BYOK API proxy terminating konn-agent mTLS and forwarding to kube-apiserver License: Apache License 2.0
Overview
lepton-cluster-api-proxy is a sidecar that terminates mutual TLS from the
Konnectivity agent and forwards requests to the customer cluster's Kubernetes
API server.
It is one of three images that make up the DGX Cloud Lepton BYOK ("Bring Your
Own Kubernetes") cluster agent, alongside lepton-cluster-bootstrap and
lepton-konnectivity-agent.
How it fits
BYOK lets you attach a Kubernetes cluster you already own to DGX Cloud Lepton, so Lepton can schedule and manage GPU workloads on it. Lepton never requires inbound network access to your cluster's API server: the cluster agent dials out and maintains the connection from your side.
| Image | Role |
|---|---|
lepton-cluster-bootstrap | One-shot Job. Registers the cluster and installs enrollment artifacts. |
lepton-cluster-api-proxy | Sidecar. Terminates agent mTLS and forwards to the Kubernetes API server. |
lepton-konnectivity-agent | Outbound tunnel endpoint for Kubernetes API traffic. |
Usage
This image is not run directly. It is deployed by the DGX Cloud Lepton cluster agent Helm chart, which is provided when you enroll a cluster. All credentials, certificates, and tokens are supplied at runtime; none are baked into the image.
License
Apache License 2.0.
The full license text and third-party notices for every open-source component
in this image are included in the image itself at /usr/share/third_party/,
along with the corresponding source.