Private AKS clusters",{"type":51,"value":3229},": use ",{"type":46,"tag":67,"props":3231,"children":3233},{"className":3232},[],[3234],{"type":51,"value":3235},"az aks command invoke",{"type":51,"value":3237}," for kubectl access; the script sets ",{"type":46,"tag":67,"props":3239,"children":3241},{"className":3240},[],[3242],{"type":51,"value":3243},"IS_PRIVATE_CLUSTER=true",{"type":51,"value":3245}," automatically when detected",{"type":46,"tag":54,"props":3247,"children":3249},{"id":3248},"reference",[3250],{"type":51,"value":3251},"Reference",{"type":46,"tag":630,"props":3253,"children":3254},{},[3255,3326,3349],{"type":46,"tag":263,"props":3256,"children":3257},{},[3258,3260,3266,3268,3274,3275,3281,3282,3288,3290,3296,3298,3304,3306,3312,3313,3319,3320],{"type":51,"value":3259},"Helpers under ",{"type":46,"tag":150,"props":3261,"children":3263},{"href":3262},"..\u002F..\u002Fdeployments\u002Fscripts\u002F",[3264],{"type":51,"value":3265},"scripts\u002F",{"type":51,"value":3267},":\n",{"type":46,"tag":67,"props":3269,"children":3271},{"className":3270},[],[3272],{"type":51,"value":3273},"install-kai-scheduler.sh",{"type":51,"value":721},{"type":46,"tag":67,"props":3276,"children":3278},{"className":3277},[],[3279],{"type":51,"value":3280},"install-gpu-operator.sh",{"type":51,"value":721},{"type":46,"tag":67,"props":3283,"children":3285},{"className":3284},[],[3286],{"type":51,"value":3287},"install-minio.sh",{"type":51,"value":3289},",\n",{"type":46,"tag":67,"props":3291,"children":3293},{"className":3292},[],[3294],{"type":51,"value":3295},"configure-storage.sh",{"type":51,"value":3297}," (+ ",{"type":46,"tag":67,"props":3299,"children":3301},{"className":3300},[],[3302],{"type":51,"value":3303},"storage\u002F{minio,azure-blob,s3,byo}.sh",{"type":51,"value":3305},"),\n",{"type":46,"tag":67,"props":3307,"children":3309},{"className":3308},[],[3310],{"type":51,"value":3311},"port-forward.sh",{"type":51,"value":721},{"type":46,"tag":67,"props":3314,"children":3316},{"className":3315},[],[3317],{"type":51,"value":3318},"verify.sh",{"type":51,"value":721},{"type":46,"tag":67,"props":3321,"children":3323},{"className":3322},[],[3324],{"type":51,"value":3325},"microk8s\u002Finstall.sh",{"type":46,"tag":263,"props":3327,"children":3328},{},[3329,3331,3337,3338,3343,3344],{"type":51,"value":3330},"Workflows under ",{"type":46,"tag":150,"props":3332,"children":3334},{"href":3333},"..\u002F..\u002Fdeployments\u002Fworkflows\u002F",[3335],{"type":51,"value":3336},"workflows\u002F",{"type":51,"value":3267},{"type":46,"tag":67,"props":3339,"children":3341},{"className":3340},[],[3342],{"type":51,"value":398},{"type":51,"value":721},{"type":46,"tag":67,"props":3345,"children":3347},{"className":3346},[],[3348],{"type":51,"value":406},{"type":46,"tag":263,"props":3350,"children":3351},{},[3352,3354],{"type":51,"value":3353},"Documentation: ",{"type":46,"tag":150,"props":3355,"children":3358},{"href":3356,"rel":3357},"https:\u002F\u002Fnvidia.github.io\u002FOSMO\u002Fmain\u002Fdeployment_guide\u002F",[2643],[3359],{"type":51,"value":3356},{"type":46,"tag":3361,"props":3362,"children":3363},"style",{},[3364],{"type":51,"value":3365},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3367,"total":3524},[3368,3386,3402,3413,3425,3439,3452,3466,3479,3490,3504,3513],{"slug":3369,"name":3369,"fn":3370,"description":3371,"org":3372,"tags":3373,"stars":3383,"repoUrl":3384,"updatedAt":3385},"nemoclaw-user-guide","retrieve NemoClaw documentation and configuration","Guides human users' AI agents to the NemoClaw docs MCP server and canonical Fern documentation in Markdown form. Use when users ask how to install, configure, operate, troubleshoot, secure, or learn NemoClaw with an AI coding assistant. Trigger keywords - nemoclaw docs, use nemoclaw with ai agent, nemoclaw mcp docs, nemoclaw install help, nemoclaw quickstart, nemoclaw markdown docs, llms.txt, agent skills.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3374,3377,3380],{"name":3375,"slug":3376,"type":15},"Documentation","documentation",{"name":3378,"slug":3379,"type":15},"MCP","mcp",{"name":3381,"slug":3382,"type":15},"Search","search",21777,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FNemoClaw","2026-07-20T06:00:01.461044",{"slug":3387,"name":3387,"fn":3388,"description":3389,"org":3390,"tags":3391,"stars":3399,"repoUrl":3400,"updatedAt":3401},"mcore-build-and-dependency","manage Megatron-LM development environments","Container-based dev environment setup and dependency management for Megatron-LM. Covers acquiring and launching the CI container, uv package management, and updating uv.lock.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3392,3395,3396],{"name":3393,"slug":3394,"type":15},"Containers","containers",{"name":17,"slug":18,"type":15},{"name":3397,"slug":3398,"type":15},"Python","python",17049,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FMegatron-LM","2026-07-27T06:06:11.249662",{"slug":3403,"name":3403,"fn":3404,"description":3405,"org":3406,"tags":3407,"stars":3399,"repoUrl":3400,"updatedAt":3412},"mcore-bump-base-image","update NVIDIA PyTorch base images","Bump the NVIDIA PyTorch base image (`nvcr.io\u002Fnvidia\u002Fpytorch:YY.MM-py3`) used by Megatron-LM CI. Covers the two pin sites (GitHub CI in `docker\u002F.ngc_version.dev` and GitLab CI in `.gitlab\u002Fstages\u002F01.build.yml`), the post-bump CI loop (re-run functional tests, refresh golden values, mark broken tests), and the gotchas that bit PRs",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3408,3411],{"name":3409,"slug":3410,"type":15},"CI\u002FCD","ci-cd",{"name":17,"slug":18,"type":15},"2026-07-14T05:25:59.97109",{"slug":3414,"name":3414,"fn":3415,"description":3416,"org":3417,"tags":3418,"stars":3399,"repoUrl":3400,"updatedAt":3424},"mcore-cicd","manage CI\u002FCD pipelines for Megatron-LM","CI\u002FCD reference for Megatron-LM. Covers CI pipeline structure, PR scope labels, triggering internal GitLab CI (which force-pushes the current branch to a pull-request\u002FBRANCH ref — always dry-run and verify the destination first; never run against shared or protected branches), and CI failure investigation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3419,3420,3421],{"name":3409,"slug":3410,"type":15},{"name":17,"slug":18,"type":15},{"name":3422,"slug":3423,"type":15},"GitHub","github","2026-07-27T06:06:12.278222",{"slug":3426,"name":3426,"fn":3427,"description":3428,"org":3429,"tags":3430,"stars":3399,"repoUrl":3400,"updatedAt":3438},"mcore-create-issue","investigate CI failures and create issues","Investigate a failing GitHub Actions run or job and create a GitHub issue for the failure.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3431,3434,3435],{"name":3432,"slug":3433,"type":15},"Debugging","debugging",{"name":3422,"slug":3423,"type":15},{"name":3436,"slug":3437,"type":15},"Triage","triage","2026-07-14T05:25:57.442089",{"slug":3440,"name":3440,"fn":3441,"description":3442,"org":3443,"tags":3444,"stars":3399,"repoUrl":3400,"updatedAt":3451},"mcore-linting-and-formatting","lint and format Megatron-LM code","Linting and formatting for Megatron-LM. Covers running autoformat.sh, tools (ruff, black, isort, pylint, mypy), and code style rules.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3445,3448],{"name":3446,"slug":3447,"type":15},"Best Practices","best-practices",{"name":3449,"slug":3450,"type":15},"Code Analysis","code-analysis","2026-07-14T05:25:56.18433",{"slug":3453,"name":3453,"fn":3454,"description":3455,"org":3456,"tags":3457,"stars":3399,"repoUrl":3400,"updatedAt":3465},"mcore-migrate-gpt-to-hybrid","migrate Megatron-LM models to HybridModel","Migration guide for moving Megatron Core GPTModel checkpoints, model providers, training commands, and layer mappings to HybridModel.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3458,3461,3464],{"name":3459,"slug":3460,"type":15},"Machine Learning","machine-learning",{"name":3462,"slug":3463,"type":15},"Migration","migration",{"name":9,"slug":8,"type":15},"2026-07-17T06:07:11.777011",{"slug":3467,"name":3467,"fn":3468,"description":3469,"org":3470,"tags":3471,"stars":3399,"repoUrl":3400,"updatedAt":3478},"mcore-onboard-gb200-1node-tests","onboard functional tests for GB200","Onboard 1-node GitHub MR functional tests for GB200 from existing mr-scoped 2-node tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3472,3475],{"name":3473,"slug":3474,"type":15},"QA","qa",{"name":3476,"slug":3477,"type":15},"Testing","testing","2026-07-14T05:25:53.673039",{"slug":3480,"name":3480,"fn":3481,"description":3482,"org":3483,"tags":3484,"stars":3399,"repoUrl":3400,"updatedAt":3489},"mcore-run-on-slurm","launch distributed training jobs on SLURM","How to launch distributed Megatron-LM training jobs on a SLURM cluster. Covers a minimal sbatch skeleton, environment-variable setup for torch.distributed.run, CUDA_DEVICE_MAX_CONNECTIONS rules across hardware and parallelism modes, container conventions, monitoring, and per-rank failure diagnosis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3485,3486],{"name":17,"slug":18,"type":15},{"name":3487,"slug":3488,"type":15},"Infrastructure","infrastructure","2026-07-14T05:25:49.362534",{"slug":3491,"name":3491,"fn":3492,"description":3493,"org":3494,"tags":3495,"stars":3399,"repoUrl":3400,"updatedAt":3503},"mcore-split-pr","split pull requests to reduce review load","Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3496,3499,3500],{"name":3497,"slug":3498,"type":15},"Code Review","code-review",{"name":3422,"slug":3423,"type":15},{"name":3501,"slug":3502,"type":15},"Pull Requests","pull-requests","2026-07-14T05:26:01.226578",{"slug":3505,"name":3505,"fn":3506,"description":3507,"org":3508,"tags":3509,"stars":3399,"repoUrl":3400,"updatedAt":3512},"mcore-testing","run and manage Megatron-LM tests","Test system for Megatron-LM. Covers test layout, recipe YAML structure, adding and running unit and functional tests, golden values, marker filters, and CI parity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3510,3511],{"name":3473,"slug":3474,"type":15},{"name":3476,"slug":3477,"type":15},"2026-07-14T05:25:54.928983",{"slug":3514,"name":3514,"fn":3515,"description":3516,"org":3517,"tags":3518,"stars":3399,"repoUrl":3400,"updatedAt":3523},"nightly-sync","manage nightly main-to-dev sync workflows","Domain knowledge for the nightly main-to-dev sync workflow. Covers merge strategy, CI architecture, failure investigation, and known issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3519,3522],{"name":3520,"slug":3521,"type":15},"Automation","automation",{"name":3409,"slug":3410,"type":15},"2026-07-30T05:29:03.275638",496,{"items":3526,"total":1160},[3527,3541,3549],{"slug":3528,"name":3528,"fn":3529,"description":3530,"org":3531,"tags":3532,"stars":26,"repoUrl":27,"updatedAt":3540},"osmo-admin","manage OSMO service configuration","Use only for offline\u002Flocal OSMO service-config admin requests involving explicit config roots or values files, or to ask for one when a file-specific config request omits it. Do not inspect the workspace to infer a root. Do not use for live workflow support, resource capacity, pod\u002Fnode diagnostics, or cluster operations, except live service-config paths that must be refused.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3533,3536,3537],{"name":3534,"slug":3535,"type":15},"Configuration","configuration",{"name":9,"slug":8,"type":15},{"name":3538,"slug":3539,"type":15},"Operations","operations","2026-07-14T05:33:26.717488",{"slug":4,"name":4,"fn":5,"description":6,"org":3542,"tags":3543,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3544,3545,3546,3547,3548],{"name":24,"slug":25,"type":15},{"name":13,"slug":14,"type":15},{"name":17,"slug":18,"type":15},{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"slug":101,"name":101,"fn":3550,"description":3551,"org":3552,"tags":3553,"stars":26,"repoUrl":27,"updatedAt":3565},"manage cloud robotics workflows with OSMO","Drive the OSMO CLI for cloud-robotics compute on behalf of an end user: check resources, submit\u002Fmonitor\u002Fdebug\u002Fexplain workflows, fetch logs and Grafana\u002FKubernetes links, inspect direct data storage, manage workflow apps, and set workflow credentials. Use whenever the user asks about OSMO pools, quota, GPUs, or nodes, or about submitting, listing, querying, monitoring, or troubleshooting workflows — including failed, PENDING, queued, stuck, or image-pull-blocked workflows, or when they ask to inspect or transfer direct storage URIs such as `s3:\u002F\u002F...`, even when they describe a workflow, cluster resource, or storage URI without saying \"OSMO\". Do not use for Kubernetes admin, server-side `osmo config` changes, OSMO install\u002Fdeploy, non-OSMO compute, or general NVIDIA hardware questions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[3554,3557,3560,3561,3564],{"name":3555,"slug":3556,"type":15},"CLI","cli",{"name":3558,"slug":3559,"type":15},"Grafana","grafana",{"name":21,"slug":22,"type":15},{"name":3562,"slug":3563,"type":15},"Monitoring","monitoring",{"name":9,"slug":8,"type":15},"2026-07-14T05:33:25.461692"]