GitOps workflow
How the platform CLI renders desired state and Argo CD reconciles four parent applications.
BullSequana AI renders desired state locally, commits it to a manifests repository, and lets Argo CD reconcile the cluster. The sealed-secrets key, or the Vault token and registry pull secret with an external Vault, and Argo CD itself are bootstrap resources applied outside that GitOps path. GPU sites can also install the optional NVIDIA GPU Operator directly with the Platform CLI.
Render and reconcile flow
The CLI validates component structure, resolves overrides and secrets, renders templates with strict undefined-variable handling, generates child Application manifests, and creates an app-of-apps manifest for each non-empty parent.
Parent applications
| Parent | Default wave | Responsibility |
|---|---|---|
common | 1 | Foundation services: networking, identity, storage, databases, and observability |
coreai | 2 | Portal, BSQAI API, LiteLLM, MLflow, Milvus, Temporal, and MCP management |
inference | 2 | KServe, KAI Scheduler, Envoy AI Gateway, CRDs, gateways, and runtime profiles |
proai | 2 | Data and ML services: Kubeflow, Spark, Lakekeeper, Kafka, managed ingestion (meltano), Superset, and workflows |
Component sync waves establish ordering inside those parents. CRDs and controllers deliberately use different waves where the controller cannot start before its API exists.
Generated layout
src/manifests/output/
├── common.yaml
├── coreai.yaml
├── inference.yaml
├── proai.yaml
├── common/
├── coreai/
├── inference/
└── proai/Each component has one <component>-argoapp.yaml and a directory containing rendered Helm values and optional extra resources. Disabled components are absent.
Initial deployment
bsqai validate
bsqai apply all -r
bsqai push-manifests "Deploy BullSequana AI"
bsqai apply-sealing-key
bsqai helm-apply argocd
# Optional on a GPU cluster that needs the platform NVIDIA integration
bsqai helm-apply gpu-operatorWith an external Vault, replace bsqai apply-sealing-key with the bootstrap steps in External Vault secrets.
-r removes the previous generated output before a complete render. It does not delete source configuration.
The GPU Operator values supplied with the platform install node feature discovery, the NVIDIA device plugin, GPU feature discovery, DCGM metrics, and MIG support. They expect the NVIDIA driver and container runtime to exist on the nodes already. Skip this command for a CPU-only deployment or when the cluster owner provides an equivalent supported integration.
Existing deployments
Do not replace the sealed-secrets key during an upgrade. The versioned upgrade workflow preserves the existing sealing certificate, key, and classified live credentials. It renders every Git source against one create-once ref, upgrades the existing Argo CD Helm release, and checkpoints the ordered cutover in argocd/bsqai-platform-upgrade. It does not run apply-sealing-key or bootstrap a replacement Argo CD installation as if the cluster were new.
See Upgrade and release process before changing an existing cluster.
Argo CD behavior
Child applications use automated pruning and self-healing, retry failed reconciliations, and apply component-specific drift rules where controllers mutate their own resources. Because pruning is enabled, review component removals and disabled flags before pushing generated output.