Installation overview

cloud: "aws"
clusterName: "arn:aws:eks:<region>:<account-id>:cluster/<cluster-name>"
hubJwt: "<JWT>" (base64 encoded)
gazetteBucket: "<gazette-bucket-name>"
druidBucket: "<adb-bucket-name>"
postgresPassword: "<user selected postgres password>" (base64 encoded)
organizationName: "<name of the organization or company>"
cipherKey: "<encryption key>" (base64 encoded)
clusterSizing: "<sizing option>"
region: "<region>"
serverSideEncryption: ""
collectNodeMetrics: true

# The URL used to reach the Arize AX UI once ingress endpoints are created
appBaseUrl: "https://<arize-app.domain>"

# Omit this field if using node level roles instead of IAM roles for service accounts (IRSA)
awsServiceAccountRoleRwBucket: "arn:aws:iam::<account-id>:role/<read-write-role>"

# Only required if using a private docker registry
pushRegistry: "<account-id>.dkr.ecr.<region>.amazonaws.com"
pullRegistry: "<account-id>.dkr.ecr.<region>.amazonaws.com"

# Only required if using a common node pool
historicalNodePoolEnabled: false

helm upgrade --install -f values.yaml arize-op arize-operator-chart.tgz

cloud: "ceph"
clusterName: "<cluster-name>"
hubJwt: "<base64-encoded-runtime-registry-jwt>"
gazetteBucket: "<gazette-bucket-name>"
druidBucket: "<adb-bucket-name>"
postgresPassword: "<base64-encoded-postgres-password>"
organizationName: "<name of the organization or company>"
cipherKey: "<base64-encoded-encryption-key>"
clusterSizing: "<sizing option>"
cephS3Endpoint: "<URL to the Ceph S3 endpoint>"
cephS3AccessKeyId: "<base64-encoded-ceph-s3-access-key-id>"
cephS3SecretAccessKey: "<base64-encoded-ceph-s3-secret-access-key>"
collectNodeMetrics: true

# The URL used to reach the Arize AX UI once ingress endpoints are created
appBaseUrl: "https://<arize-app.domain>"

# Only required if using a private container registry
pushRegistry: "<container-registry>"
pullRegistry: "<container-registry>"

# Only required if using a common node pool
historicalNodePoolEnabled: false

# Change to align with namespaces
baseRunAsUser: 1000
baseRunAsGroup: 1000
baseFsGroup: 1000
postgresRunAsUser: 70
postgresRunAsGroup: 70
postgresFsGroup: 70
operatorRunAsUser: 1000
operatorRunAsGroup: 1000
operatorFsGroup: 1000

ingressMode: 'openshift'

./arize.sh -y install

helm upgrade --install -f values.yaml arize-op arize-operator-chart.tgz

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--write-kubeconfig-mode=644" sh - && \
  mkdir -p ~/.kube && \
  sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config && \
  sudo chown $USER ~/.kube/config && \
  chmod 600 ~/.kube/config

NAME                  STATUS   ROLES           AGE    VERSION
<your machine name>   Ready    control-plane   176m   v1.34.5+k3s1

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

mkdir minio && cd minio

cat > minio-values.yaml << 'EOF'
rootUser: minio
rootPassword: <your chosen password>
persistence:
  size: <up to 75Gi>
  storageClass: local-path
replicas: 1
mode: standalone
buckets:
  - name: gazette-bucket
    policy: none
    purge: false
    versioning: true
    objectlocking: false
  - name: adb-bucket
    policy: none
    purge: false
    versioning: true
    objectlocking: false
EOF

helm repo add minio https://charts.min.io/
helm install minio minio/minio -f minio-values.yaml

VERSION=${1:-$(curl -s https://arize.com/docs/ax/selfhosting/on-premise-releases | grep -Eo 'Release [0-9]+\.[0-9]+\.[0-9]+' | head -1 | awk '{print $2}')}
cd ../ && mkdir arize-release-$VERSION && cd arize-release-$VERSION

URL=https://ch.hub.arize.com/dist
JWT="<your JWT token>"
curl -H "Authorization: Bearer $JWT" "$URL/distributions/arize-distribution-$VERSION.tar" --output "arize-distribution-$VERSION.tar"

tar xvf *.tar

cat > values.yaml << 'EOF'
cloud: "ceph"
clusterName: "default"
hubJwt: "<JWT>" (base64 encoded)
gazetteBucket: "gazette-bucket"
druidBucket: "adb-bucket"
postgresPassword: "<user selected postgres password>" (base64 encoded)
organizationName: "<name of the organization or company>"
clusterSizing: "nonha"
cephS3Endpoint: "http://minio.default.svc.cluster.local:9000"
cephS3AccessKeyId: "<Minio user set in the previous step>" (base64 encoded)
cephS3SecretAccessKey: "<Minio password set in the previous step>" (base64 encoded)
cipherKey: "<encryption key>" (base64 encoded)
storageClassCephSsd: "local-path"
storageClassCephStandard: "local-path"
ingressMode: "notls"

# The URL used to reach the Arize AX UI once ingress endpoints are created
# Use the same hostname you will put in /etc/hosts (Step 8), e.g. https://arize-app.example.local
# Private-IP only: the hostname must resolve (via hosts file or DNS) to the VM's private IP for clients on that network
appBaseUrl: "https://<arize-app.domain>"

# Only required if using a private docker registry
pushRegistry: "<docker-registry>"
pullRegistry: "<docker-registry>"

baseOverlay: |
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: internalendpoints-app
    namespace: arize
    annotations:
      traefik.ingress.kubernetes.io/service.serversscheme: h2c
EOF

./arize.sh install

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -out tls.crt \
    -keyout tls.key \
    -subj "/CN=arize-app.<your domain>/O=Arize" -addext "subjectAltName = DNS:arize-app.<your domain>"

base64 -w 0 tls.crt   # use this for tls.crt in the manifest
base64 -w 0 tls.key   # use this for tls.key in the manifest

mkdir -p ingress && cd ingress

cat > ingress.yaml << 'EOF'
apiVersion: v1
kind: Secret
metadata:
  name: arize-app-services-tls
  namespace: arize
type: kubernetes.io/tls
data:
  tls.crt: "<your value for tls.crt>"
  tls.key: "<your value for tls.key>"
apiVersion: v1
kind: Secret
metadata:
  name: default-ingress-cert
  namespace: kube-system
type: kubernetes.io/tls
data:
  tls.crt: "<your value for tls.crt>"
  tls.key: "<your value for tls.key>"
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: arize-app-services
  namespace: arize
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - arize-app.<your domain>
      secretName: arize-app-services-tls
  rules:
    - host: arize-app.<your domain>
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: internalendpoints-app
                port:
                  number: 443
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: arize-app
  namespace: arize
spec:
  entryPoints:
    - websecure
  tls:
    secretName: arize-app-services-tls
  routes:
    - match: Host(`arize-app.<your domain>`)
      kind: Rule
      services:
        - name: internalendpoints-app
          port: 443
apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default
  namespace: kube-system
spec:
  defaultCertificate:
    secretName: default-ingress-cert
EOF

kubectl apply -f ingress.yaml

# Existing entries (leave as-is)
127.0.0.1       localhost
::1             localhost

# Arize AX single-host VM (public or private IP — use the address your client can reach)
<ip address of your VM>   arize-app.<your domain>

cd examples/sdk
# Use the script’s options to point at your Arize AX endpoint and cert if required
python trace_sample_http.py

kubectl config get-clusters
kubectl config current-context

helmNamespace: arize-operator
cloud: "minio"
clusterName: "<cluster-entry-from-kubectl-config-get-clusters>"
organizationName: "<organization-name>"
clusterSizing: "<sizing-profile>"

gazetteBucket: "<gazette-bucket-name>"
druidBucket: "<adb-bucket-name>"

hubJwt: "<base64-encoded-runtime-registry-jwt>"
postgresPassword: "<base64-encoded-postgres-password>"
cipherKey: "<base64-encoded-cipher-key>"
minioPassword: "<base64-encoded-minio-password>"

appBaseUrl: "https://<arize-app-domain>"

storageClassMinioStandard: "<standard-storage-class>"
storageClassMinioSsd: "<ssd-storage-class>"

# Set this to false if the cluster does not have a separate ArizeDB node pool.
historicalNodePoolEnabled: false

# Leave empty to use the Postgres deployed by the operator.
postgresHostEndpoint: ""

# Use a shared node pool instead of a dedicated ArizeDB pool.
historicalNodePoolEnabled: false

# Use node emptyDir for component scratch space instead of large default PVCs.
ephemeralMode: emptyDir

# Disable autosizing on small clusters: with autosizing on, the ArizeDB
# historical container can request 24 GiB of memory, which will not fit on
# a typical homelab node and the pod will stay Pending.
autoSizeMemory: false
autoSizeReplicas: false

podTolerationAll: "[{key: 'workload', operator: 'Equal', value: 'arize', effect: 'NoSchedule'}]"
podTolerationBase: "[{key: 'workload', operator: 'Equal', value: 'arize', effect: 'NoSchedule'}]"
podTolerationHist: "[{key: 'workload', operator: 'Equal', value: 'arize', effect: 'NoSchedule'}]"
# Only set this if legacy Spark is enabled.
podTolerationSpark: "[{key: 'workload', operator: 'Equal', value: 'arize', effect: 'NoSchedule'}]"

baseOverlay: |
  ---
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: druid-compaction
    namespace: arize
  spec:
    replicas: 1

printf '%s' '<value>' | base64 | tr -d '\n'

./arize.sh -y -t 5400 install

namespaces "arize-operator" not found

kubectl get events -n arize --sort-by=.lastTimestamp
kubectl get sts minio -n arize

IDX=$(kubectl get sts minio -n arize \
  -o jsonpath='{range .spec.template.spec.containers[*]}{.name}{"\n"}{end}' \
  | grep -n '^minio$' | head -1 | cut -d: -f1)
if [ -z "$IDX" ]; then
  echo "MinIO container not found; contact Arize for an updated patch."
else
  IDX=$((IDX - 1))
  kubectl patch sts -n arize minio --type='json' -p="[
    {\"op\":\"test\",\"path\":\"/spec/template/spec/containers/$IDX/name\",\"value\":\"minio\"},
    {\"op\":\"remove\",\"path\":\"/spec/template/spec/containers/$IDX/ports/0/hostPort\"}
  ]"
  kubectl rollout restart statefulset/minio -n arize || true
fi

pods "promtail-xxxxx" is forbidden: violates PodSecurity "baseline:latest":
  hostPath volumes (volumes "run", "containers", "pods")

kubectl label ns arize pod-security.kubernetes.io/enforce=privileged --overwrite
kubectl rollout restart daemonset/promtail -n arize

kubectl get pods -n arize-operator
kubectl get pod arize-op-arize-operator-operator-0 -n arize-operator \
  -o jsonpath='{.metadata.annotations.operator\.arize\.com/status}{"\n"}'
kubectl get pods -n arize
kubectl get jobs -n arize

helm uninstall arize-op -n arize-operator || true

kubectl delete all,cm,secret,pvc,sa,role,rolebinding,cronjob,job \
  -n arize --all --ignore-not-found=true --wait=false || true
kubectl delete all,cm,secret,pvc,sa,role,rolebinding,job \
  -n arize-operator --all --ignore-not-found=true --wait=false || true

kubectl delete ns arize --wait=false || true
kubectl delete ns arize-operator --wait=false || true
kubectl wait --for=delete ns/arize --timeout=300s || true
kubectl wait --for=delete ns/arize-operator --timeout=300s || true

kubectl get pods -n arize -o name \
  | xargs -r kubectl delete -n arize --grace-period=0 --force

kubectl get ns arize -o json \
  | jq 'del(.spec.finalizers)' \
  | kubectl replace --raw /api/v1/namespaces/arize/finalize -f -

kubectl get ns arize || true
kubectl get ns arize-operator || true

kubectl get volumes.longhorn.io -n longhorn-system

kubectl get jobs -n arize

for job in install-postgres-init install-minio-init install-gazette-init install-druid-init; do
  echo "===== $job ====="
  pod=$(kubectl get pod -n arize -l job-name=$job -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
  [ -n "$pod" ] && kubectl logs -n arize "$pod" --tail=120
done

kubectl delete job <failed-or-stuck-job-name> -n arize || true
./arize.sh -y apply