AML registry + vnet integration

.devcontainer/devcontainer.json

@@ -24,7 +24,8 @@
 			"terragrunt": "0.44.5"
 		},
 		"ghcr.io/devcontainers/features/azure-cli:1": {
-			"version": "2.44.1"
+			"version": "2.44.1",
+			"extensions": "ml"
 		},
 		"ghcr.io/devcontainers/features/node:1": {},
 		"ghcr.io/devcontainers/features/github-cli:1": {

.gitignore

@@ -57,3 +57,6 @@ terragrunt-debug.tfvars.json
 
 # Checked out pipeline repos
 transform/pipelines/**
+
+# AML registry configuration generated by terraform
+registry.yml

infrastructure/core/locals.tf

@@ -17,19 +17,36 @@ locals {
   naming_suffix_truncated = substr(replace(replace(local.naming_suffix, "-", ""), "_", ""), 0, 17)
 
   # Split the /24 (or larger) address space into subnets of required sizes
-  # for the different terraform modules/required delegations
-  subnet_address_spaces              = cidrsubnets(azurerm_virtual_network.core.address_space[0], 2, 2, 2, 2)
+  # for the different terraform modules/required delegations. Databricks requires > /27
+  address_space_is_slash24 = length(regexall("\\/24", azurerm_virtual_network.core.address_space[0])) > 0
+  databricks_newbits       = local.address_space_is_slash24 ? 2 : 3
+  other_newbits            = local.address_space_is_slash24 ? 4 : 3
+
+  subnet_address_spaces = cidrsubnets(
+    azurerm_virtual_network.core.address_space[0],
+    3,
+    local.databricks_newbits,
+    local.databricks_newbits,
+    3,
+    local.other_newbits,
+    local.other_newbits
+  )
   core_shared_address_space          = local.subnet_address_spaces[0]
   databricks_host_address_space      = local.subnet_address_spaces[1]
   databricks_container_address_space = local.subnet_address_spaces[2]
   serve_webapps_address_space        = local.subnet_address_spaces[3]
+  aml_address_space                  = local.subnet_address_spaces[4]
+  # free_address_space               = local.subnet_address_spaces[5]
 
   create_dns_zones = var.private_dns_zones_rg == null
   required_private_dns_zones = {
     blob       = "privatelink.blob.core.windows.net"
+    file       = "privatelink.file.core.windows.net"
     keyvault   = "privatelink.vaultcore.azure.net"
     cosmos     = "privatelink.documents.azure.com"
     databricks = "privatelink.azuredatabricks.net"
     sql        = "privatelink.database.windows.net"
+    aml        = "privatelink.api.azureml.ms",
+    amlcert    = "privatelink.cert.api.azureml.ms",
   }
 }

infrastructure/core/outputs.tf

@@ -95,3 +95,7 @@ output "data_scientists_ad_group_display_name" {
   description = "Data scientists AD group display name"
   value       = azuread_group.ad_group_data_scientists.display_name
 }
+
+output "aml_address_space" {
+  value = local.aml_address_space
+}

infrastructure/serve/aml.tf

@@ -0,0 +1,109 @@
+#  Copyright (c) University College London Hospitals NHS Foundation Trust
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+resource "azurerm_machine_learning_workspace" "serve" {
+  name                          = "aml-${var.naming_suffix}"
+  location                      = var.core_rg_location
+  resource_group_name           = var.core_rg_name
+  application_insights_id       = azurerm_application_insights.serve.id
+  key_vault_id                  = var.core_kv_id
+  storage_account_id            = azurerm_storage_account.aml.id
+  public_network_access_enabled = false
+  tags                          = var.tags
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  depends_on = [
+    azurerm_private_endpoint.aml_blob
+  ]
+}
+
+resource "local_file" "aml_registry_config" {
+  content  = <<EOF
+name: ${local.aml_registry_name}
+description: Basic AML registry located in ${var.core_rg_location}
+location: ${var.core_rg_location}
+replication_locations:
+  - location: ${var.core_rg_location}
+EOF
+  filename = "registry.yml"
+}
+
+# AML registry usees public network accesss, should be altered when it support private
+resource "null_resource" "az_cli_registry_create" {
+  provisioner "local-exec" {
+    when    = create
+    command = "az ml registry create --file ${local_file.aml_registry_config.filename} --resource-group ${var.core_rg_name} --public-network-access Enabled"
+  }
+}
+
+resource "null_resource" "az_cli_registry_create_destroy" {
+  triggers = {
+    core_rg_name      = var.core_rg_name
+    aml_registry_name = local.aml_registry_name
+  }
+  provisioner "local-exec" {
+    when    = destroy
+    command = "az ml registry delete --name ${self.triggers.aml_registry_name} --resource-group ${self.triggers.core_rg_name}"
+  }
+}
+
+resource "azurerm_role_definition" "aml_registry_read_write" {
+  name        = "role-aml-registry-read-write-${var.naming_suffix}"
+  scope       = local.aml_registry_id
+  description = "Read and write from an AML model registry"
+
+  permissions {
+    actions = [
+      "Microsoft.MachineLearningServices/registries/read",
+      # "Microsoft.MachineLearningServices/registries/assets/read",
+      "Microsoft.MachineLearningServices/registries/assets/write"
+    ]
+  }
+
+  assignable_scopes = [
+    local.aml_registry_id
+  ]
+
+  depends_on = [
+    null_resource.az_cli_registry_create
+  ]
+}
+
+resource "azurerm_role_assignment" "data_scientists_can_use_registry" {
+  scope              = local.aml_registry_id
+  role_definition_id = replace(azurerm_role_definition.aml_registry_read_write.id, "|", "")
+  principal_id       = var.data_scientists_ad_group_principal_id
+}
+
+resource "azurerm_machine_learning_compute_cluster" "serve" {
+  name                          = "amlcc-serve-${var.naming_suffix}"
+  vm_priority                   = "LowPriority"
+  vm_size                       = "STANDARD_DS2_V2"
+  machine_learning_workspace_id = azurerm_machine_learning_workspace.serve.id
+  subnet_resource_id            = azurerm_subnet.aml.id
+  location                      = var.core_rg_location
+
+  scale_settings {
+    min_node_count                       = 0
+    max_node_count                       = 1
+    scale_down_nodes_after_idle_duration = "PT30S" # 30 seconds
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+}

infrastructure/serve/data.tf

@@ -0,0 +1,24 @@
+#  Copyright (c) University College London Hospitals NHS Foundation Trust
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+data "azurerm_client_config" "current" {}
+
+data "azurerm_virtual_network" "core" {
+  name                = var.core_vnet_name
+  resource_group_name = var.core_rg_name
+}
+
+data "azurerm_resource_group" "core" {
+  name = var.core_rg_name
+}

infrastructure/serve/locals.tf

@@ -0,0 +1,18 @@
+#  Copyright (c) University College London Hospitals NHS Foundation Trust
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+locals {
+  aml_registry_name = "aml-registry-${var.naming_suffix}"
+  aml_registry_id   = "/subscriptions/${data.azurerm_client_config.current.subscription_id}/resourceGroups/${var.core_rg_name}/providers/Microsoft.MachineLearningServices/registries/${local.aml_registry_name}"
+}

infrastructure/serve/main.tf

@@ -50,24 +50,6 @@ resource "azurerm_storage_account" "aml" {
   }
 }
 
-resource "azurerm_machine_learning_workspace" "serve" {
-  name                    = "aml-${var.naming_suffix}"
-  location                = var.core_rg_location
-  resource_group_name     = var.core_rg_name
-  application_insights_id = azurerm_application_insights.serve.id
-  key_vault_id            = var.core_kv_id
-  storage_account_id      = azurerm_storage_account.aml.id
-  tags                    = var.tags
-
-  identity {
-    type = "SystemAssigned"
-  }
-
-  depends_on = [
-    azurerm_private_endpoint.aml_blob
-  ]
-}
-
 resource "azurerm_container_registry" "serve" {
   name                          = "acrserve${var.naming_suffix_truncated}"
   location                      = var.core_rg_location