Skip to content

Commit a3e0f59

Browse files
aamini7aamini7
committed
WIP
1 parent 966d758 commit a3e0f59

10 files changed

Lines changed: 449 additions & 0 deletions

‎scenarios/AksOpenAiTerraform/run.sh‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,31 @@
1+
export RG_NAME=""
2+
13
export OPEN_AI_SUBDOMAIN="magic8ball"
24

5+
# Publish Image
6+
export ACR_NAME=(terraform output -raw acr_name)
7+
export IMAGE="azurecr.io/magic8ball:latest"
8+
9+
# Nginx Ingress Controller
10+
export nginxNamespace="ingress-basic"
11+
export nginxRepoName="ingress-nginx"
12+
export nginxRepoUrl="https://kubernetes.github.io/ingress-nginx"
13+
export nginxChartName="ingress-nginx"
14+
export nginxReleaseName="nginx-ingress"
15+
export nginxReplicaCount=3
16+
17+
# Certificate Manager
18+
export cmNamespace="cert-manager"
19+
export cmRepoName="jetstack"
20+
export cmRepoUrl="https://charts.jetstack.io"
21+
export cmChartName="cert-manager"
22+
export cmReleaseName="cert-manager"
23+
24+
# Cluster Issuer
25+
email="paolos@microsoft.com"
26+
clusterIssuerName="letsencrypt-nginx"
27+
clusterIssuerTemplate="cluster-issuer.yml"
28+
329
# Variables
430
acrName="CyanAcr"
531
acrResourceGrougName="CyanRG"

‎scenarios/AksOpenAiTerraform/script/01-push-app-image.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
3+
# Login
4+
az acr login --name $ACR_NAME
5+
ACR_URL=$(az acr show --name $ACR_NAME --query loginServer --output tsv)
6+
7+
# Build + Push
8+
docker build -t $ACR_URL/$IMAGE ./app --push

‎scenarios/AksOpenAiTerraform/script/04-create-nginx-ingress-controller.sh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/bin/bash
2+
3+
# Use Helm to deploy an NGINX ingress controller
4+
result=$(helm list -n $nginxNamespace | grep $nginxReleaseName | awk '{print $1}')
5+
6+
if [[ -n $result ]]; then
7+
echo "[$nginxReleaseName] ingress controller already exists in the [$nginxNamespace] namespace"
8+
else
9+
# Check if the ingress-nginx repository is not already added
10+
result=$(helm repo list | grep $nginxRepoName | awk '{print $1}')
11+
12+
if [[ -n $result ]]; then
13+
echo "[$nginxRepoName] Helm repo already exists"
14+
else
15+
# Add the ingress-nginx repository
16+
echo "Adding [$nginxRepoName] Helm repo..."
17+
helm repo add $nginxRepoName $nginxRepoUrl
18+
fi
19+
20+
# Update your local Helm chart repository cache
21+
echo 'Updating Helm repos...'
22+
helm repo update
23+
24+
# Deploy NGINX ingress controller
25+
echo "Deploying [$nginxReleaseName] NGINX ingress controller to the [$nginxNamespace] namespace..."
26+
helm install $nginxReleaseName $nginxRepoName/$nginxChartName \
27+
--create-namespace \
28+
--namespace $nginxNamespace \
29+
--set controller.nodeSelector."kubernetes\.io/os"=linux \
30+
--set controller.replicaCount=$replicaCount \
31+
--set defaultBackend.nodeSelector."kubernetes\.io/os"=linux \
32+
--set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz
33+
fi
34+
35+
# Get values
36+
helm get values $nginxReleaseName --namespace $nginxNamespace

‎scenarios/AksOpenAiTerraform/script/05-install-cert-manager.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#/bin/bash
2+
3+
# Check if the ingress-nginx repository is not already added
4+
result=$(helm repo list | grep $cmRepoName | awk '{print $1}')
5+
6+
if [[ -n $result ]]; then
7+
echo "[$cmRepoName] Helm repo already exists"
8+
else
9+
# Add the Jetstack Helm repository
10+
echo "Adding [$cmRepoName] Helm repo..."
11+
helm repo add $cmRepoName $cmRepoUrl
12+
fi
13+
14+
# Update your local Helm chart repository cache
15+
echo 'Updating Helm repos...'
16+
helm repo update
17+
18+
# Install cert-manager Helm chart
19+
result=$(helm list -n $cmNamespace | grep $cmReleaseName | awk '{print $1}')
20+
21+
if [[ -n $result ]]; then
22+
echo "[$cmReleaseName] cert-manager already exists in the $cmNamespace namespace"
23+
else
24+
# Install the cert-manager Helm chart
25+
echo "Deploying [$cmReleaseName] cert-manager to the $cmNamespace namespace..."
26+
helm install $cmReleaseName $cmRepoName/$cmChartName \
27+
--create-namespace \
28+
--namespace $cmNamespace \
29+
--set installCRDs=true \
30+
--set nodeSelector."kubernetes\.io/os"=linux
31+
fi

‎scenarios/AksOpenAiTerraform/script/06-create-cluster-issuer.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#/bin/bash
2+
3+
# Check if the cluster issuer already exists
4+
result=$(kubectl get ClusterIssuer -o json | jq -r '.items[].metadata.name | select(. == "'$clusterIssuerName'")')
5+
6+
if [[ -n $result ]]; then
7+
echo "[$clusterIssuerName] cluster issuer already exists"
8+
exit
9+
else
10+
# Create the cluster issuer
11+
echo "[$clusterIssuerName] cluster issuer does not exist"
12+
echo "Creating [$clusterIssuerName] cluster issuer..."
13+
cat $clusterIssuerTemplate |
14+
yq "(.spec.acme.email)|="\""$email"\" |
15+
kubectl apply -f -
16+
fi

‎scenarios/AksOpenAiTerraform/script/07-create-workload-managed-identity.sh‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
#!/bin/bash
2+
3+
# Variables
4+
source ./00-variables.sh
5+
6+
# Check if the user-assigned managed identity already exists
7+
echo "Checking if [$managedIdentityName] user-assigned managed identity actually exists in the [$aksResourceGroupName] resource group..."
8+
9+
az identity show \
10+
--name $managedIdentityName \
11+
--resource-group $aksResourceGroupName &>/dev/null
12+
13+
if [[ $? != 0 ]]; then
14+
echo "No [$managedIdentityName] user-assigned managed identity actually exists in the [$aksResourceGroupName] resource group"
15+
echo "Creating [$managedIdentityName] user-assigned managed identity in the [$aksResourceGroupName] resource group..."
16+
17+
# Create the user-assigned managed identity
18+
az identity create \
19+
--name $managedIdentityName \
20+
--resource-group $aksResourceGroupName \
21+
--location $location \
22+
--subscription $subscriptionId 1>/dev/null
23+
24+
if [[ $? == 0 ]]; then
25+
echo "[$managedIdentityName] user-assigned managed identity successfully created in the [$aksResourceGroupName] resource group"
26+
else
27+
echo "Failed to create [$managedIdentityName] user-assigned managed identity in the [$aksResourceGroupName] resource group"
28+
exit
29+
fi
30+
else
31+
echo "[$managedIdentityName] user-assigned managed identity already exists in the [$aksResourceGroupName] resource group"
32+
fi
33+
34+
# Retrieve the clientId of the user-assigned managed identity
35+
echo "Retrieving clientId for [$managedIdentityName] managed identity..."
36+
clientId=$(az identity show \
37+
--name $managedIdentityName \
38+
--resource-group $aksResourceGroupName \
39+
--query clientId \
40+
--output tsv)
41+
42+
if [[ -n $clientId ]]; then
43+
echo "[$clientId] clientId for the [$managedIdentityName] managed identity successfully retrieved"
44+
else
45+
echo "Failed to retrieve clientId for the [$managedIdentityName] managed identity"
46+
exit
47+
fi
48+
49+
# Retrieve the principalId of the user-assigned managed identity
50+
echo "Retrieving principalId for [$managedIdentityName] managed identity..."
51+
principalId=$(az identity show \
52+
--name $managedIdentityName \
53+
--resource-group $aksResourceGroupName \
54+
--query principalId \
55+
--output tsv)
56+
57+
if [[ -n $principalId ]]; then
58+
echo "[$principalId] principalId for the [$managedIdentityName] managed identity successfully retrieved"
59+
else
60+
echo "Failed to retrieve principalId for the [$managedIdentityName] managed identity"
61+
exit
62+
fi
63+
64+
# Get the resource id of the Azure OpenAI resource
65+
openAiId=$(az cognitiveservices account show \
66+
--name $openAiName \
67+
--resource-group $openAiResourceGroupName \
68+
--query id \
69+
--output tsv)
70+
71+
if [[ -n $openAiId ]]; then
72+
echo "Resource id for the [$openAiName] Azure OpenAI resource successfully retrieved"
73+
else
74+
echo "Failed to the resource id for the [$openAiName] Azure OpenAI resource"
75+
exit -1
76+
fi
77+
78+
# Assign the Cognitive Services User role on the Azure OpenAI resource to the managed identity
79+
role="Cognitive Services User"
80+
echo "Checking if the [$managedIdentityName] managed identity has been assigned to [$role] role with [$openAiName] Azure OpenAI resource as a scope..."
81+
current=$(az role assignment list \
82+
--assignee $principalId \
83+
--scope $openAiId \
84+
--query "[?roleDefinitionName=='$role'].roleDefinitionName" \
85+
--output tsv 2>/dev/null)
86+
87+
if [[ $current == $role ]]; then
88+
echo "[$managedIdentityName] managed identity is already assigned to the ["$current"] role with [$openAiName] Azure OpenAI resource as a scope"
89+
else
90+
echo "[$managedIdentityName] managed identity is not assigned to the [$role] role with [$openAiName] Azure OpenAI resource as a scope"
91+
echo "Assigning the [$role] role to the [$managedIdentityName] managed identity with [$openAiName] Azure OpenAI resource as a scope..."
92+
93+
az role assignment create \
94+
--assignee $principalId \
95+
--role "$role" \
96+
--scope $openAiId 1>/dev/null
97+
98+
if [[ $? == 0 ]]; then
99+
echo "[$managedIdentityName] managed identity successfully assigned to the [$role] role with [$openAiName] Azure OpenAI resource as a scope"
100+
else
101+
echo "Failed to assign the [$managedIdentityName] managed identity to the [$role] role with [$openAiName] Azure OpenAI resource as a scope"
102+
exit
103+
fi
104+
fi

‎scenarios/AksOpenAiTerraform/script/08-create-service-account.sh‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/bin/bash
2+
3+
# Variables for the user-assigned managed identity
4+
source ./00-variables.sh
5+
6+
# Check if the namespace already exists
7+
result=$(kubectl get namespace -o 'jsonpath={.items[?(@.metadata.name=="'$namespace'")].metadata.name'})
8+
9+
if [[ -n $result ]]; then
10+
echo "[$namespace] namespace already exists"
11+
else
12+
# Create the namespace for your ingress resources
13+
echo "[$namespace] namespace does not exist"
14+
echo "Creating [$namespace] namespace..."
15+
kubectl create namespace $namespace
16+
fi
17+
18+
# Check if the service account already exists
19+
result=$(kubectl get sa -n $namespace -o 'jsonpath={.items[?(@.metadata.name=="'$serviceAccountName'")].metadata.name'})
20+
21+
if [[ -n $result ]]; then
22+
echo "[$serviceAccountName] service account already exists"
23+
else
24+
# Retrieve the resource id of the user-assigned managed identity
25+
echo "Retrieving clientId for [$managedIdentityName] managed identity..."
26+
managedIdentityClientId=$(az identity show \
27+
--name $managedIdentityName \
28+
--resource-group $aksResourceGroupName \
29+
--query clientId \
30+
--output tsv)
31+
32+
if [[ -n $managedIdentityClientId ]]; then
33+
echo "[$managedIdentityClientId] clientId for the [$managedIdentityName] managed identity successfully retrieved"
34+
else
35+
echo "Failed to retrieve clientId for the [$managedIdentityName] managed identity"
36+
exit
37+
fi
38+
39+
# Create the service account
40+
echo "[$serviceAccountName] service account does not exist"
41+
echo "Creating [$serviceAccountName] service account..."
42+
cat <<EOF | kubectl apply -f -
43+
apiVersion: v1
44+
kind: ServiceAccount
45+
metadata:
46+
annotations:
47+
azure.workload.identity/client-id: $managedIdentityClientId
48+
azure.workload.identity/tenant-id: $tenantId
49+
labels:
50+
azure.workload.identity/use: "true"
51+
name: $serviceAccountName
52+
namespace: $namespace
53+
EOF
54+
fi
55+
56+
# Show service account YAML manifest
57+
echo "Service Account YAML manifest"
58+
echo "-----------------------------"
59+
kubectl get sa $serviceAccountName -n $namespace -o yaml
60+
61+
# Check if the federated identity credential already exists
62+
echo "Checking if [$federatedIdentityName] federated identity credential actually exists in the [$aksResourceGroupName] resource group..."
63+
64+
az identity federated-credential show \
65+
--name $federatedIdentityName \
66+
--resource-group $aksResourceGroupName \
67+
--identity-name $managedIdentityName &>/dev/null
68+
69+
if [[ $? != 0 ]]; then
70+
echo "No [$federatedIdentityName] federated identity credential actually exists in the [$aksResourceGroupName] resource group"
71+
72+
# Get the OIDC Issuer URL
73+
aksOidcIssuerUrl="$(az aks show \
74+
--only-show-errors \
75+
--name $aksClusterName \
76+
--resource-group $aksResourceGroupName \
77+
--query oidcIssuerProfile.issuerUrl \
78+
--output tsv)"
79+
80+
# Show OIDC Issuer URL
81+
if [[ -n $aksOidcIssuerUrl ]]; then
82+
echo "The OIDC Issuer URL of the $aksClusterName cluster is $aksOidcIssuerUrl"
83+
fi
84+
85+
echo "Creating [$federatedIdentityName] federated identity credential in the [$aksResourceGroupName] resource group..."
86+
87+
# Establish the federated identity credential between the managed identity, the service account issuer, and the subject.
88+
az identity federated-credential create \
89+
--name $federatedIdentityName \
90+
--identity-name $managedIdentityName \
91+
--resource-group $aksResourceGroupName \
92+
--issuer $aksOidcIssuerUrl \
93+
--subject system:serviceaccount:$namespace:$serviceAccountName
94+
95+
if [[ $? == 0 ]]; then
96+
echo "[$federatedIdentityName] federated identity credential successfully created in the [$aksResourceGroupName] resource group"
97+
else
98+
echo "Failed to create [$federatedIdentityName] federated identity credential in the [$aksResourceGroupName] resource group"
99+
exit
100+
fi
101+
else
102+
echo "[$federatedIdentityName] federated identity credential already exists in the [$aksResourceGroupName] resource group"
103+
fi

‎scenarios/AksOpenAiTerraform/script/09-deploy-app.sh‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/bash
2+
3+
# Variables
4+
source ./00-variables.sh
5+
6+
# Check if namespace exists in the cluster
7+
result=$(kubectl get namespace -o jsonpath="{.items[?(@.metadata.name=='$namespace')].metadata.name}")
8+
9+
if [[ -n $result ]]; then
10+
echo "$namespace namespace already exists in the cluster"
11+
else
12+
echo "$namespace namespace does not exist in the cluster"
13+
echo "creating $namespace namespace in the cluster..."
14+
kubectl create namespace $namespace
15+
fi
16+
17+
# Create config map
18+
cat $configMapTemplate |
19+
yq "(.data.TITLE)|="\""$title"\" |
20+
yq "(.data.LABEL)|="\""$label"\" |
21+
yq "(.data.TEMPERATURE)|="\""$temperature"\" |
22+
yq "(.data.IMAGE_WIDTH)|="\""$imageWidth"\" |
23+
yq "(.data.AZURE_OPENAI_TYPE)|="\""$openAiType"\" |
24+
yq "(.data.AZURE_OPENAI_BASE)|="\""$openAiBase"\" |
25+
yq "(.data.AZURE_OPENAI_MODEL)|="\""$openAiModel"\" |
26+
yq "(.data.AZURE_OPENAI_DEPLOYMENT)|="\""$openAiDeployment"\" |
27+
kubectl apply -n $namespace -f -
28+
29+
# Create deployment
30+
cat $deploymentTemplate |
31+
yq "(.spec.template.spec.containers[0].image)|="\""$image"\" |
32+
yq "(.spec.template.spec.containers[0].imagePullPolicy)|="\""$imagePullPolicy"\" |
33+
yq "(.spec.template.spec.serviceAccountName)|="\""$serviceAccountName"\" |
34+
kubectl apply -n $namespace -f -
35+
36+
# Create deployment
37+
kubectl apply -f $serviceTemplate -n $namespace

‎scenarios/AksOpenAiTerraform/script/10-create-ingress.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#/bin/bash
2+
3+
# Create the ingress
4+
echo "[$ingressName] ingress does not exist"
5+
echo "Creating [$ingressName] ingress..."
6+
cat $ingressTemplate |
7+
yq "(.spec.tls[0].hosts[0])|="\""$host"\" |
8+
yq "(.spec.rules[0].host)|="\""$host"\" |
9+
kubectl apply -n $namespace -f -

0 commit comments

Comments
 (0)