Skip to main content

​
Overview

Use this page when you already have an EKS cluster and will create or align supporting AWS resources to match Arize AX requirements.

​
Storage buckets

Create two S3 buckets:
  • One bucket for Gazette data.
  • One bucket for ArizeDB data.
Buckets can use AES256, KMS, or no encryption, depending on your security requirements.

​
Node pools

Use at least two node pools:
  • Base pool - general workloads and ingestion. Label nodes with arize=true and arize-base=true.
  • ArizeDB pool - ArizeDB historical workloads. Label nodes with arize=true and druid-historical=true.
If you cannot use separate pools, deploy on a shared pool by setting historicalNodePoolEnabled: false in values.yaml.

​
Storage classes

On a fresh AWS install the arize helm chart creates two EBS StorageClasses: SSD volumes default to gp3-2000 and standard ones default to gp3-400. These StorageClasses require the Amazon EBS CSI driver to be installed on the cluster (as the managed EKS add-on aws-ebs-csi-driver, or equivalent). To manage the StorageClasses yourself instead of having the helm chart create them, set storageClassCreationEnabled: false and ensure any class you reference already exists in the cluster. See storage performance tiers in the walkthrough for how to select them in values.yaml.

​
Namespaces

Use dedicated namespaces for Arize AX, typically arize and arize-operator. They can be pre-existing or created by the Helm chart.

​
Private VPC endpoints

If deployed on a private VPC, these endpoints must be reachable from the cluster:
  • com.amazonaws.<region>.s3
  • com.amazonaws.<region>.ecr.api
  • com.amazonaws.<region>.ecr.dkr
  • com.amazonaws.<region>.ec2
  • com.amazonaws.<region>.elasticloadbalancing
  • com.amazonaws.<region>.sts
  • com.amazonaws.<region>.ebs

​
IAM permissions

The IAM role used for Arize AX access to the ArizeDB and Gazette buckets needs these policy actions:
  • s3:ListBucket
  • s3:*Object
  • kms:Encrypt
  • kms:Decrypt
  • kms:ReEncrypt*
  • kms:GenerateDataKey*
  • kms:DescribeKey
  • bedrock:InvokeModel
If using IAM roles for service accounts (IRSA), the roles must have a trust policy that allows these service accounts to assume the role:
  • system:serviceaccount:arize:*
  • system:serviceaccount:arize-operator:*
If not using IRSA, add the policy actions to the role attached to the nodes. Pods must be able to discover the node role through instance metadata.

​
Optional image registry

An ECR or private registry is optional when pulling from Arize AI’s central image registry. If you use a private registry, set pushRegistry and pullRegistry in values.yaml.

​
Sizing

Contact Arize AI for the clusterSizing field. This field controls the deployment size and must align with the size of the cluster. Common values are small1b and medium2b.

​
Next steps