Bootstrap servcies to deploy Kubeflow with Cognito

[surajkota]

Description of your changes:

As described in #14, there are several steps to prep the resources before deploying kubeflow with Cognito. Using console to bootstrap these resources is time taking and error prone. This PR aims to enhance the UX of all things related to configuring hosted zone, creating Acm Certificates and Cognito userpool in section 1.0-3.0 and section 6.0 of the README.

With this package:

1. User will input the entries such as desired subdomain name, deployment region, userpool name in config.yaml.
   1. (Optional) root domain name and hosted zone id to configure the subdomain NS record and create a certificate, if its hosted in route53
2. (Section 1-3) Run the cognito_pre_deployment.py which will boootstrap all resources and update the resource names/ids/arn in the config.
   1. Script cleans up all the resources in case of any error in creation (best effort)
3. (Section 4-5) Use the values in config.yaml to setup Ingress, ALB controller and deploy kubeflow
4. (Section 6) Update the config.yaml with ALB DNS name and run the cognito_post_deployment.py to update the hosted zone with ALB address
5. (Section 7) Create users in Cognito and corresponding profiles in Kubeflow
   1. Login to dashboard

I will update the readme once these changes are merged in a separate PR to avoid iterating on that.

Testing

Manual

pip install -r distributions/aws/infra_configs/scripts/requirements.txt
# update config.yaml
cd distributions/aws/infra_configs
PYTHONPATH=.. python scripts/cognito_pre_deployment.py

Follow section 4 and 5 of readme to deploy Kubeflow

PYTHONPATH=.. python scripts/cognito_post_deployment.py

Final config looks like this:

cognitoUserpool:
  ARN: arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_yasI9dbxF
  appClientId: 5jmk7ljl2a74jk3n0a0fvj3l31
  domain: xxxxxxxxxx.cloudfront.net
  name: kf-userpool
kubeflow:
  ALBDNS: 72d70454-istiosystem-istio-2aa2-1234567890.us-east-1.elb.amazonaws.com
  region: us-east-1
route53:
  rootDomain:
    certARN: arn:aws:acm:us-east-1:123456789012:certificate/9d8c4bbc-3b02-4a48-8c7d-d91441c6e5af
    hostedZoneId: Z05345723JQZG48XL32CW
    name: xxxxx.xxx.xx.xxx
  subDomain:
    hostedZoneId: XXXXX
    name: platform5.xxxxx.xxx.xx.xxx
    us-east-1-certARN: arn:aws:acm:us-east-1:123456789012:certificate/373cc726-f525-4bc7-b7bf-d1d7b641c238

Areas of improvement

Load the config values to a class instead of individual variables. This does not look possible out of the box just using pyyaml and dataclass because of nested fields (ideas welcome) and needs a more advanced implementation to serialize/deserialize the input. This needs further investigation

Notes to reviewer

Why is the clean up in case of error best effort?
During testing, I found that deleting the custom domain in Coginto removes the entry but sometimes there is delay in the cloudfront disassociating from the certificate. I have increased the timeout to wait for deleting the certificate but it may not be sufficient all the time. In this case, the logs will print the certificate arn and call out that deletion was skipped

[rrrkharse]

overall LGTM

would it make sense to include a script that reads the config and best effort deletes the resources? this way customers could retry delete failures or just clean up resources without incurring applicable billing costs

[surajkota]

@rrrkharse yes, clean up can be a separate script. Let me change this in the next PR when I update the README, ok?

[surajkota]

@goswamig @rrrkharse ready to merge. fixed the bugs and separated the cleanup script

[rrrkharse]

LGTM

[surajkota]

#26

[goswamig]

route53:
  rootDomain:
    certARN: arn:aws:acm:us-east-1:123456789012:certificate/9d8c4bbc-3b02-4a48-8c7d-d91441c6e5af
    hostedZoneId: Z05345723JQZG48XL32CW
    name: xxxxx.xxx.xx.xxx
  subDomain:
    hostedZoneId: XXXXX
    name: platform5.xxxxx.xxx.xx.xxx
    us-east-1-certARN: arn:aws:acm:us-east-1:123456789012:certificate/373cc726-f525-4bc7-b7bf-d1d7b641c238

Are the value of all three subcomponents difference in root domain vs subdomain ?

[surajkota]

route53:
  rootDomain:
    certARN: arn:aws:acm:us-east-1:123456789012:certificate/9d8c4bbc-3b02-4a48-8c7d-d91441c6e5af
    hostedZoneId: Z05345723JQZG48XL32CW
    name: xxxxx.xxx.xx.xxx
  subDomain:
    hostedZoneId: XXXXX
    name: platform5.xxxxx.xxx.xx.xxx
    us-east-1-certARN: arn:aws:acm:us-east-1:123456789012:certificate/373cc726-f525-4bc7-b7bf-d1d7b641c238

Are the value of all three subcomponents difference in root domain vs subdomain ?

@goswamig Yes

[goswamig]

Looking forward for README changes.