You reach an AI Virtual Machine with virtctl, the KubeVirt command line tool, against the Compute Pool's cluster. virtctl proxies through the cluster's KubeVirt API, so there is no separate SSH endpoint to expose and no firewall rule to add. The PaletteAI console provides the kubeconfig for the cluster, but it does not host a terminal or a console session, so virtctl is required.
An AI Virtual Machine is a complete virtual machine, with its own guest operating system, that runs on a Compute Pool built for virtualization. App Deployments and Model Deployments run containerized workloads. An AI Virtual Machine gives you the whole operating system instead, for workloads that need one: GPU drivers, desktop applications, or tooling that does not run in a container. PaletteAI builds each virtual machine on KubeVirt and manages its lifecycle through a Virtual Machine Orchestrator (VMO) stack installed on the Compute Pool's cluster.
These tasks cover creating AI Virtual Machines, connecting to them, and managing them. For what an AI Virtual Machine is and how it relates to a Compute Pool, refer to AI Virtual Machines.
This guide walks through an end-to-end deployment of PaletteAI VerteX in an air-gapped environment
An App Deployment represents an AI/ML application deployed using a Profile Bundle; the Profile Bundle must contain a Workload Profile with the type Application. An App Deployment is the primary method that data scientists and ML engineers use to deploy their workloads onto Compute Pools.
The appliance install will deploy self-hosted Palette and PaletteAI on the same cluster using bare metal or edge devices. The installation is broken into two parts:
PaletteAI abstracts away the complexity of deploying AI and ML application stacks on Kubernetes. Built on proven orchestration technologies, PaletteAI enables data science teams to deploy and manage their own AI and ML application stacks while platform engineering teams maintain control over infrastructure, security, and more.
The built-in templates create a user named pai with a well-known password, so that you can sign in the first time. Replace that credential before you put anything important on the virtual machine.
A Compute resource is a live inventory of the machines available for deploying AI/ML applications and models. It connects to Palette using the Palette integration configured in Settings, discovers machines that have been tagged for PaletteAI, and reports which ones are healthy and eligible for cluster deployment. A Compute can reference a Settings resource in its own namespace, or fall back to the Settings configured for its System, Tenant, or Project scope if none is referenced. The controller refreshes the inventory automatically.
A Compute Config is a reusable blueprint of cluster settings. Platform administrators capture infrastructure details such as networking, Secure Shell (SSH) keys, and node configuration in a Compute Config once. Data scientists and ML engineers then deploy against those defaults without repeating boilerplate.
A Compute Pool is a group of shared Compute resources that PaletteAI turns into one or more Kubernetes clusters where your AI/ML applications and models run. In the hub-spoke architecture, each Compute Pool becomes a spoke cluster on which applications and models are deployed.
This page provides technical reference information for the Compute resource: the discovery tags PaletteAI reads from Palette Edge hosts, the spec fields you can set, and the status fields the controller reports. For concepts, refer to Compute. For the raw resource spec, refer to the Compute CRD documentation.
Compute resources are how PaletteAI turns your physical machines into Kubernetes clusters that run AI/ML applications and models.
This page provides technical reference information for configuring ComputeConfig resources. For concepts, refer to Compute Configs. For step-by-step instructions, refer to Create and Manage Compute Configs. For the raw resource spec, refer to the ComputeConfig CRD documentation.
This page provides technical reference information for configuring ComputePools.
A Settings resource holds the integrations PaletteAI uses to provision infrastructure and govern artificial intelligence and machine learning (AI/ML) workloads. This page shows how to configure each integration type and how to govern model availability through Project Model Settings.
This guide describes how to configure model pricing at the System scope. Model pricing is the install-wide catalog of per-model rates (USD per 1,000,000 tokens) that the Inference Launchpad gateway uses for cost accounting and that the Cost dimension of Inference Quotas is measured against. PaletteAI federates the catalog to every Launchpad-enabled spoke; each served model that appears in the catalog gets an explicit rate, and every other served model falls back to the Default rate. Without a Default and an explicit price for a model, that model's requests do not contribute to the Cost dimension of any quota.
Settings define integrations and configuration values used by Projects and Compute Pools. For integration types, prerequisites, and examples, refer to Settings and Integrations.
Create an AI Virtual Machine to get a GPU or CPU virtual machine with its own guest operating system on a Compute Pool. For what an AI Virtual Machine is and how it relates to a Compute Pool, refer to AI Virtual Machines.
This guide describes how to deploy an Inference Launchpad cluster from PaletteAI. An Inference Launchpad cluster is a standard Compute Pool whose Profile Bundle opts the spoke in to Token Metering by carrying the palette.ai/launchpad-enabled=true annotation. Once you have such a Compute Pool, deploying a vLLM-backed Model Deployment to it is the same workflow as any other Model Deployment — the Inference Launchpad gateway on the spoke automatically proxies the model.
This page covers the curated, ready-to-use Profile Bundles from PaletteAI Studio, along with the built-in Profile Bundles that ship with a PaletteAI install. Use these reference pages for stack-specific guidance beyond the general Create and Manage Profile Bundles and Import Profile Bundles tasks.
This glossary defines key terms and concepts used throughout PaletteAI. Entries indicate concepts inherited from other software, such as Palette and Open Cluster Management (OCM), and name their source.
This page contains the complete Helm chart configuration reference for the latest version of PaletteAI.
PaletteAI uses a hub-spoke architecture to separate the control plane from the data plane. The hub cluster is where you manage and configure applications. Spoke clusters are where your AI/ML applications actually run. This separation allows a single control plane to orchestrate workloads across many environments.
Review all known issues in PaletteAI and learn more about their status.
PaletteAI provides the controls that cover everyday use of an AI Virtual Machine: starting it, stopping it, cloning it, and deleting it. For management beyond those controls, use the VMO console on the Compute Pool's cluster. Refer to Manage the Virtual Machine in VMO.
This guide describes how to create, copy, edit, revoke, and delete API Keys for Token Metering. An API Key is a bearer credential that a client presents to the Inference Launchpad gateway and that draws against exactly one Inference Quota.
This guide describes how to create, edit, and delete Inference Quotas. An Inference Quota is a usage budget that the PaletteAI Inference Launchpad gateway enforces on inference requests. Each quota caps the volume a caller can consume over a rolling window, measured in Requests, Tokens, or Cost.
Multi-Instance GPU (MIG) is an NVIDIA feature that partitions a supported GPU into as many as seven isolated GPU instances. Each instance has dedicated compute, memory, and memory bandwidth, so several workloads can share one physical GPU without competing for the same resources. MIG helps you increase GPU utilization when individual workloads do not need a full GPU.
PaletteAI is multi-tenant. It organizes teams, controls access, and manages GPU resources through a hierarchy of scopes, so platform engineering teams can set organization-wide policy while data science teams keep autonomy over their own workspaces.
Network isolation keeps the network traffic of one tenant's Compute Pool separate from that of another tenant on shared AI edge infrastructure. It is built for regulated and secure-AI environments where two tenants can run on the same physical fabric yet must be provably unable to reach the other tenant's GPU traffic or external ingress.
NVIDIA Runai as a ready-to-use Profile Bundle so platform teams can deploy GPU scheduling on PaletteAI Compute Pools without assembling operators and charts by hand.
PaletteAI uses OCI (Open Container Initiative) registries to store and distribute workload artifacts between hub and spoke clusters. When you create an App Deployment or Model Deployment, the spoke cluster's Workload controller renders your Workload Profile into Kubernetes manifests, packages them as OCI artifacts, and stores them in the spoke's OCI registry. Flux controllers on the spoke then pull these artifacts and apply them.
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
Summary
PaletteAI is installed through the Mural umbrella Helm chart, which deploys a set of cooperating services. Some of these services are built by Spectro Cloud, and others are established open-source projects that PaletteAI configures and manages for you. This page explains what each component is, what it does, and where it runs, so you can recognize the services in your cluster and understand how they fit together.
PaletteAI appliance preparation follows one of two paths:
A Project is a workspace where teams deploy and manage AI/ML applications. It is the narrowest scope and where most day-to-day work happens. Every Project belongs to a parent Tenant. Projects provide the following benefits:
This guide explains how to register a bare-metal or virtual edge node with the Palette VerteX
October 22, 2026 — PaletteAI 1.4.1
This page lists the full Kubernetes Role-Based Access Control (RBAC) permissions that PaletteAI grants to each Tenant and Project role. For an overview of each role and how OpenID Connect (OIDC) groups bind to roles, refer to the Roles and Permissions concept page.
PaletteAI manages permissions using standard Kubernetes Role-Based Access Control (RBAC), with one consistent extension: every role in PaletteAI is bound to OpenID Connect (OIDC) groups rather than to individual users. When you create a Tenant or Project, PaletteAI generates the underlying roles and role bindings automatically and connects them to the OIDC groups you specify in the Tenant's tenantRoleMapping or the Project's roleMapping. Group membership in your identity provider grants or revokes access; there are no per-user resources to maintain inside the cluster.
A Scaling Policy is a reusable set of autoscaling rules for Compute Pools. It defines the CPU and GPU utilization thresholds that trigger scaling, how long utilization must hold before PaletteAI acts, the minimum and maximum resources a pool may scale between, and how long to wait between scaling actions. One policy can be attached to many Compute Pools, so teams can standardize scaling behavior instead of tuning each pool individually.
This page provides technical reference information for configuring ScalingPolicy resources. For step-by-step instructions, refer to Create and Manage Scaling Policies. For the raw resource spec, refer to the ScalingPolicy CRD documentation.
Use this guide for an end-to-end self-hosted setup that starts with the appliance installation and ends with importing and deploying your first profile bundle.
A Settings resource holds the external integrations PaletteAI uses to provision infrastructure and govern artificial intelligence and machine learning (AI/ML) workloads. The System, Tenants, and Projects each reference a Settings resource, and the controller uses the integrations defined there to communicate with Palette and the registries that supply your models.
PaletteAI shares resources down the scope hierarchy: a resource defined once at System or Tenant scope can be used by many Projects without being copied into each one. This enables platform teams to curate a common catalog of building blocks — for example, an approved Profile Bundle — while individual teams keep working in their own isolated Project namespaces.
System is the top-level scope in PaletteAI, backed by the pai-system namespace and managed by platform operators. It sits above Tenants and Projects in the scope hierarchy.
A Tenant represents an organization or major division within your company and groups one or more Projects under a single administrative boundary. Platform engineering teams typically manage Tenants. Tenants provide the following benefits:
This section describes how to manage Token Metering from PaletteAI: creating and editing the Inference Quotas that cap metered usage, issuing the API Keys that attribute each caller's traffic to a quota, and configuring the Model Pricing that converts token counts into cost figures.
Token Metering tracks AI model token consumption across requests, providing visibility into input, output, and total token usage for monitoring, attribution, and cost analysis. Every inference call that passes through the gateway is metered: requests, tokens, and estimated cost are recorded against the caller's quota so you can monitor consumption, attribute usage to the model that generated it, and cap spend before it happens.
When an AI Virtual Machine does not reach Running, the reason is reported in the conditions on the resource. Inspect them first:
This page provides troubleshooting guidance for common Compute Pool issues.
PaletteAI enforces Role-Based Access Control (RBAC) across the UI. Each create, edit, or delete action is available only to users whose role includes the required permission. If an action listed below is not visible in the UI, your role does not include the permission. Contact your administrator to request access. For the full list of permissions granted to each PaletteAI role, refer to the Role Permissions reference.