设置 Kubernetes 基于角色的访问控制 - Amazon SageMaker
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅 中国的 Amazon Web Services 服务入门 (PDF)

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

设置 Kubernetes 基于角色的访问控制

集群管理员用户还需要设置基于角色的 Kubernetes 访问控制 (RBAC),以便数据科学家用户使用在通过 Amazon HyperPod 编排的SageMaker HyperPod CLI集群上运行工作负载。EKS

选项 1:RBAC使用 Helm 图表进行设置

SageMaker HyperPod 服务团队提供了一个 Helm 子图供您进行设置RBAC。要了解更多信息,请参阅 使用 Helm 在亚马逊EKS集群上安装软件包

选项 2:RBAC手动设置

ClusterRoleBinding使用最低权限创建ClusterRole和,RoleBinding使用变异权限创建Role和。

创建ClusterRoleClusterRoleBinding担任数据科学家IAM角色

按如下方式创建集群级别的配置文件cluster_level_config.yaml

kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: hyperpod-scientist-user-cluster-role rules: - apiGroups: [""] resources: ["pods"] verbs: ["list"] - apiGroups: [""] resources: ["nodes"] verbs: ["list"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: hyperpod-scientist-user-cluster-role-binding subjects: - kind: Group name: hyperpod-scientist-user-cluster-level apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: hyperpod-scientist-user-cluster-role # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io

将配置应用于集EKS群。

kubectl apply -f cluster_level_config.yaml

在命名空间 RoleBinding 中创建角色&

这是运行训练作业的命名空间训练运算符,默认情况下,Resiliency 将进行监控。Job 自动恢复只能支持以kubeflow命名空间或命名空间为前缀aws-hyperpod的命名空间。

namespace_level_role.yaml如下方式创建角色配置文件。此示例在kubeflow命名空间中创建了一个角色

kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: kubeflow name: hyperpod-scientist-user-namespace-level-role ### # 1) add/list/describe/delete pods # 2) get/list/watch/create/patch/update/delete/describe kubeflow pytroch job # 3) get pod log ### rules: - apiGroups: [""] resources: ["pods"] verbs: ["create", "get"] - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list"] - apiGroups: [""] resources: ["pods/log"] verbs: ["get", "list"] - apiGroups: [""] resources: ["pods/exec"] verbs: ["get", "create"] - apiGroups: ["kubeflow.org"] resources: ["pytorchjobs", "pytorchjobs/status"] verbs: ["get", "list", "create", "delete", "update", "describe"] - apiGroups: [""] resources: ["configmaps"] verbs: ["create", "update", "get", "list", "delete"] - apiGroups: [""] resources: ["secrets"] verbs: ["create", "get", "list", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: namespace: kubeflow name: hyperpod-scientist-user-namespace-level-role-binding subjects: - kind: Group name: hyperpod-scientist-user-namespace-level apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: hyperpod-scientist-user-namespace-level-role # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io

将配置应用于集EKS群。

kubectl apply -f namespace_level_role.yaml

为 Kubernetes 群组创建访问入口

RBAC使用上述两个选项之一进行设置后,使用以下示例命令替换必要的信息。

aws eks create-access-entry \ --cluster-name <eks-cluster-name> \ --principal-arn arn:aws:iam::<AWS_ACCOUNT_ID_SCIENTIST_USER>:role/ScientistUserRole \ --kubernetes-groups '["hyperpod-scientist-user-namespace-level","hyperpod-scientist-user-cluster-level"]'

对于principal-arn参数,您需要使用IAM科学家的用户