Skip to main content
This procedure installs the Tensorlake Sandbox Proxy in an Amazon EKS cluster. The preparation script creates Kubernetes manifests for an AWS Network Load Balancer Service. The AWS Load Balancer Controller creates the Network Load Balancer, or NLB. The NLB accepts HTTPS traffic on port 443. It also accepts native SSH traffic on port 22.

​
1. Prepare the required values

Prepare these values: The public endpoint must be an HTTPS origin. Do not add a port or a path. The EKS cluster must have the AWS Load Balancer Controller. The controller must support service.k8s.aws/nlb Services. Install these local commands:
Install the Tensorlake CLI if the tl command is not available:

​
2. Create the AWS certificate and security group

Create an AWS Certificate Manager, or ACM, certificate in the same AWS Region as the NLB. Add these names to the certificate:
Create the DNS validation records. Wait until ACM shows the certificate status as ISSUED. Create one security group for the NLB. Add these rules: The generated NLB has listeners on ports 443 and 22. Restrict port 22 if public SSH access is not required.

​
3. Run the preparation script

Download the preparation script. Run it with the required values:
The script creates the Kubernetes manifests. It does not change the Kubernetes cluster. Keep the output directory secure. It contains private keys.

​
4. Review and apply the resources

Confirm the Kubernetes context:
Review the generated resources. Run the server dry run:
Add a Deployment patch if the cluster requires a node selector or a toleration. Apply the resources:
Wait for the NLB hostname:
Confirm that both NLB target groups are healthy. Port 443 uses target port 9080. Port 22 uses target port 2222.

​
5. Create the public DNS records

Create two DNS alias records. Configure both records to use the NLB hostname:

​
6. Activate the endpoint

Open the project settings in Tensorlake Cloud. Set SSH proxy public key to the content of this file:
Set Sandbox ingress endpoint to this value:
Save both settings.

​
7. Verify the endpoint

Verify the health route:
Verify the wildcard certificate:
Create a test sandbox. Confirm that its URL has this form:
Test command execution and WebSocket SSH:
Test native SSH if port 22 is enabled. First, sign in to the Tensorlake CLI with your Tensorlake user account. A project API key cannot register a user SSH key:
Register a user SSH key. Connect to the sandbox:
The Sandbox Proxy connects to the sandbox SSH server on private port 8096.

​
8. Rotate the certificate and keys

Use this step when the certificate or keys must change. Run prepare.sh again with a new output directory. Review and apply the new resources. The certificate fingerprint starts a rolling pod update. Update SSH proxy public key with the new outbound.key.pub value. Keep the previous output directory in secure storage until the update passes.