Skip to content
Browse Docs

Deep Dives

AI: Claude and Codex patterns

ConfigHub: Deploy and manage

Docs
Configs
Stacks
Apps
Plugins
Guides

The aks-training overlay, mirrored as a catalog entry

Criteria --service aks --intent training resolves four overlays into 13 components, and the Argo CD bundle renders into 15 Applications (one platform root plus one Application per rendered component, and some components render more than one Application for their own pre- or post-install step). It is one of the NVIDIA AICR pages. You can also view this as a markdown file.

Use this entry in ConfigHub in five steps, from fetching its exact objects to promoting a change.

What it is. AICR recipe aicr-aks-training v1.0.0, as 15 Argo CD Applications.

Install it. Apply its Applications on a cluster that runs Argo CD. The five steps below give the commands.

Needs first. Apply the 14 component Applications in the 6 sync-waves they carry, from wave 1 to wave 13. The order is recorded as a route beside the bundle and no runtime has executed it. Argo CD renders 12 upstream charts and 3 AICR bundle paths at sync time. Their CRDs, hooks, certificates and operators are handled there, and this entry has not rendered or assessed them. The plan below lists 3 more.

UNOFFICIAL/EXPERIMENTAL. This entry belongs to the AICR catalog overview. It was produced by scripts/generate-aicr-from-overlay.mjs aks-training, which mirrors an overlay from NVIDIA's AICR recipe catalog into a Catalog entry. Its source is pinned by digest, its bundle is retained, its render is checked, and one digest covers the whole rendered shape. That shape is the Argo CD wrapper only. The charts its Applications point at are not rendered or assessed here, and the entry has never run on a cluster.

What it is

The bundle leaves out dra-node-labeler, which the recipe selects, and the generation receipt records the reason AICR logged for it.

aicr recipe --criteria-strict --service aks --intent training --output recipe.yaml
aicr bundle --recipe recipe.yaml --deployer argocd-helm --output ./argocd-helm-bundle \
  --storage-class gp3 \
  --accelerated-node-selector nvidia.com/gpu.present=true \
  --workload-selector app.kubernetes.io/part-of=training \
  --system-node-selector nodeGroup=system-worker
helm template aicr-argocd ./argocd-helm-bundle --namespace argocd \
  --set repoURL=oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aicr-aks-training --output-dir rendered

The generation receipt records the exact commands, the criteria, and the release binary this entry was built with. That binary is AICR v1.0.0, and it was checked against a pinned SHA-256 before it ran.

Inputs you have to check

AICR v1.0.0 refuses to write this bundle without a system node selector. The entry carries nodeGroup=system-worker as a placeholder. It stands in for the label on your own cluster's system node group, and it is not a claim about any cluster. The generation receipt lists every place it lands in the rendered Applications and in the bundle. A different value changes the bundle bytes and every digest in this entry, so the entry has to be regenerated with your value, or a variant has to be made from it.

What the entry retains

The retained bundle is the Helm chart AICR generated, byte for byte, and its checksum list names every file in it. The rendered Applications take their source from oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aicr-aks-training/aicr-bundle:1.0.0, which is the address a publication of that bundle uses.

One digest pins this entry too

node scripts/generate-aicr-digest-index.mjs --verify --example aks-training

The digest index pins the upstream source, the recipe criteria, and all 15 Applications under one platform digest. The compiler is a generic one shared by every entry in this catalog, not something built new for this one.

What is proven and what is not

The entry was generated by a binary checked against a pinned SHA-256 before it ran. The recipe, the bundle and every rendered Application are retained byte for byte, and one digest pins the shape.

This page does not say whether the entry's source package or its literal configuration bundle is published. Each counts as published only when a tracked receipt records a push and an anonymous pull of the planned digest, and the entry's Catalog record carries that state. No ConfigHub import or promotion exists for this entry, no cluster ever ran it, and no NGC surface was contacted.

Use this entry in ConfigHub

Every Catalog entry page carries these five steps in this order. Each step says what the Catalog has run for this entry, and a step with a missing precondition gives no command.

Steps 1 and 2 need no account.

What is fixed, and what you supply

Fixed when this entry was built. These went into the build, so the objects already carry them. To change one, build the entry again from its source.

  • accelerator is any
  • intent is training
  • os is any
  • platform is any
  • service is aks
  • acceleratedNodeSelector is nvidia.com/gpu.present=true
  • repoURL is oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aicr-aks-training
  • storageClass is gp3
  • systemNodeSelector is nodeGroup=system-worker (placeholder, change it to match your cluster)
  • workloadSelector is app.kubernetes.io/part-of=training
  • deployer is argocd-helm
  • selectedOverlay is aks-training
  • appliedOverlays is base>monitoring-hpa>aks>aks-training

Yours to supply or check. The destination must have these before the objects are applied. The words in italics say what the Catalog knows about each.

  • Argo CD and its Application API must exist on the destination, with the argocd namespace, because every object in this base is an Argo CD Application in that namespace. Declared. Not checked on any destination.
  • 3 of the 15 Applications take their source from oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/aicr-aks-training/aicr-bundle at 1.0.0. That package is not published, so a destination needs a reachable copy before Argo CD can resolve them. Declared. Not checked on any destination.
  • AICR generated this recipe for accelerator=any, intent=training, os=any, platform=any, service=aks. A destination has to match those criteria, and nothing here has checked one. Declared. Not checked on any destination.
  • systemNodeSelector=nodeGroup=system-worker is a placeholder, confirmed as one on 2026-10-07. Change it to the label on your own cluster's system node group. It is written into spec.source.helm.values of 11 rendered Applications at 23 field paths. A different value changes the bundle bytes and every digest in this entry, so the entry must be regenerated with the new value or a variant must be and more. The listing gives the rest. A placeholder. Change it to match your cluster.
This entry's plan, and how to test it

These are the steps that plain objects cannot carry. ConfigHub stores them and does not carry them out. The words in italics say what the Catalog knows about each.

  • Once the destination is known. Apply the 14 component Applications in the 6 sync-waves they carry, from wave 1 to wave 13. The order is recorded as a route beside the bundle and no runtime has executed it. Who: Argo CD on the selected destination. Generated. Not run on a cluster.
  • Once the destination is known. Argo CD renders 12 upstream charts and 3 AICR bundle paths at sync time. Their CRDs, hooks, certificates and operators are handled there, and this entry has not rendered or assessed them. Who: Argo CD on the selected destination. Not evaluated.
  • Once the destination is known. Replace the placeholder systemNodeSelector nodeGroup=system-worker with the label on your own cluster's system node group, before the bundle is delivered to a destination. That means regenerating the bundle with the new value or making a variant from this entry. Who: platform operator. Written down. Not run by the Catalog.
  • Once the destination is known. Decide whether the destination needs dra-node-labeler, which the selected recipe names and the bundle does not deploy. Including one means regenerating the bundle with the input AICR names for it. Who: platform operator. Written down. Not run by the Catalog.
  • Once the destination is known. Decide whether the DRA kubelet plugin is evicted before a GPU driver container restarts. The bundle was generated with no DRA eviction node label, so dra-node-labeler is not deployed. The listing gives the rest. Who: platform operator. Written down. Not run by the Catalog.

Read what a plan is, and why some entries have one.

1. Get the exact objects Run for this entry

The Catalog rendered this entry and retains its 15 Argo CD Applications as files that one inventory lists.

# make the directories the inventory names
$ mkdir -p aicr-aks-training-v1-0-0-argocd/templates

# fetch the inventory, then every file it lists
$ curl -fsSL -o aicr-aks-training-v1-0-0-argocd/checksums.txt https://raw.githubusercontent.com/confighub/helm-expt/main/examples/aicr/aks-training/argocd-rendered/checksums.txt

$ cut -c67- aicr-aks-training-v1-0-0-argocd/checksums.txt | xargs -I{} curl -fsSL -o aicr-aks-training-v1-0-0-argocd/{} https://raw.githubusercontent.com/confighub/helm-expt/main/examples/aicr/aks-training/argocd-rendered/{}

# check every file against the inventory
$ (cd aicr-aks-training-v1-0-0-argocd && shasum -a 256 -c checksums.txt)

# check the inventory against the listing digest
$ shasum -a 256 aicr-aks-training-v1-0-0-argocd/checksums.txt
ff59e754bc12699c470b4a01452713ae1c96006be6e0b08c0310d82694a6c3e6  aicr-aks-training-v1-0-0-argocd/checksums.txt

# join the files into one for step 2
$ cat aicr-aks-training-v1-0-0-argocd/templates/*.yaml > aicr-aks-training-v1-0-0-argocd.yaml

2. Compare with another version or base Not available yet

The Catalog holds no other version or base of this entry's source in the same format. A second entry for aks-training in this format would give this step a sibling.

3. Upload it as a variant Not available yet

This entry is not published, so there is no public artifact to upload. The listing records its literal configuration bundle as not published. Publishing the rendered objects as that bundle, with a receipt, would make this step available.

4. Deploy it Not available yet

This step needs an upload command from step 3, and this entry has none. A published artifact for this entry, with a receipt, would make this step available.

5. Promote a change Not available yet

This step needs an upload command from step 3, and this entry has none. A published artifact for this entry, with a receipt, would make this step available.

Technical notes and disclaimers

  • This entry is a set of Argo CD Applications, so a test needs Argo CD. The Catalog has no test script for it.

Generated from the committed markdown file docs/demo/aicr/aks-training.md. The source file is the authoritative version.