docs: address #137 follow-ups (helm install, key-manager API, anchors, gpu-operator note) (#142)

* docs: address issue #137 follow-ups (helm install, key-manager API, revocation, index links, spec.access anchor, gpu-operator note)

* docs: fix gpu-operator AMI framing, use version placeholder, clarify key revocation (review feedback)

Author: dcmcand

docs/src/content/docs/cicd-and-releasing.md

@@ -141,6 +141,25 @@ helm show values oci://quay.io/nebari/charts/nebari-llm-serving --version <versi
 
 To install a released version, see the [Installation](/installation/) guide. To work with a local development build, which reads `values.yaml` as committed (so `latest`-tagged images), see the [Local Development](/local-development/) page.
 
+## Installing a released chart directly
+
+The [Installation](/installation/) guide's ArgoCD Application is the recommended path on Nebari - it keeps the release version under GitOps and gets you `selfHeal`/drift correction for free. For a local or manual install (testing a release, a non-ArgoCD cluster, or just poking around), install the published chart directly with `helm install`:
+
+```bash
+# From the OCI registry (no repo add needed):
+helm install nebari-llm-serving \
+  oci://quay.io/nebari/charts/nebari-llm-serving --version <version> \
+  -n nebari-llm-serving-system --create-namespace -f my-values.yaml
+
+# Or via the Helm repo index:
+helm repo add nebari https://raw.githubusercontent.com/nebari-dev/helm-repository/gh-pages/
+helm repo update
+helm install nebari-llm-serving nebari/nebari-llm-serving --version <version> \
+  -n nebari-llm-serving-system --create-namespace -f my-values.yaml
+```
+
+Replace `<version>` with a released version (the newest is on the repository's Releases page). Both forms install the same packaged chart with the same pinned image shas (see [Releasing](#releasing) above); `my-values.yaml` should set at least `platform.baseDomain` and the other required values covered in [Configuration](/configuration/).
+
 ## Known Gaps
 
 - There is no chart-testing (`ct lint`) step that validates the chart against multiple Kubernetes versions. Contributions adding `helm/chart-testing-action` are welcome.

docs/src/content/docs/configuration.mdx

@@ -242,7 +242,7 @@ The operator writes these fields to `status`; they are read-only.
 | `spec.models.catchAll` | boolean | No | Route any model id not claimed by a more specific route. Served LLMModels always win (they match Host and `x-ai-eg-model`). |
 | `spec.models.declared` | []string | No | Explicit model ids; also advertised by the gateway's `/v1/models` (external route only) so UIs can build a picker. |
 
-### spec.access
+### spec.access (external provider)
 
 Same semantics as `LLMModel`: set `public: true` or list `groups` (see [spec.access](#specaccess) above).
 

docs/src/content/docs/index.md

@@ -40,6 +40,8 @@ Apply it, and the operator downloads the weights, starts vLLM, registers the mod
 inference scheduler, creates the internal and external routes, and gates them on the groups you
 listed. See the [Quickstart](/quickstart/) for the end-to-end flow.
 
+Ready-to-apply manifests are in [`examples/models/`](https://github.com/nebari-dev/llm-serving-pack/tree/main/examples/models) (minimal, gated-HuggingFace, OCI, quantized, and advanced-scheduling).
+
 ## What you get
 
 - **Declarative model serving** - one `LLMModel` CR per model; the operator reconciles the rest.

docs/src/content/docs/installation.md

@@ -350,6 +350,17 @@ spec:
         maxDuration: 3m
 ```
 
+> **Which values block to use.** The distinction is what your GPU node's AMI
+> already ships. The manifest above disables only the driver
+> (`driver.enabled: false`), so the operator still installs the container
+> toolkit and device plugin: use it when the AMI ships the NVIDIA driver but
+> not the toolkit, which is the case for NIC's AL2023 NVIDIA AMI. If your AMI
+> ships BOTH the driver and the toolkit, use the values in
+> [`examples/nvidia-gpu-operator.yaml`](https://github.com/nebari-dev/llm-serving-pack/blob/main/examples/nvidia-gpu-operator.yaml)
+> instead, which also sets `toolkit.enabled: false` so the operator adds only
+> the device plugin. If your nodes ship neither, set `driver.enabled: true` so
+> the operator installs the driver as well.
+
 `git push` the file. ArgoCD's `nebari-root` app-of-apps picks it up on
 its next refresh (typically within a minute; you can force it with
 `kubectl annotate application -n argocd nebari-root argocd.argoproj.io/refresh=hard --overwrite`).

docs/src/content/docs/quickstart.mdx

@@ -183,6 +183,18 @@ curl https://llm.your-cluster.example.com/v1/chat/completions \
   -d '{"model": "Qwen/Qwen3.5-35B-A3B-GPTQ-Int4", "messages": [{"role": "user", "content": "Hello"}]}'
 ```
 
+You can also mint a key from the command line instead of the UI. The key-manager exposes a REST API under the same hostname (`keyManager.nebariApp.hostname`, e.g. `keys.llm.<baseDomain>`):
+
+```bash
+# Mint a key via the API instead of the UI (bearer token = a Keycloak JWT):
+curl -X POST https://keys.llm.<baseDomain>/api/keys \
+  -H "Authorization: Bearer <your-jwt>" \
+  -H "Content-Type: application/json" \
+  -d '{"modelName": "Qwen/Qwen3.5-35B-A3B-GPTQ-Int4"}'
+```
+
+To revoke a key, delete it in the key manager UI, or call `DELETE /api/keys/{namespace}/{model}/{clientID}` with the same bearer token (the `namespace`, `model`, and `clientID` come from the mint response, or from `GET /api/keys`). A revoked key immediately returns 401 on the external route.
+
 ### Internal access (JWT from JupyterLab or in-cluster service)
 
 ```python

examples/nvidia-gpu-operator.yaml

@@ -2,9 +2,11 @@
 # Required for GPU nodes to advertise nvidia.com/gpu as an allocatable
 # resource. Without this, GPU-requiring pods stay Pending.
 #
-# If your nodes use a pre-installed NVIDIA driver AMI (like AWS
-# AL2023_x86_64_NVIDIA), disable driver and toolkit installation since
-# the AMI already includes both.
+# Use this values block when your GPU nodes boot from an AMI that ships BOTH
+# the NVIDIA driver and the container toolkit: it disables both so the
+# operator only adds the device plugin. If your AMI ships the driver but not
+# the toolkit (e.g. NIC's AL2023 NVIDIA AMI), keep toolkit enabled instead
+# (see the Installation guide's nvidia-gpu-operator step).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -24,9 +26,8 @@ spec:
     helm:
       releaseName: nvidia-gpu-operator
       values: |
-        # Disable driver and toolkit if using a pre-installed NVIDIA AMI.
-        # Remove these overrides if your nodes need the operator to install
-        # NVIDIA drivers.
+        # Disable driver and toolkit when the AMI ships both. Remove these
+        # overrides if your nodes need the operator to install the driver.
         driver:
           enabled: false
         toolkit: