Please clarify Nebius credentials

[hongbo-miao]

According to https://artifacthub.io/packages/helm/skypilot/skypilot-nightly?modal=values

# Populate Nebius credentials from the secret with nebius credentials.
nebiusCredentials:
  enabled: false
  # @schema type: [string, null]
  tenantId: null
  # Name of the secret containing the Nebius credentials. Only used if enabled is true.
  nebiusSecretName: nebius-credentials

For other vendor secret, I can see I need for example api_key:

Populate Vast credentials from the secret with key `api_key`

But this nebiusSecretName comment says

Populate Nebius credentials from the secret with nebius credentials.

What keys should exist in this secret? Thanks!

[DanielZhangQD]

Hi @hongbo-miao,

You can check the keys to create the secret in the Nebius tab of the doc https://docs.skypilot.co/en/latest/reference/api-server/api-server-admin-deploy.html#optional-configure-cloud-accounts.

[Michaelvll]

@DanielZhangQD we should update the comment at https://artifacthub.io/packages/helm/skypilot/skypilot-nightly?modal=values&path=nebiusCredentials to point to the config doc : )

[DanielZhangQD]

OK. I will update that later.

[hongbo-miao]

1. I got some help from Nebius. Following step 3 and 4 in Nebius guide, I am able to generate $HOME/.nebius/credentials.json.

2. Next, I follow SkyPilot guide, I got base64 string xxx by base64 < "$HOME/.nebius/credentials.json"

   Secret:

   apiVersion: v1
   kind: Secret
   metadata:
     name: nebius-secret
     namespace: production-hm-skypilot
     labels:
       app.kubernetes.io/name: nebius-secret
       app.kubernetes.io/part-of: production-hm-skypilot
   stringData:
     # base64 < "$HOME/.nebius/credentials.json"
     credentials.json: xxx

   Helm chart:

   apiService:
     image: harbor.hongbomiao.com/docker-hub-proxy-cache/berkeleyskypilot/skypilot-nightly:1.0.0.dev20250730
     dbConnectionSecretName: hm-skypilot-secret
     enableUserManagement: true
     initialBasicAuthSecret: hm-skypilot-secret
   ingress:
     enabled: false
   ingress-nginx:
     enabled: false
   storage:
     enabled: true
     storageClassName: production-hm-skypilot-storage-class
     accessMode: ReadWriteOnce
     size: 10Gi
   lambdaCredentials:
     enabled: true
     lambdaSecretName: lambda-secret
   runpodCredentials:
     enabled: true
     runpodSecretName: runpod-secret
   nebiusCredentials:
     enabled: true
     tenantId: tenant-xxxxxxxxxxxxxxxxxx
     nebiusSecretName: nebius-secret
   vastCredentials:
     enabled: true
     vastSecretName: vast-secret

However, I can see other vendors, but not Nebius.

> sky check
🎉 Enabled infra for workspace: 'default' 🎉
  Kubernetes [compute]
    Allowed contexts:
    └── in-cluster
  Lambda [compute]
  RunPod [compute]
  Vast [compute]

Any ideas? Thanks!

[DanielZhangQD]

Could you please try to delete the nebius secret and create it with:

kubectl create secret generic nebius-secret \
  --namespace $NAMESPACE \
  --from-file=credentials.json=$HOME/.nebius/credentials.json

Or change stringData to data in your secret yaml.

[hongbo-miao]

Thanks @DanielZhangQD !

Actually, xxx should be content of cat "$HOME/.nebius/credentials.json" (it is already in one line) instead of base64 < "$HOME/.nebius/credentials.json".

apiVersion: v1
kind: Secret
metadata:
  name: nebius-secret
  namespace: production-hm-skypilot
  labels:
    app.kubernetes.io/name: nebius-secret
    app.kubernetes.io/part-of: production-hm-skypilot
stringData:
  # cat "$HOME/.nebius/credentials.json"
  credentials.json: xxx

Now it works well:

> sky check
🎉 Enabled infra for workspace: 'default' 🎉
  Kubernetes [compute]
    Allowed contexts:
    └── in-cluster
  Lambda [compute]
  Nebius [compute]
  RunPod [compute]
  Vast [compute]

Feel free to close this ticket once the Helm chart comment be more clear, thank you! 😃