diff --git a/docs/gpu-k8s-role.md b/docs/gpu-k8s-role.md
index fc510b9..2f7904d 100644
--- a/docs/gpu-k8s-role.md
+++ b/docs/gpu-k8s-role.md
@@ -31,6 +31,17 @@ sealos run \
   --cmd "kubeadm init --skip-phases=addon/kube-proxy"
 ```
 
+By default the role runs the command as root. Set `root_mode` to `false` to
+deploy in rootless mode, which adds `--user` and `--pk` options pointing to the
+SSH key for `ssh_user`. In rootless mode the host running Sealos must have
+`newuidmap` and `newgidmap` installed (typically provided by the `uidmap`
+package) along with the `fuse-overlayfs` binary to enable user namespaces.
+
+If deploying with a non-root user the command also requires `--user` and
+`--pk` options pointing to the user's SSH key. The host running Sealos must have
+`newuidmap` and `newgidmap` installed (typically provided by the `uidmap` package) 
+along with the `fuse-overlayfs` binary to enable user namespaces.
+
 
 After the cluster is running the role installs the NVIDIA device plugin and runs a test pod to ensure `nvidia-smi` works inside the cluster.
 
@@ -47,6 +58,9 @@ Add the role to your playbook along with the `ssh-trust` role which configures p
 
 
 
+Set `root_mode` to `false` if you want the playbook to operate as this user
+instead of root, enabling rootless deployment of the cluster.
+
 
 Example playbook snippet defining the IP lists:
 
diff --git a/playbooks/roles/vhosts/gpu-k8s/defaults/main.yml b/playbooks/roles/vhosts/gpu-k8s/defaults/main.yml
index 7eb77f6..c18f3ce 100644
--- a/playbooks/roles/vhosts/gpu-k8s/defaults/main.yml
+++ b/playbooks/roles/vhosts/gpu-k8s/defaults/main.yml
@@ -9,3 +9,6 @@ master_ips: []  # List of up to three master node IPs
 node_ips: []    # List of worker node IPs
 sealos_cmd_env: '{}'
 kubeadm_init_cmd: "kubeadm init --skip-phases=addon/kube-proxy"
+ssh_user: "{{ ansible_user | default('root') }}"
+ssh_private_key: "{{ ansible_ssh_private_key_file | default('~/.ssh/id_rsa') }}"
+root_mode: true
diff --git a/playbooks/roles/vhosts/gpu-k8s/meta/main.yml b/playbooks/roles/vhosts/gpu-k8s/meta/main.yml
index 9711b33..b119bda 100644
--- a/playbooks/roles/vhosts/gpu-k8s/meta/main.yml
+++ b/playbooks/roles/vhosts/gpu-k8s/meta/main.yml
@@ -1,2 +1,2 @@
 dependencies:
-  - role: common
+  - role: vhosts/common
diff --git a/playbooks/roles/vhosts/gpu-k8s/tasks/install_cluster.yml b/playbooks/roles/vhosts/gpu-k8s/tasks/install_cluster.yml
index 6404441..d9c63ce 100644
--- a/playbooks/roles/vhosts/gpu-k8s/tasks/install_cluster.yml
+++ b/playbooks/roles/vhosts/gpu-k8s/tasks/install_cluster.yml
@@ -78,8 +78,8 @@
 - name: Verify passwordless SSH access to all cluster nodes
   shell: >-
     ssh -o BatchMode=yes -o StrictHostKeyChecking=no \
-    -i {{ ansible_ssh_private_key_file | default('~/.ssh/id_rsa') }} \
-    root@{{ item }} hostname
+    -i {{ ssh_private_key }} \
+    {{ (root_mode | ternary('root', ssh_user | default(ansible_ssh_user | default(ansible_user, true) | default('root')))) }}@{{ item }} hostname
   loop: "{{ master_ips + node_ips }}"
   delegate_to: "{{ ops_host | default(masters | default(master_ips) | first) }}"
   become: false
@@ -95,6 +95,10 @@
       {{ labring_registry.stdout }}/helm:{{ helm_version }} \
       --masters {{ master_ips | join(',') }} \
       --nodes {{ node_ips | join(',') }} \
+{% if not root_mode %}
+      --user {{ ssh_user }} \
+      --pk {{ ssh_private_key }} \
+{% endif %}
       --env '{{ sealos_cmd_env }}' \
       --cmd "{{ kubeadm_init_cmd }}"
   args:
diff --git a/playbooks/roles/vhosts/ssh-trust/defaults/main.yml b/playbooks/roles/vhosts/ssh-trust/defaults/main.yml
index 4947ca7..0ad6beb 100644
--- a/playbooks/roles/vhosts/ssh-trust/defaults/main.yml
+++ b/playbooks/roles/vhosts/ssh-trust/defaults/main.yml
@@ -1 +1,3 @@
-# Default variables for ssh-trust role
+# Default user for generating and installing SSH key
+ssh_user: "{{ ansible_user | default('root') }}"
+root_mode: true
diff --git a/playbooks/roles/vhosts/ssh-trust/tasks/main.yml b/playbooks/roles/vhosts/ssh-trust/tasks/main.yml
index 38b9829..5a1549c 100644
--- a/playbooks/roles/vhosts/ssh-trust/tasks/main.yml
+++ b/playbooks/roles/vhosts/ssh-trust/tasks/main.yml
@@ -6,7 +6,8 @@
   delegate_to: "{{ ops_host }}"
   run_once: true
   become: true
-  become_user: root
+  become_user: "{{ root_mode | ternary('root', ssh_user) }}"
+
 
 - name: Fetch ops host public key
   slurp:
@@ -15,9 +16,9 @@
   delegate_to: "{{ ops_host }}"
   run_once: true
   become: true
-  become_user: root
+  become_user: "{{ root_mode | ternary('root', ssh_user) }}"
 
 - name: Authorize ops host key on cluster hosts
   ansible.builtin.authorized_key:
-    user: root
+    user: "{{ root_mode | ternary('root', ssh_user) }}"
     key: "{{ ops_pub_key.content | b64decode }}"