Deploy the data plane

This walkthrough installs the Union.ai data plane operator on AWS, GCP, Azure, OCI, or a generic (on-premise / S3-compatible) Kubernetes cluster. The steps are the same across providers; only the Helm values file differs, and each provider’s values are documented on its infrastructure page.

Before you start, provision your cloud infrastructure using the matching page and note its Deploy configuration section:

Provider	Infrastructure page	--provider	Values file
AWS	AWS	aws	values.aws.yaml
GCP	GCP	gcp	values.gcp.yaml
Azure	Azure	azure	values.azure.yaml
OCI	OCI	oci	values.yaml (base)
Generic	Generic Kubernetes	custom	values.yaml (base)

Assumptions

• You have a Union.ai organization, and you know the control plane URL for your organization (e.g. https://your-org-name.us-east-2.unionai.cloud).
• You have a cluster name provided by or coordinated with Union.
• You have a Kubernetes cluster with workload identity (IRSA / GKE Workload Identity / Entra Workload Identity) or the equivalent credentials enabled, running one of the most recent three minor Kubernetes versions. Learn more
• You have provisioned object storage, a container registry, and identity bindings as described on your provider’s infrastructure recommendations page.

Prerequisites

• Install Helm 3.
• Install uctl.
• Install the flyte CLI.
• Install the flyteplugins-union plugin, which provides the flyte create cluster and flyte get cluster commands: pip install flyteplugins-union.

Deploy the Union.ai operator

1. Add the Union.ai Helm repo:

   helm repo add unionai https://unionai.github.io/helm-charts/
   helm repo update

2. Configure the flyte CLI to talk to your control plane, then register the cluster name:

   flyte create config --endpoint <YOUR_UNION_CONTROL_PLANE_URL> --org <YOUR_ORG_NAME>
   flyte create cluster <YOUR_SELECTED_CLUSTERNAME> --pool default

   flyte create config writes .flyte/config.yaml. The first command that contacts the control plane opens a browser to authenticate you.

   Register the cluster before you install the chart: the data plane binds to this record when it starts. Every organization is provisioned with a default pool, so --pool default needs no extra setup.

3. Use the uctl selfserve provision-dataplane-resources command to generate a new client and client secret for communicating with your control plane, provision authorization permissions for the app to operate on the cluster name you selected, and provide follow-up instructions. Pass the --provider value for your cloud (see the table above):

   uctl config init --host=<YOUR_UNION_CONTROL_PLANE_URL>
   uctl selfserve provision-dataplane-resources --clusterName <YOUR_SELECTED_CLUSTERNAME> --provider <PROVIDER>

   • The command outputs the ID, name, and a secret that the Union.ai services use to communicate with your control plane. You pass the client ID and client secret to the Helm chart in step 5.
   • Save the secret that is displayed. Union does not store it, and it cannot be retrieved later.

4. Download the values file for your provider (see the table above) and fill in your infrastructure details. The exact keys — object storage, service-account/identity bindings, and any provider-specific settings — are documented in the Deploy configuration section of your provider’s infrastructure page ( AWS · GCP · Azure · OCI · Generic):

   curl -O https://raw.githubusercontent.com/unionai/helm-charts/main/charts/dataplane/<VALUES_FILE>

   Every provider needs these shared global keys set:

   • Set global.UNION_CONTROL_PLANE_HOST and global.CONTROLPLANE_HOST to your control plane hostname (no scheme, no port).
   • Set global.CLUSTER_NAME to the cluster name you registered in step 2.
   • Set global.ORG_NAME to your organization name.

   Set the remaining provider-specific keys as described on your infrastructure page.

5. Install the data plane Helm chart, passing the client ID and client secret from step 3:

   helm upgrade --install union unionai/dataplane \
     -f <VALUES_FILE> \
     --set global.AUTH_CLIENT_ID=<CLIENT_ID> \
     --set-string secrets.admin.clientId=<CLIENT_ID> \
     --set secrets.admin.clientSecret=<CLIENT_SECRET> \
     --namespace union \
     --create-namespace

6. Once deployed, check that the cluster registered with the control plane:

   flyte get cluster

   The command groups clusters by state. A successfully registered cluster appears under Enabled Clusters:

   Enabled Clusters
   NAME        ORG     STATE     HEALTH
   <cluster>   <org>   enabled   healthy

7. Follow the Quickstart to run your first workflow and verify your cluster is working correctly.

Next: manage your cluster and pools

uctl selfserve provision-dataplane-resources provisions the data plane and registers this cluster with the control plane. Once it is connected, you manage the cluster pool it belongs to, and route work to it with queues, from the Cluster and workload management user guide:

• Cluster pools: group clusters that share one data plane (object store, secrets, registry).
• Clusters: inspect and manage the cluster records registered with the control plane.
• Managing queues: route workloads to a pool and enforce concurrency, priority, and fairness.

Each cluster is assigned exactly one pool. If no custom pool is specified when the cluster is created, it joins the default pool that every organization is provisioned with, so a single-cluster deployment needs no extra pool setup.

GPU cloud deployment guides

CoreWeave, Crusoe, and Nebius have their own deployment guides, with provider-specific GPU, storage, and registry steps: