Install on Oracle OKE

Oracle Container Engine for Kubernetes (OKE) is a supported platform. Olympusx AI installs on it with the Helm chart, following Install on Kubernetes, plus the OKE-specific settings on this page. Use the chart rather than the operator on OKE: the user ID model servers run as, the model download proxy and Workload Identity for OCI Generative AI are chart values with no field on the Olympus resource.

The cluster

	Use	Why
Cluster type	Enhanced	Workload Identity, which lets Olympusx AI call OCI Generative AI with no stored key, exists only on enhanced clusters
Node shapes	x86 (`linux/amd64`) shapes, such as the E-series Flex shapes	The platform’s images are amd64 only. Do not run the platform on Ampere (arm64) shapes
Node pool	At least three worker nodes, one per availability domain	The managed database runs three instances, and a block volume stays in the availability domain it was created in
Node size	4 vCPU and 24 GB each is a working start for the platform with guardrails and tracing	See Requirements for the requests
API endpoint	Private, reached through OCI Bastion or a jump host	Nothing in Olympusx AI needs the Kubernetes API to be public
Add-ons	cert-manager and Kubernetes Metrics Server	Certificates for both hostnames, and the CPU and memory figures on the cluster pages
GPU node pools	Optional	As in Requirements: the NVIDIA GPU Operator and a driver of 580 or newer. A cluster with no GPUs serves small models on CPU

NetworkPolicy

Neither of OKE’s pod networking options enforces NetworkPolicy by itself. Install Calico in policy-only mode, following Oracle’s documentation for your networking option, before you install Olympusx AI. The platform’s internal listeners rely on NetworkPolicy to keep everything but the gateway out.

Prove enforcement before anything multi-tenant runs: with no policy, a test pod reaches a test server; with a default-deny policy in the server’s namespace, it does not. Verify the installation has the check against Olympusx AI itself.

Load balancer and ingress

Install an ingress controller and expose it through an OCI load balancer or network load balancer. Set the chart’s ingress.className to its class.

On a network load balancer in front of private worker subnets, two Service annotations decide whether connections work:

metadata:
  annotations:
    oci.oraclecloud.com/load-balancer-type: "nlb"
    oci-network-load-balancer.oraclecloud.com/is-preserve-source: "false"

With source preservation on and worker subnets routed through a NAT gateway, every connection times out. To keep a fixed address across reinstalls, reserve a public IP and name it with the oci.oraclecloud.com/reserved-ips annotation. With network security groups, set the security-list management mode to None and attach the groups with the annotations Oracle documents for your load balancer type.

Set the load balancer’s idle timeout to at least 300 seconds in front of the gateway.

Routing with the Gateway API instead. If you front the cluster with a Gateway API implementation rather than an ingress controller, keep ingress.enabled: true with consoleHost and gatewayHost set and a className no controller serves. The chart derives the sign-in address and the identity service’s redirect addresses from ingress.consoleHost; the inert Ingress objects are how it learns them. Then route the two hosts yourself:

Host	Service	Port
`<console-host>`	`olympus-studio`	8080
`<gateway-host>`	`olympus-gateway`	10000

If you enable Gateway API support in OKE’s cert-manager add-on, cert-manager does not start until the Gateway API CRDs exist. Install them, then restart cert-manager.

Storage

OKE’s default StorageClass, oci-bv, provisions block volumes with ReadWriteOnce access, which the database needs. Two properties of block volumes shape the values:

The smallest volume is 50 GB. A smaller claim is provisioned, and billed, as 50 GB. Size the database’s data and write-ahead-log volumes at 50Gi, since you pay for it either way.
A volume stays in one availability domain. A pod with a volume is scheduled in that domain only, so spread nodes across domains.

Values for OKE

Add these to the olympus-values.yaml from Install on Kubernetes:

postgresqlCNPG:
  storage:
    size: 50Gi
    storageClass: oci-bv
  walStorage:
    size: 50Gi
    storageClass: oci-bv
  backup:
    destinationPath: s3://<bucket>/olympus-db
    endpointURL: https://<object-storage-namespace>.compat.objectstorage.<region>.oraclecloud.com
    credentialsSecret: olympus-backup-s3

ingress:
  className: <ingress-class>

modelServing:
  runAsUser: 1000
  downloadProxy:
    enabled: true
    domains: [huggingface.co, hf.co]

providers:
  ociWorkloadIdentity:
    enabled: true
    region: <region>

Value	Why on OKE
Database volumes at `50Gi` on `oci-bv`	The block volume minimum
`backup.endpointURL`	OCI Object Storage’s S3-compatible endpoint for your tenancy’s namespace and region. The access key pair in `olympus-backup-s3` is a Customer Secret Key
`modelServing.runAsUser`	OKE assigns no user ID, and the inference runtime’s image runs as root without one
`modelServing.downloadProxy`	Project namespaces deny internet egress. The proxy lets model servers on this cluster fetch weights from the listed domains only. Leave it off when weights come from your own registry
`providers.ociWorkloadIdentity`	Lets the control plane call OCI Generative AI as its own pod, with no key stored anywhere

Images on OKE

The cluster pulls the platform’s images from the registry in your subscription with the pull secret, as on any cluster. To pull from OCI Container Registry instead, mirror the images there (Air-gapped installation) and either keep a pull secret for it or let the nodes authenticate as their instance principal through the kubelet credential provider for OCIR. With the credential provider, leave image.pullSecrets empty.

OCI Generative AI with Workload Identity

With providers.ociWorkloadIdentity.enabled, the control-plane pod’s service account is the OCI principal and each request is signed with a short-lived token. Grant that workload in OCI IAM, in the compartment that will be billed:

Allow any-user to use generative-ai-family in compartment <compartment> where all {
  request.principal.type = 'workload',
  request.principal.namespace = 'olympus',
  request.principal.service_account = 'olympus',
  request.principal.cluster_id = '<oke-cluster-ocid>' }

The service account name is the Helm release name; with the release olympus, it is olympus.

Then, in the console, Settings › Model providers › Add provider, choose Oracle OCI Generative AI with Workload identity, and give the region and the compartment OCID the calls are billed to. Test connection lists the compartment’s on-demand models; a successful list proves the policy is in place. Until the policy exists, the provider answers 404. External models covers the rest.

Install

Follow Install on Kubernetes from step 1, with the OKE values added. After the install:

kubectl -n olympus get pods
kubectl -n olympus get ingress

Point DNS for both hostnames at the load balancer’s public address, then continue with First sign-in.