3 navsection: installguide
4 title: Single host Arvados
7 Copyright (C) The Arvados Authors. All rights reserved.
9 SPDX-License-Identifier: CC-BY-SA-3.0
12 # "Limitations of the single host install":#limitations
13 # "Prerequisites":#prerequisites
14 # "Download the installer":#single_host
15 # "Choose the SSL configuration":#certificates
16 ## "Using a self-signed certificate":#self-signed
17 ## "Using a Let's Encrypt certificate":#lets-encrypt
18 ## "Bring your own certificate":#bring-your-own
19 # "Further customization of the installation (modifying the salt pillars and states)":#further_customization
20 # "Run the provision.sh script":#run_provision_script
21 # "Install the CA root certificate":#ca_root_certificate
22 # "Initial user and login":#initial_user
23 # "Test the installed cluster running a simple workflow":#test_install
24 # "After the installation":#post_install
26 h2(#limitations). Limitations of the single host install
28 <b>NOTE: The single host installation is a good choice for evaluating Arvados, but it is not recommended for production use.</b>
30 Using the default configuration, this installation method has a number of limitations:
32 * all services run on the same machine, and they will compete for resources. This includes any compute jobs.
33 * it uses the local machine disk for Keep storage (under the @/tmp@ directory). There may not be a lot of space available.
34 * it installs the @crunch-dispatch-local@ dispatcher, which can run just eight concurrent CWL jobs. These jobs will be executed on the same machine that runs all the Arvados services and may well starve them of resources.
36 It is possible to start with the single host installation method and modify the Arvados configuration file later to address these limitations. E.g. switch to a "different storage volume setup":{{site.baseurl}}/install/configure-s3-object-storage.html for Keep, and switch to "the cloud dispatcher":{{site.baseurl}}/install/crunch2-cloud/install-dispatch-cloud.html to provision compute resources dynamically.
38 h2(#prerequisites). Prerequisites and planning
43 * a dedicated (virtual) machine for your Arvados server with at least 2 cores and 8 GiB of RAM, running a "supported Arvados distribution":{{site.baseurl}}/install/install-manual-prerequisites.html#supportedlinux
44 * a DNS hostname that resolves to the IP address of your Arvados server
45 * ports 443, 8800-8805 need to be reachable from your client (configurable in @local.params@, see below)
46 * port 80 needs to be reachable from everywhere on the internet (only when using "Let's Encrypt":#lets-encrypt)
47 * an SSL certificate matching the hostname in use (only when using "bring your own certificate":#bring-your-own)
49 h2(#single_host). Download the installer
51 {% include 'branchname' %}
53 This procedure will install all the main Arvados components to get you up and running in a single host.
55 This is a package-based installation method, however the installation script is currently distributed in source form via @git@:
58 <pre><code>git clone https://git.arvados.org/arvados.git
59 git checkout {{ branchname }}
60 cd arvados/tools/salt-install
64 The @provision.sh@ script will help you deploy Arvados by preparing your environment to be able to run the installer, then running it. The actual installer is located in the "arvados-formula git repository":https://git.arvados.org/arvados-formula.git/tree/refs/heads/{{ branchname }} and will be cloned during the running of the @provision.sh@ script. The installer is built using "Saltstack":https://saltproject.io/ and @provision.sh@ performs the install using master-less mode.
66 First, copy the configuration files:
69 <pre><code>cp local.params.example.single_host_single_hostname local.params
70 cp -r config_examples/single_host/single_hostname local_config_dir
74 Edit the variables in the <i>local.params</i> file. Pay attention to the <b>*_PORT, *_TOKEN</b> and <b>*KEY</b> variables. The *SSL_MODE* variable is discussed in the next section.
76 h2(#certificates). Choose the SSL configuration (SSL_MODE)
78 Arvados requires an SSL certificate to work correctly. This installer supports these options:
80 * @self-signed@: let the installer create a self-signed certificate
81 * @lets-encrypt@: automatically obtain and install an SSL certificate for your hostname
82 * @bring-your-own@: supply your own certificate in the `certs` directory
84 h3(#self-signed). Using a self-signed certificate
86 In the default configuration, this installer uses self-signed certificate(s):
89 <pre><code>SSL_MODE="self-signed"
93 When connecting to the Arvados web interface for the first time, you will need to accept the self-signed certificate as trusted to bypass the browser warnings.
95 h3(#lets-encrypt). Using a Let's Encrypt certificate
97 To automatically get a valid certificate via Let's Encrypt, change the configuration like this:
100 <pre><code>SSL_MODE="lets-encrypt"
104 The hostname for your Arvados cluster must be defined in @HOSTNAME_EXT@ and resolve to the public IP address of your Arvados instance, so that Let's Encrypt can validate the domainname ownership and issue the certificate.
106 When using AWS, EC2 instances can have a default hostname that ends with <i>amazonaws.com</i>. Let's Encrypt has a blacklist of domain names for which it will not issue certificates, and that blacklist includes the <i>amazonaws.com</i> domain, which means the default hostname can not be used to get a certificate from Let's Encrypt.
108 h3(#bring-your-own). Bring your own certificate
110 To supply your own certificate, change the configuration like this:
113 <pre><code>SSL_MODE="bring-your-own"
114 CUSTOM_CERTS_DIR="${SCRIPT_DIR}/certs"
118 Copy your certificate files to the directory specified with the variable @CUSTOM_CERTS_DIR@. The provision script will find it there. The certificate and its key need to be copied to a file named after @HOSTNAME_EXT@. For example, if @HOSTNAME_EXT@ is defined as @my-arvados.example.net@, the script will look for
121 <pre><code>${CUSTOM_CERTS_DIR}/my-arvados.example.net.crt
122 ${CUSTOM_CERTS_DIR}/my-arvados.example.net.key
126 All certificate files will be used by nginx. You may need to include intermediate certificates in your certificate file. See "the nginx documentation":http://nginx.org/en/docs/http/configuring_https_servers.html#chains for more details.
128 h2(#further_customization). Further customization of the installation (modifying the salt pillars and states)
130 If you want or need further customization, you can edit the Saltstack pillars and states files. Pay particular attention to the <i>pillars/arvados.sls</i> one. Any extra <i>state</i> file you add under <i>local_config_dir/states</i> will be added to the salt run and applied to the host.
132 h2(#run_provision_script). Run the provision.sh script
134 When you finished customizing the configuration, you are ready to copy the files to the host (if needed) and run the @provision.sh@ script:
137 <pre><code>scp -r provision.sh local* tests user@host:
138 # if you have set SSL_MODE to "bring-your-own", make sure to also copy the certificate files:
139 # scp -r certs user@host:
140 ssh user@host sudo ./provision.sh
144 and wait for it to finish. The script will need 5 to 10 minutes to install and configure everything.
146 If everything goes OK, you'll get final output that looks similar to this:
149 <pre><code>arvados: Succeeded: 151 (changed=36)
154 h2(#ca_root_certificate). Install the CA root certificate (SSL_MODE=self-signed only)
156 Arvados uses SSL to encrypt communications. The web interface uses AJAX which will silently fail if the certificate is not valid or signed by an unknown Certification Authority.
158 For this reason, the @arvados-formula@ has a helper state to create a root certificate to authorize Arvados services. The @provision.sh@ script will leave a copy of the generated CA's certificate (@arvados-snakeoil-ca.pem@) in the script's directory so you can add it to your workstation.
160 Installing the root certificate into your web browser will prevent security errors when accessing Arvados services with your web browser.
162 # Go to the certificate manager in your browser.
163 #* In Chrome, this can be found under "Settings → Advanced → Manage Certificates" or by entering @chrome://settings/certificates@ in the URL bar.
164 #* In Firefox, this can be found under "Preferences → Privacy & Security" or entering @about:preferences#privacy@ in the URL bar and then choosing "View Certificates...".
165 # Select the "Authorities" tab, then press the "Import" button. Choose @arvados-snakeoil-ca.pem@
167 The certificate will be added under the "Arvados Formula".
169 To access your Arvados instance using command line clients (such as arv-get and arv-put) without security errors, install the certificate into the OS certificate storage.
174 <pre><code>cp arvados-root-cert.pem /usr/local/share/ca-certificates/
175 /usr/sbin/update-ca-certificates
182 <pre><code>cp arvados-root-cert.pem /etc/pki/ca-trust/source/anchors/
183 /usr/bin/update-ca-trust
187 h2(#initial_user). Initial user and login
189 At this point you should be able to log on to your new Arvados cluster. The workbench URL will be
191 * https://@HOSTNAME_EXT@
193 By default, the provision script creates an initial user for testing purposes. This user is configured as administrator of the newly created cluster. The username, password and e-mail address for the initial user are configured in the @local.params@ file. Log in with the e-mail address and password.
195 h2(#test_install). Test the installed cluster running a simple workflow
197 The @provision.sh@ script saves a simple example test workflow in the @/tmp/cluster_tests@ directory in the node. If you want to run it, just ssh to the node, change to that directory and run:
200 <pre><code>cd /tmp/cluster_tests
205 It will create a test user (by default, the same one as the admin user), upload a small workflow and run it. If everything goes OK, the output should similar to this (some output was shortened for clarity):
208 <pre><code>Creating Arvados Standard Docker Images project
209 Arvados project uuid is 'arva2-j7d0g-0prd8cjlk6kfl7y'
212 "uuid":"arva2-o0j2j-n4zu4cak5iifq2a",
213 "owner_uuid":"arva2-tpzed-000000000000000",
216 Creating initial user ('admin')
217 Setting up user ('admin')
222 "owner_uuid":"arva2-tpzed-000000000000000",
224 "uuid":"arva2-o0j2j-1ownrdne0ok9iox"
228 "owner_uuid":"arva2-tpzed-000000000000000",
230 "uuid":"arva2-o0j2j-1zbeyhcwxc1tvb7"
234 "email":"admin@arva2.arv.local",
236 "owner_uuid":"arva2-tpzed-000000000000000",
239 "uuid":"arva2-tpzed-3wrm93zmzpshrq2",
243 "kind":"arvados#HashList"
245 Activating user 'admin'
248 "email":"admin@arva2.arv.local",
251 "uuid":"arva2-tpzed-3wrm93zmzpshrq2",
254 Running test CWL workflow
255 INFO /usr/bin/cwl-runner 2.1.1, arvados-python-client 2.1.1, cwltool 3.0.20200807132242
256 INFO Resolved 'hasher-workflow.cwl' to 'file:///tmp/cluster_tests/hasher-workflow.cwl'
258 INFO Using cluster arva2 (https://arva2.arv.local:8443/)
259 INFO Upload local files: "test.txt"
260 INFO Uploaded to ea34d971b71d5536b4f6b7d6c69dc7f6+50 (arva2-4zz18-c8uvwqdry4r8jao)
261 INFO Using collection cache size 256 MiB
262 INFO [container hasher-workflow.cwl] submitted container_request arva2-xvhdp-v1bkywd58gyocwm
263 INFO [container hasher-workflow.cwl] arva2-xvhdp-v1bkywd58gyocwm is Final
264 INFO Overall process status is success
265 INFO Final output collection d6c69a88147dde9d52a418d50ef788df+123
268 "basename": "hasher3.md5sum.txt",
270 "location": "keep:d6c69a88147dde9d52a418d50ef788df+123/hasher3.md5sum.txt",
274 INFO Final process status is success
278 h2(#post_install). After the installation
280 Once the installation is complete, it is recommended to keep a copy of your local configuration files. Committing them to version control is a good idea.
282 Re-running the Salt-based installer is not recommended for maintaining and upgrading Arvados, please see "Maintenance and upgrading":{{site.baseurl}}/admin/maintenance-and-upgrading.html for more information.