Skip to main content

​
Overview

Use this page when you already have an EKS cluster and will create or align supporting AWS resources to match Arize AX requirements.
Prefer video? Watch Module 5 (AWS) in the installation walkthrough series.

​
Storage buckets

Create two S3 buckets:
  • One bucket for Gazette data.
  • One bucket for ArizeDB data.
Buckets can use AES256, KMS, or no encryption, depending on your security requirements.

​
Node pools

Use at least two node pools:
  • Base pool - general workloads and ingestion. Label nodes with arize=true and arize-base=true.
  • ArizeDB pool - ArizeDB historical workloads. Label nodes with arize=true and druid-historical=true.
If you cannot use separate pools, deploy on a shared pool by setting historicalNodePoolEnabled: false in values.yaml.

​
EKS Auto Mode

On a cluster that runs EKS Auto Mode, set the node provisioner in values.yaml:
This setting is required on Auto Mode. Without it, arize pods stay in Pending and no nodes are created. The managed StorageClasses follow the same setting. On eksAutoMode they are created with the ebs.csi.eks.amazonaws.com provisioner that Auto Mode supplies, so the EBS CSI driver add-on is not needed. On a cluster where gp3-400 and gp3-2000 already exist, delete both classes before switching, because the provisioner of a StorageClass cannot be changed in place. The default value is default, which covers managed node groups, self-managed nodes, cluster-autoscaler, and standalone Karpenter. Clusters that do not use Auto Mode need no change.

​
Storage classes

On a fresh AWS install the arize helm chart creates two EBS StorageClasses: SSD volumes default to gp3-2000 and standard ones default to gp3-400. These StorageClasses require the Amazon EBS CSI driver to be installed on the cluster (as the managed EKS add-on aws-ebs-csi-driver, or equivalent). On EKS Auto Mode the driver is built in instead, as described under EKS Auto Mode. To manage the StorageClasses yourself instead of having the helm chart create them, set storageClassCreationEnabled: false and ensure any class you reference already exists in the cluster. See storage performance tiers in the walkthrough for how to select them in values.yaml.

​
Namespaces

Use dedicated namespaces for Arize AX, typically arize and arize-operator. They can be pre-existing or created by the Helm chart.

​
Private VPC endpoints

If deployed on a private VPC, these endpoints must be reachable from the cluster:
  • com.amazonaws.<region>.s3
  • com.amazonaws.<region>.ecr.api
  • com.amazonaws.<region>.ecr.dkr
  • com.amazonaws.<region>.ec2
  • com.amazonaws.<region>.elasticloadbalancing
  • com.amazonaws.<region>.sts
  • com.amazonaws.<region>.ebs

​
IAM permissions

The IAM role used for Arize AX access to the ArizeDB and Gazette buckets needs these policy actions:
  • s3:ListBucket
  • s3:*Object
  • kms:Encrypt
  • kms:Decrypt
  • kms:ReEncrypt*
  • kms:GenerateDataKey*
  • kms:DescribeKey
  • bedrock:InvokeModel
If using IAM roles for service accounts (IRSA), the roles must have a trust policy that allows these service accounts to assume the role:
  • system:serviceaccount:arize:*
  • system:serviceaccount:arize-operator:*
If not using IRSA, add the policy actions to the role attached to the nodes. Pods must be able to discover the node role through instance metadata.

​
Optional image registry

An ECR or private registry is optional when pulling from Arize AI’s central image registry. If you use a private registry, set pushRegistry and pullRegistry in values.yaml.

​
Sizing

Contact Arize AI for the clusterSizing field. This field controls the deployment size and must align with the size of the cluster. Common values are small1b and medium2b.

​
Next steps