Skip to content

Commit 8cd96f2

Browse files
author
Seth
committed
Infra - refactor of modules. moved private dns to each module. various cleanup
1 parent 49d4ea1 commit 8cd96f2

14 files changed

Lines changed: 795 additions & 601 deletions

‎infra/main.bicep‎

Lines changed: 89 additions & 310 deletions
Large diffs are not rendered by default.

‎infra/modules/ai-foundry/hub.bicep‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
@description('Name of the Storage Account.')
2+
param name string
3+
4+
@description('Specifies the location for all the Azure resources.')
5+
param location string
6+
7+
@description('Optional. Tags to be applied to the resources.')
8+
param tags object = {}
9+
10+
@description('Resource ID of the virtual network to link the private DNS zones.')
11+
param virtualNetworkResourceId string
12+
13+
@description('Resource ID of the subnet for the private endpoint.')
14+
param virtualNetworkSubnetResourceId string
15+
16+
@description('Resource ID of the Log Analytics workspace to use for diagnostic settings.')
17+
param logAnalyticsWorkspaceResourceId string
18+
19+
@description('Resource ID of the Application Insights resource for the Hub.')
20+
param appInsightsResourceId string
21+
22+
@description('Resource ID of the Key Vault for the Hub.')
23+
param keyVaultResourceId string
24+
25+
@description('Resource ID of the Storage Account for the Hub.')
26+
param storageAccountResourceId string
27+
28+
@description('Resource ID of the Container Registry for the Hub.')
29+
param containerRegistryResourceId string?
30+
31+
@description('Specifies whether network isolation is enabled. This will create a private endpoint for the Storage Account and link the private DNS zone.')
32+
param networkIsolation bool = true
33+
34+
@description('Optional. Array of role assignments to create.')
35+
param roleAssignments roleAssignmentType[]?
36+
37+
@description('List of connections to apply to the workspace.')
38+
param connections connectionType[]?
39+
40+
module mlApiPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.0' = if (networkIsolation) {
41+
name: 'private-dns-mlapi-deployment'
42+
params: {
43+
name: 'privatelink.api.${toLower(environment().name) == 'azureusgovernment' ? 'ml.azure.us' : 'azureml.ms'}'
44+
virtualNetworkLinks: [
45+
{
46+
virtualNetworkResourceId: virtualNetworkResourceId
47+
}
48+
]
49+
tags: tags
50+
}
51+
}
52+
53+
module mlNotebooksPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.0' = if (networkIsolation) {
54+
name: 'private-dns-mlnotebook-deployment'
55+
params: {
56+
name: 'privatelink.notebooks.${toLower(environment().name) == 'azureusgovernment' ? 'azureml.us' : 'azureml.net'}'
57+
virtualNetworkLinks: [
58+
{
59+
virtualNetworkResourceId: virtualNetworkResourceId
60+
}
61+
]
62+
tags: tags
63+
}
64+
}
65+
66+
var nameFormatted = toLower(name)
67+
68+
module hub 'br/public:avm/res/machine-learning-services/workspace:0.10.1' = {
69+
name: take('${nameFormatted}-ai-hub-deployment', 64)
70+
dependsOn: [mlApiPrivateDnsZone, mlNotebooksPrivateDnsZone] // required due to optional flags that could change dependency
71+
params: {
72+
name: nameFormatted
73+
sku: 'Standard'
74+
kind: 'Hub'
75+
description: nameFormatted
76+
associatedApplicationInsightsResourceId: appInsightsResourceId
77+
associatedContainerRegistryResourceId: containerRegistryResourceId
78+
associatedKeyVaultResourceId: keyVaultResourceId
79+
associatedStorageAccountResourceId: storageAccountResourceId
80+
publicNetworkAccess: networkIsolation ? 'Disabled' : 'Enabled'
81+
managedNetworkSettings: {
82+
isolationMode: networkIsolation ? 'AllowInternetOutbound' : 'Disabled'
83+
}
84+
connections: connections
85+
roleAssignments: roleAssignments
86+
diagnosticSettings: [
87+
{
88+
workspaceResourceId: logAnalyticsWorkspaceResourceId
89+
metricCategories: [
90+
{
91+
category: 'AllMetrics'
92+
}
93+
]
94+
logCategoriesAndGroups: [
95+
{
96+
category: 'ComputeInstanceEvent'
97+
}
98+
]
99+
}
100+
]
101+
privateEndpoints: networkIsolation ? [
102+
{
103+
privateDnsZoneGroup: {
104+
privateDnsZoneGroupConfigs: [
105+
{
106+
privateDnsZoneResourceId: mlNotebooksPrivateDnsZone.outputs.resourceId
107+
}
108+
{
109+
privateDnsZoneResourceId: mlApiPrivateDnsZone.outputs.resourceId
110+
}
111+
]
112+
}
113+
service: 'amlworkspace'
114+
subnetResourceId: virtualNetworkSubnetResourceId
115+
}
116+
] : []
117+
location: location
118+
systemDatastoresAuthMode: 'identity'
119+
tags: tags
120+
}
121+
}
122+
123+
import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
124+
import { connectionType } from 'br/public:avm/res/machine-learning-services/workspace:0.10.1'
125+
126+
output resourceId string = hub.outputs.resourceId
127+
output name string = hub.outputs.name

‎infra/modules/ai-foundry/project.bicep‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
@description('Name of the Storage Account.')
2+
param name string
3+
4+
@description('Specifies the location for all the Azure resources.')
5+
param location string
6+
7+
@description('Optional. Tags to be applied to the resources.')
8+
param tags object = {}
9+
10+
@description('Resource ID of the parent AI Hub.')
11+
param hubResourceId string
12+
13+
@description('Resource ID of the Log Analytics workspace to use for diagnostic settings.')
14+
param logAnalyticsWorkspaceResourceId string
15+
16+
@description('Specifies whether network isolation is enabled. This will create a private endpoint for the Storage Account and link the private DNS zone.')
17+
param networkIsolation bool = true
18+
19+
@description('Optional. Array of role assignments to create.')
20+
param roleAssignments roleAssignmentType[]?
21+
22+
var nameFormatted = toLower(name)
23+
24+
module aiProject 'br/public:avm/res/machine-learning-services/workspace:0.10.1' = {
25+
name: take('${nameFormatted}-ai-project-deployment', 64)
26+
params: {
27+
name: nameFormatted
28+
sku: 'Standard'
29+
kind: 'Project'
30+
location: location
31+
hubResourceId: hubResourceId
32+
managedIdentities: {
33+
systemAssigned: true
34+
}
35+
publicNetworkAccess: networkIsolation ? 'Disabled' : 'Enabled'
36+
hbiWorkspace: false
37+
systemDatastoresAuthMode: 'identity'
38+
roleAssignments: roleAssignments
39+
diagnosticSettings: [
40+
{
41+
workspaceResourceId: logAnalyticsWorkspaceResourceId
42+
metricCategories: [
43+
{
44+
category: 'AllMetrics'
45+
}
46+
]
47+
logCategoriesAndGroups: [for log in [
48+
'AmlComputeClusterEvent'
49+
'AmlComputeClusterNodeEvent'
50+
'AmlComputeJobEvent'
51+
'AmlComputeCpuGpuUtilization'
52+
'AmlRunStatusChangedEvent'
53+
'ModelsChangeEvent'
54+
'ModelsReadEvent'
55+
'ModelsActionEvent'
56+
'DeploymentReadEvent'
57+
'DeploymentEventACI'
58+
'DeploymentEventAKS'
59+
'InferencingOperationAKS'
60+
'InferencingOperationACI'
61+
'EnvironmentChangeEvent'
62+
'EnvironmentReadEvent'
63+
'DataLabelChangeEvent'
64+
'DataLabelReadEvent'
65+
'DataSetChangeEvent'
66+
'DataSetReadEvent'
67+
'PipelineChangeEvent'
68+
'PipelineReadEvent'
69+
'RunEvent'
70+
'RunReadEvent'
71+
]: {
72+
category: log
73+
}]
74+
}
75+
]
76+
tags: tags
77+
}
78+
}
79+
80+
import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'

‎infra/modules/aisearch.bicep‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
@description('Name of the AI Search resource.')
2+
param name string
3+
4+
@description('Specifies the location for all the Azure resources.')
5+
param location string
6+
7+
@description('Optional. Tags to be applied to the resources.')
8+
param tags object = {}
9+
10+
@description('Resource ID of the virtual network to link the private DNS zones.')
11+
param virtualNetworkResourceId string
12+
13+
@description('Resource ID of the subnet for the private endpoint.')
14+
param virtualNetworkSubnetResourceId string
15+
16+
@description('Resource ID of the Log Analytics workspace to use for diagnostic settings.')
17+
param logAnalyticsWorkspaceResourceId string
18+
19+
@description('Specifies whether network isolation is enabled. This will create a private endpoint for the AI Search resource and link the private DNS zone.')
20+
param networkIsolation bool = true
21+
22+
@description('Optional. Array of role assignments to create.')
23+
param roleAssignments roleAssignmentType[]?
24+
25+
module privateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.0' = if (networkIsolation) {
26+
name: 'private-dns-search-deployment'
27+
params: {
28+
name: 'privatelink.search.windows.net'
29+
virtualNetworkLinks: [
30+
{
31+
virtualNetworkResourceId: virtualNetworkResourceId
32+
}
33+
]
34+
tags: tags
35+
}
36+
}
37+
38+
var nameFormatted = take(toLower(name), 60)
39+
40+
module aiSearch 'br/public:avm/res/search/search-service:0.9.2' = {
41+
name: take('${nameFormatted}-search-services-deployment', 64)
42+
dependsOn: [privateDnsZone] // required due to optional flags that could change dependency
43+
params: {
44+
name: nameFormatted
45+
location: location
46+
cmkEnforcement: 'Enabled'
47+
managedIdentities: {
48+
systemAssigned: true
49+
}
50+
publicNetworkAccess: networkIsolation ? 'Disabled' : 'Enabled'
51+
disableLocalAuth: true
52+
sku: 'standard'
53+
partitionCount:1
54+
replicaCount:3
55+
roleAssignments: roleAssignments
56+
diagnosticSettings: [
57+
{
58+
workspaceResourceId: logAnalyticsWorkspaceResourceId
59+
}
60+
]
61+
privateEndpoints: networkIsolation ? [
62+
{
63+
privateDnsZoneGroup: {
64+
privateDnsZoneGroupConfigs: [
65+
{
66+
privateDnsZoneResourceId: privateDnsZone.outputs.resourceId
67+
}
68+
]
69+
}
70+
subnetResourceId: virtualNetworkSubnetResourceId
71+
}
72+
] : []
73+
tags: tags
74+
}
75+
}
76+
77+
import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
78+
79+
output resourceId string = aiSearch.outputs.resourceId
80+
output name string = aiSearch.outputs.name

‎infra/modules/apim.bicep‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,16 @@ param networkIsolation bool = false
2828
@description('The resource ID of the Log Analytics workspace to use for diagnostic settings.')
2929
param logAnalyticsWorkspaceResourceId string
3030

31-
@description('Private DNS zone and Subnet information for the API Management service.')
32-
param privateEndpoint privateEndpointType?
31+
@description('Resource ID of the virtual network to link the private DNS zones.')
32+
param virtualNetworkResourceId string
33+
34+
@description('Resource ID of the subnet for the private endpoint.')
35+
param virtualNetworkSubnetResourceId string
3336

3437
@description('Optional tags to be applied to the resources.')
3538
param tags object = {}
3639

40+
3741
module apiManagementService 'br/public:avm/res/api-management/service:0.9.1' = {
3842
name: take('${name}-apim-deployment', 64)
3943
params: {
@@ -119,15 +123,29 @@ module apiManagementService 'br/public:avm/res/api-management/service:0.9.1' = {
119123
}
120124
}
121125

122-
module apimPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.11.0' = if (networkIsolation && privateEndpoint != null) {
126+
module apiManagementPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.0' = if (networkIsolation) {
127+
name: 'private-dns-apim-deployment'
128+
params: {
129+
name: 'privatelink.apim.windows.net'
130+
virtualNetworkLinks: [
131+
{
132+
virtualNetworkResourceId: virtualNetworkResourceId
133+
}
134+
]
135+
tags: tags
136+
}
137+
}
138+
139+
140+
module apimPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.11.0' = if (networkIsolation) {
123141
name: take('${name}-apim-private-endpoint-deployment', 64)
124142
params: {
125143
name: toLower('pep-${apiManagementService.outputs.name}')
126-
subnetResourceId: privateEndpoint.?subnetResourceId ?? ''
144+
subnetResourceId: virtualNetworkSubnetResourceId
127145
privateDnsZoneGroup: {
128146
privateDnsZoneGroupConfigs: [
129147
{
130-
privateDnsZoneResourceId: privateEndpoint.?privateDnsZoneResourceId ?? ''
148+
privateDnsZoneResourceId: apiManagementPrivateDnsZone.outputs.resourceId
131149
}
132150
]
133151
}
@@ -145,11 +163,6 @@ module apimPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.11.0' =
145163
}
146164
}
147165

148-
type privateEndpointType = {
149-
subnetResourceId: string
150-
privateDnsZoneResourceId: string
151-
}
152-
153166
output resourceId string = apiManagementService.outputs.resourceId
154167
output name string = apiManagementService.outputs.name
155168
output privateEndpointId string = apimPrivateEndpoint.outputs.resourceId

0 commit comments

Comments
 (0)