Loading…
Deploy a Production-Ready NVIDIA AI-Q Blueprint on Oracle Cloud Infrastructure
NVIDIA Developer BlogAnurag Kuppala
Summary
The NVIDIA AI-Q Blueprint operates as an open-source reference architecture for long-horizon agents built upon LangChain Deep Agents and the NVIDIA NeMo Agent Toolkit. Deploying this multi-agent system on Oracle Cloud Infrastructure requires coordinating foundational cloud infrastructure with containerized application workloads across Kubernetes. The deployment methodology utilizes Terraform to provision network isolation, an enhanced OKE cluster, a flexible public load balancer, and an AES-256 encrypted OCI Vault. Helm manages the application layer on Kubernetes by pulling official images from the NGC registry to run a FastAPI agent backend, a Next.js web frontend, and PostgreSQL. This configuration establishes an extensible routing architecture where user queries route automatically between shallow search agents and deep planning sub-agents while maintaining clean infrastructure teardown commands.
Context
Developers and platform engineers need a reproducible method to deploy and run the NVIDIA AI-Q multi-agent blueprint in a production-ready cloud environment rather than locally on a laptop.
Approach / What changed
The system uses Terraform to provision OCI resources—including a VCN, an OKE cluster, a flexible load balancer on port 80 forwarding to NodePort 30080, and OCI Vault for credential storage. Helm installs the AI-Q 2.0 container workloads on OKE, configuring a FastAPI agent backend, a Next.js frontend, and an in-cluster PostgreSQL instance backed by dynamic OCI Block Volume storage.
Takeaways
- NVIDIA AI-Q routes queries through an intent router either to a fast Shallow Research Agent or to a Deep Agent combining planning and research sub-agents with sandboxed tools.
- The NGC API key serves a dual role in deployment, acting as the NVIDIA inference authentication key and as the image pull credential for the nvcr.io container registry.
- While Terraform stores API keys in OCI Vault for disaster recovery, active Kubernetes pods read credentials directly from Kubernetes secrets, requiring pod rollouts upon secret rotation.
Related reading
How to Govern Autonomous Agents in Enterprise AI Factories
Autonomous AI agents require governed environments to safely inspect code, execute tests, query enterprise systems, and handle sensitive business data. The NVIDIA Secure Agent Workspace Reference Design shifts agent execution away from user laptops to dedicated, single-user virtual machines managed on Red Hat OpenShift Virtualization or Microsoft Azure. Perimeter defenses enforce enterprise single sign-on access broker connections, default-deny network egress rules, and human approval gates for critical state-changing actions. Inside the workspace virtual machine, active sandboxing through NVIDIA OpenShell evaluates signed security policies before each tool invocation while credential proxies prevent direct access to raw secrets. GitOps workflows continuously reconcile infrastructure profiles and network configurations while all operational and security telemetry streams to centralized SIEM platforms in OCSF format.
Michelle Horton