Skip to main content
AI Data Engine

AI Data Engine single-node deployment prerequisites

Contributors netapp-dbagwell
PDFs

For an AI Data Engine (AIDE) single-node deployment, you provide a Linux VM. The installer installs k3s, uses local hostPath storage for the AIDE config volume, and configures kernel parameters, host directories, and the Kubernetes resources. Prepare the VM by verifying access and tools, free disk space, firewall rules, and operating system packages before you run the install command.

Your VM must meet the requirements in the following sections before you run the install command. For VM sizing, supported operating systems, and network ports, see AIDE requirements.

Access and tools

  • You have root or sudo access on the target VM to run the installer.

  • The target host has bash 4.0 or later, curl, and tar available. macOS is not supported because it ships with bash 3.2.

  • If curl or tar is not installed, install them with dnf install curl tar on RHEL-based distributions or apt-get install curl tar on Ubuntu.

  • The installer automatically downloads and bootstraps k3s, helm, kubectl, and jq. You don't need to install these tools on the VM. The installer always downloads its own copy of kubectl to /opt/netapp/aide/.aide-installer-tools and doesn't add it to your PATH.

Storage type

Use block storage, not NFS, for the AIDE data volume. NFS-backed storage can cause underperformance. NVMe SSD or other solid-state storage is preferred for all deployment sizes. The storage must also meet the IOPS and throughput for your size in AIDE requirements.

Disk space

Free space is required on each file system that hosts the paths in the following table. Paths that share a disk share one free-space pool, so add their minimums together.

If a single disk hosts everything, the minimum free space is 65 GB plus the AIDE data volume size for your configuration. The 65 GB fixed floors exclude /var/run, which is typically tmpfs and doesn't add to this total:

Size Minimum free space on a single disk

Small

565 GB

Medium

2,065 GB

Large

6,065 GB

If the paths are on separate mounts, each mount must meet the minimum for the paths that it hosts. If you move the k3s data directory by using the --k3s-data-dir installer option, the k3s minimum applies to the new location.

Path Minimum Recommended Purpose

/var/lib/rancher/k3s

20 GB

20 GB

Container images, containerd snapshots, and the embedded database

/var/lib/kubelet

10 GB

15 GB

Kubelet state, pod ephemeral storage, and emptyDir volumes

/var/log

10 GB

10 GB

Container output and k3s system logs

/

25 GB

50 GB

Operating system packages, k3s binaries, and installer tools

/var/run

1 GB

2 GB

Sockets and process IDs (usually tmpfs, which doesn't add to a single-disk total)

/var/lib/netapp/aide

Small: 500 GB; Medium: 2,000 GB; Large: 6,000 GB

Same as minimum

AIDE data volume

Don't use a mount that is below its minimum. Mounts that are below the recommended size, or more than 85% full, aren't recommended because the kubelet can evict pods when free space is low.

For example, if k3s data, logs, and AIDE data each have a dedicated disk, provide at least 20 GB, 10 GB, and the AIDE data minimum for your configuration on those mounts, respectively. Also provide at least 25 GB free on / for the operating system and binaries, and at least 10 GB on the kubelet filesystem if it is not /.

Firewall

  • The installer downloads k3s from https://get.k3s.io and Helm from https://get.helm.sh. For all required outbound endpoints, see the outbound internet access section in AIDE requirements.

  • The host has a 1 GbE minimum network connection (10 GbE recommended for Large deployments).

  • If your environment requires an outbound proxy to reach the AI Data Engine endpoints, see Learn about proxies for AI Data Engine. To deploy with a proxy, follow Deploy AI Data Engine as a single-node deployment with a proxy.

  • The installer host must have outbound access to the NetApp container registry at 582244788873.dkr.ecr.us-west-2.amazonaws.com to pull AIDE container images and Helm charts. If you restrict where images can be pulled from, allow this registry as well. See AIDE requirements for the required registry endpoints.

The k3s ports in the following table must be free on the host before the installer starts. If a host firewall is enabled, you must also allow these ports and the pod and service CIDRs before you run the installer. Otherwise, pod networking doesn't work. These ports are internal to k3s and are separate from the ports in AIDE requirements.

Port Protocol Used by

6443

TCP

k3s / Kubernetes API server and control-plane endpoint for kubectl, the operator, and cluster components

10250

TCP

Kubelet API used for pod logs, exec/attach, and metrics-server

8472

UDP

Flannel VXLAN for pod-to-pod networking

The default pod CIDR is 10.44.0.0/16 and the default service CIDR is 10.45.0.0/16. The firewall rules permit these CIDRs so that in-cluster traffic, including CoreDNS and other Services, is not dropped. If you override the defaults with the --k3s-cluster-cidr and --k3s-service-cidr installer options, use your values in the following commands.

RHEL, Rocky Linux, AlmaLinux, and CentOS (firewalld)
sudo firewall-cmd --permanent --add-port=6443/tcp
sudo firewall-cmd --permanent --add-port=10250/tcp
sudo firewall-cmd --permanent --add-port=8472/udp
sudo firewall-cmd --permanent --zone=trusted --add-source=10.44.0.0/16
sudo firewall-cmd --permanent --zone=trusted --add-source=10.45.0.0/16
sudo firewall-cmd --reload
Ubuntu (ufw)
sudo ufw allow 6443/tcp
sudo ufw allow 10250/tcp
sudo ufw allow 8472/udp
sudo ufw allow from 10.44.0.0/16
sudo ufw allow from 10.45.0.0/16
sudo ufw reload

Unlike firewalld, ufw has no trusted zone. Use ufw allow from <cidr> to permit pod and service CIDRs; there is no --zone argument.

For the application ports that must be open, see AIDE requirements.

Operating system packages

The installer installs the packages in the following table. Ensure that your package managers have the appropriate proxy configuration if required in your environment.

Package When it is needed Where it comes from Your responsibility

cifs-utils

Every connected installation, unless cifs.upcall is already installed. Required for Kerberos-based CIFS/SMB scanning.

The VM's own repositories.

Make the package available from those repositories.

container-selinux, policycoreutils, libselinux-utils, selinux-policy-targeted

RHEL, Rocky Linux, or AlmaLinux 8 or 9 when SELinux files are present on the host, even if SELinux is disabled. These distributions include SELinux by default. The packages are not used on Ubuntu.

The VM's own repositories.

Make the packages available from those repositories.

k3s-selinux

The same RHEL-family hosts as the previous row.

rpm.rancher.io, through the AI Data Engine proxy when you use a proxy. If your repositories already provide it, the installer uses that copy.

Allow rpm.rancher.io on the proxy. You don't have to supply this package yourself.
Note NetApp hasn't validated AI Data Engine on hosts with SELinux. The installer downloads the SELinux packages in this table whenever SELinux files are present on the host, even if SELinux is disabled.