Clusters

On-Demand Clusters within Existing Cloud VPC

If you would like to launch on-demand clusters using existing VPCs, you can easily set it up by configuring SkyPilot. Without setting VPC, we launch in the default VPC in the region of the cluster. If you do set a VPC name, we will only launch in regions containing that VPC name.

You need to create or update the file ~/.sky/config.yaml to configure the VPC. For instance in Amazon Web Services, you need to add

aws:
    vpc_name: my-vpc-name

And for Google Cloud you need:

gcp:
  vpc_name: my-vpc-name

If you need support for more advanced enterprise configurations, please email support@run.house for more information. More documentation is also available at SkyPilot’s advanced config page.

On-Demand Clusters with TLS exposed

In the previous example, the cluster that was brought up in EC2 is only accessible to the original user that has SSH credentials to the machine. However, you can set up a cluster with ports exposed to open Internet, and access objects and functions via curl.

tls_cluster = rh.cluster(name="tls-cluster",
                         instance_type="CPU:2",
                         open_ports=[443], # expose HTTPS port to public
                         server_connection_type="tls", # specify how runhouse communicates with this cluster
                         den_auth=False, # no authentication required to hit this cluster (NOT recommended)
).up_if_not()

WARNING | 2024-03-06 15:19:05.297411 | /Users/rohinbhasin/work/runhouse/runhouse/resources/hardware/on_demand_cluster.py:317: UserWarning: Server is insecure and must be inside a VPC or have den_auth enabled to secure it.
  warnings.warn(

remote_tls_function = rh.function(run_home).to(tls_cluster)

remote_tls_function("Marvin")

INFO | 2024-03-06 15:26:05.482586 | Calling run_home.call
INFO | 2024-03-06 15:26:06.550625 | Time to call run_home.call: 1.07 seconds

'Run home Marvin!'

tls_cluster.head_ip

'54.172.178.196'

! curl "https://54.172.178.196/run_home/call?name=Marvin" -k

{"data":""Run home Marvin!"","error":null,"traceback":null,"output_type":"result_serialized","serialization":"json"}

This cluster is exposed to the open Internet, so anyone can hit it. If you do want to share functions and apps publically, it’s recommended you set den_auth=True when setting up your cluster, which requires a user to run runhouse login in order to hit the cluster. We’ll enable it now:

tls_cluster.enable_den_auth()

! curl "https://54.172.178.196/run_home/call?name=Marvin" -k

{"data":null,"error":raise PermissionError(\nPermissionError: No Runhouse token provided. Try running $ runhouse login or visiting https://run.house/login to retrieve a token. If calling via HTTP, please provide a valid token in the Authorization header.\n"","output_type":"exception","serialization":null}

If we send our Runhouse Den token as a header, then the request is valid:

! curl "https://54.172.178.196/run_home/call?name=Marvin" -k -H "Authorization: Bearer <YOUR TOKEN HERE>"

{"data":""Run home Marvin!"","error":null,"traceback":null,"output_type":"result_serialized","serialization":"json"}