Skip to content

Commit 7a356af

Browse files
deeikeledeeikele
authored
Merge pull request microsoft#7 from denniseik/ryhud
Adding 202 for existing VNet
2 parents 8011d6b + be2da81 commit 7a356af

File tree

6 files changed

+491
-0
lines changed

6 files changed

+491
-0
lines changed

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/.gitignore‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
11+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
12+
# .tfvars files are managed as part of configuration and so should be included in
13+
# version control.
14+
#
15+
# example.tfvars
16+
17+
# Ignore override files as they are usually used to override resources locally and so
18+
# are not checked in
19+
override.tf
20+
override.tf.json
21+
*_override.tf
22+
*_override.tf.json
23+
values.tfvars
24+
*.tfvars
25+
settings.tfvars
26+
# Include override files you do wish to add to version control using negated pattern
27+
#
28+
# !example_override.tf
29+
30+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
31+
# example: *tfplan*
32+
terraform/.terraform.lock.hcl
33+
.DS_Store
34+
terraform/.terraform.lock.hcl
35+
terraform/.terraform.lock.hcl
36+
.terraform.lock.hcl
37+
terraform/.terraform.lock.hcl

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/main.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
terraform {
2+
required_version = ">=0.15.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "=2.76.0"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {}
14+
}
15+
16+
data "azurerm_client_config" "current" {}
17+
18+
resource "azurerm_resource_group" "default" {
19+
name = "rg-${var.name}-${var.environment}"
20+
location = var.location
21+
}

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/network.tf‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# Network Security Groups
2+
3+
resource "azurerm_network_security_group" "nsg-training" {
4+
name = "nsg-training"
5+
location = azurerm_resource_group.default.location
6+
resource_group_name = azurerm_resource_group.default.name
7+
8+
security_rule {
9+
name = "BatchNodeManagement"
10+
priority = 100
11+
direction = "Inbound"
12+
access = "Allow"
13+
protocol = "Tcp"
14+
source_port_range = "*"
15+
destination_port_range = "29876-29877"
16+
source_address_prefix = "BatchNodeManagement"
17+
destination_address_prefix = "*"
18+
}
19+
security_rule {
20+
name = "AzureMachineLearning"
21+
priority = 110
22+
direction = "Inbound"
23+
access = "Allow"
24+
protocol = "Tcp"
25+
source_port_range = "*"
26+
destination_port_range = "44224"
27+
source_address_prefix = "AzureMachineLearning"
28+
destination_address_prefix = "*"
29+
}
30+
}
31+
32+
resource "azurerm_subnet_network_security_group_association" "nsg-training-link" {
33+
subnet_id = var.training_subnet_resource_id
34+
network_security_group_id = azurerm_network_security_group.nsg-training.id
35+
}
36+
37+
resource "azurerm_network_security_group" "nsg-aks" {
38+
name = "nsg-aks"
39+
location = azurerm_resource_group.default.location
40+
resource_group_name = azurerm_resource_group.default.name
41+
42+
43+
}
44+
45+
resource "azurerm_subnet_network_security_group_association" "nsg-aks-link" {
46+
subnet_id = var.aks_subnet_resource_id
47+
network_security_group_id = azurerm_network_security_group.nsg-aks.id
48+
}
49+
50+
# User Defined Routes
51+
52+
#UDR for Compute instance and compute clusters
53+
resource "azurerm_route_table" "rt-training" {
54+
name = "rt-training"
55+
location = azurerm_resource_group.default.location
56+
resource_group_name = azurerm_resource_group.default.name
57+
}
58+
59+
resource "azurerm_route" "training-Internet-Route" {
60+
name = "Internet"
61+
resource_group_name = azurerm_resource_group.default.name
62+
route_table_name = azurerm_route_table.rt-training.name
63+
address_prefix = "0.0.0.0/0"
64+
next_hop_type = "Internet"
65+
}
66+
67+
resource "azurerm_route" "training-AzureMLRoute" {
68+
name = "AzureMLRoute"
69+
resource_group_name = azurerm_resource_group.default.name
70+
route_table_name = azurerm_route_table.rt-training.name
71+
address_prefix = "AzureMachineLearning"
72+
next_hop_type = "Internet"
73+
}
74+
75+
resource "azurerm_route" "training-BatchRoute" {
76+
name = "BatchRoute"
77+
resource_group_name = azurerm_resource_group.default.name
78+
route_table_name = azurerm_route_table.rt-training.name
79+
address_prefix = "BatchNodeManagement"
80+
next_hop_type = "Internet"
81+
}
82+
83+
resource "azurerm_subnet_route_table_association" "rt-training-link" {
84+
subnet_id = var.training_subnet_resource_id
85+
route_table_id = azurerm_route_table.rt-training.id
86+
}
87+
# Inferencing (AKS) Route
88+
89+
resource "azurerm_route_table" "rt-aks" {
90+
name = "rt-aks"
91+
location = azurerm_resource_group.default.location
92+
resource_group_name = azurerm_resource_group.default.name
93+
}
94+
95+
resource "azurerm_route" "aks-Internet-Route" {
96+
name = "Internet"
97+
resource_group_name = azurerm_resource_group.default.name
98+
route_table_name = azurerm_route_table.rt-aks.name
99+
address_prefix = "0.0.0.0/0"
100+
next_hop_type = "Internet"
101+
}
102+
103+
resource "azurerm_subnet_route_table_association" "rt-aks-link" {
104+
subnet_id = var.aks_subnet_resource_id
105+
route_table_id = azurerm_route_table.rt-aks.id
106+
}

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/readme.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Azure Machine Learning workspace (moderately secure network set up)
2+
3+
This deployment configuration specifies an [Azure Machine Learning workspace](https://docs.microsoft.com/en-us/azure/machine-learning/concept-workspace),
4+
and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry.
5+
6+
In addition to these core services, this configuration specifies any networking components that are required to set up Azure Machine Learning
7+
for private network connectivity using [Azure Private Link](https://docs.microsoft.com/en-us/azure/private-link/).
8+
9+
This configuration describes the minimal set of resources you require to get started with Azure Machine Learning in a network-isolated set-up.
10+
11+
To learn more about security configurations in Azure Machine Learning, see [Enterprise security and governance for Azure Machine Learning](https://docs.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security).
12+
13+
## Resources
14+
15+
| Terraform Resource Type | Description |
16+
| - | - |
17+
| `azurerm_resource_group` | The resource group all resources get deployed into |
18+
| `azurerm_application_insights` | An Azure Application Insights instance associated to the Azure Machine Learning workspace |
19+
| `azurerm_key_vault` | An Azure Key Vault instance associated to the Azure Machine Learning workspace |
20+
| `azurerm_storage_account` | An Azure Storage instance associated to the Azure Machine Learning workspace |
21+
| `azurerm_container_registry` | An Azure Container Registry instance associated to the Azure Machine Learning workspace |
22+
| `azurerm_machine_learning_workspace` | An Azure Machine Learning workspace instance |
23+
| `azurerm_virtual_network` | An Azure Machine Learning workspace instance |
24+
| `azurerm_subnet` | An Azure Machine Learning workspace instance |
25+
| `azurerm_private_dns_zone` | Private DNS Zones for FQDNs required for Azure Machine Learning and associated resources |
26+
| `azurerm_private_dns_zone_virtual_network_link` | Virtual network links of the Private DNS Zones to the virtual network resource |
27+
| `azurerm_private_endpoint` | Private Endpoints for the Azure Machine Learning workspace and associated resources |
28+
| `azurerm_machine_learning_compute_instance` | An Azure Machine Learning compute instance a single-node managed compute. |
29+
| `azurerm_machine_learning_compute_cluster` | An Azure Machine Learning compute cluster as multi-node shared and managed compute. |
30+
| `azurerm_network_security_group` | Network security group with required inbound and outbound rules for Azure Machine Learning. |
31+
32+
33+
## Variables
34+
35+
| Name | Description |
36+
|-|-|
37+
| name | Name of the deployment |
38+
| environment | The deployment environment name (used for pre- and postfixing resource names) |
39+
| location | The Azure region used for deployments |
40+
| image_build_compute_name | Name of the compute cluster to be created and set to build docker images |
41+
| training_subnet_resource_id | Resource ID of the existing training subnet |
42+
| aks_subnet_resource_id | Resource ID of the existing aks subnet |
43+
| ml_subnet_resource_id | Resource ID of the existing ML workspace subnet |
44+
| privatelink_api_azureml_ms_resource_id | Resource ID of the existing privatelink.api.azureml.ms private dns zone |
45+
| privatelink_azurecr_io_resource_id | Resource ID of the existing privatelink.azurecr.io private dns zone |
46+
| privatelink_notebooks_azure_net_resource_id | Resource ID of the existing privatelink.notebooks.azure.net private dns zone |
47+
| privatelink_blob_core_windows_net_resource_id | Resource ID of the existing privatelink.blob.core.windows.net private dns zone |
48+
| privatelink_file_core_windows_net_resource_id | Resource ID of the existing privatelink.file.core.windows.net private dns zone |
49+
| privatelink_vaultcore_azure_net_resource_id | Resource ID of the existing privatelink.vaultcore.azure.net private dns zone |
50+
51+
## Usage
52+
53+
```bash
54+
terraform plan -var name=azureml567 -out demo.tfplan
55+
56+
terraform apply "demo.tfplan"
57+
```
58+
59+
## Learn more
60+
61+
- If you are new to Azure Machine Learning, see [Azure Machine Learning service](https://azure.microsoft.com/services/machine-learning-service/) and [Azure Machine Learning documentation](https://docs.microsoft.com/azure/machine-learning/).
62+
- To learn more about security configurations in Azure Machine Learning, see [Enterprise security and governance for Azure Machine Learning](https://docs.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security).
63+
- For all configurations of Azure Machine Learning in Terraform, see [Terraform Hashicorp AzureRM provider documentation](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/machine_learning_workspace).

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/variables.tf‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
variable "name" {
2+
type = string
3+
description = "Name of the deployment"
4+
}
5+
6+
variable "environment" {
7+
type = string
8+
description = "Name of the environment"
9+
default = "dev"
10+
}
11+
12+
variable "location" {
13+
type = string
14+
description = "Location of the resources"
15+
}
16+
17+
variable "image_build_compute_name" {
18+
type = string
19+
description = "Name of the compute cluster to be created and set to build docker images"
20+
default = "image-builder"
21+
}
22+
23+
# Existing subnets variables
24+
25+
variable "training_subnet_resource_id" {
26+
type = string
27+
description = "Resource ID of the existing training subnet"
28+
}
29+
30+
variable "aks_subnet_resource_id" {
31+
type = string
32+
description = "Resource ID of the existing aks subnet"
33+
}
34+
35+
variable "ml_subnet_resource_id" {
36+
type = string
37+
description = "Resource ID of the existing ML workspace subnet"
38+
}
39+
40+
41+
# Existing private DNS zones variables
42+
43+
variable "privatelink_api_azureml_ms_resource_id" {
44+
type = string
45+
description = "Resource ID of the existing privatelink.api.azureml.ms private dns zone"
46+
}
47+
48+
variable "privatelink_azurecr_io_resource_id" {
49+
type = string
50+
description = "Resource ID of the existing privatelink.azurecr.io private dns zone"
51+
}
52+
53+
variable "privatelink_notebooks_azure_net_resource_id" {
54+
type = string
55+
description = "Resource ID of the existing privatelink.notebooks.azure.net private dns zone"
56+
}
57+
58+
variable "privatelink_blob_core_windows_net_resource_id" {
59+
type = string
60+
description = "Resource ID of the existing privatelink.blob.core.windows.net private dns zone"
61+
}
62+
63+
variable "privatelink_file_core_windows_net_resource_id" {
64+
type = string
65+
description = "Resource ID of the existing privatelink.file.core.windows.net private dns zone"
66+
}
67+
68+
variable "privatelink_vaultcore_azure_net_resource_id" {
69+
type = string
70+
description = "Resource ID of the existing privatelink.vaultcore.azure.net private dns zone"
71+
}

0 commit comments

Comments
 (0)