MLPE 스터디 3주차 - Ch6.1 BentoML과 Yatai로 소득 분류기를 API로 배포하기

import os
import mlflow
import bentoml

mlflow.set_tracking_uri(os.environ.get("MLFLOW_TRACKING_URI", "http://192.168.0.238:5000"))
os.environ.setdefault("MLFLOW_S3_ENDPOINT_URL", "http://192.168.0.237:9000")   # RustFS LB
os.environ.setdefault("AWS_ENDPOINT_URL", os.environ["MLFLOW_S3_ENDPOINT_URL"])
model_name, model_stage = "random-forest-classifier", "Production"
m = bentoml.mlflow.import_model(model_name, model_uri=f"models:/{model_name}/{model_stage}")
print("imported", m.tag)

income_clf_runner = bentoml.mlflow.get("random-forest-classifier:latest").to_runner()
svc = bentoml.Service("income_classifier_service", runners=[income_clf_runner])

@svc.on_startup
async def initialise(context: bentoml.Context):
    config = load_config(ENV_FILE_NAME)
    # MLflow 에서 Production run 을 찾아 학습 때의 더미 컬럼 목록(column_list.pkl)을 받는다
    # MinIO(홈랩은 RustFS)와 Redis 정보로 Feast 피처 스토어를 연다
    context.state["store"] = feature_store.init_feature_store()
    context.state["col_list"] = col_list

@svc.api(input=full_input_spec, output=JSON(), route="/predict")
def predict(inputs: IncomeClassifierUsers, ctx: bentoml.Context) -> Dict[str, Any]:
    feature_df = ctx.state["store"].get_online_features(
        features=ctx.state["feature_list"], entity_rows=[inputs.dict()]).to_df()   # Feast 온라인 피처
    feature_df.drop(columns=["user_id"], inplace=True)
    input_df = InputMapper(feature_df, ctx.state["col_list"]).generate_pandas_dataframe()
    output_mapper = OutputMapper(income_clf_runner.predict.run(input_df)[0])
    return {"income_category": output_mapper.map_prediction(), "user_id": inputs.user_id}

service: "service:svc"
labels:
  owner: ml-engineering-team
  env: homelab
include:
  - "service.py"
  - "homelab.env"                # 클러스터 안 주소만 담는다. 비밀값 없음
  - "src/*.py"
  - "requirements_homelab.txt"
python:
  requirements_txt: requirements_homelab.txt
docker:
  base_image: python:3.12-slim
  env:
    - ENV_NAME=homelab

    def generate_pandas_dataframe(self):
        dummyfied_input_data = pd.get_dummies(self.data, sparse=False, dtype=float)
        transformed_input_data = dummyfied_input_data.reindex(columns=self.column_list, fill_value=0)
        return transformed_input_data

def _read_k8s_secret(name):
    """Pod 의 ServiceAccount 토큰으로 같은 네임스페이스의 Secret 하나를 읽는다."""
    sa = "/var/run/secrets/kubernetes.io/serviceaccount"
    token, ns = open(f"{sa}/token").read().strip(), open(f"{sa}/namespace").read().strip()
    ctx = ssl.create_default_context(cafile=f"{sa}/ca.crt")
    req = urllib.request.Request(f"https://kubernetes.default.svc/api/v1/namespaces/{ns}/secrets/{name}",
                                 headers={"Authorization": f"Bearer {token}"})
    data = json.load(urllib.request.urlopen(req, context=ctx, timeout=10))["data"]
    return {k: base64.b64decode(v).decode() for k, v in data.items()}


def load_config(path):
    config = dict(dotenv_values(path))
    for k, v in os.environ.items():                       # 같은 이름 환경변수가 .env 값을 덮어쓴다
        if k in config or k in SECRET_KEYS:
            config[k] = v
    if os.environ.get("K8S_SECRET_NAME"):                 # 클러스터: Secret 에서 비밀값
        sec = _read_k8s_secret(os.environ["K8S_SECRET_NAME"])
        config["MINIO_ACCESS_KEY"] = sec["AWS_ACCESS_KEY_ID"]
        config["MINIO_SECRET_KEY"] = sec["AWS_SECRET_ACCESS_KEY"]
        config["FEAST_REDIS_PASSWORD"] = sec["redis-password"]
    if config.get("MINIO_ACCESS_KEY"):                    # MLflow 아티팩트(boto3)용
        os.environ["AWS_ACCESS_KEY_ID"] = config["MINIO_ACCESS_KEY"]
        os.environ["AWS_SECRET_ACCESS_KEY"] = config["MINIO_SECRET_KEY"]
    return config

import sys
from bentoml._internal.container import build

bento_tag, image_tag = sys.argv[1], sys.argv[2]
build(bento_tag, backend="docker", tag=(image_tag,))
print("BUILD_FINISHED")

MINIO_ACCESS_KEY=$(kubectl -n mlflow get secret rustfs-credentials -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 -d)
MINIO_SECRET_KEY=$(kubectl -n mlflow get secret rustfs-credentials -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 -d)
FEAST_REDIS_PASSWORD=$(kubectl -n feast get secret redis-auth -o jsonpath='{.data.redis-password}' | base64 -d)
REDIS_IP=$(kubectl -n feast get svc redis -o jsonpath='{.spec.clusterIP}')
docker run -d --name income-clf --network host -e BENTOML_PORT=3010 \
  -e MINIO_HOST=192.168.0.237:9000 -e FEAST_S3_ENDPOINT_URL=http://192.168.0.237:9000 \
  -e MLFLOW_HOST=http://192.168.0.238:5000 -e FEAST_REDIS_HOST=$REDIS_IP \
  -e MINIO_ACCESS_KEY=$MINIO_ACCESS_KEY -e MINIO_SECRET_KEY=$MINIO_SECRET_KEY -e FEAST_REDIS_PASSWORD=$FEAST_REDIS_PASSWORD \
  -e MLFLOW_S3_ENDPOINT_URL=http://192.168.0.237:9000 $T

copy_secret mlflow rustfs-credentials yatai-system                 # RustFS 키는 복사해서 참조
kubectl -n yatai-system get secret yatai-postgresql >/dev/null 2>&1 || \
  kubectl -n yatai-system create secret generic yatai-postgresql --from-literal=password="$(rand)"
PW=$(kubectl -n yatai-system get secret yatai-postgresql -o jsonpath='{.data.password}' | base64 -d)

# 비밀번호는 kubectl 인자가 아니라 stdin 첫 줄로 넘긴다
kubectl -n mlflow exec -i deploy/mlflow-postgres -- sh -c 'read -r PW; psql -v ON_ERROR_STOP=1 -q -U "$POSTGRES_USER" -d "$POSTGRES_DB" -v pw="$PW" -f -' <<SQL
$PW
SELECT 'CREATE ROLE yatai LOGIN' WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'yatai') \gexec
ALTER ROLE yatai WITH LOGIN PASSWORD :'pw';
SELECT 'CREATE DATABASE yatai OWNER yatai' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'yatai') \gexec
SQL

# RustFS 버킷 yatai (없을 때만)
kubectl -n mlflow exec deploy/mlflow -c mlflow -- python -c "..."

helm upgrade --install yatai yatai --repo https://bentoml.github.io/helm-charts --version 1.1.13 \
  -n yatai-system -f 01-yatai/values.yaml --wait --timeout 10m
kubectl apply -f 01-yatai/yatai-lb.yaml

service: {type: ClusterIP, port: 80}       # LAN 접속은 yatai-lb.yaml (192.168.0.243)
ingress: {enabled: false}
postgresql:
  host: mlflow-postgres.mlflow.svc
  port: 5432
  user: yatai
  database: yatai
  sslmode: disable
  passwordExistingSecretName: yatai-postgresql
  passwordExistingSecretKey: password
s3:
  endpoint: rustfs.mlflow.svc:9000
  region: us-east-1
  bucketName: yatai
  secure: false
  accessKeyExistingSecretName: rustfs-credentials
  accessKeyExistingSecretKey: AWS_ACCESS_KEY_ID
  secretKeyExistingSecretName: rustfs-credentials
  secretKeyExistingSecretKey: AWS_SECRET_ACCESS_KEY
transmissionStrategy: proxy
doNotTrack: true
nodeSelector: {kubernetes.io/arch: amd64}            # 이미지가 amd64 전용
resources:
  requests: {cpu: 100m, memory: 256Mi}
  limits: {memory: 1Gi}

kubectl -n yatai-system get secret yatai-env -o jsonpath='{.data.YATAI_INITIALIZATION_TOKEN}' | base64 -d; echo

read -rs TOK && ~/mlpe-ch6/chapter-6/.venv/bin/bentoml yatai login --api-token "$TOK" --endpoint http://192.168.0.243; unset TOK

read -rs TOK && \
kubectl -n yatai-image-builder create secret generic dockerhub-push --from-literal=password="$TOK" && \
kubectl -n yatai create secret docker-registry dockerhub-push \
  --docker-server=https://index.docker.io/v1/ --docker-username=hyeonjae0913 --docker-password="$TOK"; \
unset TOK

service: {type: ClusterIP, port: 80}
dockerRegistry:
  server: docker.io/hyeonjae0913      # 이미지: docker.io/hyeonjae0913/yatai-bentos:yatai.<bento>.<version>
  inClusterServer: docker.io/hyeonjae0913
  username: hyeonjae0913
  passwordExistingSecretName: dockerhub-push
  passwordExistingSecretKey: password
  secure: true
  bentoRepositoryName: yatai-bentos
bentoImageBuildEngine: kaniko
nodeSelector: {kubernetes.io/arch: amd64}
resources:
  requests: {cpu: 50m, memory: 128Mi}
  limits: {memory: 512Mi}

service: {type: ClusterIP, port: 80}
layers:
  network:
    ingressClass: nginx
    domainSuffix: yatai.local
    automaticDomainSuffixGeneration: false
bentoDeploymentNamespaces: ["yatai"]
nodeSelector: {kubernetes.io/arch: amd64}
resources:
  requests: {cpu: 50m, memory: 128Mi}
  limits: {memory: 512Mi}

apiVersion: resources.yatai.ai/v1alpha1
kind: BentoRequest
metadata:
  name: income-classifier-service-rpvs4lgz4oiyjbch
  namespace: yatai
spec:
  bentoTag: income_classifier_service:rpvs4lgz4oiyjbch
  image: docker.io/hyeonjae0913/yatai-bentos:yatai.income_classifier_service.rpvs4lgz4oiyjbch
  dockerConfigJsonSecretName: dockerhub-push
  imageBuilderExtraPodSpec:
    nodeSelector: {kubernetes.io/arch: amd64}
  imageBuilderContainerResources:
    requests: {cpu: 500m, memory: 1Gi}
    limits: {cpu: "2", memory: 6Gi}

apiVersion: v1
kind: ServiceAccount
metadata: {name: income-classifier, namespace: yatai}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: income-classifier-secret-reader, namespace: yatai}
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["income-classifier-env"]     # rustfs-credentials + redis-auth 를 합친 Secret
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: {name: income-classifier-secret-reader, namespace: yatai}
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: income-classifier-secret-reader}
subjects:
  - {kind: ServiceAccount, name: income-classifier, namespace: yatai}

apiVersion: serving.yatai.ai/v2alpha1
kind: BentoDeployment
metadata:
  name: income-classifier-service
  namespace: yatai
spec:
  bento: income-classifier-service-rpvs4lgz4oiyjbch     # BentoRequest 가 만든 Bento 객체
  ingress: {enabled: false}
  autoscaling: {minReplicas: 1, maxReplicas: 1}         # worker1-gpu 여유가 작아 고정
  resources:
    requests: {cpu: 100m, memory: 512Mi}
    limits: {memory: 2Gi}
  envs:
    - {name: ENV_NAME, value: homelab}
    - {name: BENTOML_CONFIG_OPTIONS, value: "api_server.workers=2"}   # 기본은 노드 CPU 수(12)만큼
    - {name: MLFLOW_S3_ENDPOINT_URL, value: "http://rustfs.mlflow.svc:9000"}
    - {name: K8S_SECRET_NAME, value: income-classifier-env}
  extraPodSpec:
    nodeSelector: {kubernetes.io/arch: amd64}
    serviceAccountName: income-classifier
  runners:
    - name: random-forest-classifier
      autoscaling: {minReplicas: 1, maxReplicas: 1}
      resources:
        requests: {cpu: 100m, memory: 512Mi}
        limits: {memory: 2Gi}
      envs:
        - {name: ENV_NAME, value: homelab}
      extraPodSpec:
        nodeSelector: {kubernetes.io/arch: amd64}

apiVersion: v1
kind: Service
metadata:
  name: income-classifier-lb
  namespace: yatai
  annotations: {lbipam.cilium.io/ips: "192.168.0.244"}
spec:
  type: LoadBalancer
  selector:
    yatai.ai/bento-deployment: income-classifier-service
    yatai.ai/bento-deployment-component-type: api-server
  ports:
    - {name: http, port: 80, targetPort: 3000}
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata: {name: income-classifier-service, namespace: yatai}
spec:
  selector:
    matchLabels:
      yatai.ai/bento-deployment: income-classifier-service
      yatai.ai/bento-deployment-component-type: api-server
  endpoints:
    - {port: http, path: /metrics, interval: 30s}