Deploying Hosted Studio with DAI
When deploying DAI into a Kubernetes environment you can optionally choose to deploy Hosted Studio alongside it. Hosted Studio lets users launch on-demand, browser-based Studio workspaces directly from DAI. It is bundled as the hosted-studio sub-chart, is disabled by default, and is served at the web path /studio on your existing DAI hostname. This page describes how to enable Hosted Studio and the associated configuration options.
Because Hosted Studio runs as a DAI sub-chart, it is deployed into the same namespace as DAI and inherits DAI's global.postgresql, global.keycloak, global.httpRoute, and global.customCACert values automatically. You do not need to repeat those settings; only the hosted-studio specific values below are required.
The manager creates per-user workspaces on demand, each running an Eggplant Fusion Engine that obtains a license from the bundled RLM (Reprise License Manager) sub-chart (rlm-hosted-studio). When AI features are enabled, the Fusion Engine sends model requests through a separately deployed LiteLLM gateway.
Configure Fusion Engine licensing
Hosted Studio workspaces run Eggplant Fusion Engine, which is licensed by the bundled rlm-hosted-studio sub-chart. You need one license per Studio workspace you want to run in parallel. Speak to Eggplant Customer Support if needed.
Create a Kubernetes secret containing your Fusion Engine license, then reference it from your values via hosted-studio.rlm-hosted-studio.existingSecretName.
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: rlm
stringData:
eggPlantFunctional.lic: |
a-real-license-goes-here
licensedMacAddress: "00:11:22:33:44:55"
kubectl --namespace dai apply -f rlm-license.yaml
The licensedMacAddress value must use colon-separated hexadecimal notation (00:11:22:33:44:55). In a Kubernetes environment, RLM does not tie the license to physical hardware — any valid MAC address can be used.
Deploy the LiteLLM gateway (AI only)
This step is only required when hosted-studio.manager.aiEnabled is true. If you do not want AI features, leave hosted-studio.manager.aiEnabled: false (the default) and skip this step — you do not need to deploy LiteLLM or configure any litellm* values.
When AI is enabled, Hosted Studio sends all model requests through a LiteLLM proxy. LiteLLM presents named models to Hosted Studio (configured via hosted-studio.manager.epfModel and hosted-studio.manager.studioModel) and forwards them to your LLM backend (for example, AWS Bedrock).
The example below deploys LiteLLM from the upstream chart into your DAI namespace, mapping two model names to AWS Bedrock models. Substitute the values to suit your environment.
fullnameOverride: litellm
envVars:
LITELLM_MASTER_KEY: a-strong-litellm-master-key
LITELLM_SALT_KEY: a-strong-litellm-salt-key
AWS_ACCESS_KEY_ID: your-aws-access-key-id
AWS_SECRET_ACCESS_KEY: your-aws-secret-access-key
AWS_REGION_NAME: your-aws-region
proxy_config:
model_list:
- model_name: claude-haiku-4-5-20251001
litellm_params:
model: bedrock/eu.anthropic.claude-haiku-4-5-20251001-v1:0
aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
aws_region_name: os.environ/AWS_REGION_NAME
- model_name: claude-sonnet-4-5-20250929
litellm_params:
model: bedrock/eu.anthropic.claude-sonnet-4-5-20250929-v1:0
aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
aws_region_name: os.environ/AWS_REGION_NAME
general_settings:
master_key: os.environ/LITELLM_MASTER_KEY
helm upgrade --install litellm \
oci://ghcr.io/berriai/litellm-helm \
--namespace dai \
--values litellm-values.yaml \
--wait
The model_name values you configure here must match hosted-studio.manager.epfModel and hosted-studio.manager.studioModel in your DAI values file. Consult the LiteLLM documentation and your cloud provider's documentation to ensure your LiteLLM deployment follows best practices.
Enable Hosted Studio in your DAI values
Add a hosted-studio block to your dai.yaml values file. Substitute all the values to suit your deployment.
global:
hostedStudio:
enabled: true
hosted-studio:
manager:
studioDomain: dai.example.com
aiEnabled: true
epfModel: claude-sonnet-4-5-20250929
studioModel: claude-haiku-4-5-20251001
litellmBaseUrl: http://litellm:4000
litellmMasterKey: a-strong-litellm-master-key
rlmHost: rlm-hosted-studio
# Maximum number of workspaces that can exist at once (default 10).
maxWorkspaceCount: 10
lifeCycle:
# How often the clean-up task runs, as a cron expression (default hourly).
cronExpression: "0 * * * *"
# Inactivity before a workspace is put to sleep (default 2h).
sleepThreshold: 2h
# Inactivity before a workspace is permanently deleted (default 2M).
deleteThreshold: 2M
rlm-hosted-studio:
enabled: true
existingSecretName: rlm
See Supported Customizations below for the full list of available values.
Hosted Studio is deployed as part of the standard DAI helm upgrade --install — no separate release is required. Once DAI is deployed and the manager pod is ready, users can access Hosted Studio at https://<your-dai-host>/studio and sign in with their DAI credentials. You can check the manager is healthy with:
kubectl --namespace dai get pods -l app.kubernetes.io/name=hosted-studio
The first workspace creation may take several minutes while Kubernetes pulls the Studio and Fusion Engine images. If the workspace pod is slow to become ready, monitor image pull progress with kubectl --namespace dai get pod -l app.kubernetes.io/component=hosted-studio-workspace. To avoid this delay, you can enable the Image Pre-Pull DaemonSet.
Supported Customizations
There are a number of additional configuration options that can be used to tune the behaviour of Hosted Studio for your environment. All of the configuration described below is via helm values, which should be added to your standard dai.yaml file used for the main installation.
Enabling Hosted Studio
| Key | Description | Default |
|---|---|---|
global.hostedStudio.enabled | Set to true to deploy the Hosted Studio sub-chart. Disabled by default. | false |
Hosted Studio Manager
These values configure the Hosted Studio manager pod that runs alongside DAI.
| Key | Description | Default |
|---|---|---|
hosted-studio.replicaCount | Number of replicas of the Hosted Studio manager. | 1 |
hosted-studio.resources | Resource requests / limits for the Hosted Studio manager pod. | {"limits":{"memory":"256Mi"},"requests":{"cpu":"200m","memory":"256Mi"}} |
hosted-studio.nodeSelector | Node selector applied to the Hosted Studio manager pod. | {} |
hosted-studio.tolerations | Tolerations applied to the Hosted Studio manager pod. | [] |
AI and LiteLLM Gateway
These values are only relevant when AI features are enabled. When hosted-studio.manager.aiEnabled is false, they can be left unset.
| Key | Description | Default |
|---|---|---|
hosted-studio.manager.aiEnabled | Enables AI features. When true, the LiteLLM gateway is required and hosted-studio.manager.litellmMasterKey must be set. | false |
hosted-studio.manager.epfModel | The model name used by Fusion Engine. Must match a model_name configured in LiteLLM. | "claude-sonnet-4-5-20250929" |
hosted-studio.manager.studioModel | The model name used by Studio. Must match a model_name configured in LiteLLM. | "claude-haiku-4-5-20251001" |
hosted-studio.manager.litellmBaseUrl | Base URL of the LiteLLM gateway used to proxy model requests. | "http://litellm:4000" |
hosted-studio.manager.litellmMasterKey | Master key for authenticating with LiteLLM. Must match the LITELLM_MASTER_KEY of your LiteLLM deployment. | "" |
hosted-studio.manager.litellmKeyBudgetDuration | The duration over which the LiteLLM key budget applies (for example, 30d). | "" |
hosted-studio.manager.litellmKeyMaxBudget | Maximum budget applied to per-workspace LiteLLM keys. 0 disables the budget. | 0 |
Workspaces
These values control the Studio workspaces created on demand by the manager, including scheduling and resource sizing.
| Key | Description | Default |
|---|---|---|
hosted-studio.manager.studioDomain | The hostname users browse to reach Hosted Studio. Required — must match the hostname used in global.httpRoute.hostnames. | nil |
hosted-studio.manager.configInitImage | Container image used to initialise each workspace's configuration before Studio starts. Defaults to the Studio image when left unset. | nil |
hosted-studio.manager.maxWorkspaceCount | The maximum number of concurrent Hosted Studio workspaces. | 10 |
hosted-studio.manager.studioNodeSelector | Node selector applied to the dynamically created workspace pods. | {} |
hosted-studio.manager.studioTolerations | Tolerations applied to the dynamically created workspace pods. | [] |
hosted-studio.manager.studioResources | CPU, memory, and storage requests / limits for each Studio workspace pod. | {"cpuRequest":"1","memoryRequest":"2Gi","memoryLimit":"2Gi","storageSize":"5Gi"} |
hosted-studio.manager.epgwResources | CPU and memory requests / limits for each epgw pod. | {"cpuRequest":"1","memoryRequest":"1Gi","memoryLimit":"1Gi"} |
hosted-studio.manager.fusionEngineResources | CPU and memory requests / limits for each Fusion Engine pod. | {"cpuRequest":"1","memoryRequest":"2Gi","memoryLimit":"2Gi"} |
Image Pre-Pull
Studio workspaces are launched on demand so that cluster resources are only consumed when a user needs them. The Studio and Fusion Engine images are larger than typical container images, and while the workspace containers start up quickly, there can be a delay while the images are pulled to the node.
To avoid this, you can enable a "Pre-Pull DaemonSet". It runs on each node and ensures the workspace images are already present before a workspace is created. Once the images are pulled, a lightweight "pause" container runs so that no further resources are consumed.
The Pre-Pull DaemonSet is disabled by default. It can be customised in the following ways:
- To enable it, set
hosted-studio.prePullDaemonSet.enabled=true. - If you need to override the pause container image (e.g. for an air-gapped install), you can do this by providing the desired image under
hosted-studio.prePullDaemonSet.pauseContainer. The default image isregistry.k8s.io/pause:3.10.
| Key | Description | Default |
|---|---|---|
hosted-studio.prePullDaemonSet.enabled | Deploy a DaemonSet that pre-pulls the Studio and Fusion Engine workspace images onto each node ahead of first use. | false |
hosted-studio.prePullDaemonSet.pauseContainer | The pause container image run once the workspace images are pulled. Override for an air-gapped install. | "registry.k8s.io/pause:3.10" |
The Pre-Pull DaemonSet schedules with the same hosted-studio.manager.studioNodeSelector and hosted-studio.manager.studioTolerations as the workspace pods, so the images are pre-pulled onto the nodes where workspaces will actually run.
Workspace Lifecycle
A clean-up task runs on a schedule and reclaims idle workspaces. Thresholds accept the suffixes m (minutes), h (hours), d (days), w (weeks), and M (months, approximated as 30 days).
| Key | Description | Default |
|---|---|---|
hosted-studio.manager.lifeCycle.cronExpression | How often the cleanup task runs to sleep or delete inactive workspaces. | "0 * * * *" |
hosted-studio.manager.lifeCycle.sleepThreshold | How long a workspace can be inactive before it enters sleep mode (for example, 30m, 2h, 7d). | "2h" |
hosted-studio.manager.lifeCycle.deleteThreshold | How long a workspace can be inactive before it is permanently deleted (default 2 months). | "2M" |
RLM Licensing
By default the bundled rlm-hosted-studio sub-chart is deployed to license Fusion Engine. To use an external RLM server instead, set hosted-studio.rlm-hosted-studio.enabled to false and point hosted-studio.manager.rlmHost at your RLM host.
| Key | Description | Default |
|---|---|---|
hosted-studio.manager.rlmHost | Hostname of the RLM license server. Defaults to the bundled rlm-hosted-studio service. | "rlm-hosted-studio" |
hosted-studio.rlm-hosted-studio.enabled | Whether to deploy the bundled RLM (Reprise License Manager) sub-chart. | true |
hosted-studio.rlm-hosted-studio.existingSecretName | Name of an existing secret containing the eggPlantFunctional.lic and licensedMacAddress keys. | nil |
hosted-studio.rlm-hosted-studio.license | The RLM license content. Used instead of existingSecretName. | nil |
hosted-studio.rlm-hosted-studio.licensedMacAddress | The MAC address the license is tied to. Used instead of existingSecretName. | nil |
Network Policies
Network policies restrict the network access of Hosted Studio workspaces. They are disabled by default and can be enabled to limit egress from workspace pods.
| Key | Description | Default |
|---|---|---|
hosted-studio.networkPolicies.enabled | Set to true to deploy network policies for Hosted Studio. | false |
hosted-studio.networkPolicies.allowedDnsServers | CIDRs of DNS servers that pods are allowed to reach. | [] |
hosted-studio.networkPolicies.apiServerCidrs | CIDRs of the Kubernetes API server, required for the manager to manage workspaces. | [] |
hosted-studio.networkPolicies.gatewayNamespace | Namespace of the gateway, used to allow inbound traffic to the manager. | nil |
hosted-studio.networkPolicies.workspaceEgressBlockedCidrs | CIDRs that workspace egress traffic is blocked from reaching. | [] |