Galileo On-Prem Luna Studio Setup
Prerequisites
- Obtain the CSE-approved
luna-studio package, pinned images, questionnaire
values, and parent Galileo stack release contract.
- Provision an empty dedicated PostgreSQL database and dedicated object-storage
bucket/container. Luna Studio does not bootstrap its database.
- Create the four required Kubernetes Secrets out of band before preflight.
- Select
kubernetes or vertex_ai training and document any remote cluster.
Workflow Overview
+-- Intake + topology --+ -> +-- Immutable bundle --+ -> +-- Secret/storage/GPU + render preflight --+
-> +-- Joint-session handoff --+
When to Activate
- Prepare or review a Galileo/CSE handoff for a standalone Luna Studio install
or upgrade.
- Configure GCS, S3, Azure Blob, or MinIO-compatible storage authentication.
- Configure in-cluster GPU Jobs, Vertex AI, or a remote training cluster.
- Produce an overlay when the exact umbrella package proves it owns Luna.
- Diagnose database migration, NextAuth/CORS, route, GPU, or storage failures.
Required Intake
Ask for the Galileo instance console URL and record the exact value, for example
https://console.demo-v2.galileocloud.io/. Pass it with
--galileo-console-url; do not infer a SaaS hostname for on-prem.
Collect the namespace and release, unique ownership mode, exact chart or
umbrella evidence hashes, parent release contract, approved non-secret values,
the four Secret name/key contracts, asyncpg database readiness, storage
provider/auth/bucket, public hostname, DNS/TLS/CORS/NextAuth alignment, backend
and UI images, training platform/images, GPU scheduling, remote-cluster token
reference, NetworkPolicy/HPA/PDB choices, and approvals. Never record values.
Ownership and Safety Rules
- Default to the standalone
luna-studio release. Use umbrella-overlay only
when the exact pinned umbrella proves ownership; reject dual ownership.
- Require the four mandatory Secret references: JWT, admin, asyncpg database,
and NextAuth. Galileo API integration and cloud/remote credentials are
optional only when their features are disabled.
- Bind
frontend_url, CORS origins, UI public URL, DNS, route host, and TLS SAN
to the same HTTPS origin.
- Treat startup
alembic upgrade head as a database migration. Upgrades and
rollback require backup, release-note, and compatibility evidence.
- Keep backend/UI on standard nodes. Request
nvidia.com/gpu only for
Kubernetes training Jobs, with matching node selector and tolerations.
- Do not claim live GPU validation from a CPU-only environment.
- Never run a generic
helm upgrade --install, automatic rollback, or data
purge. Preserve failed state for diagnosis.
Read reference.md, training-and-storage.md,
lifecycle-contract.md, and
source-ledger.md for production review.
Commands
bash skills/galileo-on-prem-luna-studio-setup/scripts/setup.sh --help
bash skills/galileo-on-prem-luna-studio-setup/scripts/setup.sh \
--render --spec ./luna-studio.local.yaml \
--galileo-console-url "https://console.demo-v2.galileocloud.io/" \
--output-dir ./galileo-on-prem-rendered/luna-studio
bash skills/galileo-on-prem-luna-studio-setup/scripts/validate.sh \
--output-dir ./galileo-on-prem-rendered/luna-studio
Use the distinct --preflight, --status, --plan-rollback, and
--plan-uninstall modes with the evidence gates printed by --help. Every non-uninstall
preflight requires new private --image-evidence-file and
--endpoint-evidence-file outputs. They bind backend, UI, training, init, hook,
Job, and test image digests plus exact chart, inputs, parent target, Helm render,
and a credential-free host[:port] inventory derived in memory from non-secret
and Secret-backed settings. All historical --apply-* modes are permanent
fail-closed sentinels and touch neither the bundle nor Kubernetes. Use the
immutable lifecycle.json packet and fresh preflight/image/endpoint evidence in
a Galileo/CSE joint session. Umbrella mode always stops at a parent-stack overlay
handoff.
Completion Gate
Completion requires unique ownership, four exact Secret/key contracts, an
asyncpg connection and successful migrations, storage write/read/delete
evidence, healthy backend /health and UI /api/health, working login,
route/DNS/TLS/CORS alignment, training image resolution, and either a successful
training run or an explicit unvalidated capability record. GPU and remote
training remain open until tested on their real targets.
Troubleshooting
| Symptom |
Likely cause |
Resolution |
| Chart render fails |
One of four Secret names is absent |
Create it out of band and reference its exact name |
| Database startup fails |
Wrong driver or migration grants |
Use postgresql+asyncpg:// and grant schema DDL |
| Sign-in loops |
NextAuth/public URL mismatch |
Align route, DNS, SAN, frontend, CORS, and UI URL |
| Training Job is pending |
GPU selector, taint, resource, or plugin mismatch |
Verify all scheduling evidence on the training target |
| Vertex pipeline is missing |
Image, location, IAM, or outbound path is wrong |
Validate pinned images, pipeline root, IAM, and egress |
| Direct mutation rejected |
Exact package selected umbrella ownership |
Submit the overlay through the parent stack lifecycle |
1---2name: galileo-on-prem-luna-studio-setup3description: Render, preflight, validate, observe, and prepare Galileo/CSE joint-session install, upgrade, rollback, and retirement handoffs for Galileo Luna Studio on Kubernetes with dedicated PostgreSQL, object storage, backend and UI, routing, four out-of-band Secrets, GPU Jobs, Vertex AI, and remote or hybrid training. Use when operating Luna Studio for Galileo On-Prem or when an exact umbrella package requires a reviewed Luna overlay instead of its standalone release.4---56# Galileo On-Prem Luna Studio Setup78## Prerequisites910- Obtain the CSE-approved `luna-studio` package, pinned images, questionnaire11 values, and parent Galileo stack release contract.12- Provision an empty dedicated PostgreSQL database and dedicated object-storage13 bucket/container. Luna Studio does not bootstrap its database.14- Create the four required Kubernetes Secrets out of band before preflight.15- Select `kubernetes` or `vertex_ai` training and document any remote cluster.1617## Workflow Overview1819```text20+-- Intake + topology --+ -> +-- Immutable bundle --+ -> +-- Secret/storage/GPU + render preflight --+21 -> +-- Joint-session handoff --+22```2324## When to Activate2526- Prepare or review a Galileo/CSE handoff for a standalone Luna Studio install27 or upgrade.28- Configure GCS, S3, Azure Blob, or MinIO-compatible storage authentication.29- Configure in-cluster GPU Jobs, Vertex AI, or a remote training cluster.30- Produce an overlay when the exact umbrella package proves it owns Luna.31- Diagnose database migration, NextAuth/CORS, route, GPU, or storage failures.3233## Required Intake3435Ask for the Galileo instance console URL and record the exact value, for example36`https://console.demo-v2.galileocloud.io/`. Pass it with37`--galileo-console-url`; do not infer a SaaS hostname for on-prem.3839Collect the namespace and release, unique ownership mode, exact chart or40umbrella evidence hashes, parent release contract, approved non-secret values,41the four Secret name/key contracts, asyncpg database readiness, storage42provider/auth/bucket, public hostname, DNS/TLS/CORS/NextAuth alignment, backend43and UI images, training platform/images, GPU scheduling, remote-cluster token44reference, NetworkPolicy/HPA/PDB choices, and approvals. Never record values.4546## Ownership and Safety Rules47481. Default to the standalone `luna-studio` release. Use `umbrella-overlay` only49 when the exact pinned umbrella proves ownership; reject dual ownership.502. Require the four mandatory Secret references: JWT, admin, asyncpg database,51 and NextAuth. Galileo API integration and cloud/remote credentials are52 optional only when their features are disabled.533. Bind `frontend_url`, CORS origins, UI public URL, DNS, route host, and TLS SAN54 to the same HTTPS origin.554. Treat startup `alembic upgrade head` as a database migration. Upgrades and56 rollback require backup, release-note, and compatibility evidence.575. Keep backend/UI on standard nodes. Request `nvidia.com/gpu` only for58 Kubernetes training Jobs, with matching node selector and tolerations.596. Do not claim live GPU validation from a CPU-only environment.607. Never run a generic `helm upgrade --install`, automatic rollback, or data61 purge. Preserve failed state for diagnosis.6263Read [reference.md](reference.md), [training-and-storage.md](references/training-and-storage.md),64[lifecycle-contract.md](references/lifecycle-contract.md), and65[source-ledger.md](references/source-ledger.md) for production review.6667## Commands6869```bash70bash skills/galileo-on-prem-luna-studio-setup/scripts/setup.sh --help71```7273```bash74bash skills/galileo-on-prem-luna-studio-setup/scripts/setup.sh \75 --render --spec ./luna-studio.local.yaml \76 --galileo-console-url "https://console.demo-v2.galileocloud.io/" \77 --output-dir ./galileo-on-prem-rendered/luna-studio78```7980```bash81bash skills/galileo-on-prem-luna-studio-setup/scripts/validate.sh \82 --output-dir ./galileo-on-prem-rendered/luna-studio83```8485Use the distinct `--preflight`, `--status`, `--plan-rollback`, and86`--plan-uninstall` modes with the evidence gates printed by `--help`. Every non-uninstall87preflight requires new private `--image-evidence-file` and88`--endpoint-evidence-file` outputs. They bind backend, UI, training, init, hook,89Job, and test image digests plus exact chart, inputs, parent target, Helm render,90and a credential-free host[:port] inventory derived in memory from non-secret91and Secret-backed settings. All historical `--apply-*` modes are permanent92fail-closed sentinels and touch neither the bundle nor Kubernetes. Use the93immutable `lifecycle.json` packet and fresh preflight/image/endpoint evidence in94a Galileo/CSE joint session. Umbrella mode always stops at a parent-stack overlay95handoff.9697## Completion Gate9899Completion requires unique ownership, four exact Secret/key contracts, an100asyncpg connection and successful migrations, storage write/read/delete101evidence, healthy backend `/health` and UI `/api/health`, working login,102route/DNS/TLS/CORS alignment, training image resolution, and either a successful103training run or an explicit unvalidated capability record. GPU and remote104training remain open until tested on their real targets.105106## Troubleshooting107108| Symptom | Likely cause | Resolution |109|---|---|---|110| Chart render fails | One of four Secret names is absent | Create it out of band and reference its exact name |111| Database startup fails | Wrong driver or migration grants | Use `postgresql+asyncpg://` and grant schema DDL |112| Sign-in loops | NextAuth/public URL mismatch | Align route, DNS, SAN, frontend, CORS, and UI URL |113| Training Job is pending | GPU selector, taint, resource, or plugin mismatch | Verify all scheduling evidence on the training target |114| Vertex pipeline is missing | Image, location, IAM, or outbound path is wrong | Validate pinned images, pipeline root, IAM, and egress |115| Direct mutation rejected | Exact package selected umbrella ownership | Submit the overlay through the parent stack lifecycle |
chambear2809