Deploying Galileo on Amazon EKS

​

Setting Up Your Kubernetes Cluster with EKS, IAM, and Trust Policies for Galileo Applications

​

Prerequisites

• An AWS account with administrative access
• kubectl installed on your local machine
• aws-cli version 2 installed and configured
• Basic knowledge of Kubernetes, AWS EKS, and IAM policies

​

Setting Up the EKS Cluster

1. Create an EKS Cluster: Use the AWS Management Console or AWS CLI to create an EKS cluster in your preferred region. For CLI, use the command aws eks create-cluster with the necessary parameters.
2. Configure kubectl: Once your cluster is active, configure kubectl to communicate with your EKS cluster by running aws eks update-kubeconfig --region <region> --name <cluster_name>.

​

Configuring IAM Roles and Trust Policies

1. Create IAM Roles for EKS: Navigate to the IAM console and create a new role. Select “EKS” as the trusted entity and attach policies that grant required permissions for managing the cluster.
2. Set Up Trust Policies: Edit the trust relationship of the IAM roles to allow the EKS service to assume these roles on behalf of your Kubernetes pods.

​

Integrating Galileo DNS Endpoints

1. Determine Galileo DNS Endpoints: Identify the four DNS endpoints required by Galileo applications to function correctly. These typically include endpoints for database connections, API gateways, telemetry services, and external integrations.
2. Configure DNS in Kubernetes: Utilize ConfigMaps or external-dns controllers in Kubernetes to route your applications to the identified Galileo DNS endpoints effectively.

​

Deploying Galileo Applications

1. Prepare Application Manifests: Ensure your Galileo application Kubernetes manifests are correctly set up with the necessary configurations, including environment variables pointing to the Galileo DNS endpoints.
2. Deploy Applications: Use kubectl apply to deploy your Galileo applications onto the EKS cluster. Monitor the deployment status to ensure they are running as expected.

​

Step 0: (Optional) Deploying via AWS CloudShell

# Create directory
mkdir -p $HOME/.local/bin
cd $HOME/.local/bin

# eksctl
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl $HOME/.local/bin

​

Recommended Cluster Configuration

​

Step 1: Creating Roles and Policies for the Cluster

• Galileo IAM Policy: This policy is attached to the Galileo IAM Role. Add the following to a file called galileo-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eks:AccessKubernetesApi",
                "eks:DescribeCluster"
            ],
            "Resource": "arn:aws:eks:CLUSTER_REGION:ACCOUNT_ID:cluster/CLUSTER_NAME"
        }
    ]
}

• Galileo IAM Trust Policy: This trust policy enables an external Galileo user to assume your Galileo IAM Role to deploy changes to your cluster securely. Add the following to a file called galileo-trust-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::273352303610:role/GalileoConnect"],
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

• Galileo IAM Role with Policy: Role should only include the Galileo IAM Policy mentioned in this table. Create a file called create-galileo-role-and-policies.sh, make it executable with chmod +x create-galileo-role-and-policies.sh and run it. Make sure to run in the same directory as the json files created in the above steps.

#!/bin/sh -ex

aws iam create-policy --policy-name Galileo --policy-document file://galileo-policy.json
aws iam create-role --role-name Galileo --assume-role-policy-document file://galileo-trust-policy.json
aws iam attach-role-policy --role-name Galileo --policy-arn $(aws iam list-policies | jq -r '.Policies[] | select (.PolicyName == "Galileo") | .Arn')

​

Step 2: Deploying the EKS Cluster

eksctl create cluster -f galileo-cluster.yaml

​

Step 3: EKS IAM Identity Mapping

eksctl create iamidentitymapping
--cluster customer-cluster
--region your-region-id
--arn "arn:aws:iam::CUSTOMER-ACCOUNT-ID:role/Galileo"
--username galileo
--group system:masters

​

Step 4: Required Configuration Values

​

Step 5: Access to Deployment Logs

​

Step 6: Customer DNS Configuration

​

Creating a GPU-enabled Node Pool

1. Node Pool Creation: Use eksctl to create a node pool with an Amazon Machine Image (AMI) that supports GPUs. This example uses the g6.2xlarge instances and specifies a GPU-compatible AMI.
   Copy

   Ask AI

   eksctl create nodegroup --cluster your-cluster-name --name galileo-ml --node-type g6.2xlarge --nodes-min 1 --nodes-max 5 --node-ami ami-0656ebce2c7921ec0 --node-labels "galileo-node-type=galileo-ml" --region your-region-id
   

   In this command, replace your-cluster-name and your-region-id with your specific details. The --node-ami option is used to specify the exact AMI that supports CUDA and GPU workloads.
2. If the cluster has low usage and you want to save costs, you may also choose to use cheaper GPU like g4dn.2xlarge . Note that it only saves costs when the usage is too low to saturate one GPU, otherwise it would even cost more. And don’t choose this option if you use Protect that requires low real-time latency.

​

Using Managed RDS Postgres DB server

​

Creating RDS Aurora cluster

1. Go to AWS Console —> RDS Service and create a RDS Subnet group.

• Select the VPC in which EKS cluster is running.
• Select AZs A and B and the respective private subnets

1. Next Create a RDS aurora Postgres Cluster. Config for the cluster are listed below. General fields like cluster name, username, password etc can we enter as per cloud best practice.

1. Create K8s Secret

• Kubernetes resources: Add the following to a file called galileo-rds-details.yaml. Update all marker $ text with appropriate values. Then run kubectl apply -f galileo-rds-details.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: galileo
---
apiVersion: v1
kind: Secret
metadata:
  name: postgres
  namespace: galileo
type: Opaque
data:
  GALILEO_POSTGRES_USER: "${db_username}"
  GALILEO_POSTGRES_PASSWORD: "${db_username}"
  GALILEO_POSTGRES_REPLICA_PASSWORD: "${db_master_password}"
  GALILEO_DATABASE_URL_WRITE: "postgresql+psycopg2://${db_username}:${db_master_password}@${db_endpoint}/${database_name}"
  GALILEO_DATABASE_URL_READ: "postgresql+psycopg2://${db_username}:${db_master_password}@${db_endpoint}/${database_name}"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-datasources
  namespace: galileo
  labels:
    app: grafana
data:
  datasources.yaml: |
    apiVersion: 1
    datasources:
    - access: proxy
      isDefault: true
      name: prometheus
      type: prometheus
      url: "http://prometheus.galileo.svc.cluster.local:9090"
      version: 1
    - name: postgres
      type: postgres
      url: "${db_endpoint}"
      database: ${database_name}
      user: ${db_username}
      secureJsonData:
        password: ${db_master_password}
      jsonData:
        sslmode: "disable"
---