Connect your Kubernetes cluster and see the selected GPU nodes in your supplier account.
Add your capacity
Open Supply capacity, choose the GPU count, country, availability and pricing preference. Select Save capacity & connect cluster. You do not need cluster IDs or node names at this stage.
Install the agent
On the connection page, select Generate installation code. The code is scoped to this connection and remains valid for 90 days. Replacing the code revokes the previous one. Store it in the Kubernetes Secret created by the installation instructions, not in Git or shared documentation.
The public agent repository contains the chart, source and releases. The Helm repository is https://requenta.github.io/agent; the installation command generated by your account pins chart version 0.4.0, whose image is pinned by digest. No GitHub account or repository access is needed to install it. A remote cluster must reach the console over HTTPS; a localhost address on your laptop is not reachable from a supplier cluster.
The default GPU selector is nvidia.com/gpu.present=true. The NVIDIA GPU Operator normally supplies this label. Choose an explicit selector for the nodes you intend to offer. The agent does not label nodes or assume that every detected GPU is idle.
Check the connection
The agent reports every minute. The connection page shows its last report, node names, GPU counts and readiness. After 150 seconds without a report, the connection is shown offline. The first report binds the installation to the Kubernetes cluster identity; reusing the credential on a different cluster is rejected.
Detection is separate from qualification. Supplier authority, hardware compatibility, isolation, access expiry and cleanup are reviewed before the offer becomes bookable. Inventory mode does not provision customer workloads. Qualified capacity can activate the separate workspace controller in the same Helm release.
Permissions and network access
The agent lists selected Kubernetes nodes, reads the identity of the kube-system namespace and updates only its own status ConfigMap. It mounts a namespace service-account credential for Kubernetes and a separate connection Secret for Requenta. The Kubernetes credential is never sent to Requenta.
The container runs without root privileges or a writable root filesystem. The chart permits the Kubernetes API, cluster DNS and outbound HTTPS when the connection is enabled. HTTPS egress is not restricted to one destination IP; apply a provider egress gateway or tighter policy if your network requires destination controls. Other outbound traffic is denied when your cluster network plugin enforces Kubernetes NetworkPolicies. The Kubernetes node-list permission is cluster-wide; the selector controls which nodes the agent requests and reports, not its RBAC authority.
Disconnect or troubleshoot
Use Revoke connection in the console to stop accepting reports, then uninstall the Helm release and delete its connection Secret. Revoking inventory access does not cancel accepted compute bookings.
For an offline connection, check the agent Pod, DNS and HTTPS connectivity, the explicit node selector and credential expiry. An empty inventory means no matching nodes were found; it is not a successful GPU qualification. Never send kubeconfigs or secrets to support in plain text.
Activate workspace execution
After qualification, Requenta provides an execution credential and configuration for your approved nodes. Save the configuration as execution.json. It contains the cluster and node selection; confirm the pinned workspace image, capacity limit, maximum lifetime, Kubernetes API endpoint CIDRs/port and Requenta HTTPS destination CIDRs before applying it. The supplied controller supports Kubernetes 1.34–1.36.
Store the execution credential in a separate Secret named requenta-execution, with key token, in requenta-system. Keep it separate from the inventory connection credential. Upgrade the existing release name shown on your connection page:
helm repo update
helm upgrade YOUR_EXISTING_RELEASE requenta/requenta-agent --version 0.4.0 \
--namespace requenta-system --reset-then-reuse-values -f execution.json
The workspace controller gets a separate service account and a dedicated workload namespace with quotas and network isolation. Customer workloads receive neither Kubernetes nor Requenta credentials. The controller connects outbound; no inbound public port or supplier kubeconfig upload is required. Readiness means recent successful reconciliation, not proof that GPUs are idle or qualified. The supplier network plugin must enforce NetworkPolicies; validate isolation on your own cluster before accepting workloads.
Workspace execution supports authenticated Python and shell commands from the reservation page. Optional SSH and VS Code access require an approved SSH-capable workspace image and execution.sshEnabled: true. Persistent buckets and joining the customer's Kubernetes node pool are separate capabilities.
Before disabling execution or uninstalling, stop accepted reservations and verify workload deletion. The chart deliberately retains the workload namespace, quota and isolation policy. The local expiry loop can clean up during a Requenta outage; Pod lifetime limits also stop execution if the controller is unavailable. If the controller remains offline, inspect and remove residual resources before reusing that capacity. Revoking an inventory connection alone does not stop workspace execution.
Enable SSH and IDE access
The public agent repository includes workspace/Dockerfile and workspace/sshd_config. Extend your approved Debian/Ubuntu GPU image using a digest-pinned BASE_IMAGE, retain its GPU runtime and publish the resulting image in your registry. Validate CUDA, OpenSSH, file transfer, isolation and cleanup before enabling customer access.
Set execution.workspaceImage to the new image digest and execution.sshEnabled: true in your qualified execution values. Upgrade the agent using those complete values. The execution agent reaches the same console HTTPS origin using WebSockets; no additional inbound port, Kubernetes Service or RBAC permission is required. Your egress firewall must permit the console connection and WebSocket upgrades.
SSH runs as UID 1000 inside the allocated container. Do not grant root access or broaden workload ingress. The console exposes connection setup only after a recent SSH capability report and confirmed session handover. Disabling SSH leaves the browser command workflow available. Files remain reservation-scoped.
Verify resource limits
Before enabling bookings, record the resource review for the offer. Confirm the included CPU, RAM and disk capacity, test disk eviction and effective network-policy enforcement on your CNI, and include your image-pull and infrastructure traffic costs in your GPU price. Test the selected transfer budget through the access path customers will use. Requenta's relay controls SSH transport only; it is not a meter for the supplier's entire network bill. The supplier agreement must cover the remaining infrastructure traffic.