Networking Minerva User Guide
Networking Minerva User Guide
Breadcrumbs

Manage a Kubernetes Installation

After installation, use these procedures to change the configuration, renew the license, run the NVIDIA Minerva CLI, and uninstall NVIDIA Minerva.

Change the Configuration

The three custom resource files are your configuration of record. Keep them under version control. To change a setting, such as a collector setting or a source range, edit the file and apply it again, and the operator applies the change. Then repeat the custom-resource check in Validate the Installation.

Renew the License

To install a renewed license, replace the content of the ConfigMap, restart the license service, and wait for the restart to finish:

kubectl -n minerva-app create configmap minerva-license --from-file=license.lic=<new-license-file> \
  --dry-run=client -o yaml | kubectl apply -f -
kubectl -n minerva-app rollout restart deploy/license
kubectl -n minerva-app rollout status deploy/license

Then repeat the license check in Validate the Installation with a new port-forward, and confirm your license's identity and expiry date. Features that were unavailable become available again within about two minutes. For more about licenses, see Manage Licenses.

Operating Tips

  • When your CA rotates, re-create the ca-certs Secret in its three namespaces and restart the workloads that use it.

  • Keep the admin account and the password you set (see Sign In and Set the Administrator Password). Deleting the account doesn't remove it: the UI creates it again with the initial password at its next start.

  • Never delete or rotate the minerva-keycloak-admin Secret: the application uses it.

  • If you federate login, keep the local admin account, tested, as your recovery path.

  • Scale the gateway-push and processor collectors with the size of your fleet.

  • Only one Keycloak controller may watch the minerva-identity namespace.

  • Each NVIDIA Minerva release pins one Keycloak Operator version (26.7.5 in this release). When you move to a later release, upgrade the Keycloak Operator first: obtain the five manifest files at the version that release names, update both image tags in your overlay (see Install the Keycloak Operator), apply it, and wait for the rollout. Only then upgrade the NVIDIA Minerva operator chart. The NVIDIA Minerva operator doesn't check this pairing for you.

The NVIDIA Minerva CLI

The reference configuration doesn't run the NVIDIA Minerva CLI. If NVIDIA Support asks you to run a CLI command, enable the utility pod by setting spec.utility.enabled: true in the application file and applying it again. Once the operator has created the pod, wait for it to be ready, and then start the CLI in it:

kubectl -n minerva-app rollout status deploy/utility
kubectl -n minerva-app exec -it deploy/utility -- minerva-cli

CLI commands that depend on direct host access aren't available on Kubernetes. Use the corresponding kubectl command instead, for example kubectl logs, kubectl cp, or kubectl get pods -o wide.

Uninstall NVIDIA Minerva from Kubernetes

Warning: deleting the platform can delete data. In the reference configuration, every storage block sets retainOnDelete: true, Druid deep storage included, so deleting a resource keeps those PVCs. The identity resource keeps its database (retainDatabaseOnDelete: true) and is protected by deletionProtection: true. Most application components keep only temporary data. Deleting a namespace deletes its PVCs regardless, and retained volumes aren't backups. Back up what you need first, including the generated credential Secrets, without which retained data is unusable.

Delete in this order, leaving the operators running until the deletions complete:

kubectl -n minerva-app delete minervaapp minerva-app --wait --timeout=20m
kubectl patch minervaidentity cluster-identity --type=merge \
  -p '{"spec":{"deletionProtection":false}}'
kubectl delete minervaidentity cluster-identity --wait --timeout=20m
kubectl -n minerva-infra delete minervainfra minerva-infra --wait --timeout=30m
helm -n minerva-system uninstall minerva-operator

If a deletion hangs, diagnose the reported condition. Don't remove finalizers as a shortcut. The NVIDIA Minerva CRDs are deliberately kept. Remove them and the namespaces only for a complete purge, after confirming that nothing in them should survive:

kubectl delete ns minerva-app minerva-infra minerva-identity minerva-system
kubectl delete crd minervaapps.minerva.minerva.nvidia.com \
                   minervainfras.minerva.minerva.nvidia.com \
                   minervaidentities.minerva.minerva.nvidia.com

The namespace purge also removes the Keycloak Operator Deployment, which you installed in minerva-identity. Its CRDs and cluster-scoped RBAC remain. Those, cert-manager, your registry contents, DNS records, and load-balancer configuration are yours. Remove or keep them through your own processes.

Last updated: