DIAL Deployment Manager configuration

Deployment Manager has settings on its backend, in the target Kubernetes cluster, and on DIAL Admin Frontend. The MCP proxy image selection belongs to the backend. This page maps those settings and the steps that connect the components. It is for platform engineers who already run DIAL Admin with sign-in and have a Kubernetes cluster for managed workloads.

Where each setting lives

Place	What it sets	Reference
Backend environment variables / Spring configuration	Kubernetes credentials and namespaces, registry and Git access, database, authentication, build and workload defaults, scheduling, metrics, and telemetry.	Backend
Backend MCP proxy settings	The Alpine and Debian artifact images copied into stdio MCP wrappers.	MCP proxy
Kubernetes	Knative/KServe operators, registry access, namespace RBAC, and optional Cilium, metrics-server, and DCGM exporter.	Cluster access
Admin Frontend environment variables	DEPLOYMENTS_ENABLED, DIAL_DEPLOYMENTS_API_URL, optional model-serving and registry switches, and the user's sign-in.	Admin Frontend deployment settings
DIAL Core configuration	The models, applications, interceptors, and toolsets pointing to running container endpoints.	Core configuration

The reference uses released Backend 0.22.0 and MCP proxy 0.1.0. The upstream development configuration can describe different behavior; in particular, its NIM configuration has been removed. See Version scope.

Connect DIAL Admin

1. Prepare the workload cluster. Install Knative Serving for containers, and KServe when using Hugging Face model servings. Prepare the build and workload namespaces and bind the backend's service account to their required permissions. Add Cilium permissions when network-policy enforcement is enabled.

2. Configure the backend's storage and cluster access. Use PostgreSQL or SQL Server for production. Set its registry, build namespace, and Kubernetes kubeconfig or token; see Backend configuration. The backend needs writable storage for its database only when using local H2.

3. Set backend token validation. Set CONFIG_REST_SECURITY_MODE=oidc. Configure an identity provider matching the tokens Admin forwards, including issuer, JWKS endpoint, accepted audience, role claim, and role mapping. Frontend administrator recognition and Core's admin rules do not grant Deployment Manager roles.

4. Point Admin Frontend at the backend. Set its base URL without /api/v1:

   DEPLOYMENTS_ENABLED=true
   DIAL_DEPLOYMENTS_API_URL=http://<DEPLOYMENT_MANAGER_HOST>:8080

   MCP_REGISTRY_ENABLED=true adds MCP Registry discovery. HF_ENABLED=true exposes Hugging Face model servings; the backend also needs K8S_KSERVE_ENABLED=true. For NIM on backend 0.22.0, both the frontend's NIM_ENABLED and the backend's K8S_NIM_ENABLED are needed, along with the NVIDIA dependencies.

5. Check the result. Backend health answers at /api/v1/health. In Admin, Deployments lists Images and Containers. A successful build creates an image in the configured registry; deploying it produces a running endpoint. Creating a DIAL entity from that container registers the endpoint in Core.

Warning

CONFIG_REST_SECURITY_MODE defaults to none. Enable authentication before exposing the backend: it can create jobs, workloads, and secrets using its Kubernetes credentials.

OIDC example

These are backend variables, separate from Admin Frontend's AUTH_KEYCLOAK_* variables:

CONFIG_REST_SECURITY_MODE: oidc
PROVIDERS_KEYCLOAK_ISSUER: https://<KEYCLOAK_HOST>/realms/dial
PROVIDERS_KEYCLOAK_JWKSETURI: https://<KEYCLOAK_HOST>/realms/dial/protocol/openid-connect/certs
PROVIDERS_KEYCLOAK_AUDIENCES: dial-admin-console
PROVIDERS_KEYCLOAK_ROLECLAIMS: roles
PROVIDERS_KEYCLOAK_PRINCIPALCLAIM: sub
SECURITY_ROLES_MAPPING: '{"ConfigAdmin":["FULL_ADMIN"],"admin":["FULL_ADMIN"],"viewer":["READ_ONLY_ADMIN"]}'

The issuer must match the token's iss, while the JWKS URL must be reachable from the backend. The audience and role claims must match the token issued to the Admin client. Provider-specific mappings can override the defaults; see Security.

Helm integration

The DIAL Admin chart deploys the backend with manager.enabled: true. Its manager.image selects the backend release. manager.configuration.build.namespace and manager.configuration.deploy.{knative,kserve,nim} control the target namespaces and enabled workload types. Backend environment overrides belong in manager.env; credentials belong in manager.secrets or an existing Secret supplied through manager.extraEnvVarsSecret.

The chart's manager.configuration.database configures the backend database when the bundled PostgreSQL is enabled. With another database, set postgresql.enabled: false and supply the backend's datasource variables explicitly.

Warning

While postgresql.enabled and manager.enabled are both true, the chart generates the Secret named in manager.extraEnvVarsSecret, by default <release>-manager-db, with the bundled PostgreSQL credentials. A Secret of that name supplied for another database is overwritten.

Installing the chart does not install the workload cluster's Knative, KServe, NVIDIA, or Cilium operators. See DIAL Admin installation for installing the chart and Backend configuration for the backend's own variables.

Troubleshooting

Symptom	What to check
No Deployments menu	DEPLOYMENTS_ENABLED on Admin Frontend; check that the menu is not hidden.
Screens fail with authentication errors	The backend's issuer, JWKS, audience, role claim, and role mapping; the frontend forwards its user's token.
Build jobs cannot start	Cluster credentials, the build namespace, RBAC, registry credentials, and the selected root/rootless builder's pod security requirements.
A stdio MCP build fails or its executable cannot start	MCP proxy image selection, the base image's Linux distribution and architecture, and the server command.
Workload never becomes ready	Image pull access, startup command, resources, startup probe, Knative/KServe operator health, and the configured startup deadlines.
Node Pool selector is empty	NODE_POOLS on the backend. Defaults select pool IDs; they do not create Kubernetes node pools.
Metrics are partial	metrics-server and DCGM availability, pod proxy RBAC, the scrape budget, and workload metrics support.
Containers run but are absent from Chat	Create the corresponding entity in Core and configure its user roles; a running container alone is not a DIAL entity.