Vectice Docs
API Reference (Latest)Vectice WebsiteStart Free Trial
Latest
Latest
  • 🏠Introduction
    • Vectice overview
      • Autolog
      • Next-Gen Autolog [BETA]
      • AskAI
      • Vectice for financial services
  • 🏁Quickstart
    • Getting started
    • Quickstart project
    • Tutorial project
    • FAQ
  • ▶️Demo Center
    • Feature videos
  • 📊Manage AI/ML projects
    • Organize workspaces
      • Create a workspace
      • Workspace Dashboard
    • Organize projects
      • Create a project
      • Project templates best practices
    • Invite colleagues
    • Define phase requirements
    • Collaborate with your team
  • 🚀Log and Manage Assets with Vectice API
    • API cheatsheets
      • Vectice Python API cheatsheet
      • Vectice R API cheatsheet
    • Connect to API
    • Log assets to Vectice
      • Autolog your assets
      • Log datasets
      • Log models
      • Log attachments and notes
      • Log code
      • Log a custom data source
      • Log assets using Vectice IDs
      • Log dataset structure and statistics
      • Log custom metadata in a table format
      • Log MLFLow runs
    • Retrieve assets from app
    • Manage your assets
    • Manage your iteration
    • Preserve your code and asset lineage
  • 🤝Create Model documentation and reports
    • Create model documentation with Vectice Reports
    • Streamline documentation with Macros
    • Auto-document Models and Datasets with AskAI Prompts
    • Document phase outcomes
  • 🗂️Admin Guides
    • Organization management
    • Workspace management
    • Teams management
    • User management
      • User roles and permissions
      • Update a user role in your organization
      • Activate and deactivate users
      • Reset a user's password
    • Manage report templates
  • 🔗Integrations
    • Integrations Overview
    • Integrate Vectice with your data platform
  • 💻IT & Security
    • IT & Security Overview
    • Secure Evaluation Environment Overview
    • Deployment
      • SaaS offering (Multi-Tenant SaaS)
      • Kubernetes self-hosted offering
        • General Architecture & Infrastructure
        • Kubernetes on GCP
          • Appendices
        • Kubernetes on AWS
          • Appendices
        • Kubernetes on Azure
          • Appendices
        • GCP Marketplace deployment
        • On premise
        • Configuration
      • Bring Your Own LLM Guide
    • Data privacy
    • User management
    • SSO management
      • Generic SAML integration
      • Okta SSO integration
    • Security
      • Data storage security
      • Network Security
        • HTTPS communication
        • Reverse proxy
        • CORS/CSRF
        • VPC segregation
      • Sessions
      • Secrets and certificates
      • Audit logs
      • SOC2
      • Security updates
      • Best practices
      • Business continuity
    • Monitoring
      • Installation guide
      • Customizing the deployments
    • Maintenance & upgrades
    • Integrating Vectice Securely
  • ⭐Glossary
    • Concepts
      • Workspaces
      • Projects
        • Setup a project
      • Phases
      • Iterations
        • Iterative development
      • Datasets
        • Dataset resources
        • Dataset properties
        • Dataset lineage and versions
      • Models
      • Reports
  • 🎯Release notes
    • Release notes
  • ↗️References
    • Vectice Python API Reference
    • Vectice R API Cheatsheet
    • Notebooks and code samples
    • Vectice website
Powered by GitBook
On this page
  • Context
  • Understanding prerequisites
  • Infrastructure requirements
  • Other requirements
  • 2. How to provision the infrastructure
  • Provisioning via Terraform (with Terragrunt Wrapper)
  • Provisioning via Azure portal
  • 3. How to deploy the Vectice application
  • Step 1: Connect to the cluster and create the Vectice namespace
  • Step 2: Install the Cert Manager
  • Step 3: Set up the Application Gateway on the cluster
  • Step 4: Create Secrets for Ingress and Docker Image Retriever
  • Step 5: Install the Vectice Stack

Was this helpful?

  1. IT & Security
  2. Deployment
  3. Kubernetes self-hosted offering

Kubernetes on Azure

Context

The purpose of this document is to describe how to create the necessary infrastructure to deploy Vectice on a Kubernetes cluster in Azure, followed by instructions to deploy the Vectice software

Understanding prerequisites

Infrastructure requirements

#

Requirement

Notes or Details

1

Security Groups

Port 443 (HTTPS)

3128 Outbound (pip install)

SMTP Port (e.g 2525)

2

Kubernetes Cluster

v1.16+ deployed agentpool: 1 node Standard_D4s_v4

userpool: 2 nodes with Standard_D4as_v4

3

Azure Blob Storage Container

In the same region

4

Azure Database for PostgreSQL flexible server

13.x Cloud SQL instance

Other requirements

#

Requirement

Notes or Details

5

Domain Name

Example: https://vectice.my-company.com

6

SSL Certificate

Must be associated with the domain name above

Self-signed certificates are not recommended

Deployment environment with the following tools:

7

Helm v3

8

Kubectl

9

Azure CLI

11

Openssl

2. How to provision the infrastructure

You have two ways to create the infrastructure necessary for running Vectice.

Provisioning via Terraform (with Terragrunt Wrapper)

  • Expected Time: 40 minutes

  • Steps:

Provisioning via Azure portal

  • Expected Time: 2 hours

  • Steps:

    • Create a resource group in your chosen subscription

3. How to deploy the Vectice application

The provisioning of Vectice on Kubernetes will happen in 5 steps:

Step 1: Connect to the cluster and create the Vectice namespace

First, define the variables for the next steps and retrieve connections from your deployment machine. Below, sample values are provided between brackets:

AZURE_SUBSCRIPTION=<080kkb88-bf7d-44d-b46e-3302454g5r>
CLUSTER_NAME=<vectice-cluster>
RESOURCE_GROUP=<my-resource_group>
KUBE_RESOURCE_GROUP=<kubernetes resource group>
az account set --subscription $AZURE_SUBSCRIPTION
az aks get-credentials --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME
CONTEXT=`kubectl config get-contexts | grep '*' |  grep '*' | awk '{print $2}'`

The expected output should look like this:

Merged "vectice-cluster" as current context in /home/wsl/.kube/config

Next, test the connection:

kubectl --context $CONTEXT get namespaces

The expected output should look like this:

NAME              STATUS   AGE
default           Active   3h54m
kube-node-lease   Active   3h54m
kube-public       Active   3h54m
kube-system       Active   3h54m

Finally, create the Vectice namespace where applications will be deployed:

kubectl --context $CONTEXT create namespace vectice

Step 2: Install the Cert Manager

Next, install the cert-manager and cert-manager-csi-driver applications on the cluster.

Cert-manager is used to implement SSL for internal communication between Vectice pods, Cert-manager-csi-driver will attach a csi volume containing the certificates to the Vectice pods

helm --kube-context $CONTEXT repo add jetstack https://charts.jetstack.io
helm --kube-context $CONTEXT repo update
helm --kube-context $CONTEXT install cert-manager jetstack/cert-manager -n cert-manager --create-namespace --set crds.enabled=true
helm --kube-context $CONTEXT install cert-manager-csi-driver jetstack/cert-manager-csi-driver --create-namespace -n cert-manager

Next, generate a custom Certificate Authority and create its associated secret:

openssl req -x509 -nodes -newkey rsa:4096 -days 3650 -keyout /tmp/ca.key -out /tmp/ca.crt -subj '/CN=vectice-internal-ca' -addext "keyUsage = keyCertSign"
kubectl --context $CONTEXT create secret tls vectice-internal-ca -n vectice --cert=/tmp/ca.crt --key=/tmp/ca.key

Step 3: Set up the Application Gateway on the cluster

You can reuse an existing application gateway through the Azure portal.

If you did not have an existing Application Gateway, the creation could be blocked because of a permission issue. The AG needs to create a subnet on the Vnet used by the AKS Cluster.

As the AG belongs to the Managed Resource Group of the AKS cluster, permission is needed to add on the Managed Identity of the AG.

Navigate to the AKS managed Resource group created along with the cluster and Click on the managed Identity that contains the name of your AG (it might take a few minutes to appear).

Navigate to the Azure role assignment menu, and add the role "Network Contributor" to the general resource group you use for the resources (not the AKS managed resource group).

Add root-certificate to the application gateway

az network application-gateway root-cert create --cert-file /tmp/ca.crt --gateway-name ingress-appgateway -n vectice-internal-ca --resource-group $KUBE_RESOURCE_GROUP

Step 4: Create Secrets for Ingress and Docker Image Retriever

First, create a self-signed certificate using the following command, replacing the item highlighted with your own Common Name (CN). Below, sample values are provided between brackets.

CNVALUE=<vectice.my-company.com>
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 -keyout /tmp/vectice-cert.key -out /tmp/vectice-cert.crt -subj "/CN=$CNVALUE"

Then, use the command below to install your certificates in the cluster

kubectl --context $CONTEXT create secret tls vectice-private-https -n vectice --cert=/tmp/vectice-cert.crt --key=/tmp/vectice-cert.key
kubectl --context $CONTEXT create secret docker-registry vectice-gar-secrets -n vectice \
--docker-server=https://us-docker.pkg.dev \
--docker-username=_json_key \
--docker-password="$(cat vectice-image-puller.json)" \
--docker-email=$(cat vectice-image-puller.json | grep "client_email" | cut -d '"' -f 4)

Step 5: Install the Vectice Stack

From the package your account team provided, untar helm vectice chart and create myvalues.yml from values.yml file. Below, sample values are provided between brackets.

VERSION=<241.1.0>
tar -xvf vectice-$VERSION.tgz
cd vectice-$VERSION
cp values.yaml myvalues.yaml

Next, fill in the values in myvalues.yaml according to your environment deployment, and deploy Vectice global objects using Helm

cd ..
helm --kube-context $CONTEXT upgrade --install vectice vectice -f vectice/myvalues.yaml -n vectice --create-namespace --wait 

Once this is done, retrieve the Vectice ingress IP. Note: this might take up to 5 minutes to appear

kubectl --context $CONTEXT get ingress vectice -n vectice 

The expected output should look like this. Below are example values:

NAME      CLASS                      HOSTS                    ADDRESS   PORTS     AGE
vectice   azure-application-gateway  vectice.my-company.com   2.3.4.5   80, 443   1d

Finally, add the A record as a new entry in your DNS resolver.

In this example, the A record would look like below:

DOMAIN             RECORD TYPE     NAME        CONTENT
my-company.com     A               vectice     2.3.4.5
PreviousAppendicesNextAppendices

Last updated 1 month ago

Was this helpful?

Complete instructions, including the Terraform script, are found in the package your Vectice account team provided you. Contact if you require assistance.

PostgreSQL Instance creation, see

Kubernetes cluster creation, see

Blob Storage Creation, see

Creating network links, see

: Connect to the Cluster and Create the Vectice Namespace

: Install the Cert Manager

: Set up the Application Gateway on the cluster

: Create Secrets for Ingress and Docker Image Retriever

: Install the Vectice Stack

For any questions or assistance with deployment, please reach out to

To enable the AGIC add-on, go to the page and select your Cluster. Go to the Settings > Networking and Virtual Network Integration tab to find the application gateway ingress controller section. Click on the ManageCheck box next to Enable ingress controller, and Create a new Application Gateway or Select your existing one.

Once the application gateway is created, add the root certificate created at the to the application gateway. Below, sample values are provided between brackets.

To deploy the software, you can retrieve the necessary Docker images directly from the Vectice Registry. Alternatively, if you prefer, we can provide the images via an alternative delivery method that would be defined together. If your Kubernetes cluster is configured to pull images directly from the Vectice Registry, navigate to the location of the “vectice-image-puller.json” file. This is found in the package your Vectice account team provided you. Contact if you require assistance. Use this file to create the secret that will be used to pull the docker images from the Vectice GAR registry.

Please refer to the and comments inside the file myvalues.yaml to customize values.

Learn more about .

💻
support@vectice.com
support@vectice.com
Kubernetes services
support@vectice.com
configuration page
A DNS records
Step 1
Step 2
Step 3
Step 4
Step 5
Step 2
Installation Guide
Installation Guide
Installation Guide
Installation Guide
Appendix 1: Creating the SQL Instance
Appendix 2: Cluster Creation
Appendix 3: Creating the Blob Storage container
Appendix 4: Creating the network links