# The k0s-training overlay, mirrored as a catalog entry

UNOFFICIAL/EXPERIMENTAL. This entry belongs to
[the AICR catalog overview](./index.md). It was produced by
`scripts/generate-aicr-from-overlay.mjs k0s-training`, which mirrors an
overlay from NVIDIA's AICR recipe catalog into a Catalog entry. Its source is
pinned by digest, its bundle is retained, its render is checked, and one
digest covers the whole rendered shape. That shape is the Argo CD wrapper
only. The charts its Applications point at are not rendered or assessed here,
and the entry has never run on a cluster.

## What it is

Criteria `--service k0s --intent training` resolves four overlays into 12 components,
and the Argo CD bundle renders into 12 Applications (one platform root plus one
Application per rendered component, and some components render more than one
Application for their own pre- or post-install step).

The bundle leaves out dra-node-labeler, which the recipe selects, and the
generation receipt records the reason AICR logged for it.

```bash
aicr recipe --criteria-strict --service k0s --intent training --output recipe.yaml
aicr bundle --recipe recipe.yaml --deployer argocd-helm --output ./argocd-helm-bundle \
  --storage-class gp3 \
  --accelerated-node-selector nvidia.com/gpu.present=true \
  --workload-selector app.kubernetes.io/part-of=training \
  --system-node-selector nodeGroup=system-worker
helm template aicr-argocd ./argocd-helm-bundle --namespace argocd \
  --set repoURL=oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aicr-k0s-training --output-dir rendered
```

The [generation receipt](../../../examples/aicr/k0s-training/generation-receipt.yaml)
records the exact commands, the criteria, and the release binary this entry
was built with. That binary is AICR v1.0.0, and it was checked against a
pinned SHA-256 before it ran.

## Inputs you have to check

AICR v1.0.0 refuses to write this bundle without a system node selector. The
entry carries `nodeGroup=system-worker` as a placeholder. It stands in for the
label on your own cluster's system node group, and it is not a claim about any
cluster. The
[generation receipt](../../../examples/aicr/k0s-training/generation-receipt.yaml)
lists every place it lands in the rendered Applications and in the bundle. A
different value changes the bundle bytes and every digest in this entry, so
the entry has to be regenerated with your value, or a variant has to be made
from it.

## What the entry retains

The [retained bundle](../../../examples/aicr/k0s-training/argocd-helm-bundle) is the
Helm chart AICR generated, byte for byte, and
[its checksum list](../../../examples/aicr/k0s-training/argocd-helm-bundle-checksums.txt)
names every file in it. The rendered Applications take their source from
`oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aicr-k0s-training/aicr-bundle:1.0.0`,
which is the address a publication of that bundle uses.

## One digest pins this entry too

```bash
node scripts/generate-aicr-digest-index.mjs --verify --example k0s-training
```

The [digest index](../../../examples/aicr/k0s-training/digest-index/README.md)
pins the upstream source, the recipe criteria, and all 12 Applications
under one platform digest. The compiler is a generic one shared by every
entry in this catalog, not something built new for this one.

## What is proven and what is not

The entry was generated by a binary checked against a pinned SHA-256 before
it ran. The recipe, the bundle and every rendered Application are retained
byte for byte, and one digest pins the shape.

This page does not say whether the entry's source package or its literal
configuration bundle is published. Each counts as published only when a
tracked receipt records a push and an anonymous pull of the planned digest,
and the entry's Catalog record carries that state. No ConfigHub import or
promotion exists for this entry, no cluster ever ran it, and no NGC surface
was contacted.