Installation (Nebius)

Saturn Cloud Enterprise on Nebius provides a fully managed AI platform on Nebius GPU infrastructure. It enables teams to train large language models, run advanced AI research, and deploy enterprise-scale ML workloads.

Key Features

• Access to NVIDIA H100, H200, and GB200 GPUs with up to 141GB HBM3e memory per GPU.
• Elastic Kubernetes scaling, integrated storage, and enterprise security.
• Support for large-scale model training including 70B+ parameter models.

Architecture Overview at a Glance

In a typical installation, we deploy into your Nebius Managed Kubernetes (MK8S) cluster in your Nebius project, integrate it with your existing VPC and subnet, and configure CPU and GPU node pools optimized for data science workloads. Saturn Cloud is hosted publicly with secure authentication by default, with private networking options available if required.

This standard installation creates a ready-to-use platform for machine learning and AI workloads with GPU acceleration. Beyond the default setup, Saturn Cloud can customize node pool sizes, GPU configurations, and network settings to meet your organization’s needs.

The infrastructure includes:

Core Components

• MK8S Cluster: A managed Kubernetes cluster with version 1.33 by default and integrated container registry access
• VPC Network: Integration with Nebius VPC and subnet infrastructure for network isolation
• Node Pools: Auto-scaling node groups optimized for different workload types, including GPU-accelerated nodes
• Storage: Integration with Nebius storage services for persistent data storage
• Container Registry: Secure access to Nebius Container Registry (NCR) for container images

Network Architecture

Saturn Cloud integrates with your existing Nebius VPC infrastructure:

1. Network Integration

Network integration ensures that Saturn Cloud is deployed seamlessly within your existing Nebius VPC and subnet configuration.

• Existing VPC: Utilizes your pre-configured Nebius VPC and subnet
• Subnet Integration: Deployed within your specified subnet ID for controlled network placement
• Public Endpoints: Cluster control plane accessible via public endpoints with secure authentication
• Regional Deployment: Supports deployment in Nebius regions (eu-north1 primary)

2. Network Security

The Nebius deployment ensures:

• Integration with existing VPC security controls
• Controlled access through IAM and service accounts
• Secure container registry access via group memberships
• Kubernetes-native network policies for workload isolation

Node Pool Architecture

The installation creates specialized node pools optimized for AI and data science workloads.

1. System Node Pool

The system node pool is dedicated to running Saturn Cloud’s control plane and core system services.

• Purpose: Runs Saturn Cloud control plane and system services
• Platform: cpu-d3 (latest generation CPU platform)
• Preset: 4vcpu-16gb (4 vCPUs, 16GB RAM)
• Scaling: 2-100 nodes
• Disk: 93GB Network SSD (non-replicated)

2. CPU Node Pools

Saturn Cloud provisions multiple CPU-optimized node pools for various computational requirements:

4 vCPU (nebius-cpu-d3-4vcpu-16gb)

• Platform: cpu-d3
• Preset: 4vcpu-16gb (4 vCPUs, 16GB RAM)
• Use Case: General purpose workloads, development environments
• Auto-scaling: 0-10 nodes

16 vCPU (nebius-cpu-d3-16vcpu-64gb)

• Platform: cpu-d3
• Preset: 16vcpu-64gb (16 vCPUs, 64GB RAM)
• Use Case: Memory-intensive analytics, data processing
• Auto-scaling: 0-10 nodes

64 vCPU (nebius-cpu-d3-64vcpu-256gb)

• Platform: cpu-d3
• Preset: 64vcpu-256gb (64 vCPUs, 256GB RAM)
• Use Case: Large-scale computational workloads, big data processing
• Auto-scaling: 0-10 nodes

3. GPU Node Pools

The reference Terraform chooses GPU node pools from your region. It creates one pool for the 1-GPU size of each GPU platform the region offers, and each pool scales from zero to 10 nodes. These are the defaults:

Each pool appears in Saturn Cloud as an instance size named nebius-<platform>-<preset>, for example nebius-gpu-h200-sxm-1gpu-16vcpu-200gb. The first GPU pool in the list is the default GPU size.

To install in a region that is not listed, or to choose different pools, set node_pools yourself. 8-GPU sizes, such as 8x H200, need an InfiniBand fabric from Nebius support. Contact support@saturncloud.io to discuss GPU options for your workload requirements.

Security Features

Saturn Cloud on Nebius is deployed with multiple security controls to protect access, data, and workloads:

• Service Account Authentication: Dedicated service accounts for secure cluster and registry access
• IAM Group Integration: Automated membership management for container registry permissions
• Workload Identity: Kubernetes-native service account to IAM mapping
• Network Policies: Fine-grained network segmentation within the cluster
• Encrypted Storage: Network SSD with built-in encryption
• Secure Endpoints: TLS-encrypted control plane and API access

Storage and Data Access

Saturn Cloud leverages Nebius storage and registry services to ensure reliable data access and high availability:

• Network SSD: High-performance, non-replicated storage for boot disks
• Persistent Volumes: Dynamic provisioning through CSI drivers
• Container Registry: Integrated access to Nebius Container Registry
• Multi-Zone: Support for multi-zone deployments for high availability

Monitoring and Operations

Operational features in Saturn Cloud automate scaling, resource allocation, and system health management:

• Cluster Autoscaling: Automatic node provisioning based on workload demands
• GPU Scheduling: Automatic GPU resource allocation and scheduling
• Health Monitoring: Continuous monitoring of node and cluster health
• Automatic Updates: Managed Kubernetes updates and security patches

Installation Process

Saturn Cloud Enterprise for Nebius can be deployed using two approaches:

Option 1: Fully Managed Installation (Recommended)

The Saturn Cloud support team handles the complete installation process.

Prerequisites:

1. Nebius Project Setup: Ensure you have a Nebius project with appropriate permissions
2. Network Configuration: Have your VPC and subnet configured and note the subnet ID
3. IAM Groups: Identify your viewers group ID for container registry access

Installation Steps:

1. Prepare Service Account Credentials: Set up Nebius service account with required environment variables:

   export NB_AUTHKEY_PRIVATE_PATH="/path/to/private/key"
   export NB_AUTHKEY_PUBLIC_ID="your-public-key-id"
   export NB_SA_ID="your-service-account-id"
   

2. Configure Installation Parameters: Provide the following information to Saturn Cloud support:

   # Your Nebius project ID
   project_id = "project-xxxxxxxxxxxxxxxxxx"
   
   # The subnet ID where the cluster will be deployed
   subnet_id = "vpcsubnet-xxxxxxxxxxxxxxxxxx"
   
   # The ID of the viewers group for container registry access
   viewers_group_id = "group-xxxxxxxxxxxxxxxxxx"
   
   # Name for your Kubernetes cluster
   cluster_name = "my-saturn-cluster"
   

3. Grant Installation Access: Provide Saturn Cloud support with the necessary service account permissions

4. Installation Deployment: The support team will handle the infrastructure deployment using Terraform

5. Access Your Installation: Receive your Saturn Cloud URL and admin credentials

Option 2: Self-Service Installation

For customers who prefer to provision infrastructure themselves, Saturn Cloud provides Terraform templates and deployment automation.

Prerequisites:

1. Nebius Project Setup: A Nebius project with a VPC and subnet, and a Nebius account that can create service accounts, add them to the tenant’s editors group, and create access keys. The first subnet listed in the project is used.
2. Nebius CLI: The nebius CLI installed and logged in
3. Terraform: Terraform 1.8 or later
4. Command-line tools: kubectl, helm and jq

Installation Steps:

1. Register Your Tenancy

Register your organization with Saturn Cloud to receive provisioning credentials:

curl -X POST https://manager.saturnenterprise.io/api/v2/customers/register \
    -H "Content-Type: application/json" \
    -d '{
      "name": "your-organization-name",
      "email": "your-email@example.com",
      "cloud": "nebius"
    }'

2. Activate Your Account

You will receive an activation email with a token. Activate your account using:

curl -X POST https://manager.saturnenterprise.io/v2/activate \
    -H "Content-Type: application/json" \
    -d '{"token": "YOUR_ACTIVATION_TOKEN"}'

Alternatively, use the activation link provided in the email:

https://manager.saturnenterprise.io/v2/activate?token=YOUR_ACTIVATION_TOKEN

After activation, you will receive an email with a terraform.tfvars file attached. It contains a 4-hour bootstrap API token and your domain, which is your-organization-name.saturnenterprise.io.

curl -X POST https://manager.saturnenterprise.io/v2/resend-setup \
    -H "Content-Type: application/json" \
    -d '{
      "name": "your-organization-name",
      "email": "your-email@example.com"
    }'

3. Clone Reference Terraform

Saturn Cloud provides a reference Terraform template. It represents a standard configuration and can be customized to meet your specific requirements. The same directory is used for every region.

git clone https://github.com/saturncloud/saturncloud-reference-terraform.git
cd saturncloud-reference-terraform/nebius

4. Configure Terraform Variables

Replace terraform.tfvars in this directory with the file from your activation email, and then make these changes:

# The chart version last installed from scratch on Nebius.
# The file from your email may name an older version, so check this line.
helm_chart_version = "2026.8.1-62"

# Your choice of name for the Kubernetes cluster
cluster_name = "my-saturn-cluster"

Your project ID, region, subnet and viewers group are not set in this file. The script in the next step sets them. The file from your email also sets saturn_domain to your-organization-name.saturnenterprise.io. If you leave it out, Terraform uses that same domain.

Check these defaults against your project before you deploy:

• Node pools: The node pools come from your region, as listed under GPU Node Pools. In a region that is not listed, terraform plan stops with an error until you set node_pools. To see the platforms in your region, run nebius compute platform list --parent-id "${NEBIUS_PROJECT_ID}".
• Shared filesystem: A 100 GiB shared filesystem is created by default. Set enable_filestore = false to skip it.
• SSH key: If ~/.ssh/id_rsa.pub exists, it is added to the nodes for an ubuntu user. Set ssh_public_key to use a different key.

5. Deploy Infrastructure

Set your Nebius details and source environment.sh. Run terraform from the same shell, because the script sets its credentials as shell variables. If you open a new shell, source the script again.

export NEBIUS_TENANT_ID='tenant-xxxxxxxxxxxxxxxxxx'
export NEBIUS_PROJECT_ID='project-xxxxxxxxxxxxxxxxxx'
export NEBIUS_REGION='eu-north1'

source environment.sh

# Initialize Terraform
terraform init

# Review the planned changes
terraform plan

# Apply the configuration
terraform apply

environment.sh creates a state bucket and a service account named saturn-cloud-sa in your project, adds that service account to the tenant’s editors group, and creates an access key for it that expires after one day. To keep more than one deployment in a project, set a different SATURN_DEPLOYMENT_NAME for each one before you source the script.

If terraform init reports that the access key is invalid, wait a minute and run it again, because a new key takes a short time to reach Object Storage.

environment.sh sets the state bucket to the enhanced-throughput storage class, including a bucket left by an earlier attempt, because some regions have no standard storage quota. If an earlier attempt failed to save state with QuotaLimitExceeded, Terraform wrote the state to errored.tfstate. Upload it with terraform state push errored.tfstate after you source environment.sh again.

This provisions:

• Nebius Managed Kubernetes (MK8S) cluster
• CPU and GPU node pools
• IAM service accounts and permissions
• A shared filesystem, unless you turned it off
• The Saturn Cloud operator, which then installs the remaining services

terraform apply can finish before Saturn Cloud is ready, because the operator continues the installation in the cluster.

6. Verify Installation

Configure kubectl:

CLUSTER_ID=$(terraform state show nebius_mk8s_v1_cluster.saturn_cluster | awk '/^ *id /{print $3; exit}' | tr -d '"')
nebius mk8s cluster get-credentials --id "$CLUSTER_ID" --external --kubeconfig ./kubeconfig --force
export KUBECONFIG=$PWD/kubeconfig

Then check the installation:

# Verify cluster access
kubectl get nodes

# Check all pods are running
kubectl get pods -A

# Check that the API answers. Use your own domain.
curl https://app.your-organization-name.saturnenterprise.io/api/status

The last command returns {"status": "ok", ...} with the installed version. The address can take about 10 minutes to resolve to your cluster after the install starts, because the operator checks DNS every 5 minutes.

Note: Workload nodes will not be visible initially as they scale from 0 and are provisioned on-demand when users create workloads. Expect the first workload on a pool to take a few minutes longer while its node starts and its image downloads.

7. Access Your Installation

Open https://app.your-organization-name.saturnenterprise.io. The email address you set as saturn_admin_email receives a welcome email with a link to set the password. The admin username is admin.

The installation typically completes in 15-30 minutes.

Uninstalling a Self-Service Installation

This deletes the cluster and all data in it, including the Saturn Cloud database, user disks and the shared filesystem. Run these commands from the nebius directory, in a shell where you have sourced environment.sh again.

Removing the operator from the Terraform state first is required, because uninstalling the operator through Terraform times out.

CLUSTER_ID=$(terraform state show nebius_mk8s_v1_cluster.saturn_cluster | awk '/^ *id /{print $3; exit}' | tr -d '"')

terraform state rm 'helm_release.saturn_operator[0]'
terraform destroy

Deleting the cluster can take more than 10 minutes. If terraform destroy reports that a resource is still being deleted, wait a few minutes and run it again.

Terraform does not remove the disks that Kubernetes created for Saturn Cloud, or the service account that environment.sh created. Delete them with:

for id in $(nebius compute disk list --parent-id "$NEBIUS_PROJECT_ID" --format json \
  | jq -r --arg c "$CLUSTER_ID" '.items[]? | select(.metadata.labels["compute.csi.nebius.com/cluster-id"] == $c) | .metadata.id'); do
  nebius compute disk delete --id "$id"
done

nebius iam service-account delete --id "$(nebius iam service-account get-by-name \
  --parent-id "$NEBIUS_PROJECT_ID" --name "${SATURN_DEPLOYMENT_NAME}-sa" --format json | jq -r '.metadata.id')"

Ongoing Management

Saturn Cloud Enterprise on Nebius is fully managed, meaning:

• Automatic Kubernetes updates and security patches
• 24/7 monitoring and support for both CPU and GPU workloads
• Performance optimization for AI/ML workloads
• NVIDIA driver updates and GPU health monitoring
• Backup and disaster recovery
• Scaling optimization based on workload patterns

Cost Optimization

The Nebius infrastructure uses several cost optimization strategies:

• Auto-scaling to Zero: All node pools except system nodes can scale to zero when unused
• Efficient Resource Allocation: Right-sized presets for different workload types
• GPU Optimization: Automatic GPU scheduling prevents resource waste
• Network SSD: Cost-effective storage with high performance
• Resource Tagging: Detailed cost allocation through Kubernetes labels
• Idle Detection: Automatic shutdown of unused GPU resources

Performance Characteristics

Saturn Cloud on Nebius provides:

• GPU Options - H100, H200, and GB200 GPUs with high memory capacity
• High-Speed Networking - Optimized for multi-GPU and distributed training
• CPU-D3 Platform - Latest generation CPU architecture
• Memory-Optimized Configurations - Large memory allocations for big data workloads
• Container Registry Integration - Fast image pulls for rapid scaling

Next Steps

After installation:

• Operations: Understand upgrades, failure modes, and day-to-day operations
• Customization: Customize node pools, deploy additional services, integrate with existing tools
• Admin Guide: Invite users, manage groups, monitor resources, run reports