EKS — where the Posit pods run.
The Kubernetes cluster for the
cloud track
. Node groups, add-ons, the
CernVM-FS CSI
prefix foundation, and ingress. The cluster is
defined
by eksctl in
cc.ndexr.io/eks/cluster.yaml
; this page is the observe face. VPC, IAM and credentials come from
aws.ndexr.io
.
Cluster at a glance
Node group
Managed node group `posit` — m7i.2xlarge, min 1 / desired 2 / max 4. Kubernetes pinned at 1.31 (bump deliberately, §7).
Add-ons
aws-ebs-csi-driver for Posit data PVCs; the CernVM-FS CSI driver (kube-system) mounts the read-only stack. IRSA enabled for Secrets Manager.
Workloads
Posit Workbench / Connect / PPM in the `posit` namespace, deployed from the pinned helmfile in cc.ndexr.io.
Node ISA — the portability lever (§2)
The node
instance type
fixes the CPU ISA of every pod — the same lever
aws
owns for the bare-metal build host.
m7i.2xlarge
is Sapphire Rapids (AVX-512 capable), but the stack is built
GENERIC
(
-march=x86-64
), so a CVMFS binary loads here
and
on a laptop client. Do not move to a
native
/AVX-512-only node group unless every client is guaranteed that ISA — that would be a report-up, recorded in
env.ndexr.io
.
The prefix foundation on this cluster
CernVM-FS CSI
The exact driver Compute Canada/DRAC runs on Kubernetes. Mounts /cvmfs/software.ndexr.io/…/current read-only into every Posit pod — zero per-node installs.
North star, in-pod
A pod with only a thin base image + the CSI mount can `ml R/…` with zero host/image leakage — proven with readelf loader/RPATH checks (cc bin/90-verify-prefix.sh).
Ingress
nginx forwards connect/workbench/ppm hostnames to the EKS service endpoints in the `posit` namespace.