Skip to main content
Version: v1.1.x

Configure Settings

Settings define integrations and configuration values used by Projects and Compute Pools. For integration types, prerequisites, and examples, refer to Settings and Integrations.

Overview​

You can configure Settings in PaletteAI at two levels:

  • Project-level Settings: Settings that you create in a Project namespace. Each Project can have its own Settings that define integrations specific to that Project.

  • Tenant-level Settings: Settings that you create in the Tenant namespace for Tenant-scoped resources. Tenant-level Settings can share Hugging Face and NVIDIA NGC integrations with selected Projects.

Tenant Settings and Project Settings​

Tenants and Projects each maintain their own Settings resource. Manage the Tenant Settings Ref from the Settings Ref tab on the Tenant Settings page. Every Project references a Settings resource in its own namespace through Project.spec.settingsRef.

Settings Reference​

The settingsRef field on the Tenant resource points to the Tenant-level Settings resource. When you configure it:

  • The reference points to a Settings resource by name and namespace in the Tenant namespace (tenant-<tenant-name>).

  • The Tenant Settings Ref supplies Palette credentials for Tenant-scoped Compute Pools and other Tenant-level operations.

  • Projects do not inherit the Tenant Settings Ref. Each Project must define its own settingsRef and Palette integration.

Integration Scope​

Settings resolution follows this model:

  • Every Project defines its own Settings resource in its Project namespace and references it through Project.spec.settingsRef.

  • Project.spec.settingsRef is a name-only reference. Because it has no namespace field, it always resolves to a Settings resource with that name in the Project namespace. It cannot directly target a Settings resource in another namespace, such as the Tenant namespace.

  • Palette integrations are not shared between Tenant and Project scopes. Each Tenant and each Project must define its own Palette integration with its own credentials.

  • Hugging Face and NVIDIA NGC integrations defined at the Tenant level can be shared with selected Projects through sharedWithProjects and optionally locked to prevent Project overrides.

  • When a Project defines Hugging Face or NVIDIA integrations in addition to shared Tenant integrations, PaletteAI merges them at the integration field level. Project-level values take precedence for integrations the Project defines locally.

  • The Settings controller computes the effective merged Settings and stores them in status.effectiveSettings, which represents the authoritative resolved configuration.

  • Secrets referenced by a Tenant-level Settings resource live in the Tenant namespace (tenant-<tenant-name>), while secrets referenced by a Project-level Settings resource live in the Project namespace. Each Settings resource can reference secrets only from its own namespace.

Manage Tenant Settings​

Use the Settings Ref tab on the Tenant Settings page to:

  • Create new Tenant-level Settings.

  • Set the Tenant Settings Ref on the Tenant resource.

  • Share Hugging Face and NVIDIA NGC integrations with selected Projects.

  • View and manage Settings at both the Tenant and Project levels.

  • Edit or clone existing Settings.

The Settings Ref tab displays Settings at both the Tenant and Project levels, showing which integrations are in use across your organization.

Integration Secrets​

Each integration in a Settings resource references one or more Kubernetes secrets. PaletteAI enforces strict ownership rules for these secrets to ensure safe lifecycle management.

Secret Namespace​

All integration secrets must reside in the same namespace as their Settings resource. For example, a Settings resource in the project-docs namespace must reference secrets that also exist in project-docs. This applies to all integration types:

  • Palette: spec.integrations.palette.namespace must match the Settings namespace.

  • Hugging Face: The API key secret must be in the Settings namespace.

  • NVIDIA: The NGC API key secret and image pull secret must be in the Settings namespace.

info

When Hugging Face or NVIDIA integrations are shared or merged across scopes, secrets referenced by a Tenant-level Settings resource live in the Tenant namespace (tenant-<tenant-name>), while secrets referenced by a Project-level Settings resource live in the Project namespace. Palette integration secrets are always scoped to the Tenant or Project that defines them. Each Settings resource is responsible only for secrets in its own namespace.

Secret Ownership​

Within a namespace, each integration secret can be referenced by only one Settings resource. Duplicate integration secrets (where multiple Settings resources reference the same Palette integration secret) are detected during reconciliation. The system reports duplicates through the PaletteIntegrationUnique status condition as warnings, but does not block the Settings resource from becoming Ready. Reconciliation may issue non-blocking nudges to prompt resolution of duplicates.

Automatic Secret Deletion​

When you delete a Settings resource, PaletteAI automatically deletes integration secrets it references, provided no other Settings resource in the same namespace still references them. The controller preserves shared integration secrets while other Settings peers still reference them. Only orphaned secrets (no longer referenced by any Settings) are deleted. If any secret cannot be removed, the Settings resource is retained and the deletion is blocked.

warning

Deleting a Settings resource permanently deletes its integration secrets. Before deleting, ensure you no longer need the credentials stored in those secrets, or copy them elsewhere.

Deletion Protection​

A Settings resource cannot be deleted while a non-deleting Project or Tenant still references it. If you attempt to delete one, PaletteAI returns a validation error that identifies the referencing Project or Tenant. Remove or update the reference first, then delete the Settings resource.

When to Use Tenant-Level vs. Project-Level Settings​

Consider using Tenant-level Settings when:

  • You need Palette credentials for Tenant-scoped Compute Pools or other Tenant-level operations.

  • You want to share Hugging Face or NVIDIA NGC integrations across multiple Projects.

  • You need centralized management of model-registry API keys with optional per-Project lockdown.

Consider using Project-level Settings when:

  • You create a new Project. Every Project requires its own Settings resource and Palette integration.

  • Projects need isolated Palette credentials for security, compliance, or separate Palette tenants.

  • Different teams manage different Projects independently.

Next Steps​

After you configure Settings, refer to the following resources for related Project administration tasks: