> ## Documentation Index > Fetch the complete documentation index at: https://docs.domino.ai/llms.txt > Use this file to discover all available pages before exploring further. # Set up Domino on EKS, AKS and GKE Domino can run on a Kubernetes cluster provided by [AWS Elastic Kubernetes Service (EKS)](https://aws.amazon.com/eks/), [Azure Kubernetes Service (AKS)](https://azure.microsoft.com/en-us/services/kubernetes-service/), and [Google Kubernetes Engine (GKE)](https://cloud.google.com/kubernetes-engine/). To find out how to set up Domino on Kubernetes clusters provided by EKS, AKS, or GKE, select the relevant tab below: When running on EKS, the Domino architecture uses AWS resources to fulfill the Domino cluster requirements as follows: A map of the Amazon Web Services architecture you’ll need to set up a Domino deployment * EKS features a fully managed Kubernetes control plane. * Domino uses a dedicated Auto Scaling Group (ASG) of EKS workers to host the Domino platform. * ASGs of EKS workers host elastic compute for Domino executions. * AWS S3 stores user data, internal Docker registry, backups, and logs. * Elastic Container Registry can be configured as an external Docker registry. * AWS EFS stores Domino Datasets. * The `ebs.csi.aws.com` provisioner creates persistent volumes for Domino executions. * [Calico](https://docs.aws.amazon.com/eks/latest/userguide/calico.html) is a network plugin that supports [Kubernetes network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/). * Domino cannot be installed on EKS Fargate, since Fargate does not support stateful workloads with persistent volumes. * Domino recommends provisioning via our [Terraform modules](https://github.com/dominodatalab/terraform-aws-eks). * Domino recommends nodes have private IPs fronted by a load balancer with proper security controls. Nodes in the cluster can egress to the Internet through a NAT gateway. Note that the use of GPU compute instances is optional. Your annual Domino license fee will not include any charges incurred from using AWS services. You can find detailed pricing information for the Amazon services listed above at [https://aws.amazon.com/pricing](https://aws.amazon.com/pricing). ## Set up an EKS cluster for Domino Domino maintains [Terraform modules](https://github.com/dominodatalab/terraform-aws-eks) that provision AWS infrastructure in your VPC in a manner consistent with how we validate Domino internally. To promote standardization, stability, and easier troubleshooting, Domino highly recommends that you deploy our Terraform, working with a Domino Solutions Architect to customize as needed. This section describes how to configure an Amazon EKS cluster for use with Domino. You should be familiar with the following AWS services: * Elastic Kubernetes Service (EKS) * Identity and Access Management (IAM) * Virtual Private Cloud (VPC) Networking * Elastic Block Store (EBS) * Elastic File System (EFS) * S3 Object Storage Additionally, a basic understanding of Kubernetes concepts like node pools, network CNI, storage classes, autoscaling, and Docker are useful when deploying the cluster. ### Security considerations You must create IAM policies in the AWS console to provision an EKS cluster. Domino recommends that you grant the least privilege when you create IAM policies. Grant elevated privileges when necessary. See information about the [grant least privilege concept](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege). ### Service quotas Amazon maintains default service quotas for each of the services listed previously. Log in to the [AWS Service Quotas console](https://console.aws.amazon.com/servicequotas/home) to check the [default service quotas](https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html) and manage your quotas. ### VPC networking If you plan to do [VPC peering](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) or set up a [site-to-site VPN connection](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html) to connect your cluster to other resources like data sources or authentication services, [configure your cluster VPC accordingly](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) to avoid address space collisions. ### Namespaces You do not have to configure namespaces prior to installation. Domino will create the following namespaces in the cluster during installation, according to the following specifications: | Namespace | Contains | | ----------------- | ----------------------------------------------------------------------------------------------------------------------- | | `domino-platform` | Persistent Domino platform services and metadata required for platform operation (control plane). | | `domino-compute` | Ephemeral Domino execution pods launched by user actions in the application (workspaces, Domino endpoints, apps, etc.). | | `domino-system` | Domino installation metadata and secrets. | ### Node pools The EKS cluster must have at least two ASGs that produce worker nodes with the following specifications and distinct node labels, and it might include an optional GPU pool: | Pool | Min-Max | Instance | Disk | Labels | | --------------- | ------- | ---------------- | ---- | ----------------------------------------------------------------- | | `platform` | 4-6 | m7i-flex.2xlarge | 128G | `dominodatalab.com/node-pool: platform` | | `compute` | 1-20 | m6i.2xlarge | 400G | `dominodatalab.com/node-pool: default` `domino/build-node: true` | | Optional: `gpu` | 0-5 | g5.2xlarge | 400G | `dominodatalab.com/node-pool: default-gpu` `nvidia.com/gpu: true` | The `platform` ASG can run in one availability zone or across three availability zones. If you want Domino to run with some components deployed as highly available [ReplicaSets](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) you must use three availability zones. Using two zones is not supported, as it results in an even number of nodes in a single failure domain. All compute node pools you use must have corresponding ASGs in any AZ used by other node pools. If you set up an isolated node pool in one zone, you might encounter volume affinity issues. To run the `default` and `default-gpu` pools across multiple availability zones, you must duplicate ASGs in each zone with the same configuration, including the same labels, to ensure pods are delivered to the zone where the required ephemeral volumes are available. To get suitable drivers onto GPU nodes, use the [EKS-optimized accelerated AMI distributed by Amazon](https://docs.aws.amazon.com/eks/latest/userguide/gpu-ami.html) as the machine image for the GPU node pool. You can add ASGs with distinct `dominodatalab.com/node-pool` labels to make other instance types available for Domino executions. See [Manage Compute Resources](/cloud/admin/infrastructure-and-compute/manage-compute-resources) to learn how these different node types are referenced by labels from the Domino application. ### Network plugin Domino relies on [Kubernetes network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to manage secure communication between pods in the cluster. The network plugin implements network policies, so your cluster must use a networking solution that supports `NetworkPolicy`, such as [Calico](https://www.tigera.io/project-calico/). See the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/calico.html) about installing Calico for your EKS cluster. If you use the [Amazon VPC CNI](https://github.com/aws/amazon-vpc-cni-k8s) for networking, with only NetworkPolicy enforcement components of Calico, ensure the subnets you use for your cluster have CIDR ranges of sufficient size, as every deployed pod in the cluster will be assigned an elastic network interface and consume a subnet address. Domino recommends at least a /23 CIDR for the cluster. ### Dynamic block storage The EKS cluster must be equipped with an EBS-backed storage class that Domino will use to provision ephemeral volumes for user execution. GP2 and GP3 volume types are supported. See the following for an example storage class specification: ```yaml theme={null} apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: dominodisk-gp3 parameters: type: gp3 provisioner: ebs.csi.aws.com reclaimPolicy: Delete volumeBindingMode: WaitForFirstConsumer ``` When using GP3, your IAM policy must allow additional permissions to operate on these ephemeral volumes. Use this [example IAM policy](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/helm-chart-aws-ebs-csi-driver-2.1.1/docs/example-iam-policy.json#L85/) as a reference. ### Datasets storage To store Datasets in Domino, you must configure an EFS (Elastic File System). You must provision the EFS file system and configure an access point to allow access from the EKS cluster. Configure the access point with the following key parameters, also shown in the following image. * Root directory path: `/domino` * User ID: `0` * Group ID: `0` * Owner user ID: `0` * Owner group ID: `0` * Root permissions: `777` EFS access point Record the file system and access point IDs for use when you install Domino. ### Blob storage When running in EKS, Domino can use Amazon S3 for durable object storage. Create the following S3 buckets: * One bucket for user data * One bucket for the internal Docker registry * One bucket for logs * One bucket for backups Configure each bucket to permit read and write access from the EKS cluster. This means that you must apply an IAM policy to the nodes in the cluster like the following: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads" ], "Resource": [ "arn:aws:s3:::$your-logs-bucket-name", "arn:aws:s3:::$your-backups-bucket-name", "arn:aws:s3:::$your-user-data-bucket-name", "arn:aws:s3:::$your-registry-bucket-name" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::$your-logs-bucket-name/*", "arn:aws:s3:::$your-backups-bucket-name/*", "arn:aws:s3:::$your-user-data-bucket-name/*", "arn:aws:s3:::$your-registry-bucket-name/*" ] } ] } ``` Record the names of these buckets for use when you install Domino. ### Autoscaler access If you intend to deploy the Kubernetes Cluster Autoscaler in your cluster, the instance profile used by your platform nodes must have the necessary [AWS Auto Scaling permissions](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html). See the following example policy: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeTags", "autoscaling:SetDesiredCapacity", "autoscaling:TerminateInstanceInAutoScalingGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeInstanceTypes" ], "Resource": "*", "Effect": "Allow" } ] } ``` ### Domain You must configure Domino to serve from a specific FQDN. To serve Domino securely over HTTPS, you also need an SSL certificate that covers the chosen name. Record the FQDN for use when you install Domino. A Domino install can’t be hosted on a subdomain of another Domino install. For example, if you have Domino deployed at `data-science.example.com`, you can’t deploy another instance of Domino at `acme.data-science.example.com`. A map of the Azure architecture to set up a Domino deployment **Runtime platform ([Azure Kubernetes Service](https://azure.microsoft.com/en-us/products/kubernetes-service)):**\ **A -** AKS cluster deployed in three [Availability Zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview). The cluster must match Domino’s compatible Kubernetes versions. **Nodes/instances ([AKS node pools](https://learn.microsoft.com/en-us/azure/aks/create-node-pools)):**\ **B -** System Pool: Scales 1-3 per zone, Standard\_DS4\_v2.\ **C -** Platform Pool: Scales 1-3 per zone, Standard\_D8S\_v4.\ **D -** Compute Pool: Scales 0-10 per zone, Standard\_D8S\_v4.\ **E -** GPU Pool: Scales 0-3 per zone, Standard\_NC6s\_v3. **Networking:**\ **F -** [Ingress load balancer](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview). **Storage:**\ **G -** Environment and model images; [Azure Container Registry](https://azure.microsoft.com/en-us/products/container-registry).\ **H -** [Storage Account](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview); Azure Files access for shared file system; [Datasets](https://azure.microsoft.com/en-us/products/storage/files); [Azure Blob](https://azure.microsoft.com/en-us/products/storage/blobs) API access for Project files, Logs, and Backups. When running on AKS, the Domino architecture uses Azure resources to fulfill the Domino cluster requirements as follows: * For a complete Terraform module for Domino-compatible AKS provisioning, see [terraform-azure-aks on GitHub](https://github.com/dominodatalab/terraform-azure-aks). * The AKS control plane, with managed Kubernetes masters, handles Kubernetes control. * The AKS cluster’s default [node pool](https://docs.microsoft.com/en-us/cli/azure/ext/aks-preview/aks/nodepool?view=azure-cli-latest) is configured to host the Domino platform. * Additional AKS node pools provide compute nodes for user workloads. * When Domino is deployed in AKS, it is compatible with the `containerd` runtime, which is the AKS default runtime for Kubernetes 1.19 and above. * When using the `containerd` runtime, the Azure Container Registry stores Domino images. * An [Azure storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) stores Domino blob data and datasets * The `kubernetes.io/azure-disk` provisioner creates persistent volumes for Domino executions. * The Advanced Azure CNI is used for cluster networking, and Calico enforces network policy. * An SSL-terminating [Application Gateway](https://docs.microsoft.com/en-us/azure/application-gateway/overview) that points to a Kubernetes load balancer handles Ingress to the Domino application. * Domino recommends provisioning with [Terraform](https://www.terraform.io/) for extended control and customizability of all resources. When you set up your Azure Terraform provider, add a `partner_id` with a value of `31912fbf-f6dd-5176-bffb-0a01e8ac71f2` to enable [usage attribution](https://docs.microsoft.com/en-us/azure/marketplace/azure-partner-customer-usage-attribution#use-terraform). When using AzureRM Provider v4 or later, you must also set `subscription_id` in the provider block or export the `ARM_SUBSCRIPTION_ID` environment variable: ```hcl theme={null} provider "azurerm" { partner_id = "31912fbf-f6dd-5176-bffb-0a01e8ac71f2" subscription_id = var.subscription_id features {} } ``` ## Set up an AKS cluster for Domino This section describes how to configure an AKS cluster for use with Domino. ### Resource groups You can provision the cluster, storage, and application gateway in an existing [resource group](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal#what-is-a-resource-group). When Azure creates the cluster, it will create a separate resource group that will contain the cluster components themselves. ### Namespaces You do not have to configure namespaces prior to install. Domino will create three namespaces in the cluster during installation, according to the following specifications: | Namespace | Contains | | --------------- | ---------------------------------------------------------------------------------------- | | `platform` | Durable Domino application, metadata, platform services required for platform operation. | | `compute` | Ephemeral Domino execution pods launched by user actions in the application. | | `domino-system` | Domino installation metadata and secrets. | ### Node pools The AKS cluster must have at least two node pools: `platform` (for platform nodes) and `default` (for compute nodes). The cluster can also include a `default-GPU` node pool. All node pools must contain worker nodes with the following specifications and distinct node labels: | Pool | Min-Max | VM | Disk | Labels | | ----------------------- | ------- | ----------------- | ---- | ----------------------------------------------------------------- | | `platform` | 4-6 | Standard\_DS5\_v2 | 128G | `dominodatalab.com/node-pool: platform` | | `default` | 1-20 | Standard\_DS4\_v2 | 128G | `dominodatalab.com/node-pool: default` `domino/build-node: true` | | Optional: `default-gpu` | 0-5 | Standard\_NC6\_v3 | 128G | `dominodatalab.com/node-pool: default-gpu` `nvidia.com/gpu: true` | The recommended architecture creates the `platform` node pool by configuring the cluster’s initial default node pool. See the following cluster Terraform resource for a complete example. ```shell theme={null} resource "azurerm_kubernetes_cluster" "aks" { name = example_cluster location = "East US" resource_group_name = "example_resource_group" dns_prefix = "example_cluster" private_cluster_enabled = false default_node_pool { node_public_ip_enabled = false name = "platform" node_count = 4 node_labels = { "dominodatalab.com/node-pool" : "platform" } vm_size = "Standard_DS5_v2" availability_zones = ["1", "2", "3"] max_pods = 250 os_disk_size_gb = 128 node_taints = [] auto_scaling_enabled = true min_count = 1 max_count = 4 } network_profile { load_balancer_sku = "Standard" network_plugin = "azure" network_policy = "calico" dns_service_ip = "100.97.0.10" service_cidr = "100.97.0.0/16" } } ``` You must add the `default` compute node pool after the cluster is created. This is *not* the initial cluster default node pool, but a separate node pool named `default`. It contains the default Domino compute nodes. See the following node pool Terraform resource for a complete example. ```shell theme={null} resource "azurerm_kubernetes_cluster_node_pool" "aks" { node_public_ip_enabled = false kubernetes_cluster_id = "example_cluster_id" name = "default" node_count = 1 vm_size = "Standard_DS4_v2" availability_zones = ["1", "2", "3"] max_pods = 250 os_disk_size_gb = 128 os_type = "Linux" node_labels = { "domino/build-node" = "true" "dominodatalab.com/build-node" = "true" "dominodatalab.com/node-pool" = "default" } node_taints = [] auto_scaling_enabled = true min_count = 1 max_count = 20 } ``` You can add node pools with distinct `dominodatalab.com/node-pool` labels to make other instance types available for Domino executions. See [Manage Compute Resources](/cloud/admin/infrastructure-and-compute/manage-compute-resources) to learn how these different node types are referenced by label from the Domino application. When you add GPU node pools, consider the Azure best practices on [using GPU nodes in AKS](https://docs.microsoft.com/en-us/azure/aks/gpu-cluster). ### Network plugin The Domino-hosting cluster must use the Advanced Azure CNI with network policy enforcement by Calico. See the following `network_profile` configuration example. ```shell theme={null} network_profile { load_balancer_sku = "Standard" network_plugin = "azure" network_policy = "calico" dns_service_ip = "100.97.0.10" service_cidr = "100.97.0.0/16" } ``` ### Dynamic block storage AKS clusters come equipped with several `kubernetes.io/azure-disk` backed storage classes by default. Domino requires use of premium disks for adequate input and output performance. You can use the `managed-premium` class that is created by default. Consult the following storage class specification as an example. ```yaml theme={null} allowVolumeExpansion: true apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: labels: kubernetes.io/cluster-service: "true" name: managed-premium selfLink: /apis/storage.k8s.io/v1/storageclasses/managed-premium parameters: cachingmode: ReadOnly kind: Managed storageaccounttype: Premium_LRS reclaimPolicy: Delete volumeBindingMode: Immediate ``` ### Persistent blob and data storage Domino uses one Azure storage account for both blob data and files. See the following configuration for the two resources required, the storage account itself and a blob container inside the account. ```shell theme={null} resource "azurerm_storage_account" "domino" { name = "example_storage_account" resource_group_name = "example_resource_group" location = "East US" account_kind = "StorageV2" account_tier = "Standard" account_replication_type = "LRS" access_tier = "Hot" } resource "azurerm_storage_container" "domino_registry" { name = "docker" storage_account_name = "example_storage_account" container_access_type = "private" } ``` Record the names of these resources for use when you install Domino. ### Domain Domino must be configured to serve from a specific FQDN. To serve Domino securely over HTTPS, you need an SSL certificate that covers the chosen name. Record the FQDN for use when installing Domino. A Domino install can’t be hosted on a subdomain of another Domino install. For example, if you have Domino deployed at `data-science.example.com`, you can’t deploy another instance of Domino at `acme.data-science.example.com`. ## Example installer configuration See the following example configuration file for the Installation Process based on the previous provisioning examples. ```yaml theme={null} schema: '1.0' name: domino-deployment version: 4.1.9 hostname: domino.example.org pod_cidr: '100.97.0.0/16' ssl_enabled: true ssl_redirect: true request_resources: true enable_network_policies: true create_restricted_pod_security_policy: true namespaces: platform: name: domino-platform annotations: {} labels: domino-platform: 'true' compute: name: domino-compute annotations: {} labels: {} system: name: domino-system annotations: {} labels: {} ingress_controller: create: true gke_cluster_uuid: '' storage_classes: block: create: false name: managed-premium type: azure-disk access_modes: - ReadWriteOnce base_path: '' default: false shared: create: true name: dominoshared type: azure-file access_modes: - ReadWriteMany efs: region: '' filesystem_id: '' nfs: server: '' mount_path: '' mount_options: [] azure_file: storage_account: '' blob_storage: projects: type: shared s3: region: '' bucket: '' sse_kms_key_id: '' azure: account_name: '' account_key: '' container: '' gcs: bucket: '' service_account_name: '' project_name: '' logs: type: shared s3: region: '' bucket: '' sse_kms_key_id: '' azure: account_name: '' account_key: '' container: '' gcs: bucket: '' service_account_name: '' project_name: '' backups: type: shared s3: region: '' bucket: '' sse_kms_key_id: '' azure: account_name: '' account_key: '' container: '' gcs: bucket: '' service_account_name: '' project_name: '' default: type: shared s3: region: '' bucket: '' sse_kms_key_id: '' azure: account_name: '' account_key: '' container: '' gcs: bucket: '' service_account_name: '' project_name: '' enabled: true autoscaler: enabled: false cloud_provider: azure groups: - name: '' min_size: 0 max_size: 0 aws: region: '' azure: resource_group: '' subscription_id: '' spotinst_controller: enabled: false token: '' account: '' external_dns: enabled: false provider: aws domain_filters: [] zone_id_filters: [] git: storage_class: managed-premium email_notifications: enabled: false server: smtp.customer.org port: 465 encryption: ssl from_address: domino@customer.org authentication: username: '' password: '' monitoring: prometheus_metrics: true newrelic: apm: false infrastructure: false license_key: '' helm: tiller_image: gcr.io/kubernetes-helm/tiller appr_registry: quay.io appr_insecure: false appr_username: '$QUAY_USERNAME' appr_password: '$QUAY_PASSWORD' private_docker_registry: server: quay.io username: '$QUAY_USERNAME' password: '$QUAY_PASSWORD' internal_docker_registry: s3_override: region: '' bucket: '' sse_kms_key_id: '' gcs_override: bucket: '' service_account_name: '' project_name: '' azure_blobs_override: account_name: 'example_storage_account' account_key: 'example_storage_account_key' container: 'docker' telemetry: intercom: enabled: false mixpanel: enabled: false gpu: enabled: false fleetcommand: enabled: false api_token: '' teleport_kube_agent: enabled: false proxyAddr: teleport-domino.example.org:443 authToken: TOKEN ``` A map of the Google Cloud architecture you’ll need to set up a Domino deployment When running on GKE, the Domino architecture uses Google Cloud Provider (GCP) resources to fulfill the Domino cluster requirements as follows: * The [GKE cluster](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture) manages Kubernetes control. * Domino uses one [node pool](https://cloud.google.com/kubernetes-engine/docs/concepts/node-pools) of three [n1-standard-8](https://cloud.google.com/compute/docs/machine-types) worker nodes to host the Domino platform. * Additional node pools host elastic compute for Domino executions with optional GPU accelerators. * [Cloud Filestore](https://cloud.google.com/filestore/docs/) stores user data, backups, logs, and Domino Datasets. * A [Cloud Storage Bucket](https://cloud.google.com/storage/docs/creating-buckets) stores the Domino Docker Registry. * The `kubernetes.io/gce-pd` provisioner creates persistent volumes for Domino executions. ## Set up a GKE cluster for Domino This section describes how to configure an GKE cluster for use with Domino. ### Namespaces You don’t have to configure namespaces prior to install. Domino creates the following namespaces in the cluster during installation, according to the following specifications: | Namespace | Contains | | --------------- | ---------------------------------------------------------------------------------------- | | `platform` | Durable Domino application, metadata, platform services required for platform operation. | | `compute` | Ephemeral Domino execution pods launched by user actions in the application. | | `domino-system` | Domino installation metadata and secrets. | ### Node pools The GKE cluster must have at least two node pools that produce worker nodes with the following specifications and distinct node labels, and it might include an optional GPU pool: | Pool | Min-Max | Instance | Disk | Labels | | ----------------------- | ------- | ------------- | ---- | ---------------------------------------------------------------- | | `platform` | 4-6 | n1-standard-8 | 128G | `dominodatalab.com/node-pool: platform` | | `default` | 1-20 | n1-standard-8 | 400G | `dominodatalab.com/node-pool: default` `domino/build-node: true` | | Optional: `default-gpu` | 0-5 | n1-standard-8 | 400G | `dominodatalab.com/node-pool: default-gpu` | If you want to configure the `default-gpu` pool, you must add a GPU accelerator the node pool. See the GKE documentation about [available accelerators](https://cloud.google.com/kubernetes-engine/docs/how-to/gpus) and deploying a DaemonSet that automatically installs the [necessary drivers](https://cloud.google.com/kubernetes-engine/docs/how-to/gpus#installing_drivers). You can add node pools with distinct `dominodatalab.com/node-pool` labels to make other instance types available for Domino executions. See [Manage Compute Resources](/cloud/admin/infrastructure-and-compute/manage-compute-resources) to learn how these different node types are referenced by labels from the Domino application. Consult the following [Terraform](https://www.terraform.io/) snippets for code representations of the required node pools. **Platform pool** ```shell theme={null} resource "google_container_node_pool" "platform" { name = "platform" location = $YOUR_CLUSTER_ZONE_OR_REGION cluster = $YOUR_CLUSTER_NAME initial_node_count = 3 autoscaling { max_node_count = 3 min_node_count = 3 } node_config { preemptible = false machine_type = "n1-standard-8" labels = { "dominodatalab.com/node-pool" = "platform" } disk_size_gb = 128 local_ssd_count = 1 } management { auto_repair = true auto_upgrade = true } timeouts { delete = "20m" } } ``` **Default compute pool** ```shell theme={null} resource "google_container_node_pool" "compute" { name = "compute" location = $YOUR_CLUSTER_ZONE_OR_REGION cluster = $YOUR_CLUSTER_NAME initial_node_count = 1 autoscaling { max_node_count = 20 min_node_count = 1 } node_config { preemptible = false machine_type = "n1-standard-8" labels = { "domino/build-node" = "true" "dominodatalab.com/build-node" = "true" "dominodatalab.com/node-pool" = "default" } disk_size_gb = 400 local_ssd_count = 1 } management { auto_repair = true auto_upgrade = true } timeouts { delete = "20m" } } ``` **Optional GPU pool** ```shell theme={null} resource "google_container_node_pool" "gpu" { provider = google-beta name = "gpu" location = $YOUR_CLUSTER_ZONE_OR_REGION cluster = $YOUR_CLUSTER_NAME initial_node_count = 0 autoscaling { max_node_count = 5 min_node_count = 0 } node_config { preemptible = false machine_type = "n1-standard-8" guest_accelerator { type = "nvidia-tesla-p100" count = 1 } labels = { "dominodatalab.com/node-pool" = "default-gpu" } disk_size_gb = 400 local_ssd_count = 1 workload_metadata_config { node_metadata = "GKE_METADATA_SERVER" } } management { auto_repair = true auto_upgrade = true } timeouts { delete = "20m" } } ``` ### Network policy enforcement Domino relies on [Kubernetes network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to manage secure communication between pods in the cluster. By default, the network plugin in GKE will not enforce these policies. To run Domino securely on GKE, you must enable enforcement of network policies. See the [GKE documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy) for instructions about how to enable network policy enforcement for your cluster. ### Dynamic block storage The Domino installer will automatically create a storage class like the following example for use provisioning GCE persistent disks as [execution volumes](/cloud/admin/infrastructure-and-compute/manage-compute-resources/manage-persistent-volumes). No manual setup is necessary for this storage class. ```yaml theme={null} apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: dominodisk parameters: replication-type: none type: pd-standard provisioner: kubernetes.io/gce-pd reclaimPolicy: Delete volumeBindingMode: WaitForFirstConsumer ``` ### Shared storage A Cloud File store instance must be provisioned with at least 10T of capacity and it must be configured to allow access from the cluster. You must provide the IP address and mount path of this instance to the Domino installer, and it will create an NFS storage class like the following. ```yaml theme={null} allowVolumeExpansion: true apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: labels: app.kubernetes.io/instance: nfs-client-provisioner app.kubernetes.io/managed-by: Tiller app.kubernetes.io/name: nfs-client-provisioner helm.sh/chart: nfs-client-provisioner-1.2.6-0.1.4 name: domino-shared parameters: archiveOnDelete: "false" provisioner: cluster.local/nfs-client-provisioner reclaimPolicy: Delete volumeBindingMode: Immediate ``` ### Docker registry storage You need one [Cloud Storage Bucket](https://cloud.google.com/storage/docs/creating-buckets) accessible from your cluster to be used to store the internal Domino Docker Registry. ### Domain You must configure Domino to serve from a specific FQDN. To serve Domino securely over HTTPS, you need an SSL certificate that covers the chosen name. Record the FQDN for use when you install Domino. A Domino install can’t be hosted on a subdomain of another Domino install. For example, if you have Domino deployed at `data-science.example.com`, you can’t deploy another instance of Domino at `acme.data-science.example.com`. After Domino is deployed into your cluster, you must set up DNS for this name to point to an [HTTPS Cloud Load Balancer](https://cloud.google.com/load-balancing/docs/choosing-load-balancer) that has an SSL certificate for the chosen name, and forwards traffic to port 80 on your platform nodes. ## Next steps * Deploy workloads across multiple Kubernetes clusters with Domino’s [Nexus Hybrid Architecture](/cloud/admin/architecture-and-deployment/architecture/nexus-hybrid-architecture). * Learn about how Domino uses Keycloak to manage [user accounts](/cloud/admin/architecture-and-deployment/architecture/user-accounts).