AutoGineer
Generated banner for Physical AI Infrastructure Setup And Resilient Scaling
Generated logo for Physical AI Infrastructure Setup And Resilient Scaling

Physical AI Infrastructure Setup And Resilient Scaling

NVIDIAOfficialCreated by NVIDIA Physical AI

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • Medium risk
  • Has scripts
Download ZIP

From the author

Use when the user wants to set up, scale, validate, or harden NVIDIA physical AI infrastructure for synthetic data generation workflows across local MicroK8s or Azure AKS, including Kubernetes clusters, inference endpoint deployment, OSMO deployment, workload submission readiness, and infrastructure failure recovery. Trigger keywords: physical ai infrastructure, resilient scaling, SDG infrastructure, microk8s, azure aks, NVCF deployment, NIM Operator, OSMO deploy, workflow scaling. Don't trigger for: OSMO log summarization or workload-only operations unless infrastructure setup, scaling, validation, or recovery is requested.
— the description by NVIDIA Physical AI

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a comprehensive framework for deploying, scaling, and validating the infrastructure required for NVIDIA Physical AI synthetic data generation (SDG) workflows. It manages the lifecycle of Kubernetes clusters (MicroK8s or Azure AKS), OSMO orchestration, and inference backends (NIM Operator, NVCF, or Azure AI Foundry). The skill enforces strict preflight checks, reproducible configuration management, and systematic recovery procedures to ensure reliable workload execution.

What it does

  • Provisions and configures Kubernetes clusters on MicroK8s or Azure AKS.
  • Deploys and manages OSMO orchestration layers for workload submission.
  • Sets up inference endpoints using NIM Operator, NVCF, or Azure AI Foundry.
  • Executes mandatory preflight checks to validate infrastructure readiness.
  • Provides structured recovery paths for failed workflow states or infrastructure issues.
  • Ensures secure credential handling and environment-aware configuration.

When to use it

  • When setting up a new Physical AI SDG environment from scratch.
  • When scaling existing infrastructure to meet new workload demands.
  • When validating the health and readiness of cluster, inference, or OSMO components.
  • When troubleshooting and recovering from infrastructure or workflow deployment failures.

Advantages

  • Standardizes infrastructure deployment across different cloud and local environments.
  • Reduces configuration drift by using checked-in scripts and reproducible patterns.
  • Improves reliability through mandatory preflight and verification gates.
  • Provides a unified interface for complex multi-component stacks.

Usage examples

“Set up resilient Physical AI infrastructure for VDA on Azure AKS with NIM Operator.”
The agent will initiate the setup flow for Azure AKS, configure the necessary OSMO and NIM Operator components, run preflight checks, and prepare the environment for VDA workload submission.
“My MicroK8s cluster for SDG is failing to schedule jobs; help me validate and recover.”
The agent will guide you through the verification gates for the MicroK8s cluster, inspect OSMO pod status, check storage credentials, and identify the root cause of the scheduling failure.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/nvidia/physical-ai-infrastructure-setup-and-resilient-scaling/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip physical-ai-infrastructure-setup-and-resilient-scaling.zip -d .agents/skills

Documentation by NVIDIA Physical AI

Physical AI Infrastructure Setup And Resilient Scaling

Canonical skill for the Physical AI infrastructure stack. Use it to compose cluster, inference, OSMO, and workload stages into a reproducible Physical AI SDG environment, then keep the environment observable and recoverable.

Operating Rules

  • Read only the component references needed for the selected target. Do not load every component by default.

  • Keep the repo as the durable artifact. Fix checked-in config or scripts, then rerun. Do not recover a failed install with untracked one-off changes.

  • Run mutating cluster, OSMO, Helm, Terraform, or Azure operations through checked-in scripts when a script exists. Read-only diagnostics are allowed.

  • Stop at the first red gate. Fix the lowest owning layer in this order: config, script, then skill guidance.

  • Derive values from the environment when possible. Ask only for values that cannot be inferred, such as API keys, target choice, or quota tradeoffs.

  • Store secrets in ${REPO_ROOT}/.env. Cluster-derived values such as storage, database, Redis, and endpoint names come from Terraform outputs or platform queries, not .env.

  • Preflight means no deployed state: no cluster API, Terraform outputs, Helm releases, OSMO pools, or workflow state. Those belong to deploy/verify gates.

  • Never print, echo, or paste raw keys into commands, YAML, logs, or transcripts. Prefer credential handles, Kubernetes secretKeyRef, and runtime-only secret injection. Scan raw transcript exports with scripts/scan_transcript_secrets.py before sharing.

  • Use absolute paths. Derive repo root with git rev-parse --show-toplevel.

Component References

Each component lives inside this skill so the stack has one canonical trigger. Load the component reference only when the selected target needs that slice.

ConcernLoadAssets
Stage matrix and old driver notescomponents/driver/reference.mdNone
MicroK8s clustercomponents/cluster-microk8s/reference.mdcomponents/cluster-microk8s/scripts/, components/cluster-microk8s/runtimeclass-nvidia-runc.yaml
Azure AKS clustercomponents/cluster-azure/reference.mdcomponents/cluster-azure/scripts/, components/cluster-azure/terraform/
NIM Operator inferencecomponents/inference-nim-operator/reference.mdcomponents/inference-nim-operator/scripts/, components/inference-nim-operator/nims/
NVCF inferencecomponents/inference-nvcf/reference.mdcomponents/inference-nvcf/scripts/
Azure AI Foundry inferencecomponents/inference-azure/reference.mdcomponents/inference-azure/scripts/
MicroK8s OSMOcomponents/osmo-k8s/reference.mdcomponents/osmo-k8s/scripts/, upstream OSMO deploy scripts
Azure OSMOcomponents/osmo-azure/reference.mdcomponents/osmo-azure/scripts/, upstream OSMO deploy scripts plus Azure TF outputs
Azure access setupcomponents/azure-access/reference.mdNone
OSMO CLI and workflow operationscomponents/osmo-cli/reference.mdcomponents/osmo-cli/scripts/, components/osmo-cli/references/, components/osmo-cli/agents/, components/osmo-cli/tests/
OpenClaw Azure device logincomponents/openclaw-azure-login/reference.mdNone
OSMO CLI Support Files

The OSMO CLI component has second-level support files because its command and workflow surface is large. Load these directly only for the stated case.

FileRead when
components/osmo-cli/agents/workflow-expert.mdSpawning a workflow-generation or workflow-failure subagent.
components/osmo-cli/agents/logs-reader.mdSpawning a log summarization subagent for OSMO workflow failures.
components/osmo-cli/references/cli-commands.mdExact OSMO CLI flags, payloads, or command syntax are needed.
components/osmo-cli/references/workflow-spec.mdWorkflow YAML schema, credentials, outputs, or provider fields are needed.
components/osmo-cli/references/workflow-patterns.mdMulti-task, data dependency, Jinja, serial, or parallel workflow design is needed.
components/osmo-cli/references/advanced-patterns.mdCheckpointing, retry/exit behavior, or node exclusion is needed.
components/osmo-cli/tests/orchestrator-runtime-failure.mdValidating or debugging the OSMO orchestration review pattern.

Target Selection

Pick exactly one option per stage. Stage 2 follows stage 1.

  1. Kubernetes: MicroK8s or Azure

  2. OSMO: MicroK8s OSMO when Kubernetes is MicroK8s, Azure OSMO when Kubernetes is Azure

  3. Inference: NIM Operator, NVCF, Azure AI Foundry, or None

  4. Workload: Video Data Augmentation, Defect Image Generation, NuRec Carline Adaptation, NRE, NCore, Asset Harvester, or custom workflow YAML

Reject invalid combinations before provisioning:

ClusterNIM OperatorNVCFAzure AI Foundry
MicroK8syesyesno, Foundry requires Azure identities
Azureyesyesyes

For OpenClaw or any chat-only environment that cannot open a browser, read components/openclaw-azure-login/reference.md before Azure prerequisites. For any Azure target, read components/azure-access/reference.md before Azure component preflights.

Setup Flow

  1. Confirm target choices and workload compute requirements.

  2. Load the selected component references.

  3. Resolve prerequisites up front, including API keys, Azure access, caller CIDR, GPU quota, storage class, and OSMO login requirements.

  4. Run scripts/preflight.sh for every selected infrastructure component plus any OSMO CLI/workload preflight before provisioning; build the implementation plan from the results and stop on red preflight.

  5. Deploy Kubernetes first. Nothing else starts until the cluster gate is green.

  6. Deploy OSMO and inference after Kubernetes. These can proceed in parallel once the cluster exists, but workload submission waits for both selected gates.

  7. Submit the workload only after OSMO, storage credentials, compute pool, and selected inference endpoints are verified. For VDA, this includes preflight_credentials.sh, pre_submit_guard.py with resolved --set values, non-empty model-cache prefixes, and workflow-namespace endpoint smoke checks.

  8. Monitor through completion. On failed workflow state, inspect events and logs from components/osmo-cli/reference.md; do not resubmit blindly.

Inference Discovery

Avoid over-deploying expensive endpoints.

  1. Scan the chosen workflow spec and default values for endpoint references: *.osmo-nims.svc.cluster.local, api.nvcf.nvidia.com/*, *.inference.ai.azure.com, or *.cognitiveservices.azure.com.

  2. Map each reference to the selected backend:

    • NIM Operator: service name must match a directory under components/inference-nim-operator/nims/.

    • NVCF: function URL or function ID must be supplied by the environment.

    • Azure AI Foundry: endpoint name must be deployed through components/inference-azure/scripts/install.sh.

  3. If the workflow needs a capability the selected backend lacks, stop and report the mismatch. Do not silently substitute another model.

Verification Gates

Each stage has its own Verify section in the component reference. These gates are mandatory:

StageGate
KubernetesCluster API reachable, nodes Ready, GPU capacity advertised for GPU paths, and CPU+NVCF paths have runtimeclass/nvidia mapped to runc.
InferenceEvery endpoint referenced by the workload is reachable. NIM readiness uses /v1/health/ready; NVCF and Foundry still need task-specific authenticated checks.
OSMOOSMO pods Ready, pool ONLINE, port-forward watchdogs alive, storage credentials configured, and verify-hello workflow COMPLETED.
WorkloadSelected workload pre-submit guards pass before submit. osmo workflow query <id> reports COMPLETED and every task is green. Failed terminal states require events and logs before retry.

Resilient Scaling

  • Size the cluster from workload needs before provisioning. For Azure, check CPU and GPU quota for the selected VM families before terraform apply.

  • For NIM Operator, deploy only the NIMServices referenced by the workload. Each service pins GPU and model-cache storage for the lifetime of the cluster.

  • Keep OSMO storage URL schemes aligned with the active backend. Local MicroK8s uses MinIO, Azure uses Blob-backed configuration.

  • Treat Pending, Unknown, ImagePullBackOff, unbound PVCs, or 0 Ready replicas as layer failures. Investigate scheduling, storage, image credentials, and adjacent platform state before retrying the same command.

  • For long deploys or workflow watches, provide heartbeat updates with current state, elapsed time, last useful observation, and next check.

Workload Routing

  • Video Data Augmentation: use skills/physical-ai-video-data-augmentation/SKILL.md.

  • Defect Image Generation: use skills/physical-ai-defect-image-generation/SKILL.md.

  • NuRec carline adaptation: use skills/carline-adaptation/SKILL.md.

  • NRE, NCore, and Asset Harvester live in the canonical NuRec catalog listed in skills/INDEX.md.

  • Custom workload: submit the provided workflow YAML through OSMO after checking resource requests, image credentials, data credentials, and inference URLs.

Evaluation Prompts And Results

  • Positive trigger: "Set up resilient Physical AI infrastructure for VDA on Azure AKS with NIM Operator." Expected: use this skill.

  • Negative trigger: "Summarize recent OSMO workflow logs for this workflow ID." Expected: do not use this infrastructure setup skill unless the request also involves setup, scaling, validation, or recovery of the infrastructure stack.

Latest static review: 2026-05-26, description keywords match the expected routes above.

Files

components/cluster-azure/scripts/setup.sh

#!/usr/bin/env bash
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Post-deploy AKS setup: GPU Operator + RWX default StorageClass via helmfile.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TF_DIR="$SCRIPT_DIR"

"${SCRIPT_DIR}/preflight.sh"

# Always fetch credentials from TF to ensure correct cluster
RG=$(terraform -chdir="$TF_DIR" output -raw resource_group 2>/dev/null)
CLUSTER=$(terraform -chdir="$TF_DIR" output -raw aks_name 2>/dev/null)
[[ -n "$RG" && -n "$CLUSTER" ]] || { echo "ERROR: terraform outputs not available"; exit 1; }
az aks get-credentials -g "$RG" -n "$CLUSTER" --overwrite-existing

# Drift guard: if caller IP moved since last apply, AKS API allowlist and the
# storage account firewall (both driven by allowed_cidr) lock us out. Rewrite
# deploy.tfvars + do a full `terraform apply` — targeting only AKS would leave
# Blob / Key Vault / any other allowed_cidr consumer stale.
CURRENT_IP=$(curl -fsS --max-time 10 ifconfig.me)
AUTHORIZED=$(az aks show -g "$RG" -n "$CLUSTER" \
  --query "apiServerAccessProfile.authorizedIpRanges" -o tsv)
if [[ -n "$CURRENT_IP" ]] && ! grep -q "$CURRENT_IP" <<<"$AUTHORIZED"; then
  echo "==> allowed_cidr drift ($AUTHORIZED does not include $CURRENT_IP); syncing tfvars + full terraform apply"
  tmp=$(mktemp)
  awk -v new="${CURRENT_IP}/32" '
    /^[[:space:]]*allowed_cidr[[:space:]]*=/ {
      print "allowed_cidr = [\"" new "\"]";
      if ($0 ~ /\[/ && $0 !~ /\]/) in_allowed_cidr = 1;
      next;
    }
    in_allowed_cidr {
      if ($0 ~ /\]/) in_allowed_cidr = 0;
      next;
    }
    { print }
  ' "$TF_DIR/deploy.tfvars" > "$tmp"
  mv "$tmp" "$TF_DIR/deploy.tfvars"
  terraform -chdir="$TF_DIR" apply -input=false -auto-approve \
    -var-file=deploy.tfvars
fi

# Sanity: API reachable before running helmfile (fail fast, not 10-min hang)
kubectl cluster-info --request-timeout=15s >/dev/null || {
  echo "ERROR: cannot reach AKS API after CIDR sync. Check network / authorizedIpRanges."
  exit 1
}

echo "==> Ensure default StorageClass is RWX-capable (NFS + nconnect=4)"
# NIM multi-node needs RWX:
#   https://docs.nvidia.com/nim-operator/latest/multi-node.html
# NFS over Azure Files Premium with nconnect=4 is the fastest RWX option on
# this cluster's kernel (5.15 — too old for SMB Multichannel, which needs
# Ubuntu 22.04 kernel 6.8.0-1044+ per
#   https://learn.microsoft.com/en-us/azure/storage/files/smb-performance
# ). Shares are dynamically provisioned INSIDE the TF-managed Premium
# FileStorage SA (main.tf → azurerm_storage_account.nfs); no SA auto-
# creation, so `terraform destroy` cleans up end-to-end. See
# storage-class-nfs.yaml for driver parameter reference.
export NFS_RESOURCE_GROUP="$RG"
NFS_STORAGE_ACCOUNT=$(terraform -chdir="$TF_DIR" output -raw nfs_storage_account 2>/dev/null)
[[ -n "$NFS_STORAGE_ACCOUNT" ]] || { echo "ERROR: nfs_storage_account TF output missing — run terraform apply"; exit 1; }
export NFS_STORAGE_ACCOUNT
envsubst < "$SCRIPT_DIR/storage-class-nfs.yaml" | kubectl apply -f -

DESIRED_DEFAULT_SC="azurefile-nfs-premium"
CURRENT_DEFAULT_SC=$(kubectl get sc -o jsonpath='{.items[?(@.metadata.annotations.storageclass\.kubernetes\.io/is-default-class=="true")].metadata.name}')
if [[ "$CURRENT_DEFAULT_SC" != "$DESIRED_DEFAULT_SC" ]]; then
  echo "    current default: ${CURRENT_DEFAULT_SC:-<none>} -> ${DESIRED_DEFAULT_SC}"
  # Demote every currently-defaulted SC (there can only be one by convention,
  # but be defensive).
  for sc in $(kubectl get sc -o jsonpath='{.items[?(@.metadata.annotations.storageclass\.kubernetes\.io/is-default-class=="true")].metadata.name}'); do
    [[ "$sc" == "$DESIRED_DEFAULT_SC" ]] && continue
    kubectl annotate sc "$sc" storageclass.kubernetes.io/is-default-class- --overwrite
  done
  kubectl annotate sc "$DESIRED_DEFAULT_SC" storageclass.kubernetes.io/is-default-class=true --overwrite
else
  echo "    default already $DESIRED_DEFAULT_SC"
fi

echo "==> helmfile sync"
helmfile -f "$SCRIPT_DIR/helmfile.yaml" sync

echo "==> Verify"
kubectl get pods -n gpu-operator --no-headers
echo "---"
kubectl get nodes -o wide

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key, Needs Node.js

The author says: Requires the selected component prerequisites, usually kubectl plus either MicroK8s or Azure CLI/Terraform, and OSMO or inference credentials for the chosen target.

Security

What our scanner noticed· Medium risk

  • Large base64-encoded blobs
  • Instructions that use the network
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
NVIDIA Physical AI
Publisher
NVIDIA (Official)
Source
NVIDIA/skills · skills/physical-ai-infrastructure-setup-and-resilient-scaling · commit fce3cca
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE-APACHE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
openai/plugins

AutoGineer is not affiliated with or endorsed by NVIDIA Physical AI or NVIDIA.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download physical-ai-infrastructure-setup-and-resilient-scaling.zip