The cloud-native AI suite can be installed on ACK Pro, ACK Serverless Pro, and ACK Edge Pro clusters running Kubernetes 1.18 or later. This topic explains how to install the suite and configure the cloud-native AI operations and developer consoles.
Prerequisites
Ensure that you have:
-
An ACK Pro, ACK Serverless Pro, or ACK Edge Pro cluster running Kubernetes 1.18 or later is created.
-
(For the AI operations console) Container Monitoring and Log Service selected on the Component Configurations page during cluster creation, or ack-arms-prometheus and loongcollector installed on the Add-ons page. See Use Alibaba Cloud Prometheus for monitoring and Collect container logs from an ACK cluster
Deploy the suite
-
Log on to the ACK console. In the left navigation pane, click Clusters.
-
On the Clusters page, click your cluster name. In the left-side pane, choose Applications > Cloud-native AI Suite.
-
On the Cloud-native AI Suite page, click Deploy.
-
On the deployment page, select the components to install. See Component reference for details and compatibility.
If you select Kube Queue, Console, and Kubeflow Pipelines together, Arena is required.
-
Click Deploy Cloud-native AI Suite. The system runs an environment and dependency check, then deploys the selected components.
Component reference
The following table lists all components, their namespaces, and supported cluster types.
| Configuration | Component | Namespace | ACK Pro | ACK Serverless Pro | ACK Edge Pro |
|---|---|---|---|---|---|
| Elasticity | ack-alibaba-cloud-metrics-adapter | kube-system | Yes | No | Yes |
| Acceleration (Fluid data acceleration) | ack-fluid | fluid-system | Yes | Yes | Yes |
| Scheduling (batch task scheduling, GPU sharing, topology-aware GPU scheduling, and NPU scheduling) | ack-ai-installer | kube-system | Yes | No | Yes |
| Kube Queue | ack-kube-queue | kube-queue | Yes | Yes | Yes |
| Arena (CLI) | ack-arena | kube-system | Yes | Yes | Yes |
| Console (Platform for AI) | ack-pai | pai-system | Yes | No | Yes |
| Console (AI Dashboard) | ack-ai-dashboard | kube-ai | Yes | No | Yes |
| Console (AI Developer Console) | ack-ai-dev-console | kube-ai | Yes | No | Yes |
| Console Data Storage | ack-mysql | kube-ai | Yes | No | Yes |
| Workflow (Kubeflow Pipelines) | ack-ai-pipeline | kube-ai | Yes | No | Yes |
| Monitoring | ack-arena-exporter | kube-ai | Yes | No | Yes |
ack-pai integrates algorithms and engines optimized by Platform for AI (PAI), including Data Science Workshop (DSW), Deep Learning Containers (DLC), and Elastic Algorithm Service (EAS), to improve elasticity and efficiency for AI development, training, and inference.
To configure custom parameters for Scheduling components, click Advanced on the deployment page.
If you selected Arena, configure the Arena client separately after installation.
See Fluid data acceleration, ack-ai-installer, ack-kube-queue, and ack-ai-pipeline.
Configure the AI console
Starting January 22, 2025, the AI console (AI Dashboard and AI Developer Console) is available only to whitelisted users. Existing deployments are unaffected. Non-whitelisted users can install and configure the AI console through the open-source community. See data-on-ack.
Authorize the AI console
-
In the Ecosystem Tools section, select Console. A Note dialog box appears.
-
If the authorization status shows Authorized, skip to Select an access method.
-
If the status shows Unauthorized in red and OK is unavailable, complete the authorization below.
-
-
Create a custom policy in Resource Access Management (RAM).
-
Log on to the RAM console. In the left navigation pane, choose Permissions > Policies.
-
Click Create Policy.
-
On the JSON tab, enter the following policy and click OK. Name the policy
k8sWorkerRolePolicy-{ClusterID}.{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "cs:*", "log:GetProject", "log:GetLogStore", "log:GetConfig", "log:GetMachineGroup", "log:GetAppliedMachineGroups", "log:GetAppliedConfigs", "log:GetIndex", "log:GetSavedSearch", "log:GetDashboard", "log:GetJob", "ecs:DescribeInstances", "ecs:DescribeSpotPriceHistory", "ecs:DescribePrice", "eci:DescribeContainerGroups", "eci:DescribeContainerGroupPrice", "log:GetLogStoreLogs", "ims:CreateApplication", "ims:UpdateApplication", "ims:GetApplication", "ims:ListApplications", "ims:DeleteApplication", "ims:CreateAppSecret", "ims:GetAppSecret", "ims:ListAppSecretIds", "ims:ListUsers" ], "Resource": "*" } ] }
-
-
Attach the custom policy to the cluster RAM role.
-
In the RAM console, in the left navigation pane, choose Identities > Roles.
-
Search for
KubernetesWorkerRole-{ClusterID}and click Grant Permission in the Actions column. -
In the Grant Permission panel, search for
k8sWorkerRolePolicy-{ClusterID}. -
Select the policy and click Grant permissions.
-
-
Return to the Note dialog box and click Authorization Check. The status changes to Authorized and OK becomes available.
Select an access method
In the Note dialog box, select an access method and click OK.
| Access method | Recommended use | Notes |
|---|---|---|
| Private IP | Production | Accesses the console over the internal network |
| Internal Domain | Production | Uses a private domain name |
| Public Domain | Testing only | Map the public domain to the NGINX Ingress SLB public IP in your local hosts file |
Configure console data storage
After you select Console under Interaction Mode, the Console Data Storage option appears. Choose a storage method.
Pre-installed MySQL (testing only)
If you do not select ApsaraDB RDS, the cluster uses a built-in MySQL database by default.
This option is recommended for testing only. If the cluster fails or storage is lost, data may be lost.
Deployment creates a 120 GB disk as a PersistentVolumeClaim (PVC) using the StorageClass. ACK does not manage the disk lifecycle. Delete the disk manually when no longer needed.
ApsaraDB RDS (production)
Use ApsaraDB RDS for production workloads.
If a connection error occurs, see Troubleshoot instance connection failures.
To change the storage method, uninstall and reinstall the suite. Delete the Secretkubeai-rdsin thekube-ainamespace before reinstalling, if it exists.
-
Purchase an ApsaraDB RDS instance and create a database and an account. See Quick start for ApsaraDB RDS and Billing overview.
-
Click Deploy Cloud-native AI Suite at the bottom of the deployment page.
-
In the ACK console, click the cluster name. In the left navigation pane, choose Configurations > Secrets.
-
From the Namespace drop-down list, select
kube-ai. -
Click Create from YAML.
-
Enter the following YAML template to create a Secret named
kubeai-rds, then click Create.Parameter Description MYSQL_HOSTThe ApsaraDB RDS connection endpoint MYSQL_DB_NAMEThe database name MYSQL_USERThe database account username MYSQL_PASSWORDThe database account password apiVersion: v1 kind: Secret metadata: name: kubeai-rds namespace: kube-ai type: Opaque stringData: MYSQL_HOST: "Your RDS endpoint" MYSQL_DB_NAME: "Database name" MYSQL_USER: "Database username" MYSQL_PASSWORD: "Database password"
Configure workflow data storage
If you select Kubeflow Pipelines as the workflow engine, the Workflow Data Storage option appears. Choose a storage method.
Pre-installed MinIO (testing only)
If you do not select OSS, the cluster uses a built-in MinIO instance by default.
This option is recommended for testing only. If the cluster fails or storage is lost, data may be lost.
Deployment creates a 20 GB disk as a PVC using the StorageClass. ACK does not manage the disk lifecycle. Delete the disk manually when no longer needed.
Object Storage Service (testing and production)
Use Object Storage Service (OSS) for persistent, scalable workflow data storage.
-
If the
kube-ainamespace does not exist, create it:The
kube-ainamespace is created automatically during suite deployment. Verify it exists before creating.kubectl create ns kube-ai -
In the ACK console, click the cluster name. In the left navigation pane, choose Configurations > Secrets.
-
From the Namespace drop-down list, select
kube-ai. -
Click Create from YAML.
-
Enter the following YAML to create a Secret named
kubeai-oss, then click Create.Parameter Description ENDPOINTThe OSS endpoint for your region. See OSS regions and endpoints ACCESS_KEY_IDThe AccessKey ID of a RAM user with AliyunOSSFullAccesspermission. See Create an AccessKey pairACCESS_KEY_SECRETThe AccessKey secret of the RAM user apiVersion: v1 kind: Secret metadata: name: kubeai-oss namespace: kube-ai type: Opaque stringData: ENDPOINT: "https://oss-cn-beijing.aliyuncs.com" ACCESS_KEY_ID: "****" ACCESS_KEY_SECRET: "****" -
After creating the Secret, verify that a bucket named
mlpipeline-<clusterid>appears in the OSS console. See Billing overview for OSS billing. -
Return to the deployment page and install Kubeflow Pipelines.
Verify the deployment
After deployment, verify that the components are running:
-
In the ACK console, click the cluster name. In the left-side pane, choose Applications > Cloud-native AI Suite. The component list shows all installed components with their versions.
-
Confirm that each component shows a successful deployment status. You can Deploy or Uninstall individual components. If a newer version is available, you can also Upgrade.
-
If you installed the AI consoles, click AI Dashboard or AI Developer Console in the upper-left corner of the Cloud-native AI Suite page to verify access.