diff --git a/docs/configuration/component-manager-rms.md b/docs/configuration/component-manager-rms.md index c7ce9a647c..651a4d999e 100644 --- a/docs/configuration/component-manager-rms.md +++ b/docs/configuration/component-manager-rms.md @@ -1,4 +1,4 @@ -# Component Manager RMS Backends (Day 1) +# Component Manager RMS Backends (Day 1) v2.0 New Operator guide for configuring **Rack Manager Service (RMS)** backends in the `[component_manager]` section of `nico-api` site config, and the **rack profile** diff --git a/docs/configuration/dns.md b/docs/configuration/dns.md index aa0a0522c2..1319af3e0c 100644 --- a/docs/configuration/dns.md +++ b/docs/configuration/dns.md @@ -1,4 +1,4 @@ -# DNS +# DNS v2.0 New NICo answers DNS for everything it manages. Records are never authored by hand: they derive from the machine, BMC, and instance inventory in the `nico-api` database, appear when an interface or instance gains an address, and disappear when it loses one. This page covers the names NICo serves, how the site zone and per-segment subdomains are configured, and how reverse (PTR) resolution works. For the deployment side - the `nico-dns` service, the recursive resolver in front of it, and the fixed infrastructure service names - refer to [IP and Network Configuration](../provisioning/ip-and-network-configuration.md#3-dns-configuration). diff --git a/docs/configuration/machine_identity.md b/docs/configuration/machine_identity.md index 5855fae0d6..6f0507268e 100644 --- a/docs/configuration/machine_identity.md +++ b/docs/configuration/machine_identity.md @@ -1,4 +1,4 @@ -# Machine Identity (Day 1) +# Machine Identity (Day 1) v2.0 New Operator guide for per-organization **machine identity** configuration: JWT-SVID issuance for tenant workloads, optional RFC 8693 token delegation, discovery endpoints, verification, and signing-key rotation. @@ -118,12 +118,12 @@ When token delegation is configured, NICo issues a short-lived **intermediate** **Endpoint:** `PUT /v2/org/{org}/nico/site/{siteID}/tenant-identity/token-delegation` -> **Recommendation:** Token delegation causes `nico-api` to call the org-configured `tokenEndpoint` over HTTP(S). For external token exchange URLs, configure site-level egress controls in `[machine_identity]` during [Day 0](../getting-started/installation-options/day0-machine-identity.md): -> -> - `token_endpoint_http_proxy` — route outbound token-exchange HTTP through a controlled egress proxy -> - `token_endpoint_domain_allowlist` — restrict which hostnames tenants may register on `tokenEndpoint` -> -> Together these mitigate SSRF-style risk if a tenant admin supplies an endpoint the API should not reach. They are optional at install time but **strongly recommended** for production sites that delegate to external hosts. +**Recommendation:** Token delegation causes `nico-api` to call the org-configured `tokenEndpoint` over HTTP(S). For external token exchange URLs, configure site-level egress controls in `[machine_identity]` during [Day 0](../getting-started/installation-options/day0-machine-identity.md): + +- `token_endpoint_http_proxy` — route outbound token-exchange HTTP through a controlled egress proxy +- `token_endpoint_domain_allowlist` — restrict which hostnames tenants may register on `tokenEndpoint` + +Together these mitigate SSRF-style risk if a tenant admin supplies an endpoint the API should not reach. They are optional at install time but **strongly recommended** for production sites that delegate to external hosts. Example (adjust fields to match your STS): @@ -142,9 +142,11 @@ curl -sS -X PUT \ }' ``` -> **PUT is full replace:** omitting `clientSecretBasic` on an update clears stored credentials. Re-supply secrets on every update that should keep basic auth. +**PUT is full replace:** omitting `clientSecretBasic` on an update clears stored credentials. Re-supply secrets on every update that should keep basic auth. -> **Note:** `tokenEndpoint` may use `http://` with an IP address (for example a node-local sidecar). NICo allows this for in-instance STS; use allowlists and network policy in production where appropriate. + +`tokenEndpoint` may use `http://` with an IP address (for example a node-local sidecar). NICo allows this for in-instance STS; use allowlists and network policy in production where appropriate. + ```bash # Remove delegation (return to direct signing) diff --git a/docs/configuration/secrets-storage.md b/docs/configuration/secrets-storage.md index 34e489ffb1..1419af2ffd 100644 --- a/docs/configuration/secrets-storage.md +++ b/docs/configuration/secrets-storage.md @@ -1,4 +1,4 @@ -# Secrets Storage +# Secrets Storage v2.0 New NICo keeps the credentials it manages (BMC logins, switch and UFM accounts, factory defaults, and so on) in a credentials store. Vault is the historical and default backend. NICo can also store credentials in Postgres, encrypted per credential with envelope encryption, and can read both backends side by side; that combination is what makes a gradual, reversible migration off Vault possible. diff --git a/docs/hcl.md b/docs/hcl.md index f698a52b92..6749f069f5 100644 --- a/docs/hcl.md +++ b/docs/hcl.md @@ -8,59 +8,59 @@ inquiries or technical specifications, please contact the original hardware vend **Last Updated: 2/20/2026** -| Host Machine | BMC/Management Firmware Version | BIOS/UEFI Version | Misc. Firmware Version (FPGA, CPLD, LXPM, etc.) | -|-------------------------------------|-------------------------------------|---------------------|-------------------------------------------------| -| GB200 NVL - Wiwynn | 25.06-2_NV_WW_02 | 1.3.2GA | 1.3.2GA | -| NVSwitch Tray - Wiwynn | 1.3.2GA | 1.3.2GA | 1.3.2GA | -| GB200 Compute Tray (1RU) | 1.3.2GA | 1.3.2GA | 1.3.2GA | -| NVSwitch Tray DGX | 1.3.2GA | 1.3.2GA | 1.3.2GA | -| DGX H100 | 25.06.27 (DGXH100_H200_25.06.4 pkg) | 1.06.07 (DGXH100_H200_25.06.4 pkg) | | -| Lenovo ThinkSystem SR670 V2 | 6.10 | 3.30 | 3.31.01 | -| Lenovo ThinkSystem SR675 V3 | 14.10 | 8.30 | 4.20.03 | -| Lenovo ThinkSystem SR675 V3 OVX* | 14.10 | 8.30 | 4.20.03 | -| Lenovo ThinkSystem SR650 | 10.40 | 4.30 | 2.13 | -| Lenovo ThinkSystem SR650 V3 | 6.92 | 3.70 | 4.21.01 | -| Lenovo ThinkSystem SR650 V2 | 5.70 | 3.60 | 3.31.01 | -| Lenovo ThinkSystem SR650 V2 OVX* | 5.70 | 3.60 | 3.31.01 | -| Lenovo ThinkSystem SR655 V3 | 5.80 | 5.70 | 4.20.03 | -| Lenovo ThinkSystem SR655 V3 OVX* | 5.80 | 5.70 | 4.20.03 | -| Lenovo ThinkSystem SR665 V3 OVX* | 5.80 | 5.70 | 4.20.03 | -| Lenovo SR650 V4 | 1.90 | 1.30 | 5.03.00 | -| Lenovo HS350X V3 | 1.20 | 2.17.0 | | -| Dell PowerEdge XE9680 | iDRAC 7.20.60.50 | 2.7.4 | 1.6.0 | -| Dell PowerEdge R750 | iDRAC 7.20.60.50 | 1.18.1 | 1.1.1 | -| SYS-221H-TNR | 1.03.18 | 2.7 | SAA Ver = 1.3.0-p7 | -| Dell PowerEdge R760 | iDRAC 7.20.60.50 | 2.7.5 | 1.2.6 | -| ARS-121L-DNR | 01.08.02 / 01.03.16 (LCC) | 2.2a / 2.0 (LCC) | SAA Ver = 1.2.0-p6 / SUM = 2.14.0-p6 (LCC) | -| SYS-221H-TN24R | X1.05.10 | 2.7 | SAA Ver = 1.3.0-p5 | -| ARS-221GL-NR | 1.03.16 | 2.0 | | -| HPE ProLiant DL385 Gen10 Plus v2 | 3.15 | 3.80_09-05-2025 | | -| DL380 Gen12 | 1.20.00 | 1.62_02-06-2026 | | -| SSG-121E-NES24R | 01.04.19 | 2.7 | SAA Ver = 1.3.0-p1 | -| SYS-121H-TNR | X1.05.10 | 2.7 | SAA Ver = 1.3.0-p5 | -| SYS-821GE-TNHR | 1.03.18 | 2.7 | SAA Ver = 1.3.0-p7 | -| Dell R760xd2 | iDRAC 7.20.80.50 | 2.9.4 | 1.1.2 | -| Dell R670 | iDRAC 1.20.80.51 | 1.7.5 | | -| Dell R770 | iDRAC 1.20.80.51 | 1.7.5 | | -| SYS-421GE-TNRT | 1.03.19 | 2.6 | SAA Ver = 1.2.0-p8 | -| Dell PowerEdge R640 | iDRAC 7.00.00.182 | 2.24.0 | 1.0.6 | +| Host Machine | BMC/Management Firmware Version | BIOS/UEFI Version | Misc. Firmware Version (FPGA, CPLD, LXPM, etc.) | +| ------------ | ------------------------------- | ----------------- | ----------------------------------------------- | +| GB200 NVL - Wiwynn | 25.06-2_NV_WW_02 | 1.3.2GA | 1.3.2GA | +| NVSwitch Tray - Wiwynn | 1.3.2GA | 1.3.2GA | 1.3.2GA | +| GB200 Compute Tray (1RU) | 1.3.2GA | 1.3.2GA | 1.3.2GA | +| NVSwitch Tray DGX | 1.3.2GA | 1.3.2GA | 1.3.2GA | +| DGX H100 | 25.06.27 (DGXH100_H200_25.06.4 pkg) | 1.06.07 (DGXH100_H200_25.06.4 pkg) | | +| Lenovo ThinkSystem SR670 V2 | 6.10 | 3.30 | 3.31.01 | +| Lenovo ThinkSystem SR675 V3 | 14.10 | 8.30 | 4.20.03 | +| Lenovo ThinkSystem SR675 V3 OVX* | 14.10 | 8.30 | 4.20.03 | +| Lenovo ThinkSystem SR650 | 10.40 | 4.30 | 2.13 | +| Lenovo ThinkSystem SR650 V3 | 6.92 | 3.70 | 4.21.01 | +| Lenovo ThinkSystem SR650 V2 | 5.70 | 3.60 | 3.31.01 | +| Lenovo ThinkSystem SR650 V2 OVX* | 5.70 | 3.60 | 3.31.01 | +| Lenovo ThinkSystem SR655 V3 | 5.80 | 5.70 | 4.20.03 | +| Lenovo ThinkSystem SR655 V3 OVX* | 5.80 | 5.70 | 4.20.03 | +| Lenovo ThinkSystem SR665 V3 OVX* | 5.80 | 5.70 | 4.20.03 | +| Lenovo SR650 V4 | 1.90 | 1.30 | 5.03.00 | +| Lenovo HS350X V3 | 1.20 | 2.17.0 | | +| Dell PowerEdge XE9680 | iDRAC 7.20.60.50 | 2.7.4 | 1.6.0 | +| Dell PowerEdge R750 | iDRAC 7.20.60.50 | 1.18.1 | 1.1.1 | +| SYS-221H-TNR | 1.03.18 | 2.7 | SAA Ver = 1.3.0-p7 | +| Dell PowerEdge R760 | iDRAC 7.20.60.50 | 2.7.5 | 1.2.6 | +| ARS-121L-DNR | 01.08.02 / 01.03.16 (LCC) | 2.2a / 2.0 (LCC) | SAA Ver = 1.2.0-p6 / SUM = 2.14.0-p6 (LCC) | +| SYS-221H-TN24R | X1.05.10 | 2.7 | SAA Ver = 1.3.0-p5 | +| ARS-221GL-NR | 1.03.16 | 2.0 | | +| HPE ProLiant DL385 Gen10 Plus v2 | 3.15 | 3.80_09-05-2025 | | +| DL380 Gen12 | 1.20.00 | 1.62_02-06-2026 | | +| SSG-121E-NES24R | 01.04.19 | 2.7 | SAA Ver = 1.3.0-p1 | +| SYS-121H-TNR | X1.05.10 | 2.7 | SAA Ver = 1.3.0-p5 | +| SYS-821GE-TNHR | 1.03.18 | 2.7 | SAA Ver = 1.3.0-p7 | +| Dell R760xd2 | iDRAC 7.20.80.50 | 2.9.4 | 1.1.2 | +| Dell R670 | iDRAC 1.20.80.51 | 1.7.5 | | +| Dell R770 | iDRAC 1.20.80.51 | 1.7.5 | | +| SYS-421GE-TNRT | 1.03.19 | 2.6 | SAA Ver = 1.2.0-p8 | +| Dell PowerEdge R640 | iDRAC 7.00.00.182 | 2.24.0 | 1.0.6 | \* OVX may not show up as an option; check the Server Serial Number to confirm. -### Hosts -- Under Development +### Hosts -- Under Development Upcoming This list outlines platforms that are under development and have not undergone full unit testing. -| Host Machine | BMC/Management Firmware Version | BIOS/UEFI Version | Provisioning Manager Version | -|-------------------------------------|-------------------------------------|---------------------|--------------------------------------------| -| Lenovo GB300 Compute Tray | 3.0.0 | 1.0.0GA | 1.0.0GA | +| Host Machine | BMC/Management Firmware Version | BIOS/UEFI Version | Provisioning Manager Version | +| ------------ | ------------------------------- | ----------------- | ---------------------------- | +| Lenovo GB300 Compute Tray | 3.0.0 | 1.0.0GA | 1.0.0GA | ## DPUs -| DPU | Firmware / Software Version | -|--------------|---------------------------------------------------| -| BlueField 2 | DOCA 3.2.0 | -| BlueField 3 | DOCA 3.2.0 | +| DPU | Firmware / Software Version | +| --- | --------------------------- | +| BlueField 2 | DOCA 3.2.0 | +| BlueField 3 | DOCA 3.2.0 | ## GPUs @@ -71,4 +71,3 @@ Unlike host platforms, GPU compatibility is not validated on a per-platform basi | GPU Family | Support | | ---------- | ------- | | Current NVIDIA Data Center GPUs | Supported | - diff --git a/docs/manuals/vpc/flat_vpcs_zero_dpu.md b/docs/manuals/vpc/flat_vpcs_zero_dpu.md index 9f1a71c417..9597459977 100644 --- a/docs/manuals/vpc/flat_vpcs_zero_dpu.md +++ b/docs/manuals/vpc/flat_vpcs_zero_dpu.md @@ -1,4 +1,4 @@ -# Flat VPCs and Zero-DPU Hosts +# Flat VPCs and Zero-DPU Hosts v2.0 New `Flat` is a VPC virtualization type for tenant instances that run on hosts **without a NICo-managed DPU** — either hosts with no DPU hardware at all, or @@ -371,7 +371,7 @@ Rules enforced at allocation: Read instance status through the REST API or `nicocli`: -``` +```text GET /v2/org/{org}/nico/instance/{id} nicocli instance get ``` diff --git a/docs/operations/firmware-updates.md b/docs/operations/firmware-updates.md index a681047e89..105a5d052b 100644 --- a/docs/operations/firmware-updates.md +++ b/docs/operations/firmware-updates.md @@ -1,4 +1,4 @@ -# Firmware Updates +# Firmware Updates New This guide first gives a high-level view of firmware updates in NICo and helps you choose the workflow that applies to your hardware. The linked workflow diff --git a/docs/operations/monitoring-health.md b/docs/operations/monitoring-health.md index 658583d531..23039323e5 100644 --- a/docs/operations/monitoring-health.md +++ b/docs/operations/monitoring-health.md @@ -1,4 +1,4 @@ -# Monitoring and Health +# Monitoring and Health New This page covers monitoring and health workflows for NICo sites after deployment: hardware health, DPU health, aggregate host health, health diff --git a/docs/operations/nvos-password-rotation.md b/docs/operations/nvos-password-rotation.md index a94473f1d0..a96f8a0b3e 100644 --- a/docs/operations/nvos-password-rotation.md +++ b/docs/operations/nvos-password-rotation.md @@ -1,4 +1,4 @@ -# NVOS Password Rotation +# NVOS Password Rotation v2.0 New Use this workflow to rotate the NVOS admin password across managed NVLink switches, monitor site-wide convergence, and recover switches that do not reach the published target. diff --git a/docs/operations/tenant-lifecycle-cleanup.md b/docs/operations/tenant-lifecycle-cleanup.md index b4284ec40a..84f8cdca3d 100644 --- a/docs/operations/tenant-lifecycle-cleanup.md +++ b/docs/operations/tenant-lifecycle-cleanup.md @@ -1,4 +1,4 @@ -# Tenant Lifecycle Cleanup +# Tenant Lifecycle Cleanup New Use this workflow to release an instance, track NICo cleanup progress, and verify that the host is ready for reuse. diff --git a/docs/provisioning/boot-interfaces-and-dpu-modes.md b/docs/provisioning/boot-interfaces-and-dpu-modes.md index aef0e9ebdd..33d517c5d8 100644 --- a/docs/provisioning/boot-interfaces-and-dpu-modes.md +++ b/docs/provisioning/boot-interfaces-and-dpu-modes.md @@ -1,4 +1,4 @@ -# Boot Interfaces and DPU Policies +# Boot Interfaces and DPU Policies v2.0 New This guide explains how NICo decides **which interface a host boots from**, how a host's **DPUs are managed**, and how operators configure both through the Expected Machines table. It is the deep companion to [Ingesting Hosts](ingesting-hosts.md): that page covers the end-to-end ingest flow and the basic `expected_machines.json`; this page covers the per-host and per-NIC knobs (`dpu_policy`, `host_nics`), **what the defaults do when you set nothing**, and how a boot device is chosen and applied behind the scenes. diff --git a/docs/provisioning/machine-validation.md b/docs/provisioning/machine-validation.md index 3ec36e7807..faae2aaaa2 100644 --- a/docs/provisioning/machine-validation.md +++ b/docs/provisioning/machine-validation.md @@ -1,4 +1,4 @@ -# Machine Validation +# Machine Validation v2.0 Machine Validation is NVIDIA Infra Controller's in-band validation framework for checking a machine before it is made available to tenants. NICo uses Scout to run diff --git a/fern/changelog/2026-01-23.mdx b/fern/changelog/2026-01-23.mdx index e2d58681f4..97ccd3ba78 100644 --- a/fern/changelog/2026-01-23.mdx +++ b/fern/changelog/2026-01-23.mdx @@ -2,7 +2,7 @@ tags: ["EOL", "deployment", "gb200", "nvlink"] --- -## NVIDIA Infra Controller EA End of Life +## NVIDIA Infra Controller EA EOL NVIDIA Infra Controller EA introduced a self-hosted, disconnected deployment model with source and build instructions that do not depend on NGC. diff --git a/fern/changelog/2026-02-12.mdx b/fern/changelog/2026-02-12.mdx index 6e027a50dd..41989fd06c 100644 --- a/fern/changelog/2026-02-12.mdx +++ b/fern/changelog/2026-02-12.mdx @@ -1,8 +1,8 @@ --- -tags: ["EOL", "rest-api", "provisioning", "nvlink"] +tags: ["EOL", "nvlink", "provisioning", "rest-api"] --- -## NVIDIA Infra Controller v0.2 End of Life +## NVIDIA Infra Controller v0.2 EOL NVIDIA Infra Controller v0.2 made the project available as open-source software and expanded its APIs, orchestration, and hardware lifecycle support. diff --git a/fern/changelog/2026-05-15.mdx b/fern/changelog/2026-05-15.mdx index bee429f76f..6d475e516f 100644 --- a/fern/changelog/2026-05-15.mdx +++ b/fern/changelog/2026-05-15.mdx @@ -1,8 +1,8 @@ --- -tags: ["current", "deployment", "rack-level-administration", "gb200"] +tags: ["maintenance", "deployment", "gb200", "rack-level-administration"] --- -## NVIDIA Infra Controller v0.8 Current +## NVIDIA Infra Controller v0.8 Maintenance NVIDIA Infra Controller v0.8 introduced a unified documentation site, simplified deployment, and expanded rack-level administration for GB200 systems. diff --git a/fern/changelog/2026-07-31.mdx b/fern/changelog/2026-07-31.mdx index 74e6365797..8a55e50c0e 100644 --- a/fern/changelog/2026-07-31.mdx +++ b/fern/changelog/2026-07-31.mdx @@ -1,8 +1,12 @@ --- -tags: ["next", "deployment", "ntp", "security", "database"] +tags: ["current", "database", "deployment", "dpu", "machine-identity", "multi-arch", "networking", "ntp", "rest-api", "security", "telemetry", "validation", "zero-dpu"] --- -## NVIDIA Infra Controller v2.0 Next +## NVIDIA Infra Controller v2.0 Current + +NICo v2.0 expands bare-metal lifecycle management with built-in NTP, broader hardware telemetry, multi-architecture support, and stronger security and operational controls. + +Before upgrading an existing deployment, review the REST API database migration requirements below. The NICo REST API database has moved from a standalone PostgreSQL instance to the shared Zalando-managed `nico-pg-cluster`. A new `nico_rest` database and `nico-rest.nico` user are provisioned automatically (gated on `rest.enabled: true`). Database credentials are now synced by External Secrets Operator as the `nico-rest-pg-creds` secret in the `nico-rest` namespace, replacing the former `db-creds` secret. diff --git a/fern/docs.yml b/fern/docs.yml index ceaaa2bc4a..6bf942cd1d 100644 --- a/fern/docs.yml +++ b/fern/docs.yml @@ -44,5 +44,11 @@ redirects: destination: "/infra-controller/documentation/getting-started/quick-start-guide" - source: "/infra-controller/documentation/introduction" destination: "/infra-controller/documentation/overview/what-is-nico" + - source: "/infra-controller/documentation/operations-day-2/firmware-updates" + destination: "/infra-controller/documentation/operations-day-2/firmware-updates/overview" + - source: "/infra-controller/documentation/operations-day-2/observability/core-metrics" + destination: "/infra-controller/documentation/operations-day-2/observability/core-metrics-list" + - source: "/infra-controller/documentation/provisioning-day-0/boot-interfaces-and-dpu-modes" + destination: "/infra-controller/documentation/provisioning-day-0/boot-interfaces-and-dpu-policies" - source: "/infra-controller/documentation/reference/release-notes" destination: "/infra-controller/documentation/release-notes" diff --git a/fern/fern.config.json b/fern/fern.config.json index 22bc767300..162a343345 100644 --- a/fern/fern.config.json +++ b/fern/fern.config.json @@ -1,4 +1,4 @@ { "organization": "nvidia", - "version": "5.80.4" + "version": "5.89.1" }