Skip to main content
Version: v1.3.x

Configure System Settings

Use System Settings to manage System-scoped configuration in the PaletteAI UI. System is the top-level scope, backed by the pai-system namespace and managed by platform operators. From this page, you can manage organization-wide configuration such as integrations, GPU limits, Compute Configs, Scaling Policies, Model as a Service Mappings, and Multi-Instance GPU (MIG) availability that cascades to every Tenant and Project.

To modify settings for a single Tenant, refer to Configure Tenant Settings. For more information on the different scopes, refer to System Scope and Multi-Tenancy.

Prerequisites​

  • You must have the System administrator role. For details, refer to Roles and Permissions.

  • System-scoped resources are created in the pai-system namespace. Do not confuse the System scope with the internal platform namespace (mural-system by default), which holds installer-managed resources that cannot be edited in place.

Configure System Settings​

  1. Log in to PaletteAI.

  2. From the Projects Menu in the top-left, select the System scope.

  3. From the left main menu, select System Settings.

Manage System Settings Ref​

A System Settings Ref holds integrations shared with Tenants and Projects in the organization. The System scope has at most one Settings Ref. System-level Settings share Hugging Face and NVIDIA NGC integrations with, and can lock them for, the Tenants and their Projects that you select; by default, an integration is shared with all Tenants and their Projects.

For background on how Settings inheritance works across scopes, refer to Settings and Integrations.

Add an Integration​

Each integration represents a connection to an external system, such as Palette, Hugging Face, or NVIDIA NIMs. Each integration type can be added once per System Settings Ref.

  1. On the Settings Ref tab, on the System sub-tab, select Add Integration to open the Add Integration drawer.

  2. Choose an Integration Type — Palette, Hugging Face, or NVIDIA NIMs. The form fields update to match the selected type.

  3. Complete the fields for the chosen integration type:

    • Palette integration — used to provision compute resources from your Palette tenant. Provide the Integration Name, Host URL, Project ID, and API Key. Select Validate to verify the credentials against the Palette server.
    • Hugging Face integration — enables Hugging Face model management features. Provide the Integration Name and your Hugging Face Hub API Key. Select Validate to verify the key against the Hugging Face API.
    • NVIDIA NIMs integration — enables NVIDIA NGC model management features. Provide the Integration Name and your NVIDIA NGC API Key. Select Validate to check that a key is provided. The Validate action does not verify the key format or contact NVIDIA NGC.

  4. (Optional) Expand Metadata to add Kubernetes labels and annotations to the integration.

  5. (Hugging Face and NVIDIA NIMs only) Under Shared access, choose which Tenants and Projects can use this integration, and optionally lock the integration so lower scopes cannot override it.

  6. Select Confirm to add the integration.

Edit or Delete an Integration​

Use the action menu on each row of the Integrations table to edit or delete an integration. Palette integrations cannot be deleted; use Edit & Share to rotate their credentials.

Manage Resource Limits​

On the Resource Limits tab, set organization-wide GPU limits and requests that act as ceilings on every Tenant, and review or adjust per-Tenant GPU quotas. For the full quota model, refer to GPU Quotas.

  1. On the System sub-tab, update the system-wide GPU Limits and GPU Requests, and then select Save changes.

    Each entry must use a unique GPU variant and a limit value. If a warning indicates that Tenants exceed the system GPU limits, increase the system limits or reduce Tenant limits.

  2. Select the Tenants sub-tab to review GPU limits and requests across Tenants.

  3. Search or filter to locate the Tenant, and then select Edit to adjust that Tenant's GPU limits and requests.

Manage Multi-Instance GPU​

Govern where Multi-Instance GPU (MIG) configuration appears in the user interface across the whole organization. System decisions are authoritative: neither a Tenant nor a Project can override the System scope's MIG governance. These controls affect only where MIG configuration is exposed; they do not change how the NVIDIA GPU Operator applies MIG.

  1. Open the System MIG settings.

  2. Enable or disable MIG configuration across all Tenants and Projects.

  3. Choose which Tenants may configure MIG in their Compute Pool flows.

    • Allow all Tenants to expose MIG configuration. This is the default.
    • Restrict MIG configuration to a specific list of Tenants.
    • Allow no Tenants to expose MIG configuration.

  4. Save your changes.

Tenants further refine which of their Projects may configure MIG. Refer to Manage Multi-Instance GPU in Tenant Settings for the Tenant-scoped controls.

info

MIG configuration also depends on the hardware. Even when the System scope allows MIG, PaletteAI offers MIG configurations only for Compute Pools whose GPUs support MIG. Refer to Multi-Instance GPU for the hardware requirements.

Manage Network Isolation​

Connect PaletteAI to an external network fabric provider and govern where network isolation is required across the organization. Manage network isolation from the Network Isolation page, available from the left main menu at the System scope. The page has three tabs — Integrations, Isolation Units, and Tenancy Settings. For what network isolation does and the network planes it separates, refer to Network Isolation.

Adding an integration or saving governance requires the spectrocloud.com/settings:update permission, and adding an isolation unit requires the spectrocloud.com/aviztenants:create permission. If an action or button described in the documentation is not displayed, your role does not include the required permission.

Add an Aviz Integration​

Only one Aviz integration is allowed per scope. If an integration already exists at this scope, edit it to change it, or delete it before adding a new one.

  1. On the Integrations tab, select Add Aviz Integration. If no integration exists yet, select Create Aviz Network Isolation Integration from the empty state. The Create Aviz Network Isolation Integration wizard opens.

  2. On the General information step, provide the connection details for Aviz ONES:

    • Name — A unique name for the integration.
    • Host — The Aviz ONES API base URL, including the authentication service port (typically 8089), for example https://ones.example.com:8089.
    • Username and Password — The Aviz ONES account PaletteAI uses to create and manage network isolation.
    • (Optional) Enable Skip TLS Verification to disable TLS certificate verification when connecting to Aviz ONES. Not recommended — disabling verification exposes the connection to man-in-the-middle attacks that can intercept Aviz credentials and management traffic. Prefer a trusted certificate chain for the Aviz ONES host.
    • Select Validate Credentials to verify the account against Aviz ONES.
    • (System and Tenant scopes) Under Shared access, choose which lower scopes can use this integration. Shared scopes can use the integration but cannot change or delete it.

    Select Next.

  3. On the Isolation Units step, select Add Aviz ONES Tenant to define one or more isolation units for this integration. Each unit requires an Aviz ONES Tenant name, a Fabric name, and a Max GPUs value. You can also add isolation units later from the Isolation Units tab. Select Next.

  4. On the Review step, confirm the details, and then select Create Aviz Network Integration.

Add an Isolation Unit​

An isolation unit is an Aviz ONES Tenant — an isolated environment on your Aviz ONES fabric with dedicated GPU capacity that Compute Pools consume.

  1. On the Isolation Units tab, select Add Aviz ONES Tenant. The Add Aviz ONES Tenant drawer opens.

  2. Complete the fields:

    • Aviz Integration — The integration this unit belongs to. This field is required and cannot be changed after the unit is created.
    • Aviz ONES Tenant name — A unique name for the unit. It must start with a letter, be at most 12 characters, and contain only letters, numbers, underscores, or dashes.
    • Fabric name — The Aviz ONES fabric that provides the unit's isolation.
    • Max GPUs — The maximum number of GPUs the unit can allocate. Must be greater than zero.
    • (Optional) Description — A description of the unit.

  3. Select Confirm to add the isolation unit.

Require Network Isolation for System-Scoped Compute Pools​

On the Tenancy Settings tab, govern whether network isolation is required at the System scope and for the Tenants and Projects you select. System decisions take precedence: a requirement set here cannot be turned off at a lower scope.

  1. Enable Require Network Isolation for System-scoped Compute Pools to require an isolation unit on every System-scoped Compute Pool. The System scope is not ready until each System-scoped Compute Pool has one.

  2. Under Tenant and Project Isolation Requirements, choose which Tenants and Projects must use network isolation for their Compute Pools. Those scopes are not ready until an isolation unit is provided.

  3. Select Save changes.

Create Compute Config​

Create a System-scoped Compute Config that Tenants and Projects can adopt as a shared infrastructure baseline. Each Compute Config captures cluster defaults such as Secure Shell (SSH) keys, Network Time Protocol (NTP) servers, and the network overlay.

  1. On the Compute Config tab, on the System sub-tab, select Create Compute Config and complete the wizard.

  2. Under Shared access, choose which Tenants and Projects can use this Compute Config.

  3. Review the configuration and select Create.

Edit, clone, or delete a System Compute Config from the action menu on each row. Deletion is blocked while a Compute Config is in use.

Create Scaling Policy​

Create a System Scaling Policy that Compute Pools across the organization can reference to autoscale workloads.

For background on autoscaling and the YAML reference, refer to Create and Manage Scaling Policies.

  1. On the Autoscaling Policies tab, on the System sub-tab, select Create Autoscaling Policy and provide the policy name, metrics, resource bounds, cooldown, and timeout.

  2. Under Shared access, choose which Tenants and Projects can use this policy.

  3. Select Create to save the policy.

Edit, clone, or delete a System Scaling Policy from the action menu on each row. Deletion is disabled while the policy is referenced by any Compute Pool.

Create Model as a Service Mappings​

Create a mapping on the Model as a Service Mappings tab to route incoming Model Deployments to a chosen Profile Bundle based on the model's source and attributes. When a Model Deployment matches the source and filters defined for a mapping, PaletteAI deploys the model using the target Profile Bundle.

  1. On the System sub-tab, select Add Mapping, choose the model source and match filter, and pick the target Profile Bundle.

  2. Select Confirm to save the mapping.

Edit or delete an existing mapping from the action menu on each row.

Validate​

  1. Refresh the System Settings page and confirm your saved changes persist on the applicable System or Tenants sub-tab.

Next Steps​