Skip to main content
Version: v1.1.x

Configure Tenant Settings

Use Tenant Settings to manage Tenant-scoped configuration in the PaletteAI UI. From this page, you can manage Tenant configuration such as display information, integrations, OpenID Connect (OIDC) group access, target namespace access control, model access control lists, per-Tenant and per-Project GPU limits, Tenant compute inventory, Compute Configs, Scaling Policies, and Model as a Service Mappings.

To modify settings for a single Project at the project scope, refer to Configure Project Settings. For more information on the different scopes, refer to Tenants and Projects.

Prerequisites​

  • At least one Project exists in the Tenant, and you can access that Project in the PaletteAI UI. Tenant visibility in the UI depends on Project access.

  • To update Tenant-wide settings, you must have the Tenant admin role. For details, refer to Tenant Role Permissions.

  • To edit entries in the Projects sub-tabs, you must have the required Project permissions. For details, refer to Project Role Permissions.

Configure Tenant Settings​

  1. Log in to PaletteAI and select the Tenant you want to manage.

  2. From the Projects Menu in the top-left, select All Projects.

  3. From the left main menu, select Tenant Settings.

Manage Basic Information​

Use the Basic Information tab to update Tenant display values that appear elsewhere in the PaletteAI UI.

  1. Update Tenant Name or Description. To add or remove Annotations and Labels, expand Metadata.

  2. Select Save changes.

Create Tenant Settings Ref​

A Tenant Settings Ref holds integrations for Tenant-scoped resources. Each Tenant has at most one Settings Ref. Create the Settings Ref once, then add or update integrations as your environment grows. Hugging Face and NVIDIA NGC integrations can be shared with Projects; Palette integrations apply only at the Tenant scope and are not shared with Projects.

For background on how Tenant and Project Settings interact, refer to Settings and Integrations.

Enablement​

When no Tenant Settings Ref exists, the Tenant sub-tab shows an empty state titled Tenant-level settings are not available.

  1. On the Settings Ref tab, on the Tenant sub-tab, select Create Tenant-level Settings.

  2. In the Settings Ref Name field, enter a name for the settings resource.

    The name must be 63 characters or fewer and contain only lowercase alphanumeric characters or hyphens, beginning and ending with an alphanumeric character. The name cannot be changed after creation.

  3. Add at least one Palette, Hugging Face, or NVIDIA Inference Microservices (NIMs) integration. The create dialog requires at least one integration before you can save. For field-level guidance per integration type, refer to Add an Integration.

  4. Select Confirm.

After the Tenant Settings Ref is created, the Tenant sub-tab shows the Settings Ref header and the Integrations table. Continue with Manage Tenant Settings Ref to add more integrations or update existing ones.

Manage Tenant Settings Ref​

Add or update the integrations in the Tenant Settings Ref, and review the integrations configured in each Project. The Settings Ref tab opens to the Tenant sub-tab by default. The page header shows Settings Ref followed by the name you assigned, with a Ready or Not Ready status badge. Not Ready indicates that one or more integrations do not have a valid secret.

Add an Integration​

Each integration represents a connection to an external system, such as Palette, Hugging Face, or NVIDIA NIMs. Each integration type can be added once per Tenant Settings Ref. Palette integrations are used for Tenant-scoped operations only and cannot be shared with Projects. Hugging Face and NVIDIA NIMs integrations can be shared with specific Projects in the Tenant and optionally locked so Projects cannot override them.

  1. On the Tenant sub-tab, select Add Integration to open the Add Integration drawer.

  2. Choose an Integration Type — Palette, Hugging Face, or NVIDIA NIMs. The form fields update to match the selected type.

  3. Complete the fields for the chosen integration type:

    • Palette integration — used to provision compute resources from your Palette tenant. Provide:

      • Integration Name — display name, for example, Palette-Acme.
      • Host URL — the Palette host URL, for example, https://console.spectrocloud.com.
      • Tenant — the Palette tenant slug, for example, acme.
      • Project ID — the default Palette project UID that PaletteAI uses when provisioning clusters.
      • (Optional) Toggle Skip SSL Certificate Verification on to bypass certificate validation when connecting to the Palette server.
      • API Key — the Palette API key. Select Validate to verify the credentials against the Palette server.
      • (Optional) Toggle Cert Secret Ref on to reference a Kubernetes Secret containing a custom certificate authority bundle for the Palette server.

    • Hugging Face integration — enables Hugging Face model management features at the Project level. Provide:

      • Integration Name — display name, for example, HuggingFace-Acme.
      • API Key — your Hugging Face Hub API key. Select Validate to verify the key against the Hugging Face API.

    • NVIDIA NIMs integration — enables NVIDIA NGC model management features at the Project level. Provide:

      • Integration Name — display name, for example, NVIDIA-Acme.
      • API Key — your NVIDIA NGC API key. Select Validate to check that a key is provided. The Validate action does not verify the key format or contact NVIDIA NGC.

  4. (Optional) Expand Metadata to add Kubernetes labels and annotations to the integration.

  5. (Hugging Face and NVIDIA NIMs only; not available for Palette) Configure shared access for the integration:

    • Under Projects, choose which Projects in the Tenant can use this integration.
    • To prevent Projects from configuring their own version of the integration, enable Enforce tenant integration across all projects. Locked integrations cannot be replaced by a Project-level configuration.

    When you enforce the integration and one or more selected Projects already have the same integration type configured, PaletteAI shows a warning. Select Go to impacted projects in the warning to switch to the Projects sub-tab filtered to those Projects.

  6. Select Confirm to add the integration.

Edit or Delete an Integration​

Use the action menu on each row of the Integrations table to edit or delete an integration.

  • Edit & Share opens the integration drawer so you can update fields, change which Projects the integration is shared with, and toggle the lock setting. To replace the API key for an existing integration, clear the masked value and re-enter the key, and then select Validate before saving.

  • Delete removes the integration. When the integration is used by active model deployments, PaletteAI requires you to confirm by typing the integration name. Affected deployments are marked out of policy until they are updated or deleted.

Palette integrations cannot be deleted from the Tenant Settings Ref. To rotate Palette credentials, use Edit & Share to update the existing entry.

Edit Basic Information​

To update the Tenant Settings Ref's labels and annotations, select the Settings dropdown next to the Settings Ref name, and then select Edit basic information. The Settings Ref name itself cannot be changed after creation.

Review Project Integrations​

Use the Projects sub-tab to review the integrations configured in each Project, including Hugging Face and NVIDIA NGC integrations shared from the Tenant Settings Ref.

  1. Select the Projects sub-tab.

  2. Search or filter to locate the Project. To open or close every Project row at once, select Expand all or Collapse all.

  3. Expand a Project to review its integrations table. Each row shows the Integration Name, Type, Last modified timestamp, and Scope badge (Tenant for an integration shared from the Tenant Settings Ref, Project for an integration owned by the Project).

  4. (Optional) Select Edit in the action menu on a Project-scoped row to update a Project integration. Tenant-scoped rows are read-only here; manage them from the Tenant sub-tab.

Manage User Access​

On the User Access tab, control which OIDC groups administer the Tenant and which OIDC groups map to Project Viewer, Editor, and Admin roles.

  1. On the Tenant sub-tab, add or remove OIDC groups in Tenant Admin Groups, and then select Save changes.

    Blank entries are ignored. Configure at least one OIDC group before you save changes.

  2. Select the Projects sub-tab to review each Project's OIDC Viewer, Editor, and Admin group assignments.

  3. Search or filter to locate the Project, and then select Edit to update that Project's OIDC group assignments.

    The edit drawer updates the Viewer Groups, Editor Groups, and Admin Groups fields for the selected Project.

Manage Target Namespaces​

On the Target Namespaces tab, configure which Kubernetes namespaces on spoke clusters are permitted deployment targets for workloads.

  1. On the Tenant sub-tab, add or remove namespace entries in the Allow list (namespaces where workloads and their resources can be deployed) and Deny list (namespaces where workloads and their resources cannot be deployed), and then select Save.

    Alternatively, enable Allow all (*) to permit all namespaces by default and deny specific ones, or Deny all (*) to block all namespaces by default and allow specific ones.

  2. Select the Projects sub-tab to review and edit each Project's target namespace configuration.

Manage Models List​

On the Models List tab, define which models are allowed and denied for use across the available integrations (Hugging Face and NVIDIA NIMs).

  1. On the Tenant sub-tab, configure the access control list for each model source by adding allowed or denied entries, and then save your changes.

  2. Select the Projects sub-tab to review each Project's model access control lists, including Tenant configuration shared with the Project.

Manage Resource Limits​

On the Resource Limits tab, set GPU limits and requests for the Tenant, and review or adjust per-Project GPU quotas.

  1. On the Tenant sub-tab, update GPU Limits and GPU Requests, and then select Save changes.

    Each entry must use a unique GPU family and a limit value. If a warning indicates that Projects exceed the Tenant GPU limits, increase the Tenant limits or reduce Project limits.

  2. (Optional) In the Tenant GPU reservations section, use Add reservation to reserve GPUs for Tenant-level Compute Pools and workloads. Each reservation value must be at most the Tenant limit for that GPU type.

  3. Select the Projects sub-tab to review GPU limits and requests across Projects.

  4. Search or filter to locate the Project, and then select Edit to adjust GPU limits and requests.

Manage Compute​

On the Compute tab, review the worker and control plane nodes that the Tenant's Projects have discovered through their Palette integrations. The tab opens to the Tenant sub-tab by default and is read-only.

  1. On the Tenant sub-tab, review every node from all Compute resources in the Tenant's own namespace.

    Project compute nodes are displayed separately on the Projects sub-tab. The table includes Node Name, Status (Free, In use, Unhealthy, Unavailable, or Unknown), Compute Pool, Type (Worker or Control Plane), Resource Groups, Architecture, CPU, Memory, GPU family, GPU count, and GPU memory. On the Projects sub-tab, a Project column also appears.

  2. Filter the list with Filter by name, or with the Status and Type filters. The Projects sub-tab also offers a Project filter.

  3. Select the Projects sub-tab to review compute nodes grouped by their owning Project.

Create Compute Config​

Create a Tenant-scoped Compute Config that Projects can adopt as a shared infrastructure baseline. Each Compute Config captures cluster defaults such as Secure Shell (SSH) keys, Network Time Protocol (NTP) servers, and the network overlay.

Enablement​

  1. On the Compute Config tab, on the Tenant sub-tab, select Create Compute Config to open the Create tenant compute config wizard.

  2. Complete the wizard steps:

    • Basic Information — set the Compute Config Name and Deletion Policy, optionally add SSH Keys, and pick the Projects that can use this Compute Config under Shared access.
    • Edge Configuration — configure NTP servers and the network overlay.
    • Node Pool Defaults — configure the control plane pool and worker pool default settings, such as node count, architecture, CPU, memory, labels, annotations, taints, single-node cluster mode, and worker-node eligibility.
    • Review — confirm the configuration and select Create.

    The Shared access section is shown only when the Tenant has at least one Project. Sharing with Projects is optional.

Manage Compute Configs​

Review and adjust the Tenant Compute Configs and inspect Project-scoped Compute Configs. The Compute Config tab opens to the Tenant sub-tab by default.

  1. On the Tenant sub-tab, review the Tenant Compute Configs.

    The table includes a Default radio column, Compute Config Name, Control Plane Pools, Worker pools, Shared with, and an action menu.

  2. Edit, clone, or delete a Compute Config from the action menu on each row.

    Cloning populates the wizard from the source. Deletion is disabled while the Compute Config is the Tenant default.

  3. Select the Projects sub-tab to inspect Compute Configs scoped to each Project.

    Search by name or filter by Project, then expand a Project row to review its Project-scoped Compute Configs together with any Tenant Compute Configs shared into the Project. The Scope column distinguishes Tenant from Project sources.

Create Scaling Policy​

Create a Tenant Scaling Policy that Projects can reference from their Compute Pools to autoscale workloads.

For background on autoscaling and the YAML reference, refer to Create and Manage Scaling Policies.

Enablement​

  1. On the Autoscaling Policies tab, on the Tenant sub-tab, select Create Autoscaling Policy at the top of the table to open the Create Auto-Scaling Policy dialog.

  2. Provide the following:

    • Scaling Policy Name — a unique Kubernetes-compliant name.
    • Metrics — add one or more CPU or GPU metrics with scale-up and scale-down thresholds and durations. At least one CPU or GPU metric is required.
    • Resource Bounds — optional minimum and maximum CPU counts, plus minimum and maximum GPU counts per family. Each GPU family in Resource Bounds must have a matching entry in Metrics.
    • Cool Down Duration — minimum wait time between scaling actions. Defaults to 15 minutes.
    • Timeout Duration — maximum duration for an ongoing scaling operation. Defaults to 30 minutes.
    • Shared access — under Projects, choose which Projects can use this policy.

  3. Select Create to save the policy.

Manage Scaling Policies​

Review the Tenant Scaling Policies, inspect their adoption across Compute Pools, and edit, clone, or delete existing policies. The Autoscaling Policies tab opens to the Tenant sub-tab by default.

  1. On the Tenant sub-tab, review the Tenant Scaling Policies.

    The table includes Scaling Policy Name, Shared with, Metrics, In use Compute Pools, Cooldown, Timeout, Scope, and an action menu. System policies appear with a system Scope badge and only support Clone.

  2. Select the In use Compute Pools count to open a drawer that lists the Compute Pools referencing the policy along with each pool's owning Project.

  3. Edit, clone, or delete a policy from the action menu on each row.

    Editing modifies the policy in place. Cloning opens the dialog populated from the source policy. Deletion is disabled while the policy is referenced by any Compute Pool.

  4. Select the Projects sub-tab to inspect Scaling Policies scoped to each Project.

    Search by name or filter by Project, then expand a Project row to view its Project-scoped Scaling Policies. Edit, clone, or delete a Project policy from the action menu on each row.

Create Model as a Service Mappings​

Create a mapping on the Model as a Service Mappings tab to route incoming Model Deployments to a chosen Profile Bundle based on the model's source and attributes. When a Model Deployment matches the source and filters defined for a mapping, PaletteAI deploys the model using the target Profile Bundle. The tab has Tenant and Projects sub-tabs; you create new mappings on the Tenant sub-tab, while the Projects sub-tab lets you review, edit, or delete existing Project-level mappings.

Enablement​

  1. On the Model as a Service Mappings tab, on the Tenant sub-tab, select Add Mapping to open the Add Mapping drawer. The drawer has two columns.

  2. In the Model Source column on the left, choose Hugging Face or NVIDIA NIMs as the source type. For Hugging Face, define the Model Match filters (AND). Each mapping supports at most one filter, which is a key-value pair that a model must match for the mapping to apply.

    For Hugging Face, the filter key is apps with values vllm or ollama. NVIDIA NIMs mappings do not use filters.

  3. In the Target Profile Bundle column on the right, pick the Profile Bundle that PaletteAI uses when a model matches the filter.

    The table lists each Profile Bundle's Name, Version, and Type. Only Application and Fullstack Profile Bundles are eligible; Infrastructure bundles do not appear.

  4. Select Confirm to save the mapping, or Cancel to discard it. Confirmed mappings are saved to the Tenant automatically.

Manage Model as a Service Mappings​

Review existing mappings, and edit or delete them. Changes are saved to the Tenant automatically.

  1. On the Tenant sub-tab, review the mappings table.

    The table includes Target Profile Bundle, Source Type, Model Filters, and an action menu. Filter the list by Source Type or use Filter by name to search.

  2. Edit or delete an existing mapping from the action menu on each row.

  3. Select the Projects sub-tab to review Project-level mappings. You can edit or delete existing Project mappings from the action menu, but you cannot create new mappings on this sub-tab.

Validate​

  1. Refresh the Tenant Settings page and confirm your saved changes persist on the applicable Tenant or Projects sub-tab.

Next Steps​