本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
設定以角色為基礎的存取控制
叢集管理員使用者還需要為資料科學家使用者設定 Kubernetes 角色型存取控制 (RBAC)
選項 1:RBAC使用頭盔圖進行設置
SageMaker HyperPod 服務團隊提供了一個 Helm 子圖表來RBAC設置。如需進一步了解,請參閱 使用 Helm 在 Amazon EKS 叢集上安裝套件。
選項 2:RBAC手動設定
ClusterRoleBinding
以最低權限創ClusterRole
建並創建Role
並RoleBinding
具有突變權限。
ClusterRoleBinding
為資料科學家IAM角色建立 ClusterRole
(F)
建立叢集層級配置檔案cluster_level_config.yaml
,如下所示。
kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: hyperpod-scientist-user-cluster-role rules: - apiGroups: [""] resources: ["pods"] verbs: ["list"] - apiGroups: [""] resources: ["nodes"] verbs: ["list"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: hyperpod-scientist-user-cluster-role-binding subjects: - kind: Group name: hyperpod-scientist-user-cluster-level apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: hyperpod-scientist-user-cluster-role # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io
將配置套用至EKS叢集。
kubectl apply -f cluster_level_config.yaml
RoleBinding 在命名空間中建立角色 (A)
這是執行訓練工作的命名空間訓練操作員,而彈性預設會監視。Job 自動恢復只能在kubeflow
名稱空間或前aws-hyperpod
置詞的命名空間中支援。
建立角色組態檔案namespace_level_role.yaml
,如下所示。此範例會在kubeflow
命名空間中建立角色
kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: kubeflow name: hyperpod-scientist-user-namespace-level-role ### # 1) add/list/describe/delete pods # 2) get/list/watch/create/patch/update/delete/describe kubeflow pytroch job # 3) get pod log ### rules: - apiGroups: [""] resources: ["pods"] verbs: ["create", "get"] - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list"] - apiGroups: [""] resources: ["pods/log"] verbs: ["get", "list"] - apiGroups: [""] resources: ["pods/exec"] verbs: ["get", "create"] - apiGroups: ["kubeflow.org"] resources: ["pytorchjobs", "pytorchjobs/status"] verbs: ["get", "list", "create", "delete", "update", "describe"] - apiGroups: [""] resources: ["configmaps"] verbs: ["create", "update", "get", "list", "delete"] - apiGroups: [""] resources: ["secrets"] verbs: ["create", "get", "list", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: namespace: kubeflow name: hyperpod-scientist-user-namespace-level-role-binding subjects: - kind: Group name: hyperpod-scientist-user-namespace-level apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: hyperpod-scientist-user-namespace-level-role # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io
將配置套用至EKS叢集。
kubectl apply -f namespace_level_role.yaml
為 Kubernetes 群組建立存取項目
RBAC使用上述兩個選項之一進行設定後,請使用下列範例命令取代必要資訊。
aws eks create-access-entry \ --cluster-name
<eks-cluster-name>
\ --principal-arn arn:aws:iam::<AWS_ACCOUNT_ID_SCIENTIST_USER>
:role/ScientistUserRole \ --kubernetes-groups '["hyperpod-scientist-user-namespace-level","hyperpod-scientist-user-cluster-level"]'
對於principal-arn
參數,您需要使用IAM科學家的用戶.