Kubernetes用の管理エージェントHelmのインストール¶

# Create a namespace for your ingress resources
kubectl create namespace ingress-mlops

# Add the ingress-nginx repository
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

# Use Helm to deploy an NGINX ingress controller
#
# These settings should be considered sane defaults to help quickly get you started.
# You should consult the official documentation to determine the best settings for
# your expected prediction load. With Helm, it is trivial to change any of these
# settings down the road.
helm install nginx-ingress ingress-nginx/ingress-nginx \
    --namespace ingress-mlops \
    --set controller.ingressClassResource.name=mlops \
    --set controller.autoscaling.enabled=true \
    --set controller.autoscaling.minReplicas=2 \
    --set controller.autoscaling.maxReplicas=3 \
    --set controller.config.proxy-body-size=51m \
    --set controller.config.proxy-read-timeout=605s \
    --set controller.config.proxy-send-timeout=605s \
    --set controller.config.proxy-connect-timeout=65s \
    --set controller.metrics.enabled=true 

repos="datarobot/mlops-management-agent
datarobot/mlops-tracking-agent
datarobot/datarobot-portable-prediction-api
mlops/frozen-model"
for repo in $repos; do
aws ecr create-repository --repository-name $repo
done 

eksctl create iamserviceaccount --approve \
    --cluster <your-cluster-name> \
    --namespace datarobot-mlops \
    --name datarobot-management-agent-image-builder \
    --attach-policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser 

{ "credsStore": "ecr-login" } 

kubectl create configmap docker-config \
    --namespace datarobot-mlops \
    --from-file=<path to config.json> 

imageBuilder:
…
configMap: "docker-config"
serviceAccount:
    create: false
    name: "datarobot-management-agent-image-builder" 

kubectl create secret docker-registry registry-creds \
    --namespace datarobot-mlops \
    --docker-server=<container-registry-name>.azurecr.io \
    --docker-username=<admin-username> \
    --docker-password=<admin-password> 

imageBuilder:
…
secretName: "registry-creds" 

# Enable workload identity on your existing cluster
gcloud container clusters update <CLUSTER-NAME> \
--workload-pool=<PROJECT-NAME>.svc.id.goog

# Enable workload identity on an existing node pool
gcloud container node-pools update <NODE-POOL-NAME> \
--cluster=<CLUSTER-NAME> \
--workload-metadata=GKE_METADATA 

# Create Service Account
gcloud iam service-accounts create gcr-push-user

# Give user push access to GCR
gcloud projects add-iam-policy-binding <PROJECT-NAME> \
--member=serviceAccount:[gcr-push-user]@<PROJECT-NAME>.iam.gserviceaccount.com \
--role=roles/cloudbuild.builds.builder

# Link GKE ServiceAccount with the IAM Service Account
gcloud iam service-accounts add-iam-policy-binding \
--role roles/iam.workloadIdentityUser \
--member "serviceAccount:<PROJECT-NAME>.svc.id.goog[datarobot-mlops/datarobot-management-agent-image-builder]" \
gcr-push-user@<PROJECT-NAME>.iam.gserviceaccount.com 

imageBuilder:
…
serviceAccount:
    create: true
    annotations: {
    iam.gke.io/gcp-service-account: gcr-push-user@<PROJECT-NAME>.iam.gserviceaccount.com
    }
    name: datarobot-management-agent-image-builder 

oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge 

oc new-project datarobot-mlops
oc create sa datarobot-management-agent-image-builder

# Allows the SA to push to the registry
oc policy add-role-to-user registry-editor -z datarobot-management-agent-image-builder

# Our Docker builds require the ability to run as `root` to build our images
oc adm policy add-scc-to-user anyuid -z datarobot-management-agent-image-builder 

$ oc describe sa/datarobot-management-agent-image-builder

Name:                datarobot-management-agent-image-builder
Namespace:           datarobot-mlops
Labels:              <none>
Annotations:         <none>
Image pull secrets:  datarobot-management-agent-image-builder-dockercfg-p6p5b
Mountable secrets:   datarobot-management-agent-image-builder-dockercfg-p6p5b
                    datarobot-management-agent-image-builder-token-pj9ks
Tokens:              datarobot-management-agent-image-builder-token-p6dnc
                    datarobot-management-agent-image-builder-token-pj9ks
Events:              <none> 

$ oc describe secret $(oc get secret/datarobot-management-agent-image-builder-dockercfg-p6p5b -o jsonpath='{.metadata.annotations.openshift\.io/token-secret\.name}')

Name:         datarobot-management-agent-image-builder-token-p6dnc
Namespace:    datarobot-mlops
Labels:       <none>
Annotations:  kubernetes.io/created-by: openshift.io/create-dockercfg-secrets
            kubernetes.io/service-account.name: datarobot-management-agent-image-builder
            kubernetes.io/service-account.uid: 34101931-d402-49bf-83df-7a60b31cdf44

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:          11253 bytes
namespace:       10 bytes
service-ca.crt:  12466 bytes
token:           eyJhbGciOiJSUzI1NiIsImtpZCI6InJqcEx5LTFjOElpM2FKRzdOdDNMY… 

oc create secret docker-registry registry-creds \
    --docker-server=image-registry.openshift-image-registry.svc:5000 \
    --docker-username=imagebuilder \
    --docker-password=eyJhbGciOiJSUzI1NiIsImtpZCI6InJqcEx5LTFjOElpM2FKRzdOdDNMY… 

imageBuilder:
…
secretName: registry-creds

rbac:
    create: false
serviceAccount:
    create: false
    name: datarobot-management-agent-image-builder 

imageBuilder:
…
skipSslVerifyRegistries:
    - image-registry.openshift-image-registry.svc:5000 

imageBuilder:
…
extraVolumes:
    - name: cacert
    hostPath:
        path: /etc/docker/certs.d

extraVolumeMounts:
    - name: cacert
    mountPath: /certs/
    readOnly: true

extraArguments:
    - --registry-certificate=image-registry.openshift-image-registry.svc:5000=/certs/image-registry.openshift-image-registry.svc:5000/ca.crt 

oc adm policy add-scc-to-user hostmount-anyuid -z datarobot-management-agent-image-builder 

kubectl create secret docker-registry registry-creds \
    --namespace datarobot-mlops \
    --docker-server=<container-registry-name>.your-company.com \
    --docker-username=<push-username> \
    --docker-password=<push-password> 

imageBuilder:
…
secretName: "registry-creds"  

imageBuilder:
…
secretName: "registry-creds"
insecureRegistries:
    - <container-registry-name>.your-company.com