cluster-setup Chart Values

Complete values.yaml reference with sections for cluster, operator, agent, frontend, monitoring, networking.

The cluster-setup chart installs the Wingsmith operator, optionally the serving agent, DCGM exporter, Dynamo platform, and monitoring in a GPU cluster.

No chart or image is published yet, so install from the repository and run images from a registry of your own.

Required values

The chart refuses to render without cluster.id and cluster.hubUrl.

Cluster

On a managed cluster (readOnly: false), all three operation types (cordon, drain, benchmark) are allowed. On a read-only cluster, they come from allowedOperations (empty by default).

A read-only install with no operations has no write access outside the release namespace.

Enrolment token

The enrolment token is the cluster’s alone. Mint it on the register screen or with POST /v1/clusters/{ref}/enrolment-token. The plane has no shared token.

Pools

Example:

pools:
  labelKey: hangar.dev/pool
  gpuValue: gpu
  cacheValue: cache
  gpuTolerationKey: nvidia.com/gpu
  cacheTaintKey: hangar.dev/cache

Fabric

For AWS EFA:

fabric:
  type: efa
  devices: 4
  resource: vpc.amazonaws.com/efa
  privileged: true

For RDMA:

fabric:
  type: rdma
  devices: 2
  resource: rdma/hca
  privileged: false

Operator

Operator workload namespace

Operator images

allowedPrefixes is a security boundary. When set, the operator refuses any image that does not start with one of the listed prefixes.

Operator engine

Operator prefetch

Operator benchmarks

images is a security boundary. The operator refuses any harness image not on the list.

Operator metrics

Agent

Agent gateway

The agent dials this one address and finds all replicas by redialling.

Agent frontend

The chart refuses:

• agent.enabled with cluster.readOnly: true
• agent.enabled with an empty gateway.address
• A gateway that is still a flat string or carries a scheme
• An empty enrolmentToken.value

Frontend

Frontend mode

Changing the mode later is not a configuration change. Dynamo holds a graph’s component set immutable after creation, so every existing graph must be deleted and re-rendered, and every model reloads its weights. Pick before the first model lands.

Per-model frontend

Shared frontend

The shared frontend image must match the Dynamo platform version (1.4.1).

Image pull secrets

If your registry needs a credential, set imagePullSecret: name alone references a kubernetes.io/dockerconfigjson Secret you created, or create: true with registry, username, and token has the chart create it.

The Secret is attached to the operator and agent ServiceAccounts. For engine or frontend images in a private registry, name it in operator.engine.imagePullSecrets or frontend.imagePullSecrets, and the chart copies the Secret to the workload namespace.

Monitoring

Remote write authentication

Use one of:

Example with enrolment token (default):

monitoring:
  enabled: true
  remoteWrite:
    url: https://metrics.example.com/api/v1/push
    basicAuth:
      useEnrolmentToken: true

Example with custom basic auth:

monitoring:
  enabled: true
  remoteWrite:
    url: https://metrics.example.com/api/v1/push
    basicAuth:
      useEnrolmentToken: false
      username: my-cluster
      password: secret

Every series carries cluster (equal to cluster.id) and region external labels.

Networking

Serving egress

Egress from the workload namespace is open by default. Media URLs in a request are fetched from inside the serving pods, so on an open network a request can make them reach internal addresses.

networkPolicy.servingEgress.enabled closes the pods’ egress: they may then reach only their own namespace, the release namespace, DNS, the API server CIDRs, and the peers in to. Prefetch and benchmark jobs are not selected.

Check what your models fetch at startup before turning it on.

Model cache

The operator mounts the model-cache PVC by name for weight downloads.

Hugging Face token

For gated models. The chart creates hf-token-secret in the workload namespace when create: true.

Subcharts

DCGM exporter

NVIDIA’s DCGM exporter provides device identity (UUIDs), device classes, topology domains, and health.

Dynamo platform

The Dynamo platform is a cluster-wide controller with broad permissions (effectively cluster-admin). You should know what you are granting before you install it.

If the Dynamo platform is already installed, or you want to install it yourself, set dynamo-platform.enabled: false and install a 1.4.x release separately. The operator only needs the DynamoGraphDeployment CRD and a Dynamo operator reconciling it.

Versioning

The chart follows SemVer, and appVersion always equals version. The operator and serving-agent images default to that tag (operator.image.tag and agent.image.tag empty), with pullPolicy: IfNotPresent.

Set a tag only to run a build of your own. A mismatched operator and chart is not a supported combination. operator.image.digest and agent.image.digest (sha256:...) pin the exact build and take precedence over the tag.

The Dynamo version is the one the operator renders DynamoGraphDeployments for, and it is what an engine runtime image must be built against.

CRDs

The chart ships two CRDs in crds/, both in the hangar.dev API group at v1alpha1:

• SyncedResource: the operator’s local copy of what the plane declared
• StreamCheckpoint: the resume cursor on the hub stream

v1alpha1 means the schema can change between releases without a conversion webhook. Helm installs crds/ on the first helm install and never touches it again.

When a release notes a CRD change, apply it yourself before upgrading:

kubectl apply --server-side -f crds/

Example values

Minimal:

cluster:
  id: iad-1
  hubUrl: wss://plane.example.com/v1/hub/sync

enrolmentToken:
  value: hgro1.abcdef...

pools:
  labelKey: hangar.dev/pool
  gpuValue: gpu
  cacheValue: cache

modelCache:
  storageClassName: nfs-client

operator:
  image:
    repository: registry.example.com/hangar/operator

With agent and monitoring:

cluster:
  id: iad-1
  hubUrl: wss://plane.example.com/v1/hub/sync
  readOnly: false

enrolmentToken:
  value: hgro1.abcdef...

pools:
  labelKey: hangar.dev/pool
  gpuValue: gpu
  cacheValue: cache

fabric:
  type: efa
  devices: 4

modelCache:
  storageClassName: nfs-client

operator:
  image:
    repository: registry.example.com/hangar/operator

agent:
  enabled: true
  replicas: 2
  gateway:
    address: hangar.example.com:443
  image:
    repository: registry.example.com/hangar/agent

frontend:
  mode: per-model
  perModel:
    image: registry.example.com/dynamo/frontend:1.4.1

monitoring:
  enabled: true
  remoteWrite:
    url: https://metrics.example.com/api/v1/push