Skip to content

Deploy a Kronos worker with Helm

Deploy a yasp-embedded worker on a Kubernetes cluster from the published yasp-embedded-worker chart. For a single host, use the Docker deploy instead.

Run these from a machine with kubectl/helm configured for the target cluster and yasp-agent installed. Fill each <…> from your cluster.

1. Get a registry key

The chart pull and the image pull both authenticate with a registry key. Get yours and export it as REGISTRY_KEY, with your API key in YASP_API_KEY.

2. Add the chart repository

helm repo add yasp-public https://nexus.yasp.ai/repository/helm/ --username token --password "$REGISTRY_KEY"
helm repo update yasp-public

3. Create the cluster Secrets

Set your context and namespace, then create the image-pull Secret (one chart-level imagePullSecrets covers both the controller and the per-task Job pods):

export CTX=<kube-context>; export NS=<namespace>
kubectl --context="$CTX" create namespace "$NS" --dry-run=client -o yaml | kubectl --context="$CTX" apply -f -

kubectl --context="$CTX" -n "$NS" create secret docker-registry yasp-nexus-pull \
  --docker-server=docker.yasp.ai --docker-username=token --docker-password="$REGISTRY_KEY" \
  --dry-run=client -o yaml | kubectl --context="$CTX" apply -f -

Store a Kronos (embedded) long-lived worker register key (~6 months) so the worker can register.

export KRONOS_WORKER_KEY=$(yasp-toolkit embedded key)

export KRONOS_WORKER_KEY=$(curl -fsS -X POST \
  -H "Authorization: Bearer $YASP_API_KEY" -G \
  --data-urlencode "audience=embedded-api" \
  --data-urlencode "scope=embedded-register" \
  "https://compile.yasp.ai/api/token")

kubectl --context="$CTX" -n "$NS" create secret generic yasp-embedded-register-key \
  --from-literal=token="$KRONOS_WORKER_KEY" \
  --dry-run=client -o yaml | kubectl --context="$CTX" apply -f -

Alternatively, you can continue to use your API key:

kubectl --context="$CTX" -n "$NS" create secret generic yasp-embedded-register-key \
  --from-literal=token="$YASP_API_KEY" \
  --dry-run=client -o yaml | kubectl --context="$CTX" apply -f -

4. Install the chart

One release number drives both the chart --version and the image tag (v-prefixed) — the install block below resolves the latest with yasp-toolkit registry helm-version (drop --latest to list recent versions).

Not every arch_spec ships in every release

Confirm the image exists before deploying (this also pre-stages it):

docker pull docker.yasp.ai/yasp-inference/backend/<arch-spec>:v<version>

First, list your GPU nodes' exact product labels (the value for job.nodeSelector):

kubectl --context="$CTX" get nodes \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.nvidia\.com/gpu\.product}{"\n"}{end}'

Then install, picking the image.repository arch_spec for your nodes' OS (how each is derived is in the overview):

Target host <arch-spec>
Ubuntu 20.04 dGPU u2004-cu114-trt86-py311
Ubuntu 22.04 dGPU u2204-cu126-trt104-py311
Ubuntu 24.04 dGPU u2404-cu129-trt1014-py311
Jetson, JetPack 5.1.2 jp512-cu122-trt85-py311
Jetson, JetPack 6 (Orin) jp61-cu126-trt103-py311
Drive AGX (DriveOS 6.0.10) dos6010-cu114-trt86-py311 
export VERSION=$(yasp-toolkit registry helm-version yasp-embedded-worker --latest)

helm --kube-context="$CTX" upgrade --install <release> yasp-public/yasp-embedded-worker \
  --version "$VERSION" \
  --namespace "$NS" \
  --set router.apiHost=https://compile.yasp.ai/api \
  --set auth.existingSecret=yasp-embedded-register-key \
  --set auth.secretKey=token \
  --set image.registry=docker.yasp.ai \
  --set image.repository=yasp-inference/backend/<arch-spec> \
  --set image.tag="v$VERSION" \
  --set 'imagePullSecrets[0].name=yasp-nexus-pull' \
  --set worker.target=<advertised-arch-target> \
  --set 'worker.tags.host=<gpu-node>' \
  --set "worker.tags.version=v$VERSION" \
  --set "worker.tags.last_update=$(date +%F)" \
  --set job.gpu.enabled=true --set job.gpu.resourceKey=nvidia.com/gpu --set job.gpu.count=1 \
  --set 'job.nodeSelector.nvidia\.com/gpu\.product=<EXACT-GPU-PRODUCT-LABEL>' \
  --set-json 'job.tolerations=[{"key":"nvidia.com/gpu","operator":"Exists","effect":"NoSchedule"}]'

The chart is now stored in the release, so you can drop the repo entry: helm repo remove yasp-public.

Per-cluster knobs to validate
  • job.runtimeClassName — set to the cluster's NVIDIA RuntimeClass (commonly nvidia) only if nvidia isn't already the nodes' default runtime.
  • controller.replicaCount — set to the number of nvidia.com/gpu units on the node (MIG slices or multiple cards) so each GPU gets its own worker registration.
  • worker.tags.routing=<name> — register in a separate routing pool for testing instead of the stable pool. See Tags & routing.

5. Verify

kubectl --context="$CTX" -n "$NS" rollout status deploy/<release>-yasp-embedded-worker --timeout=600s
kubectl --context="$CTX" -n "$NS" logs deploy/<release>-yasp-embedded-worker --tail=20 \
  | grep -iE 'API Key OK|worker_registered'
yasp-toolkit embedded workers

The first image pull on a cold node can take minutes; the chart's startup probe budgets for it. The advertised Arch Spec in embedded workers is the value you pass to --arch-spec when you compile.

Rollout stuck or worker not registering?

Send the rollout status and pod logs above to support@yasp.ai. Need an image for hardware that isn't listed? See requesting an arch_spec.

Agent-assisted deploy and upgrades

From the yasp shell, the deploy-embedded-worker-helm skill automates this flow (GPU targeting, secrets, gpu-operator CDI gotchas), and upgrade-helm-releases bumps existing releases to the latest version across the cluster.

Stop or remove the worker

kubectl --context="$CTX" -n "$NS" scale deploy/<release>-yasp-embedded-worker --replicas=0   # pause (scale back up to resume)
helm --kube-context="$CTX" uninstall <release> --namespace "$NS"                              # remove entirely

Scaling to zero stops the worker while keeping the release; helm uninstall removes it (the yasp-nexus-pull / yasp-embedded-register-key Secrets stay — delete them with kubectl delete secret if you're done). Once gone, it drops out of yasp-toolkit embedded workers after it stops heartbeating.