Skip to main content

Install DIAL Admin

Install DIAL Admin on Kubernetes with the dial/dial-admin Helm chart, connected directly to DIAL Core. This guide is for DevOps engineers who run DIAL with the Helm charts. It assumes a running DIAL Core and an identity provider that Core already trusts.

What the chart deploys​

The umbrella dial/dial chart doesn't include DIAL Admin; it has its own chart. dial/dial-admin 0.20.0, with app version 0.22.0, has four parts:

PartValues keyDefaultRole
Admin FrontendfrontendOn, image 0.22.0The web interface, deployed through the dial-extension chart
Admin BackendbackendOn, image 0.22.1The optional backend
PostgreSQLpostgresqlOnThe backend's database, and Deployment Manager's when manager is on
DIAL Deployment Manager BackendmanagerOffBuilds images and runs containers for the Deployments screens

With the default values, the chart starts the backend and its database but sets no environment variables on the frontend. The frontend is connected to neither DIAL Core nor the backend until you set them.

Prerequisites​

  • Helm 3.8.0 or later, and the DIAL chart repository: helm repo add dial https://charts.dialx.ai.
  • DIAL Core with the Configuration API, reachable from the cluster.
  • A client for DIAL Admin in your identity provider, with the redirect URI https://<ADMIN_HOST>/api/auth/callback/<PROVIDER_ID>. Provider IDs are listed in Other identity providers.
  • DIAL Core set up to validate that provider's tokens and to recognize administrators in access.admin.rules. See Authentication and administrator access.

Step 1: Write the values file​

This values.yaml turns off the backend and its database, and connects the frontend to DIAL Core with Keycloak sign-in:

backend:
  enabled: false
postgresql:
  enabled: false

frontend:
  image:
    tag: 0.22.5
  env:
    DIAL_CORE_API_URL: "<DIAL_CORE_URL>"
    NEXTAUTH_URL: "https://<ADMIN_HOST>"
    NEXTAUTH_COOKIE_PREFIX: "admin"
    THEMES_CONFIG_URL: "<THEMES_URL>"
    AUTH_KEYCLOAK_HOST: "https://<KEYCLOAK_HOST>/realms/<REALM>"
    AUTH_KEYCLOAK_CLIENT_ID: "dial-admin-console"
  secrets:
    NEXTAUTH_SECRET: "<NEXTAUTH_SECRET>"
    AUTH_KEYCLOAK_SECRET: "<KEYCLOAK_CLIENT_SECRET>"
  livenessProbe:
    enabled: true
    httpGet:
      path: /api/health
  readinessProbe:
    enabled: true
    httpGet:
      path: /api/health
  ingress:
    enabled: true
    ingressClassName: nginx
    hosts:
      - <ADMIN_HOST>
    tls:
      - secretName: dial-admin-tls
        hosts:
          - <ADMIN_HOST>
  • frontend.env sets plain environment variables. frontend.secrets goes into a Kubernetes Secret that the pod loads with envFrom.
  • DIAL_CORE_API_URL is DIAL Core's in-cluster URL, such as http://dial-core.dial.svc.cluster.local. DIAL_ADMIN_API_URL stays unset, which selects the direct-to-Core setup.
  • The Keycloak issuer in AUTH_KEYCLOAK_HOST must be reachable from both the browser and the Admin pod. For another identity provider, replace the AUTH_KEYCLOAK_* variables with that provider's; see Other identity providers.
  • The chart leaves the probes off. The frontend serves its health check at /api/health.
  • The image tag overrides the chart's default 0.22.0 with the latest 0.22 patch.

To connect Evaluation, Deployments, or Analytics, add their variables to frontend.env; see Optional services. The chart doesn't deploy the evaluation services; see DIAL Evaluations. Deployment Manager in this chart turns on with manager.enabled: true; see DIAL Deployment Manager configuration for its cluster, storage, authentication, and MCP proxy settings.

Step 2: Install the chart​

helm repo update
helm upgrade --install dial-admin dial/dial-admin \
  -f ./values.yaml \
  --version 0.20.0 \
  -n dial

The release creates a Deployment, Service, Ingress, Secret, ServiceAccount, and NetworkPolicy, all named dial-admin-frontend. The Service listens on port 80 and forwards to the container's port 3000.

Step 3: Verify the installation​

  1. Check that the pod is ready:

    kubectl -n dial get pods -l app.kubernetes.io/instance=dial-admin

  2. Open https://<ADMIN_HOST> and sign in.

  3. Open AI Gateway › Models. The list shows the models from DIAL Core's configuration files and storage.

If the screens load but Core calls answer 403, the user's token doesn't match Core's access.admin.rules.

Add Admin Backend​

To run the optional backend as well, keep backend and postgresql on, or use externalDatabase for your own PostgreSQL. Then point the frontend to the backend's Service:

frontend:
  env:
    DIAL_ADMIN_API_URL: "http://dial-admin-backend.<NAMESPACE>.svc.cluster.local"

The backend needs its own settings for DIAL Core, token validation, and configuration export; see Admin Backend configuration. The chart's own examples set THEMES_CONFIG_HOST on the frontend. The frontend reads THEMES_CONFIG_URL, so use that name instead.

Result​

The DIAL Admin frontend runs in the cluster, signs administrators in through your identity provider, and manages DIAL Core's configuration through the Configuration API.

Further reading​