Applies to SUSE AI Factory

2 Can I provide repository credentials during the SUSE AI Factory installation? #

To access applications and blueprints from SUSE Application Collection and SUSE Registry, you need to provide valid credentials. By default, you can configure the credentials after the SUSE AI Factory installation is complete as described in Chapter 3, Are there any post-deployment steps?.

However, you can specify the credentials during the SUSE AI Factory installation process as well. The result is identical—specifying credentials during the installation creates the secrets and configure the settings in Rancher.

Warning

Storing credentials in a plain-text values YAML file poses a security risk. Always restrict the file permissions of your override files to prevent unauthorized local access. Avoid passing passwords directly in command-line arguments to prevent them from being recorded in your shell history.

For production environments, we recommend using secure secrets-management tools, such as the helm-secrets plug-in with Mozilla SOPS, or the External Secrets Operator.

Tip

User names for specific registries are preconfigured:

SUSE Registry uses regcode.
NVIDIA catalog uses $oauthtoken.

2.1 Providing registry credentials during Helm CLI installation #

Download and display the default values for the SUSE AI Factory installation.
```
> helm show values oci://ghcr.io/suse/chart/aif-operator --version 2.1.0
```
Create the aif-values.yaml file and restrict its permissions so that only you can read and write to it:
```
> touch aif-values.yaml && chmod 600 aif-values.yaml
```

Copy the section that deals with registry credentials into the file, for example:

credentials:
  # credential for oci://dp.apps.rancher.io/charts
  applicationCollection:
    username: ""
    password: ""
  # credential to pull NGC artifacts
  # e.g. https://helm.ngc.nvidia.com/nvidia
  nvidia:
    username: "$oauthtoken"
    password: ""
  # credential for oci://registry.suse.com/ai/charts
  suseRegistry:
    username: "regcode"
    password: ""

Provide the credentials to individual registries in the related username: and password: fields.
Save the file and install SUSE AI Factory as described in Section 1.1, “How do I install SUSE AI Factory using the Helm CLI?” by specifying the override file, for example:
```
> helm install aif-operator \
  oci://ghcr.io/suse/chart/aif-operator:2.1.0 \
  --namespace aif-operator \
  --create-namespace \
  -f aif-values.yaml
```

2.2 Providing registry credentials during installation in SUSE Rancher Prime #

Important

You must have Rancher Administrator privileges to perform this task.

Start the SUSE AI Factory installation as described in Section 1.2, “How do I install SUSE AI Factory using Rancher?”.
On the installation screen, activate Customize Helm options before install.

Update the part of the installation chart that deals with registry credentials by providing credentials to individual registries.

credentials:
  # credential for oci://dp.apps.rancher.io/charts
  applicationCollection:
    username: ""
    password: ""
  # credential to pull NGC artifacts
  # e.g. https://helm.ngc.nvidia.com/nvidia
  nvidia:
    username: "$oauthtoken"
    password: ""
  # credential for oci://registry.suse.com/ai/charts
  suseRegistry:
    username: "regcode"
    password: ""

Continue the installation by clicking the Install button in the bottom right.