Setup guides on TauGrid

Enable a workspace

Mon, 01 Jan 0001 00:00:00 +0000

Before researchers can submit workloads, the platform team prepares the cluster and creates a TauWorkspace. TauGrid then keeps the workspace namespace, queue access, and Kubernetes permissions in the expected state.

Prepare the workspace

Prepare the Kubernetes cluster. Set up the network, node pools, identity, container registry, storage, GPU support, and CSI drivers required by your workloads.
Install TauGrid, then verify the installation:
```
tau cluster validate installation --context <context>
```
A successful validation exits with code 0.

Hand off a workspace

Mon, 01 Jan 0001 00:00:00 +0000

Complete this checklist after the TauWorkspace readiness gate reports Ready. A handoff is reproducible only when every step below succeeds from a clean checkout, not from a platform owner’s already-primed shell.

The non-secret connection descriptor

The only artifact a researcher needs is tau/workspace.connection.yaml, a non-secret workspace connection descriptor:

Field	Contains
`schema`	Fixed value `tau.workspace.connection.v1`.
`workspace`	The TauWorkspace name.
`cluster.contextName`	The Kubernetes context name Tau selects.
`cluster.systemNamespace`	The TauGrid system namespace; defaults to `tau-system`.
`access.method`	`kubeconfig` for an existing context or `aks` for automatic AKS credential acquisition.
`access.aks.resourceID`	Required only for `access.method: aks`; the AKS cluster’s ARM resource ID.
`access.aks.tenantID`	Required only for `access.method: aks`; the Microsoft Entra tenant ID.
`authorization.mode`	`cluster-wide` or `workspace-rbac`.
`authorization.requiredRole`	Required only in `workspace-rbac` mode; forbidden in `cluster-wide` mode.
`requirements.minTauVersion`	The minimum compatible `tau` CLI version.
`network.privateCluster`	Whether the Kubernetes API server requires private network access.
`network.instructions`	Required only when `privateCluster: true` (for example, VPN steps).

It must never contain a credential, kubeconfig, client secret, or cloud access token. With access.method: kubeconfig, tau loads the normal kubeconfig rules (including KUBECONFIG) and copies only the named context, cluster, and user into an isolated mode-0600 kubeconfig outside the repository. With access.method: aks, it obtains normal AKS cluster-user credentials through the caller’s Azure identity and isolates those instead.

Prepare ADX/Kusto for TauGrid

Mon, 01 Jan 0001 00:00:00 +0000

ADX/Kusto is an optional platform data service. Platform teams provision its cluster, databases, Entra identities, federation, and database roles. Prepare those platform resources once; Portal, lifecycle recorder, and adx-mon are separate consumers. Their released charts manage the TauGrid/adx-mon schema objects that they own.

Provision the service

Choose an approved region, SKU, capacity, network path, retention policy, and cost owner. This CLI shape illustrates the required flags; choose SKU, capacity, and other values to match your own environment:

Enable lifecycle recorder

Mon, 01 Jan 0001 00:00:00 +0000

The lifecycle recorder is an optional, standalone ADX/Kusto producer; Portal is one optional consumer of its output. It runs one metadata-only tau run history record Deployment and records observations of Jobs, RayJobs, and Kueue Workloads in one workload namespace. Portal can optionally read the resulting rows as durable Ray history, but the recorder is useful independently of Portal.

Prepare the namespace, adx-mon, and identity

Before enabling the recorder:

Configure Portal

Mon, 01 Jan 0001 00:00:00 +0000

Portal is the unified, read-only browser entry point. tau cluster install enables its operator-facing Kubernetes path by default in the system release namespace (tau-system unless --namespace selects another namespace); it ships as part of the one TauGrid umbrella release rather than a separate taugrid-core Helm release.

Understand the default boundary

The default distribution creates deployment/tau-portal, service/tau-portal, a dedicated ServiceAccount, and cluster-wide read-only Kubernetes RBAC. Portal remains ClusterIP-only and relies on network-level access control rather than application-level login, so kubectl port-forward is an operator diagnostic rather than a researcher endpoint.