You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When you generate and apply kubernetes resources, an ingress is created to manage external traffic to Kubernetes services. The AWS Appliction Load Balancer(ALB) Ingress Controller will provision an Application Load balancer for that ingress. By default, TLS and authentication are not enabled at creation time.
14
14
15
-
The Kubeflow community plans to move from [Ambassador](https://www.getambassador.io/) to [Istio](https://istio.io/) to manage internal traffic (see [this issue](https://github.com/kubeflow/kubeflow/issues/2261)). Currently, [Ambassador](https://www.getambassador.io/) still plays the role of an API gateway. TLS, authentication, and authorization either can be done at the ALB or Istio layer for the AWS platform, and we plan to have Istio forward ingress traffic to the Istio gateway and then on to Ambassador when this happens. Once receive a clear direction from the community, we will enable TLS and authentication by default.
15
+
In Kubeflow 0.6 release, community already move from [Ambassador](https://www.getambassador.io/) to [Istio](https://istio.io/) to manage internal traffic. In AWS solution, TLS, authentication,can be done at the ALB and and authorization can be done at Istio layer.
16
16
17
17
18
18
## Enable TLS and Authentication
@@ -39,17 +39,24 @@ To get TLS support from the ALB Ingress Controller, you need to follow [this tut
39
39
40
40
In order to authenticate and manage users for Kubeflow, let's create a user pool. You can follow these instructions here. Once a user pool created, we will have a `UserPoolId`, a Cognito Domain name, and a Cognito Pool Arn.
41
41
42
-
Before you apply k8s, you can go into ${KUBEFLOW_SRC}/${KFAPP}/ks_app,
42
+
Before you `generate all -V`, please update Cognito spec in `app.yaml` like this,
43
43
44
44
```
45
-
ks param set istio-ingress CognitoUserPoolArn arn:aws:cognito-idp:us-west-2:xxx:userpool/xxx
46
-
ks param set istio-ingress CognitoAppClientId xxxxxx
47
-
ks param set istio-ingress CognitoUserPoolDomain xxxx
48
-
ks param set istio-ingress enableCognito true
49
-
ks param set istio-ingress certArn arn:aws:acm:us-west-2:xxx:certificate/xxxe4031c
Copy file name to clipboardExpand all lines: content/docs/aws/deploy/existing-cluster.md
+29-13
Original file line number
Diff line number
Diff line change
@@ -9,16 +9,26 @@ This is one step of [installing Kubeflow](/docs/aws/deploy/install-kubeflow), pl
9
9
10
10
### Deploy Kubeflow on existing Amazon EKS Cluster
11
11
12
-
If you would like to deploy Kubeflow on existing Amazon EKS cluster, the only difference in setup is when you initialize the platform setup. Since you manage your own cluster resources, you need to provide `AWS_CLUSTER_NAME`and `AWS_NODEGROUP_ROLE_NAMES`.
12
+
If you would like to deploy Kubeflow on existing Amazon EKS cluster, the only difference in setup is when you initialize the platform setup. Since you manage your own cluster resources, you need to provide `AWS_CLUSTER_NAME`, `cluster region`and `worker roles`.
13
13
14
+
1. Download `kfctl` binary and config file
15
+
16
+
```shell
17
+
# Add kfctl to PATH, to make the kfctl binary easier to use.
1. Retrieve the Amazon EKS cluster name, AWS Region, and IAM role name for your worker nodes. Set these values to the following environment variables.
26
+
27
+
1. Retrieve the Amazon EKS cluster name, AWS Region, and IAM role name foryour worker nodes. Set these valuesin the manifest file.
16
28
17
29
```shell
18
-
export KFAPP=kfapp
19
-
export REGION=<YOUR EKS CLUSTER REGION>
20
30
export AWS_CLUSTER_NAME=<YOUR EKS CLUSTER NAME>
21
-
exportAWS_NODEGROUP_ROLE_NAMES=<YOUR NODE GROUP ROLE NAMES>
31
+
exportKFAPP=${AWS_CLUSTER_NAME}
22
32
```
23
33
24
34
> Note: To get your Amazon EKS worker node IAM role name, you can check IAM setting by running the following commands. This command assumes that you used `eksctl` to create your cluster. If you use other provisioning tools to create your worker node groups, please find the role that is associated with your worker nodes in the Amazon EC2 console.
@@ -33,15 +43,21 @@ If you would like to deploy Kubeflow on existing Amazon EKS cluster, the only di
If you have multiple node groups, you will see corresponding number of node group roles. In that case, please provide the role names as a comma-separated list.
46
+
Change cluster region and worker roles names in your `kfctl_aws.yaml`
All rest steps are exact same for both install kubeflow on new cluster and existing cluster. Please come back to [Installing Kubeflow](/docs/aws/deploy/install-kubeflow) to finish post installation step.
Copy file name to clipboardExpand all lines: content/docs/aws/deploy/install-kubeflow.md
+79-91
Original file line number
Diff line number
Diff line change
@@ -4,12 +4,9 @@ description = "Instructions for deploying Kubeflow with the shell"
4
4
weight = 4
5
5
+++
6
6
7
-
This guide describes how to use the `kfctl.sh` script to
7
+
This guide describes how to use the `kfctl` golang cli to
8
8
deploy Kubeflow on Amazon Web Services (AWS).
9
9
10
-
> Note: Amazon Web Services (AWS) is moving from `kfctl.sh` to a command line interface (CLI) which gives you more control over your configuration and better reliability. It's under development and will be released around end of June.
@@ -19,136 +16,127 @@ deploy Kubeflow on Amazon Web Services (AWS).
19
16
* Enter your Access Keys ([Access Key ID and Secret Access Key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys)).
20
17
* Enter your preferred AWS Region and default output options.
21
18
* Install [eksctl](https://github.com/weaveworks/eksctl) (version 0.1.31 or newer) and the [aws-iam-authenticator](https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html).
You do not need to have an existing Amazon Elastic Container Service for Kubernetes (Amazon EKS) cluster. The deployment process will create a cluster for you.
25
21
26
22
The installation tool uses the `eksctl` command and doesn't support the `--profile` option in that command.
27
23
If you need to switch role, use the `aws sts assume-role` commands. See the AWS guide to [using temporary security credentials to request access to AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html).
28
24
29
25
30
-
## Understanding the deployment process
31
-
32
-
The deployment process is controlled by 4 different commands:
26
+
## Kubeflow installation
33
27
34
-
***init** - The initial one-time set up.
35
-
***generate** - Creates the configuration files that define your various resources.
36
-
***apply** - Creates or updates the resources.
37
-
***delete** - Deletes the resources.
28
+
1. Download the latest `kfctl` golang binary from [Kubeflow release page](https://github.com/kubeflow/kubeflow/releases) and unpack it.
38
29
39
-
With the exception of `init`, all commands take an argument which describes the set of resources to apply the command to; this argument can be one of the following:
30
+
```
31
+
# Add kfctl to PATH, to make the kfctl binary easier to use.
32
+
tar -xvf kfctl_<release tag>_<platform>.tar.gz
33
+
export PATH=$PATH:"<path to kfctl>"
34
+
```
40
35
41
-
***platform** - All AWS resources; that is, anything that doesn’t run on Kubernetes. Like IAM policy attachments, Amazon EKS cluster creation, etc.
42
-
***k8s** - All Kubernetes resources. Such as Kubeflow packages and add-on packages like `fluentd` or `istio`.
Your Kubeflow `app` directory contains the following files and directories:
44
+
* `kfctl_aws.yaml` is one of setup manifests, please check [kfctl_aws_cognito.yaml](https://github.com/kubeflow/kubeflow/blob/master/bootstrap/config/kfctl_aws_cognito.yaml) for the template to enable authentication.
48
45
49
-
***app.yaml** - Defines the configuration related to your Kubeflow deployment.
50
-
* These values are set when you run `kfctl init`.
51
-
* These values are snapshotted inside `app.yaml` to make your app self contained.
52
-
***${KFAPP}/aws_config** - A directory that contains a sample `eksctl` cluster configuration file that defines the AWS cluster and policy files to attach to your node group roles.
53
-
* This directory is created when you run `kfctl.sh generate platform`.
54
-
* You can modify the `cluster_config.yaml` and `cluster_features.sh` files to customize your AWS infrastructure.
55
-
***${KFAPP}/k8s_specs** - A directory that contains YAML specifications for daemons deployed on your Kubernetes Engine cluster.
56
-
***kustomize** is a directory that contains the kustomize packages for Kubeflow applications.
57
-
* The directory is created when you run `kfctl generate`.
58
-
* You can customize the Kubernetes resources (modify the manifests and run `kfctl apply` again).
46
+
- If you plan to use `kfctl` to create a new eks cluster, please remove follow lines in the manifest file.
47
+
- If you want to install on existing EKS cluster, please change roles to your worker node group roles. See [existing cluster](/docs/aws/deploy/existing-cluster) for details.
59
48
60
-
The provisioning scripts can either bring up a new cluster and install Kubeflow on it, or you can install Kubeflow on your existing cluster. We recommend that you create a new cluster for better isolation.
* KUBEFLOW_SRC - Full path to your preferred download directory. Please use the full absolute path, for example `/tmp/kubeflow-aws`
71
+
* KFAPP - Use a relative directory name here rather than absolute path, such as `kfapp`. It will be used as eks cluster name.
72
+
* CONFIG - Path to the configuration file
78
73
79
-
1. Run the following commands to set up your environment and initialize the cluster.
80
74
81
-
> Note: If you would like to install Kubeflow on your existing EKS cluster, please skip this step
82
-
> and follow the setup instructions for an [existing cluster](/docs/aws/deploy/existing-cluster) instead.
83
-
> When you are finished, return here and resume with the next step.
75
+
*Important!!!* By default, these scripts create an AWS Application Load Balancer for Kubeflow that is open to public. This is good for development testing and for short term use, but we do not recommend that you use this configuration for production workloads.
84
76
77
+
To secure your installation, Follow the [instructions](/docs/aws/authentication) to add authentication.
1. Wait for all the resources to become ready in the `kubeflow` namespace.
81
+
```
82
+
kubectl -n kubeflow get all
94
83
```
95
84
85
+
1. Get Kubeflow service endpoint and copy link in browser.
96
86
97
-
* AWS_CLUSTER_NAME - Specify a unique name for your Amazon EKS cluster.
98
-
* KFAPP - Use a relative directory name here rather than absolute path, such as `kfapp`.
99
-
* REGION - Use the AWS Region you want to create your cluster in.
100
-
101
-
1. Generate and apply platform changes.
102
-
103
-
You can customize your cluster configuration, control plane logging, and private cluster endpoint access before you `apply platform`, please see [Customizing Kubeflow on AWS](/docs/aws/customizing-aws) for more information.
> Note: If you see `no kind "ClusterConfig" is registered for version "eksctl.io/v1alpha5"` error, it means your eksctl version is low and not compatible with latest version. Please upgrade it and have another try.
94
+
This deployment may take 3-5 minutes to become ready. Verify that the address works by opening it in your preferred Internet browser. You can also run `kubectl delete istio-ingress -n istio-system` to remove the load balancer entirely.
113
95
114
-
1. Generate and apply the Kubernetes changes.
96
+
## Post Installation
115
97
116
-
```shell
117
-
${KUBEFLOW_SRC}/scripts/kfctl.sh generate k8s
118
-
```
98
+
Kubeflow 0.6 release brings multi-tenancy support and user are not able to create notebooks in `kubeflow`, `default` namespace. Instead, please create a `Profile` using `kubectl apply -f profile.yaml` and profile controller will create new namespace and service account which is allowed to create notebook in that namespace.
119
99
120
-
__*Important!!!*__ By default, these scripts create an AWS Application Load Balancer for Kubeflow that is open to public. This is good for development testing and for short term use, but we do not recommend that you use this configuration for production workloads.
100
+
```yaml
101
+
apiVersion: kubeflow.org/v1alpha1
102
+
kind: Profile
103
+
metadata:
104
+
name: aws-sample-user
105
+
spec:
106
+
owner:
107
+
kind: User
108
+
name: aws-sample-user
109
+
```
121
110
122
-
To secure your installation, you have two options:
123
-
124
-
* Disable ingress before you `apply k8s`. Open `${KUBEFLOW_SRC}/${KFAPP}/env.sh` and edit the `KUBEFLOW_COMPONENTS` environment variable. Delete `,\"alb-ingress-controller\",\"istio-ingress\"` and save the file.
111
+
## Understanding the deployment process
125
112
126
-
* Follow the [instructions](/docs/aws/authentication) to add authentication before you `apply k8s`
113
+
The deployment process is controlled by 4 different commands:
127
114
128
-
Once your customization is done, you can run this command to deploy Kubeflow.
129
-
```shell
130
-
${KUBEFLOW_SRC}/scripts/kfctl.sh apply k8s
131
-
```
115
+
***init** - The initial one-time set up.
116
+
***generate** - Creates the configuration files that define your various resources.
117
+
***apply** - Creates or updates the resources.
118
+
***delete** - Deletes the resources.
132
119
133
-
1. Wait forall the resources to become readyin the `kubeflow` namespace.
134
-
```
135
-
kubectl -n kubeflow get all
136
-
```
120
+
With the exception of `init`, all commands take an argument which describes the set of resources to apply the command to; this argument can be one of the following:
137
121
138
-
1. Open Kubeflow Dashboard
139
-
* If you chose to use a load balancer, you can retrieve the public DNS name here.
122
+
***platform** - All AWS resources; that is, anything that doesn’t run on Kubernetes. Like IAM policy attachments, Amazon EKS cluster creation, etc.
123
+
***k8s** - All Kubernetes resources. Such as Kubeflow packages and add-on packages like `fluentd` or `istio`.
Your Kubeflow `app` directory contains the following files and directories:
147
129
148
-
This deployment may take 3-5 minutes to become ready. Verify that the address works by opening it in your preferred Internet browser. You can also run `kubectl delete istio-ingress -n istio-system` to remove the load balancer entirely.
130
+
***app.yaml** - Defines the configuration related to your Kubeflow deployment.
131
+
* These values are set when you run `kfctl init`.
132
+
* These values are snapshotted inside `app.yaml` to make your app self contained.
133
+
***${KFAPP}/aws_config** - A directory that contains a sample `eksctl` cluster configuration file that defines the AWS cluster and policy files to attach to your node group roles.
134
+
* This directory is created when you run `kfctl generate platform -V`.
135
+
* You can modify the `cluster_config.yaml` and `cluster_features.yaml` files to customize your AWS infrastructure.
136
+
***kustomize** is a directory that contains the kustomize packages for Kubeflow applications.
137
+
* The directory is created when you run `kfctl generate`.
138
+
* You can customize the Kubernetes resources (modify the manifests and run `kfctl apply` again).
149
139
150
-
* If you didn't create a load balancer, please use port-forwarding to visit your cluster. Run following command and visit `localhost:8080`.
140
+
The provisioning scripts can either bring up a new cluster and install Kubeflow on it, or you can install Kubeflow on your existing cluster. We recommend that you create a new cluster for better isolation.
0 commit comments