github.com/pachyderm/pachyderm@v1.13.4/doc/docs/1.11.x/deploy-manage/deploy/amazon_web_services/aws_cloudfront.md (about)

     1  # Deploy a Pachyderm Cluster with CloudFront
     2  
     3  After you have an EKS cluster or a Kubernetes cluster
     4  deployed with `kops` ready,
     5  you can integrate it with Amazon
     6  CloudFront™.
     7  
     8  Amazon CloudFront is a content delivery network (CDN) that
     9  streams data to your website, service, or application securely
    10  and with great performance. Pachyderm recommends that you
    11  set up Pachyderm with CloudFront for all production
    12  deployments.
    13  
    14  To deploy Pachyderm cluster with CloudFront,
    15  complete the following steps:
    16  
    17  1. [Create a CloudFront Distribution](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.html#GettingStartedCreateDistribution)
    18  1. [Deploy Pachyderm with an IAM role](aws-deploy-pachyderm.md)
    19  1. [Apply the CloudFront Key Pair](#apply-the-cloudfront-key-pair)
    20  
    21  ## Apply the CloudFront Key Pair
    22  
    23  If you need to create signed URLs and
    24  signed cookies for the data that goes to Pachyderm, you need to
    25  configure your AWS account to use a valid CloudFront key pair.
    26  Only a root AWS account can generate these secure credentials. Therefore,
    27  you might need to request your IT department to create them for you.
    28  
    29  For more information, see the [Amazon documentation](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html#private-content-creating-cloudfront-key-pairs).
    30  
    31  The CloudFront key pair includes the following attributes:
    32  
    33  - The private and public key. For this deployment, you only need the private
    34  key.
    35  - The key pair ID. Typically, the key pair ID is recorded in the filename.
    36  
    37  **Example:**
    38  
    39  ```
    40  rsa-APKAXXXXXXXXXXXXXXXX.pem
    41  pk-APKAXXXXXXXXXXXXXXXX.pem
    42  ```
    43  
    44  The key-pair ID is `APKAXXXXXXXXXXXXXXXX`. The other file is
    45  the private key, which looks similar to the following text:
    46  
    47  !!! example
    48      ```shell
    49      cat pk-APKAXXXXXXXXXXXX.pem
    50      -----BEGIN RSA PRIVATE KEY-----
    51      ...
    52      ```
    53  
    54  To apply this key pair to your CloudFront distribution, complete
    55  the following steps:
    56  
    57  1. Download the `secure-cloudfront.sh` script from the Pachyderm
    58  repository:
    59  
    60     ```shell
    61     curl -o secure-cloudfront.sh https://raw.githubusercontent.com/pachyderm/pachyderm/master/etc/deploy/cloudfront/secure-cloudfront.sh
    62     ```
    63  
    64  1. Make the script executable:
    65  
    66     ```shell
    67     chmod +x secure-cloudfront.sh
    68     ```
    69  
    70  1. From the `deploy.log` file, obtain the S3 bucket name for your
    71  deployment and the CloudFront distribution ID.
    72  
    73  1. Apply the key pair to your CloudFront distribution:
    74  
    75     ```shell
    76     ./secure-cloudfront.sh --region us-west-2 --zone us-west-2c --bucket YYYY-pachyderm-store --cloudfront-distribution-id E1BEBVLIDYTLEV  --cloudfront-keypair-id APKAXXXXXXXXXXXX --cloudfront-private-key-file ~/Downloads/pk-APKAXXXXXXXXXXXX.pem
    77     ```
    78  
    79  1. Restart the `pachd` pod for the
    80  changes to take effect:
    81  
    82     ```shell
    83     kubectl scale --replicas=0 deployment/pachd && kubectl scale --replicas=1 deployment/pachd && kubectl get pod
    84     ```
    85  
    86  1. Verify the setup by checking the `pachd` logs and confirming that
    87  Kubernetes uses the CloudFront credentials:
    88  
    89     ```shell
    90     kubectl get pod
    91     ```
    92  
    93     **System Response:**
    94  
    95     ```shell
    96     NAME                        READY     STATUS             RESTARTS   AGE
    97     etcd-0                   1/1       Running            0          19h
    98     etcd-1                   1/1       Running            0          19h
    99     etcd-2                   1/1       Running            0          19h
   100     pachd-2796595787-9x0qf   1/1       Running            0          16h
   101  
   102     kubectl logs pachd-2796595787-9x0qf | grep cloudfront
   103     2017-06-09T22:56:27Z INFO  AWS deployed with cloudfront distribution at d3j9kenawdv8p0
   104     2017-06-09T22:56:27Z INFO  Using cloudfront security credentials - keypair ID (APKAXXXXXXXXX) - to sign cloudfront URLs
   105     ```
   106