physical-ai-infrastructure-setup-and-resilient-scaling

Use when the user wants to set up, scale, validate, or harden NVIDIA physical AI infrastructure for synthetic data generation workflows across local MicroK8s or Azure AKS, including Kubernetes clusters, inference endpoint deployment, OSMO deployment, workload submission readiness, and infrastructure failure recovery. Trigger keywords: physical ai infrastructure, resilient scaling, SDG infrastructure, microk8s, azure aks, NVCF deployment, NIM Operator, OSMO deploy, workflow scaling. Don't trigger

2,665stars303forksUpdated 7/25/2026

DevOps & CI/CD Cloud Infrastructure #devops #nvidia #infrastructure #azure #kubernetes #terraform

Security Assessment

Low Risk(85/100)

Detected risks:

Privileged, mutating infrastructure operations(The skill performs privileged operations such as sudo-run MicroK8s and GPU install scripts, Terraform-driven creation of Azure cloud resources, and Helm releases, which mutate real cluster and cloud state., A bootstrap step shallow-clones the upstream NVIDIA OSMO repository and executes its install script with root privileges, so the resulting environment depends on trusting that upstream code.)

Cloud and API credential handling(The skill manages cloud and NGC API credentials, storing secrets in a repo-root .env file and validating endpoints with bearer tokens, though it is defensive: it never echoes raw keys, prefers Kubernetes secret references and runtime-only injection, and recommends scanning transcripts for leaked secrets.)

Security Score85/100

About physical-ai-infrastructure-setup-and-resilient-scaling

Physical AI Infrastructure Setup and Resilient Scaling is a large, NVIDIA-authored composite skill for standing up, scaling, validating, and hardening the Physical AI synthetic-data-generation (SDG) infrastructure stack across local MicroK8s or Azure AKS. It is organized as a canonical trigger that loads component references on demand, covering Kubernetes cluster provisioning, inference endpoint deployment (NIM Operator, NVCF, and Azure AI Foundry), OSMO deployment and CLI/workflow operations, Azure access setup, and infrastructure failure recovery. It solves the problem of composing these stages into a reproducible SDG environment and keeping it observable and recoverable.

The skill is built around defensive operating rules. It treats the repository as the durable artifact (fixing checked-in config or scripts and rerunning rather than applying untracked one-off changes), runs mutating cluster, OSMO, Helm, Terraform, or Azure operations through checked-in scripts, and stops at the first failed gate to fix the lowest owning layer. Its credential handling is notably careful: secrets live in a repo-root .env, it never prints or echoes raw keys, it prefers credential handles, Kubernetes secretKeyRef, and runtime-only secret injection, and it recommends scanning transcript exports for secrets before sharing. Component references document standard flows such as az login, NGC Org API key setup with bearer-token endpoint validation, and MicroK8s bootstrap that shallow-clones the upstream NVIDIA OSMO repo and runs a GPU install script with sudo.

Target users are platform and MLOps engineers deploying NVIDIA Physical AI/SDG infrastructure on Kubernetes and Azure. The inherent considerations are operational: the skill performs privileged, mutating infrastructure operations (sudo installs, Terraform-driven cloud resource creation, Helm releases) and manages cloud and NGC credentials, so it should be run in an authorized environment by someone with the appropriate Azure/PIM roles.

FAQ

What environments does it support?

Local MicroK8s and Azure AKS, plus inference via NIM Operator, NVCF, or Azure AI Foundry, and OSMO deployment and workflow operations. Component references are loaded only for the selected target.

How does it handle secrets and credentials?

Secrets are stored in a repo-root .env, and it never prints or echoes raw keys. It prefers credential handles, Kubernetes secretKeyRef, and runtime-only injection, and recommends scanning transcript exports for secrets before sharing.

Does it make changes to my infrastructure?

Yes. It performs privileged, mutating operations (for example sudo installs, Terraform-driven Azure resource creation, and Helm releases), running them through checked-in scripts. Read-only diagnostics are allowed at preflight; deployed state belongs to later gates.

What are the prerequisites?

kubectl plus either MicroK8s or Azure CLI/Terraform, appropriate OSMO or inference credentials, and for Azure typically subscription Owner (or Contributor plus User Access Administrator) via PIM. MicroK8s needs a GPU host with NVIDIA driver 525+.

Where do configuration values come from?

It derives values from the environment where possible, using git rev-parse for the repo root and Terraform outputs or platform queries for cluster-derived names, and asks the user only for values that cannot be inferred, such as API keys or target choice.

All Files

68 files

components/cluster-azure/terraform/prerequisites/robotics-azure-resource-providers.txt0.3 KB