56 results available
Sign in
Skills directory

dynamo-troubleshoot

nvidia

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 6 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 0. Classified findings remaining: 6. Unclassified scanner findings remaining: 0. Review findings closed: 6. Review findings remaining: 15.


Open before hardening

5

Medium

1

Low
Open after hardening

5

Medium

1

Low

Expand
File
Group
Subtype
Severity
Status
references/failure-decision-tree.md

Sensitive Data & Secret Exposure

Data exfiltration

Medium
Open
SKILL.md

Tool & MCP Manipulation

MCP over-permissioning

Medium
Open
scripts/collect_dynamo_debug_bundle.py

Malicious Code & Command Execution

Dynamic code execution

Medium
Open
BENCHMARK.md

Sensitive Data & Secret Exposure

Agent snooping

Medium
Open
SKILL.md

Prompt Injection

Indirect prompt injection

Medium
Open
references/failure-decision-tree.md

Privilege Escalation & Host / Cloud Compromise

SSRF and cloud metadata access

Low
Open

6 findings


SKILL.md

Dynamo Troubleshoot

<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. SPDX-License-Identifier: CC-BY-4.0 -->

Purpose

Turn a Dynamo failure into a clear problem class, strongest signal, and next action. Start with read-only evidence, avoid secrets, and fix one layer at a time.

Prerequisites

  • Python 3.10+ on the operator machine.
  • kubectl configured with read access to the target namespace.
  • Permission to read pods, events, jobs, PVCs, and DynamoGraphDeployment resources (NOT secrets).
  • Network reachability to the cluster API server.

Instructions

1. Collect A Read-Only Bundle

Run:

python3 scripts/collect_dynamo_debug_bundle.py \
  --namespace "${NAMESPACE}"

If the user names a deployment, include it:

python3 scripts/collect_dynamo_debug_bundle.py \
  --namespace "${NAMESPACE}" \
  --deployment-name <deployment-name>

Do not collect Kubernetes secrets. Do not print Hugging Face tokens.

2. Classify The Failure

Use references/failure-decision-tree.md and classify into one primary bucket:

  • cluster/platform
  • namespace/secret
  • model cache/PVC/download
  • image pull/runtime image
  • GPU scheduling/resources
  • operator/DynamoGraphDeployment reconciliation
  • frontend/router
  • worker/backend
  • endpoint/API
  • benchmark/perf job

3. Debug Top Down

Check in this order:

  1. namespace, storage class, GPU nodes
  2. PVC and model-download job
  3. DynamoGraphDeployment status and events
  4. pod status, describe pod, and container logs
  5. frontend service and port-forward
  6. /v1/models
  7. /v1/chat/completions
  8. benchmark job only after endpoint smoke test passes

4. Fix One Layer At A Time

Prefer the smallest reversible change:

  • create missing namespace or HF secret
  • patch storageClassName
  • patch image pull secret
  • reduce GPU request only if the recipe can still be valid
  • switch KV router to approximate mode only if workers do not publish events
  • restart failed jobs after fixing the underlying config

After each fix, rerun the relevant readiness check before moving deeper.

Available Scripts

ScriptPurposeArguments

scripts/collect_dynamo_debug_bundle.py

Collect a read-only debug bundle (pods, events, jobs, PVCs, CR status)

--namespace, --deployment-name

Invoke via the agentskills.io run_script() protocol:

run_script("scripts/collect_dynamo_debug_bundle.py", args=["--namespace", "dynamo-demo"])

Examples

Collect everything in a namespace for triage:

python3 scripts/collect_dynamo_debug_bundle.py --namespace dynamo-demo

Scope to a single failing deployment:

python3 scripts/collect_dynamo_debug_bundle.py \
  --namespace dynamo-demo \
  --deployment-name qwen-vllm-disagg

Equivalent through the agent protocol:

run_script("scripts/collect_dynamo_debug_bundle.py", args=["--namespace", "dynamo-demo", "--deployment-name", "qwen-vllm-disagg"])

Output Contract

Return:

  • problem class
  • evidence checked
  • strongest signal
  • likely cause
  • exact next command or patch
  • what was ruled out
  • whether it is safe to continue deployment or benchmarking

Limitations

  • Read-only. Never mutates the cluster; remediation commands are returned, not executed.
  • Will not collect secrets or print Hugging Face tokens; some failure modes (auth) may need user-side inspection.
  • Bundle size grows with deployment size; on very large namespaces, scope with --deployment-name.
  • Does not validate disagg transport — use dynamo-interconnect-check for that.

Troubleshooting

SymptomLikely causeNext step

kubectl returns Forbidden on events/pods

Service account lacks read RBAC

Ask operator for read-only role binding on the namespace

Bundle missing DynamoGraphDeployment status

Operator not installed or different namespace

Verify dynamo-platform operator is installed and watching the namespace

Model-download job in Pending

PVC unbound or HF secret missing

Fix PVC binding or create the named HF secret, then rerun the job

Worker pods CrashLoopBackOff

Image/runtime mismatch or GPU not available

Inspect container logs; check nvidia.com/gpu allocatable on nodes

Benchmark

See BENCHMARK.md for the NVCARPS-EVAL performance report (auto-generated by the NVSkills CI pipeline).

References

  • Read references/failure-decision-tree.md for bucket-specific checks.
  • Use scripts/collect_dynamo_debug_bundle.py for read-only bundle collection.

Install

Install with chainctl
chainctl skill install public/nvidia/dynamo-troubleshoot:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/nvidia/skills
Upstream commitefd358a207cd9ab26db8296467f340efe4bfb9d7
OCI reference

skills.cgr.dev/public/github.com/nvidia/skills/dynamo-troubleshoot:latest

License

Apache-2.0

Files

BENCHMARK.md

HARDENING.md

LICENSE

SKILL.md

evals/evals.json

references/failure-decision-tree.md

scripts/collect_dynamo_debug_bundle.py

skill-card.md

skill.oms.sig


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.