Kubeflow – Deploying Kubeflow

Docs: Set up a GCP Project

Mon, 01 Jan 0001 00:00:00 +0000

Follow these steps to set up your GCP project:

Select or create a project on the GCP Console.
Make sure that you have the owner role for the project. The deployment process creates various service accounts with appropriate roles in order to enable seamless integration with GCP services. This process requires that you have the owner role for the project in order to deploy Kubeflow.
Make sure that billing is enabled for your project. See the guide to modifying a project’s billing settings.
Go to the following pages on the GCP Console and ensure that the specified APIs are enabled:
- Compute Engine API
- Kubernetes Engine API
- Identity and Access Management (IAM) API
- Deployment Manager API
- Cloud Resource Manager API
- Cloud Filestore API
- AI Platform Training & Prediction API
- Cloud Build API (It’s required if you plan to use Fairing in your Kubeflow cluster)
If you are using the GCP Free Tier or the 12-month trial period with $300 credit, note that you can’t run the default GCP installation of Kubeflow, because the free tier does not offer enough resources. You need to upgrade to a paid account.

For more information, see the following issues:
- kubeflow/website #1065 reports the problem.
- kubeflow/kubeflow #3936 requests a Kubeflow configuration to work with a free trial project.
Read the GCP guide to resource quotas to understand the quotas on resource usage that Compute Engine enforces, and to learn how to check your quota and how to request an increase in quota.

You do not need a running GKE cluster. The deployment process creates a cluster for you.

Next steps

Set up an OAuth credential if you want to use Cloud Identity-Aware Proxy (Cloud IAP). Cloud IAP is recommended for production deployments or deployments with access to sensitive data. You can skip this step if you want to test Kubeflow in a non-production environment.
Choose one of the following ways to deploy Kubeflow:
- Using the UI. This option provides a simple way to deploy Kubeflow.
- Using the CLI. This option provides more control over the deployment process.

Docs: Set up OAuth for Cloud IAP

Mon, 01 Jan 0001 00:00:00 +0000

If you want to use Cloud Identity-Aware Proxy (Cloud IAP) when deploying Kubeflow on GCP, then you must follow these instructions to create an OAuth client for use with Kubeflow.

You can skip the instructions on this page if you want to use basic authentication (username and password) with Kubeflow instead of Cloud IAP. Cloud IAP is recommended for production deployments or deployments with access to sensitive data.

Follow the steps below to create an OAuth client ID that identifies Cloud IAP when requesting access to a user’s email account. Kubeflow uses the email address to verify the user’s identity.

Set up your OAuth consent screen:
- In the Application name box, enter the name of your application. The example below uses the name “Kubeflow”.
- Under Support email, select the email address that you want to display as a public contact. You must use either your email address or a Google Group that you own.
- If you see Authorized domains, enter
```
<project>.cloud.goog
```
  - where <project> is your Google Cloud Platform (GCP) project ID.
  - If you are using your own domain, such as acme.com, you should add that as well
  - The Authorized domains option appears only for certain project configurations. If you don’t see the option, then there’s nothing you need to set.
- Click Save.
- Here’s an example of the completed form:
On the credentials screen:
- Click Create credentials, and then click OAuth client ID.
- Under Application type, select Web application.
- In the Name box enter any name for your OAuth client ID. This is not the name of your application nor the name of your Kubeflow deployment. It’s just a way to help you identify the OAuth client ID.
Click Create. A dialog box appears, like the one below:
Copy the client ID shown in the dialog box, because you need the client ID in the next step.
On the Create credentials screen, find your newly created OAuth credential and click the pencil icon to edit it:
In the Authorized redirect URIs box, enter the following (if it’s not already present in the list of authorized redirect URIs):
```
https://iap.googleapis.com/v1/oauth/clientIds/<CLIENT_ID>:handleRedirect
```
- <CLIENT_ID> is the OAuth client ID that you copied from the dialog box in step four. It looks like XXX.apps.googleusercontent.com.
- Note that the URI is not dependent on the Kubeflow deployment or endpoint. Multiple Kubeflow deployments can share the same OAuth client without the need to modify the redirect URIs.
Press Enter/Return to add the URI. Check that the URI now appears as a confirmed item under Authorized redirect URIs. (The URI should no longer be editable.)

Here’s an example of the completed form:
Click Save.
Make note that you can find your OAuth client credentials in the credentials section of the GCP Console. You need to retrieve the client ID and client secret later when you’re ready to enable Cloud IAP.

Next steps

Choose one of the following ways to deploy Kubeflow:

Using the UI. This option provides a simple way to deploy Kubeflow.
Using the CLI. This option provides more control over the deployment process.

Docs: Deploy using UI

Mon, 01 Jan 0001 00:00:00 +0000

This page provides instructions for using the Kubeflow deployment web app to deploy Kubeflow on GCP. The deployment web app currently supports Kubeflow v1.0.0.

For more control over your deployment, see the guide to deployment using the CLI. The CLI supports Kubeflow v1.0.2 and later versions.

Before you start

Check the following requirements before installing Kubeflow:

Make sure that your GCP project meets the minimum requirements described in the project setup guide.
If you want to use Cloud Identity-Aware Proxy (Cloud IAP) for access control, follow the guide to setting up OAuth credentials. Cloud IAP is recommended for production deployments or deployments with access to sensitive data.

Deploy Kubeflow

Here’s a partial screenshot of the deployment user interface (UI):

Follow these steps to open the deployment UI and deploy Kubeflow on GCP:

Open https://deploy.kubeflow.cloud/ in your web browser. You should see a form like the one in the above screenshot.
Sign in to your browser using an account that has the owner role for your GCP project.
Complete the following fields on the form:
- Project ID: Enter your GCP project ID.
- Deployment name: Enter a short name that you can use to recognize this deployment of Kubeflow. The maximum length for the deployment name is 25 characters.
- Choose how to connect to Kubeflow service: You can choose one of the following options:
  - Login with GCP IAP: Choose this option if you want to use Cloud Identity-Aware Proxy (Cloud IAP) for access control. Cloud IAP is the best option for production deployments or deployments with access to sensitive data. See more details below.
  - Login with Username Password: Warning: This option is deprecated in Kubeflow 1.0 and will be removed in the next version. We recommend switching to IAP.
- GKE zone: Enter the GCP zone in which to create your deployment. The default is us-central-1a.
- Kubeflow version: Choose one of the available versions of Kubeflow. You can see all the versions on the Kubeflow releases page. If you need a version that does not show on the deployment UI, you need to deploy Kubeflow using the CLI.
- Share Anonymous Usage Report: Check this option to allow Kubeflow to report usage data using Spartakus. Spartakus does not report any personal information. The default is to enable the reporting of usage data.
Click Create Deployment.
Watch for the deployment updates in the information box at the bottom of the deployment UI.

Authenticating with Cloud IAP

This section contains details about using Cloud IAP to control access to Kubeflow. Cloud IAP is the best option for production deployments or deployments with access to sensitive data.

Follow the guide to setting up OAuth credentials.
Choose the Login with GCP IAP option on the Kubeflow deployment UI.
Enter your IAP OAuth client ID and IAP OAuth client secret into the corresponding fields on the deployment UI.
Complete the rest of the form as described above.

Kubeflow will be available at the following URI:

https://<deployment_name>.endpoints.<project>.cloud.goog/

It can take 10-15 minutes for the URI to become available. You can watch for updates in the information box on the deployment UI. If the deployment takes longer than expected, click Kubeflow Service Endpoint to try accessing your Kubeflow URI.

Authenticating with username and password

No longer supported

Basic authentication is not supported in Kubeflow v1.0.0 and will be removed entirely in the next version. We highly recommend switching to deploying Kubeflow with IAP.

Next steps

Run a full ML workflow on Kubeflow, using the end-to-end MNIST tutorial or the GitHub issue summarization example.
See how to delete your Kubeflow deployment using the CLI or the GCP Console.
See how to customize your Kubeflow deployment.
See how to upgrade Kubeflow and how to upgrade or reinstall a Kubeflow Pipelines deployment.
Troubleshoot any issues you may find.

Docs: Deploy using CLI

Mon, 01 Jan 0001 00:00:00 +0000

This guide describes how to use the kfctl command line interface (CLI) to deploy Kubeflow on GCP. The command line deployment gives you more control over the deployment process and configuration than you get if you use the deployment UI. If you’re looking for a simpler deployment procedure, see how to deploy Kubeflow using the deployment UI.

Before you start

Before installing Kubeflow on the command line:

Ensure you have installed the following tools:
- kubectl.
- gcloud. If you already have gcloud installed, run gcloud components update to get the latest version of all your installed Cloud SDK components.
If you’re using Cloud Shell, enable boost mode.
Make sure that your GCP project meets the minimum requirements described in the project setup guide.
Follow the guide setting up OAuth credentials. to create OAuth credentials for Cloud Identity-Aware Proxy (Cloud IAP).

Prepare your environment

Follow these steps to download the kfctl binary for the Kubeflow CLI and set some handy environment variables:

Download the kfctl v1.0.2 release from the kfctl releases page.

Unpack the tar ball:

tar -xvf kfctl_v1.0.2_<platform>.tar.gz

Log in. You only need to run this command once:
```
gcloud auth login
```
Create user credentials. You only need to run this command once:
```
gcloud auth application-default login
```

Configure gcloud default values for zone and project

# Set your GCP project ID and the zone where you want to create 
# the Kubeflow deployment:
export PROJECT=<your GCP project ID>
export ZONE=<your GCP zone>

gcloud config set project ${PROJECT}    
gcloud config set compute/zone ${ZONE}

kfctl by default uses the gcloud defaults for zone and project
You can override this by explicitly setting zone and project in your KFDef file

Select the KFDef spec to use as the basis for your deployment

export CONFIG_URI="https://raw.githubusercontent.com/kubeflow/manifests/v1.0-branch/kfdef/kfctl_gcp_iap.v1.0.2.yaml"

Create environment variables containing the OAuth client ID and secret that you created earlier
```
export CLIENT_ID=<CLIENT_ID from OAuth page>
export CLIENT_SECRET=<CLIENT_SECRET from OAuth page>
```
- The CLIENT_ID and CLIENT_SECRET can be obtained from the Cloud Console by selecting APIs & Services -> Credentials
Pick a name KF_NAME for your Kubeflow deployment and directory for your configuration.
```
export KF_NAME=<your choice of name for the Kubeflow deployment>
export BASE_DIR=<path to a base directory>
export KF_DIR=${BASE_DIR}/${KF_NAME}
```
- For example, your kubeflow deployment name might be ‘my-kubeflow’ or ‘kf-test’.
- Set base directory where you want to store one or more Kubeflow deployments. For example, ${HOME}/kf_deployments.
(Optional) Add the kfctl binary to your path. If you don’t add kfctl to your path, you must use the full path each time you run kfctl.
```
export PATH=$PATH:<path to your kfctl file>
```

Notes:

${PROJECT} - The project ID of the GCP project where you want Kubeflow deployed.
${ZONE} - The GCP zone where you want to create the Kubeflow deployment. You can see a list of zones in the Compute Engine documentation. If you plan to use accelerators, you must choose a zone that supports the type you want. See the guide to customizing your Kubeflow deployment.
${CONFIG_URI} - The GitHub address of the configuration YAML file that you want to use to deploy Kubeflow. For GCP deployments, the recommended configuration is:
```
https://raw.githubusercontent.com/kubeflow/manifests/v1.0-branch/kfdef/kfctl_gcp_iap.v1.0.2.yaml
```
When you run kfctl apply or kfctl build (see the next step), kfctl creates a local version of the configuration YAML file which you can further customize if necessary.
${KF_NAME} - The name of your Kubeflow deployment. If you want a custom deployment name, specify that name here. For example, my-kubeflow or kf-test. The value of KF_NAME must consist of lower case alphanumeric characters or ‘-’, and must start and end with an alphanumeric character. The value of this variable cannot be greater than 25 characters. It must contain just a name, not a directory path. You also use this value as directory name when creating the directory where your Kubeflow configurations are stored, that is, the Kubeflow application directory.
${KF_DIR} - The full path to your Kubeflow application directory.

Deploying Kubeflow

To deploy Kubeflow using the default settings, run the kfctl apply command:

mkdir -p ${KF_DIR}
cd ${KF_DIR}
kfctl apply -V -f ${CONFIG_URI}

kfctl will try to populate the KFDef spec with various defaults automatically

project and zone will be set based on your gcloud config defaults
the name for the deployment will be inferred from the directory ${KF_DIR}
You can override these values by modifying your KFDef spec before running the build and apply commands

You can follow the instructions in the next section to override these defaults.

Customizing your Kubeflow deployment

The process outlined in the previous step configures Kubeflow with various defaults. You can follow the instructions below to have greater control.

Download the KFDef file to your local directory to allow modifications
```
mkdir -p ${KF_DIR}
cd ${KF_DIR}
curl -L -o ${CONFIG_FILE} https://raw.githubusercontent.com/kubeflow/manifests/v1.0-branch/kfdef/kfctl_gcp_iap.v1.0.2.yaml
```
- CONFIG_FILE should be the name you would like to use for your local config file; e.g. “kfdef.yaml”
Edit the KFDef spec in the yaml file. The following snippet shows you how to set values in the configuration file using yq:
```
yq w -i ${CONFIG_FILE} 'spec.plugins[0].spec.project' ${PROJECT}
yq w -i ${CONFIG_FILE} 'spec.plugins[0].spec.zone' ${ZONE}
yq w -i ${CONFIG_FILE} 'metadata.name' ${KF_NAME}
```
- PROJECT: The GCP project to deploy in
- ZONE: The zone to deploy in
- KF_NAME: The name used for your deployment.
Run the kfctl build command to generate kustomize and GCP Deployment manager configuration files for your deployment:
```
cd ${KF_DIR}
kfctl build -V -f ${CONFIG_FILE}
```
To customize your GKE cluster modify the deployment manager configuration files in the directory ${KF_DIR}/gcp_config.
- For more information refer to:
  - customizing your Kubeflow deployment
  - deployment manager docs.
To customize individual Kubeflow applications modify the Kustomize manifests in the directory ${KF_DIR}/kustomize
- For more information please refer to the kustomize docs.
Run the kfctl apply command to deploy Kubeflow:
```
kfctl apply -V -f ${CONFIG_FILE}
```

Check your deployment

Follow these steps to verify the deployment:

The deployment process creates a separate deployment for your data storage. After running kfctl apply you should notice two new deployments:
- {KF_NAME}-storage: This deployment has persistent volumes for your pipelines.
- {KF_NAME}: This deployment has all the components of Kubeflow, including a GKE cluster named ${KF_NAME} with Kubeflow installed.
When the deployment finishes, check the resources installed in the namespace kubeflow in your new cluster. To do this from the command line, first set your kubectl credentials to point to the new cluster:
```
gcloud container clusters get-credentials ${KF_NAME} --zone ${ZONE} --project ${PROJECT}
```
Then see what’s installed in the kubeflow namespace of your GKE cluster:
```
kubectl -n kubeflow get all
```

Access the Kubeflow user interface (UI)

Follow these steps to access the Kubeflow central dashboard:

Enter the following URI into your browser address bar. It can take 20 minutes for the URI to become available:

https://<KF_NAME>.endpoints.<project-id>.cloud.goog/

You can run the following command to get the URI for your deployment:

kubectl -n istio-system get ingress
NAME            HOSTS                                                      ADDRESS         PORTS   AGE
envoy-ingress   your-kubeflow-name.endpoints.your-gcp-project.cloud.goog   34.102.232.34   80      5d13h

The following command sets an environment variable named HOST to the URI:

export HOST=$(kubectl -n istio-system get ingress envoy-ingress -o=jsonpath={.spec.rules[0].host})

Follow the instructions on the UI to create a namespace. See the guide to creation of profiles.

Notes:

It can take 20 minutes for the URI to become available. Kubeflow needs to provision a signed SSL certificate and register a DNS name.
If you own or manage the domain or a subdomain with Cloud DNS then you can configure this process to be much faster. See kubeflow/kubeflow#731.

Understanding the deployment process

This section gives you more details about the kfctl configuration and deployment process, so that you can customize your Kubeflow deployment if necessary.

kfctl process and configuration

The kfctl deployment process includes the following commands:

kfctl build - (Optional) Creates configuration files defining the various resources in your deployment. You only need to run kfctl build if you want to edit the resources before running kfctl apply. See the guide to customizing your Kubeflow deployment.
kfctl apply - Creates or updates the resources.
kfctl delete - Deletes the resources.

The kfctl deployment process applies default values to certain properties as follows:

Email address: kfctl attempts to fetch your email address from your Cloud SDK configuration. You can run gcloud config list to see the default email address, which the command output lists as the account. If kfctl can’t find a valid email address, you must use the flag --email <your email address> to pass a valid email address. This email address becomes an administrator in the configuration of your Kubeflow deployment.
GCP project ID: kfctl attempts to fetch your project ID from your Cloud SDK configuration. You can run gcloud config list to see your active project ID.
GCP zone: kfctl attempts to fetch the zone from your Cloud SDK configuration. You can run gcloud config list to see your active zone.
Kubeflow deployment name: kfctl defaults to the name of the directory where you run the kfctl build or kfctl apply command.

You can also explicitly set the following values in your ${CONFIG_FILE} configuration file:

Kubeflow deployment name
GCP project
GCP zone
Email address

The following snippet shows you how to set values in the configuration file using yq:

yq w -i ${CONFIG_FILE} 'spec.plugins[0].spec.project' ${PROJECT}
yq w -i ${CONFIG_FILE} 'spec.plugins[0].spec.zone' ${ZONE}
yq w -i ${CONFIG_FILE} 'metadata.name' ${KF_NAME}

Application layout

Your Kubeflow application directory ${KF_DIR} contains the following files and directories:

${CONFIG_FILE} is a YAML file that defines configurations related to your Kubeflow deployment.
- This file is a copy of the GitHub-based configuration YAML file that you used when deploying Kubeflow: kfctl_gcp_iap.v1.0.0.yaml.
- When you run kfctl apply or kfctl build, kfctl creates a local version of the configuration file, ${CONFIG_FILE}, which you can further customize if necessary.
gcp_config is a directory that contains Deployment Manager configuration files defining your GCP infrastructure.
- The directory is created when you run kfctl build or kfctl apply.
- You can modify these configurations to customize your GCP infrastructure. After modifying a configuration, run kfctl apply again.
kustomize is a directory that contains the kustomize packages for Kubeflow applications. See how Kubeflow uses kustomize.
- The directory is created when you run kfctl build or kfctl apply.
- You can customize the Kubernetes resources by modifying the manifests and running kfctl apply again.

We recommend that you check in the contents of your ${KF_DIR} directory into source control.

GCP service accounts

The kfctl deployment process creates three service accounts in your GCP project. These service accounts follow the principle of least privilege. The service accounts are:

${KF_NAME}-admin is used for some admin tasks like configuring the load balancers. The principle is that this account is needed to deploy Kubeflow but not needed to actually run jobs.
${KF_NAME}-user is intended to be used by training jobs and models to access GCP resources (Cloud Storage, BigQuery, etc.). This account has a much smaller set of privileges compared to admin.
${KF_NAME}-vm is used only for the virtual machine (VM) service account. This account has the minimal permissions needed to send metrics and logs to Stackdriver.

Basic authentication (deprecated)

No longer supported

Basic authentication is not supported in Kubeflow v1.0.0 and will be removed entirely in the next version. We highly recommend switching to deploying Kubeflow with IAP.

Next steps

Run a full ML workflow on Kubeflow, using the end-to-end MNIST tutorial or the GitHub issue summarization Pipelines example.
See how to delete your Kubeflow deployment using the CLI.
See how to customize your Kubeflow deployment.
See how to upgrade Kubeflow and how to upgrade or reinstall a Kubeflow Pipelines deployment.
Troubleshoot any issues you may find.

Docs: Monitor Cloud IAP Setup

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Identity-Aware Proxy (Cloud IAP) is the recommended solution for accessing your Kubeflow deployment from outside the cluster, when running Kubeflow on Google Cloud Platform (GCP).

This document is a step-by-step guide to ensuring that your IAP-secured endpoint is available, and to debugging problems that may cause the endpoint to be unavailable.

Introduction

When deploying Kubeflow using the deployment UI or the command-line interface, you choose the authentication method you want to use. One of the options is Cloud IAP. This document assumes that you have already deployed Kubeflow.

Kubeflow uses the Google-managed certificate to provide an SSL certificate for the Kubeflow Ingress.

Cloud IAP gives you the following benefits:

Users can log in in using their GCP accounts.
You benefit from Google’s security expertise to protect your sensitive workloads.

Monitoring your Cloud IAP setup

Follow these instructions to monitor your Cloud IAP setup and troubleshoot any problems:

Examine the Ingress and Google Cloud Build (GCB) load balancer to make sure it is available:

kubectl -n istio-system describe ingress

Name:             envoy-ingress
Namespace:        kubeflow
Address:          35.244.132.160
Default backend:  default-http-backend:80 (10.20.0.10:8080)
Annotations:
...
Events:
   Type     Reason     Age                 From                     Message
   ----     ------     ----                ----                     -------
   Normal   ADD        12m                 loadbalancer-controller  kubeflow/envoy-ingress
   Warning  Translate  12m (x10 over 12m)  loadbalancer-controller  error while evaluating the ingress spec: could not find service "kubeflow/envoy"
   Warning  Translate  12m (x2 over 12m)   loadbalancer-controller  error while evaluating the ingress spec: error getting BackendConfig for port "8080" on service "kubeflow/envoy", err: no BackendConfig for service port exists.
   Warning  Sync       12m                 loadbalancer-controller  Error during sync: Error running backend syncing routine: received errors when updating backend service: googleapi: Error 400: The resource 'projects/code-search-demo/global/backendServices/k8s-be-32230--bee2fc38fcd6383f' is not ready, resourceNotReady
 googleapi: Error 400: The resource 'projects/code-search-demo/global/backendServices/k8s-be-32230--bee2fc38fcd6383f' is not ready, resourceNotReady
   Normal  CREATE  11m  loadbalancer-controller  ip: 35.244.132.160
...

There should be an annotation indicating that we are using managed certificate:

annotation:
  networking.gke.io/managed-certificates: gke-certificate

Any problems with creating the load balancer are reported as Kubernetes events in the results of the above describe command.

If the address isn’t set then there was a problem creating the load balancer.
The CREATE event indicates the load balancer was successfully created on the specified IP address.
The most common error is running out of GCP quota. To fix this problem, you must either increase the quota for the relevant resource on your GCP project or delete some existing resources.

Verify that a managed certificate resource is generated:
```
kubectl describe -n istio-system managedcertificate gke-certificate
```
The status field should have information about the current status of the Certificate. Eventually, certificate status should be Active.
Wait for the load balancer to report the back ends as healthy:
```
kubectl describe -n istio-system ingress envoy-ingress

...
Annotations:
 kubernetes.io/ingress.global-static-ip-name:  kubeflow-ip
 kubernetes.io/tls-acme:                       true
 certmanager.k8s.io/issuer:                    letsencrypt-prod
 ingress.kubernetes.io/backends:               {"k8s-be-31380--5e1566252944dfdb":"HEALTHY","k8s-be-32133--5e1566252944dfdb":"HEALTHY"}
...
```
Both backends should be reported as healthy. It can take several minutes for the load balancer to consider the back ends healthy.

The service with port 31380 is the one that handles Kubeflow traffic. (31380 is the default port of the service istio-ingressgateway.)

If the backend is unhealthy, check the pods in istio-system:
- kubectl get pods -n istio-system
- The istio-ingressgateway-XX pods should be running
- Check the logs of pod backend-updater-0, iap-enabler-XX to see if there is any error
- Follow the steps here to check the load balancer and backend service on GCP.
Try accessing Cloud IAP at the fully qualified domain name in your web browser:
```
https://<your-fully-qualified-domain-name>     
```
If you get SSL errors when you log in, this typically means that your SSL certificate is still propagating. Wait a few minutes and try again. SSL propagation can take up to 10 minutes.

If you do not see a login prompt and you get a 404 error, the configuration of Cloud IAP is not yet complete. Keep retrying for up to 10 minutes.
If you get an error Error: redirect_uri_mismatch after logging in, this means the list of OAuth authorized redirect URIs does not include your domain.

The full error message looks like the following example and includes the relevant links:
```
The redirect URI in the request, https://mykubeflow.endpoints.myproject.cloud.goog/_gcp_gatekeeper/authenticate, does not match the ones authorized for the OAuth client. 	
To update the authorized redirect URIs, visit: https://console.developers.google.com/apis/credentials/oauthclient/22222222222-7meeee7a9a76jvg54j0g2lv8lrsb4l8g.apps.googleusercontent.com?project=22222222222	
```
Follow the link in the error message to find the OAuth credential being used and add the redirect URI listed in the error message to the list of authorized URIs. For more information, read the guide to setting up OAuth for Cloud IAP.

Next steps

The GCP troubleshooting guide for Kubeflow.
Guide to sharing cluster access.
GCP guide to Cloud IAP.

Docs: Delete using CLI

Mon, 01 Jan 0001 00:00:00 +0000

This page shows you how to use the CLI to delete a Kubeflow deployment on Google Cloud Platform (GCP).

Before you start

This guide assumes the following settings:

The ${KF_DIR} environment variable contains the path to your Kubeflow application directory, which holds your Kubeflow configuration files. For example, /opt/my-kubeflow/.
```
export KF_DIR=<path to your Kubeflow application directory>
```

The ${CONFIG_FILE} environment variable contains the path to your Kubeflow configuration file.

export CONFIG_FILE=${KF_DIR}/kfctl_gcp_iap.v1.0.2.yaml

Or:

export CONFIG_FILE=${KF_DIR}/kfctl_gcp_basic_auth.v1.0.2.yaml

For further background about the above settings, see the guide to deploying Kubeflow with the CLI.

Deleting your deployment

Run the following commands to delete your deployment and reclaim all GCP resources:

# If you want to delete all the resources, including storage:
kfctl delete -f ${CONFIG_FILE} --delete_storage

# If you want to preserve storage, which contains metadata and information
# from Kubeflow Pipelines:
kfctl delete -f ${CONFIG_FILE}

You should consider preserving storage if you may want to relaunch Kubeflow in the future and restore the data from your pipelines.

Docs: Delete using GCP Console

Mon, 01 Jan 0001 00:00:00 +0000

This page shows you how to delete your Kubeflow deployment using Deployment Manager in the GCP Console.

Note: For best results you should use the CLI to delete Kubeflow. Deleting with Deployment Manager as described below can orphan some resources like Cloud Endpoints.

To delete your Kubeflow deployment and reclaim all related resources using the GCP Console:

Open the Deployment Manager in the GCP Console for your project. Deployment Manager lists all the available deployments in your project. Make sure that the selected project is the same as the one you used for your Kubeflow deployment.
Select the Kubeflow deployment with the deployment name you used at the time of creation and click the Delete button at the top.

This action should delete any running nodes in your deployment, delete service accounts that were created for the deployment, and reclaim all resources.

Docs: Features of Kubeflow on GCP

Mon, 01 Jan 0001 00:00:00 +0000

Running Kubeflow on GCP brings you the following features:

You use Deployment Manager to declaratively manage all non-Kubernetes resources (including the GKE cluster). Deployment Manager is easy to customize for your particular use case.
You can take advantage of GKE autoscaling to scale your cluster horizontally and vertically to meet the demands of machine learning (ML) workloads with large resource requirements.
Cloud Identity-Aware Proxy (Cloud IAP) makes it easy to securely connect to Jupyter and other web apps running as part of Kubeflow.
Stackdriver provides persistent logs to aid in debugging and troubleshooting.
You can use GPUs and Cloud TPU to accelerate your workload.

Next steps

Deploy Kubeflow if you haven’t already done so.
Run a full ML workflow on Kubeflow, using the end-to-end MNIST tutorial or the GitHub issue summarization example.