Object Store¶

## create a secret for the KFP backend
kubectl create secret generic \
  "kubeflow-pipelines--backend-object-store-auth" \
  --namespace "kubeflow" \
  --from-literal AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE \
  --from-literal AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

## create a secret for the "team-1" profile
kubectl create secret generic \
  "kubeflow-pipelines--profile-object-store-auth--team-1" \
  --namespace "my-namespace" \
  --from-literal AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE \
  --from-literal AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

## create a secret for the "team-2" profile
kubectl create secret generic \
  "kubeflow-pipelines--profile-object-store-auth--team-2" \
  --namespace "my-namespace" \
  --from-literal AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE \
  --from-literal AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

deploykf_core:
  deploykf_profiles_generator:

    ## NOTE: each profile can override the defaults 
    ##       see under `profiles` for an example of a profile 
    ##       which overrides the default auth pattern
    ##
    profileDefaults:
      tools:
        kubeflowPipelines:
          objectStoreAuth:
            ## (OPTION 1):
            ##  - all profiles share the same access key (NOT RECOMMENDED)
            ##  - the `existingSecretAccessKeyKey` and `existingSecretSecretKeyKey`
            ##    reference the KEY NAMES in the Kubernetes Secret you create
            ##
            #existingSecret: "my-secret-name"
            #existingSecretNamespace: "my-namespace"
            #existingSecretAccessKeyKey: "AWS_ACCESS_KEY_ID"
            #existingSecretSecretKeyKey: "AWS_SECRET_ACCESS_KEY"

            ## (OPTION 2):
            ##  - each profile has its own access key
            ##  - instances of '{profile_name}' in `existingSecret` 
            ##    are replaced with the profile name
            ##  - the `existingSecretAccessKeyKey` and `existingSecretSecretKeyKey`
            ##    reference the KEY NAMES in the Kubernetes Secret you create
            ##
            existingSecret: "kubeflow-pipelines--profile-object-store-auth--{profile_name}"
            existingSecretNamespace: "my-namespace"
            existingSecretAccessKeyKey: "AWS_ACCESS_KEY_ID"
            existingSecretSecretKeyKey: "AWS_SECRET_ACCESS_KEY"

    ## example of a profile which overrides the default auth
    #profiles:
    #  - name: "my-profile"
    #    members: []
    #    tools:
    #      kubeflowPipelines:
    #        objectStoreAuth:
    #          existingSecret: "my-secret-name"
    #          existingSecretNamespace: "" # defaults to the profile's namespace
    #          existingSecretAccessKeyKey: "AWS_ACCESS_KEY_ID"
    #          existingSecretSecretKeyKey: "AWS_SECRET_ACCESS_KEY"

kubeflow_tools:
  pipelines:
    bucket:
      ## this specifies the name of your bucket (and region, if applicable)
      name: kubeflow-pipelines
      region: ""

    objectStore:
      useExternal: true

      ## this specifies the S3-compatible endpoint of your object store
      ##  - for S3 itself, you may need to use the region-specific endpoint
      ##  - don't set a port unless it is non-standard
      host: "s3.amazonaws.com"
      port: ""
      useSSL: true

      ## these credentials are used by the KFP backend (not profiles)
      auth:
        ## (OPTION 1):
        ##  - set keys with values (NOT RECOMMENDED)
        #accessKey: "AKIAIOSFODNN7EXAMPLE"
        #secretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

        ## (OPTION 2):
        ##  - read a kubernetes secret from the 'kubeflow' namespace
        ##  - note, `existingSecretKey` specifies the KEY NAMES in the 
        ##    secret itself, which contain the secret values
        existingSecret: "kubeflow-pipelines--backend-object-store-auth"
        existingSecretAccessKeyKey: "AWS_ACCESS_KEY_ID"
        existingSecretSecretKeyKey: "AWS_SECRET_ACCESS_KEY"

eksctl create iamserviceaccount \
  --cluster "my-cluster" \
  --namespace "kubeflow" \
  --name "ml-pipeline" \
  --role-name "kubeflow-pipelines-backend" \
  --attach-policy-arn "arn:aws:iam::MY_ACCOUNT_ID:policy/MY_POLICY_NAME" \
  --approve

deploykf_core:
  deploykf_profiles_generator:

    ## NOTE: if you want to have a different set of plugins for each profile,
    ##       for example, to have some profiles use a different IAM role,
    ##       you can define the `plugins` list explicitly in a profile 
    ##       to override the default plugins
    profileDefaults:
      plugins:
        - kind: AwsIamForServiceAccount
          spec:
            awsIamRole: "arn:aws:iam::MY_ACCOUNT_ID:role/MY_ROLE_NAME"
            AnnotateOnly: true

    ## example of a profile which overrides the default plugins
    #profiles:
    #  - name: "my-profile"
    #    members: []
    #    plugins:
    #      - kind: AwsIamForServiceAccount
    #        spec:
    #          awsIamRole: "arn:aws:iam::MY_ACCOUNT_ID:role/MY_ROLE_NAME"
    #          AnnotateOnly: true

kubeflow_dependencies:
  kubeflow_argo_workflows:
    controller:
      serviceAccount:
        annotations:
          eks.amazonaws.com/role-arn: "arn:aws:iam::MY_ACCOUNT_ID:role/MY_ROLE_NAME"
    server:
      serviceAccount:
        annotations:
          eks.amazonaws.com/role-arn: "arn:aws:iam::MY_ACCOUNT_ID:role/MY_ROLE_NAME"

kubeflow_tools:
  pipelines:
    serviceAccounts:
      apiServer:
        annotations:
          eks.amazonaws.com/role-arn: "arn:aws:iam::MY_ACCOUNT_ID:role/MY_ROLE_NAME"
      frontend:
        annotations:
          eks.amazonaws.com/role-arn: "arn:aws:iam::MY_ACCOUNT_ID:role/MY_ROLE_NAME"

    bucket:
      name: kubeflow-pipelines
      region: "us-west-2"

    objectStore:
      useExternal: true

      ## for IRSA, this should always be "s3.{region}.amazonaws.com" or similar
      host: "s3.us-west-2.amazonaws.com"
      useSSL: true

      auth:
        ## setting `fromEnv` to `true` disables all other auth methods
        ## so the AWS Credential Provider Chain will try to use IRSA-based auth
        fromEnv: true