Nim Operator Install

NVIDIA NIM Operator Install

Use this skill to install or upgrade the NVIDIA NIM Operator on an existing Kubernetes cluster. The skill installs the operator and its CRDs only. Do not deploy NIMService, NIMCache, NIMPipeline, or NeMo service custom resources unless the user explicitly asks for that as a separate task.

This is the canonical, agent-neutral skill folder. If another agent framework needs a specific discovery path, create a thin adapter or symlink to this folder instead of duplicating the workflow.

Workspace Root

Assume commands run from the root of the k8s-nim-operator repository unless the user gives another working directory. Before using repo-relative paths such as .agents/skills/... or deployments/helm/k8s-nim-operator, verify the current directory:

pwd
test -f deployments/helm/k8s-nim-operator/Chart.yaml
test -f .agents/skills/nim-operator-install/SKILL.md

If these checks fail, ask for the correct repository root or cd to it before continuing.

Safety Contract

Run read-only discovery before proposing any cluster-changing command. Before running any mutating command, print the exact commands, summarize the expected impact, and ask for confirmation.

Read-only examples: kubectl get, kubectl describe, kubectl auth can-i, helm version, helm list, helm search repo, helm status, helm get values.

Mutating examples: helm repo add, helm repo update, helm dependency update, helm upgrade --install, kubectl create, kubectl apply, kubectl patch, kubectl delete.

Defaults

• NIM Operator release: nim-operator
• NIM Operator namespace: nim-operator
• Public NVIDIA Helm repo name: nvidia
• Public NVIDIA Helm repo URL: https://helm.ngc.nvidia.com/nvidia
• Local NIM Operator chart path: deployments/helm/k8s-nim-operator
• NIM Operator chart version: latest available from the selected chart source unless the user requests a specific version
• GPU Operator: verify first; ask before installing if missing
• GPU Operator namespace: gpu-operator
• Dynamo: disabled unless requested
• KServe: verify only; do not install KServe from this skill

References

• For validation levels, command safety checks, and evidence format, read references/validation.md.
• For a read-only validation helper from the repository root, run .agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh.

How To Ask For This Skill

End users do not need to know the internal file layout. They should ask the agent for the outcome they want. Recognize and support these prompt patterns:

Dry run only:

Use the NIM Operator install skill to dry-run installation on my Kubernetes cluster. Show preflight checks, available chart versions, selected version, and Helm dry-run output. Do not install anything.

Install latest public chart:

Use the NIM Operator install skill to install NIM Operator from the public NVIDIA Helm repo. Check prerequisites first, ask me which chart version to use, and do not run mutating commands until I approve.

Install a specific version:

Use the NIM Operator install skill to install NIM Operator version <version>. Verify that version exists in the NVIDIA Helm repo before installing.

Install from the local chart:

Use the NIM Operator install skill to install from the local chart in this repo. Show me the local chart version and ask before installing.

Install with Dynamo:

Use the NIM Operator install skill to install NIM Operator with Dynamo enabled. Ask before enabling any Dynamo sub-options.

Validate an existing install:

Use the NIM Operator install skill to validate the current NIM Operator installation. Run only read-only checks and summarize release, pods, CRDs, GPU Operator, cert-manager, and KServe status.

Upgrade:

Use the NIM Operator install skill to upgrade my existing NIM Operator release. Show the current version, available versions, selected target version, preserved Helm values, and ask before upgrading.

Remote cluster through SSH:

Use the NIM Operator install skill against my remote Kubernetes host <user>@<host>. Run commands over SSH, show every command before running it, and do not install until I approve.

Manual CLI Usage

This section is for humans, CI jobs, and reviewers who want to run the same workflow without an agent. Run local commands from the repository root and ensure kubectl points at the target cluster before running any Helm command.

Validation only:

.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh

Validation with overrides:

NIM_OPERATOR_RELEASE=nim-operator \
NIM_OPERATOR_NAMESPACE=nim-operator \
GPU_OPERATOR_NAMESPACE=gpu-operator \
.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh

Public chart install or upgrade:

helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm repo update
helm search repo nvidia/k8s-nim-operator --versions
selected_version="REPLACE_WITH_VERSION_FROM_SEARCH_OUTPUT"
.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh
helm upgrade --install nim-operator nvidia/k8s-nim-operator \
  --namespace nim-operator \
  --create-namespace \
  --version "${selected_version}" \
  --set operator.admissionController.enabled=false
.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh

To dry-run instead of installing, add --dry-run --debug to the helm upgrade --install command. To enable Dynamo, append --set dynamo.enabled=true and only add Dynamo sub-options if they are intentionally selected.

Local chart install or upgrade:

helm show chart deployments/helm/k8s-nim-operator
.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh
helm upgrade --install nim-operator deployments/helm/k8s-nim-operator \
  --namespace nim-operator \
  --create-namespace
.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh

Remote SSH usage if the skill folder has been copied to the remote host:

ssh <user>@<host> '~/.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh'
ssh <user>@<host> 'helm repo add nvidia https://helm.ngc.nvidia.com/nvidia'
ssh <user>@<host> 'helm repo update'
ssh <user>@<host> 'helm search repo nvidia/k8s-nim-operator --versions'
ssh <user>@<host> 'selected_version="REPLACE_WITH_VERSION_FROM_SEARCH_OUTPUT"; helm upgrade --install nim-operator nvidia/k8s-nim-operator --namespace nim-operator --create-namespace --version "${selected_version}" --set operator.admissionController.enabled=false'
ssh <user>@<host> '~/.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh'

Initial Questions

Ask only for missing choices that materially affect the install:

1. Use the public NVIDIA Helm repo or the local chart from the current checkout?
2. Enable Dynamo? If yes, should any Dynamo sub-options be set?
3. Verify KServe compatibility? If yes, verify KServe is already installed, but do not install it.
4. If GPU Operator is absent, should this skill install it as a dependency?
5. Namespace, release name, version, or chart path overrides.

If the user wants a quick default install, use public repo, latest available chart version, namespace nim-operator, release nim-operator, Dynamo disabled, KServe verification disabled, and GPU Operator install only if the user approves after the prerequisite check. Tell the user which version will be installed and ask whether they want a different version before running Helm.

Version Selection

For public chart installs and upgrades, never leave <selected-version> unresolved. Discover versions first:

helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm repo update
helm search repo nvidia/k8s-nim-operator --versions

Use the first version returned by helm search repo ... --versions as the latest candidate, then ask:

I found latest NIM Operator chart version <latest-version>. Do you want to install this version, or should I use a different version?

If the user accepts the latest version, set selected_version=<latest-version>. If the user provides another version, verify that version appears in the helm search repo output before using it. If it does not appear, stop and ask the user to choose one of the available versions.

For local chart installs and upgrades, inspect the local chart:

helm show chart deployments/helm/k8s-nim-operator

Tell the user the local chart version and appVersion, then ask whether to proceed with that local chart or switch to the public chart flow.

Dry-Run Demo Flow

When the user asks for a dry run or demo, do not install anything. Start by calling the bundled validation helper so preflight evidence is captured before chart discovery or Helm rendering. Use this sequence:

.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh
helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm repo update
helm search repo nvidia/k8s-nim-operator --versions
helm template nim-operator nvidia/k8s-nim-operator \
  --namespace nim-operator \
  --version <selected-version> \
  <approved-values>
helm upgrade --install nim-operator nvidia/k8s-nim-operator \
  --namespace nim-operator \
  --create-namespace \
  --version <selected-version> \
  <approved-values> \
  --dry-run --debug

Before rendering or dry-running Helm, resolve <selected-version> through the Version Selection flow and replace <approved-values> with the exact values the user approved, such as --set operator.admissionController.enabled=false or --set dynamo.enabled=true.

Prerequisite Checks

Start prerequisite discovery by calling the bundled validation helper:

.agents/skills/nim-operator-install/scripts/validate-nim-operator-install.sh

This is the canonical preflight call site for the skill. It checks client tools, cluster access, RBAC, nodes, GPU availability, GPU Operator status, cert-manager status, KServe presence, current NIM Operator state, and NIM Operator CRDs.

If the helper is unavailable or a narrower manual check is needed, run these read-only checks before proposing install commands:

kubectl config current-context
kubectl cluster-info
kubectl auth can-i create customresourcedefinitions.apiextensions.k8s.io
kubectl auth can-i create clusterroles.rbac.authorization.k8s.io
helm version
kubectl get nodes
kubectl get nodes -o custom-columns=NAME:.metadata.name,GPUS:.status.allocatable.nvidia\.com/gpu
kubectl get ns gpu-operator
kubectl get pods -n gpu-operator
kubectl get clusterpolicies.nvidia.com
kubectl get ns cert-manager
kubectl get pods -n cert-manager

Interpret the results:

• Cluster-admin or equivalent privileges are normally required because the charts install CRDs and cluster-scoped RBAC.
• NVIDIA GPU Operator is required for GPU-backed NIM workloads. If it is missing, ask whether to install it before installing NIM Operator.
• GPU allocatable resources may be absent before GPU Operator is installed or ready. After GPU Operator installation, verify nvidia.com/gpu capacity and allocatable resources.
• cert-manager is required when operator.admissionController.enabled=true and operator.admissionController.tls.mode=cert-manager, which are NIM Operator chart defaults. If cert-manager is absent, either stop and ask the user to install it, or propose --set operator.admissionController.enabled=false only if the customer accepts disabling the admission controller.

For KServe verification, also run:

kubectl get crd inferenceservices.serving.kserve.io
kubectl get pods -n kserve

If KServe is absent, do not install it. Tell the user KServe-backed NIMService resources will not work until KServe is installed.