Installing Optimizer Hub on AWS Elastic Kubernetes Service

Using Kubernetes Nodes and Permissions

To configure AWS S3 storage, use the following configuration. Ensure that your Kubernetes nodes with opthub-compilebroker and opthub-gateway have RW permissions to S3 bucket(s), and the target buckets exist.

A role with the below policy must be assigned to instances (EC2, EC2 ASG, Fargate, etc) for the opthub-compilebroker and opthub-gateway pods.

 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::opthub-*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "s3:*Object"
      ],
      "Resource": [
        "arn:aws:s3:::opthub-*/*"
      ],
      "Effect": "Allow"
    }
  ]
}

Using AWS Service Accounts

If your security practices do not allow you to give nodes access to S3 buckets, you can also grant access to just the key services in Optimizer Hub. You can do this by configuring AWS IAM, roles, and permissions as described in the AWS documentation.

In the next steps, Optimizer Hub assumes the role name is opthub-s3-role. The IAM role trust relationship entry needs the following additional settings in AWS (you will need to change the IDs in this example to align with your configuration):

 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::163957972732:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/F7E8B430691CFE3B776B8CA663896762"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringLike": {
                    "oidc.eks.us-west-2.amazonaws.com/id/F7E8B430691CFE3B776B8CA663896762:sub": "system:serviceaccount:*:opthub*",
                    "oidc.eks.us-west-2.amazonaws.com/id/F7E8B430691CFE3B776B8CA663896762:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

After creating the Service Accounts, add the following settings to your values-override.yaml file:

 
deployment:
    serviceAccount:
      annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::<...>:role/opthub-s3-role

The Helm chart of Optimizer Hub creates the following Service Accounts:

Storage for ReadyNow Orchestrator

You can limit the usage of persistent storage by ReadyNow Orchestrator with the appropriate settings.

Cluster Requirements

You can create a cluster following the steps in Cluster Provisioning on EKS, or use a cluster created by any other means according to these requirements:

Cluster Provisioning on EKS

If you don’t have a cluster available to run Optimzer Hub, you can provision one on EKS with the following steps:

By using opthub_eks.yaml, the following gets created in your AWS account:

Install Optimizer Hub on an EKS Cluster

Follow the installation instructions on "Installing Optimizer Hub on Kubernetes" to install all services of Optimizer Hub. Or, in case you don’t want to install the full Optimizer Hub but only a part of the services, check "Configuring the Active Optimizer Hub Services".

In the step where Helm is used to create the node groups in the cluster, pass in the additional configuration file eks/values-eks.yaml, located in the installation package. This file includes the nodegroup affinity settings and other settings expected by EKS.

The Helm installation command needs to be extended with the values-eks.yaml config file:

 
helm install opthub opthub-helm/azul-opthub \
  -n my-opthub \
  -f values-eks.yaml \
  -f values-override.yaml

When adding multiple values files, remember the last one takes precedence.