Skip to content

Commit ce37d06

Browse files
ryhudryhud
committed
Adding 202 for existing VNet
1 parent 6a6b306 commit ce37d06

6 files changed

Lines changed: 580 additions & 0 deletions

File tree

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/.gitignore‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
11+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
12+
# .tfvars files are managed as part of configuration and so should be included in
13+
# version control.
14+
#
15+
# example.tfvars
16+
17+
# Ignore override files as they are usually used to override resources locally and so
18+
# are not checked in
19+
override.tf
20+
override.tf.json
21+
*_override.tf
22+
*_override.tf.json
23+
values.tfvars
24+
*.tfvars
25+
settings.tfvars
26+
# Include override files you do wish to add to version control using negated pattern
27+
#
28+
# !example_override.tf
29+
30+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
31+
# example: *tfplan*
32+
terraform/.terraform.lock.hcl
33+
.DS_Store
34+
terraform/.terraform.lock.hcl
35+
terraform/.terraform.lock.hcl
36+
.terraform.lock.hcl
37+
terraform/.terraform.lock.hcl

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/main.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
terraform {
2+
required_version = ">=0.15.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "=2.76.0"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {}
14+
}
15+
16+
data "azurerm_client_config" "current" {}
17+
18+
resource "azurerm_resource_group" "default" {
19+
name = "rg-${var.name}-${var.environment}"
20+
location = var.location
21+
}

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/network.tf‎

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
/*
2+
# Virtual Network
3+
resource "azurerm_virtual_network" "default" {
4+
name = "vnet-${var.name}-${var.environment}"
5+
address_space = var.vnet_address_space
6+
location = azurerm_resource_group.default.location
7+
resource_group_name = azurerm_resource_group.default.name
8+
}
9+
10+
resource "azurerm_subnet" "snet-training" {
11+
name = "snet-training"
12+
resource_group_name = azurerm_resource_group.default.name
13+
virtual_network_name = azurerm_virtual_network.default.name
14+
address_prefixes = var.training_subnet_address_space
15+
enforce_private_link_endpoint_network_policies = true
16+
}
17+
18+
resource "azurerm_subnet" "snet-aks" {
19+
name = "snet-aks"
20+
resource_group_name = azurerm_resource_group.default.name
21+
virtual_network_name = azurerm_virtual_network.default.name
22+
address_prefixes = var.aks_subnet_address_space
23+
enforce_private_link_endpoint_network_policies = true
24+
}
25+
26+
resource "azurerm_subnet" "snet-workspace" {
27+
name = "snet-workspace"
28+
resource_group_name = azurerm_resource_group.default.name
29+
virtual_network_name = azurerm_virtual_network.default.name
30+
address_prefixes = var.ml_subnet_address_space
31+
enforce_private_link_endpoint_network_policies = true
32+
}
33+
34+
# Private DNS Zones
35+
resource "azurerm_private_dns_zone" "dnsvault" {
36+
name = "privatelink.vaultcore.azure.net"
37+
resource_group_name = azurerm_resource_group.default.name
38+
}
39+
40+
resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinkvault" {
41+
name = "dnsvaultlink"
42+
resource_group_name = azurerm_resource_group.default.name
43+
private_dns_zone_name = azurerm_private_dns_zone.dnsvault.name
44+
virtual_network_id = azurerm_virtual_network.default.id
45+
}
46+
47+
resource "azurerm_private_dns_zone" "dnsstorageblob" {
48+
name = "privatelink.blob.core.windows.net"
49+
resource_group_name = azurerm_resource_group.default.name
50+
}
51+
52+
resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinkblob" {
53+
name = "dnsblobstoragelink"
54+
resource_group_name = azurerm_resource_group.default.name
55+
private_dns_zone_name = azurerm_private_dns_zone.dnsstorageblob.name
56+
virtual_network_id = azurerm_virtual_network.default.id
57+
}
58+
59+
60+
resource "azurerm_private_dns_zone" "dnsstoragefile" {
61+
name = "privatelink.file.core.windows.net"
62+
resource_group_name = azurerm_resource_group.default.name
63+
}
64+
65+
resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinkfile" {
66+
name = "dnsfilestoragelink"
67+
resource_group_name = azurerm_resource_group.default.name
68+
private_dns_zone_name = azurerm_private_dns_zone.dnsstoragefile.name
69+
virtual_network_id = azurerm_virtual_network.default.id
70+
}
71+
72+
resource "azurerm_private_dns_zone" "dnscontainerregistry" {
73+
name = "privatelink.azurecr.io"
74+
resource_group_name = azurerm_resource_group.default.name
75+
}
76+
77+
resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinkcr" {
78+
name = "dnscrlink"
79+
resource_group_name = azurerm_resource_group.default.name
80+
private_dns_zone_name = azurerm_private_dns_zone.dnscontainerregistry.name
81+
virtual_network_id = azurerm_virtual_network.default.id
82+
}
83+
84+
resource "azurerm_private_dns_zone" "dnsazureml" {
85+
name = "privatelink.api.azureml.ms"
86+
resource_group_name = azurerm_resource_group.default.name
87+
}
88+
89+
resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinkml" {
90+
name = "dnsazuremllink"
91+
resource_group_name = azurerm_resource_group.default.name
92+
private_dns_zone_name = azurerm_private_dns_zone.dnsazureml.name
93+
virtual_network_id = azurerm_virtual_network.default.id
94+
}
95+
96+
resource "azurerm_private_dns_zone" "dnsnotebooks" {
97+
name = "privatelink.azureml.notebooks.net"
98+
resource_group_name = azurerm_resource_group.default.name
99+
}
100+
101+
resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinknbs" {
102+
name = "dnsnotebookslink"
103+
resource_group_name = azurerm_resource_group.default.name
104+
private_dns_zone_name = azurerm_private_dns_zone.dnsnotebooks.name
105+
virtual_network_id = azurerm_virtual_network.default.id
106+
}
107+
*/
108+
109+
# Network Security Groups
110+
111+
resource "azurerm_network_security_group" "nsg-training" {
112+
name = "nsg-training"
113+
location = azurerm_resource_group.default.location
114+
resource_group_name = azurerm_resource_group.default.name
115+
116+
security_rule {
117+
name = "BatchNodeManagement"
118+
priority = 100
119+
direction = "Inbound"
120+
access = "Allow"
121+
protocol = "Tcp"
122+
source_port_range = "*"
123+
destination_port_range = "29876-29877"
124+
source_address_prefix = "BatchNodeManagement"
125+
destination_address_prefix = "*"
126+
}
127+
security_rule {
128+
name = "AzureMachineLearning"
129+
priority = 110
130+
direction = "Inbound"
131+
access = "Allow"
132+
protocol = "Tcp"
133+
source_port_range = "*"
134+
destination_port_range = "44224"
135+
source_address_prefix = "AzureMachineLearning"
136+
destination_address_prefix = "*"
137+
}
138+
}
139+
140+
resource "azurerm_subnet_network_security_group_association" "nsg-training-link" {
141+
subnet_id = var.training_subnet_resource_id
142+
network_security_group_id = azurerm_network_security_group.nsg-training.id
143+
}
144+
145+
resource "azurerm_network_security_group" "nsg-aks" {
146+
name = "nsg-aks"
147+
location = azurerm_resource_group.default.location
148+
resource_group_name = azurerm_resource_group.default.name
149+
150+
151+
}
152+
153+
resource "azurerm_subnet_network_security_group_association" "nsg-aks-link" {
154+
subnet_id = var.aks_subnet_resource_id
155+
network_security_group_id = azurerm_network_security_group.nsg-aks.id
156+
}
157+
158+
# User Defined Routes
159+
160+
#UDR for Compute instance and compute clusters
161+
resource "azurerm_route_table" "rt-training" {
162+
name = "rt-training"
163+
location = azurerm_resource_group.default.location
164+
resource_group_name = azurerm_resource_group.default.name
165+
}
166+
167+
resource "azurerm_route" "training-Internet-Route" {
168+
name = "Internet"
169+
resource_group_name = azurerm_resource_group.default.name
170+
route_table_name = azurerm_route_table.rt-training.name
171+
address_prefix = "0.0.0.0/0"
172+
next_hop_type = "Internet"
173+
}
174+
175+
resource "azurerm_route" "training-AzureMLRoute" {
176+
name = "AzureMLRoute"
177+
resource_group_name = azurerm_resource_group.default.name
178+
route_table_name = azurerm_route_table.rt-training.name
179+
address_prefix = "AzureMachineLearning"
180+
next_hop_type = "Internet"
181+
}
182+
183+
resource "azurerm_route" "training-BatchRoute" {
184+
name = "BatchRoute"
185+
resource_group_name = azurerm_resource_group.default.name
186+
route_table_name = azurerm_route_table.rt-training.name
187+
address_prefix = "BatchNodeManagement"
188+
next_hop_type = "Internet"
189+
}
190+
191+
resource "azurerm_subnet_route_table_association" "rt-training-link" {
192+
subnet_id = var.training_subnet_resource_id
193+
route_table_id = azurerm_route_table.rt-training.id
194+
}
195+
# Inferencing (AKS) Route
196+
197+
resource "azurerm_route_table" "rt-aks" {
198+
name = "rt-aks"
199+
location = azurerm_resource_group.default.location
200+
resource_group_name = azurerm_resource_group.default.name
201+
}
202+
203+
resource "azurerm_route" "aks-Internet-Route" {
204+
name = "Internet"
205+
resource_group_name = azurerm_resource_group.default.name
206+
route_table_name = azurerm_route_table.rt-aks.name
207+
address_prefix = "0.0.0.0/0"
208+
next_hop_type = "Internet"
209+
}
210+
211+
resource "azurerm_subnet_route_table_association" "rt-aks-link" {
212+
subnet_id = var.aks_subnet_resource_id
213+
route_table_id = azurerm_route_table.rt-aks.id
214+
}

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/readme.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Azure Machine Learning workspace (moderately secure network set up)
2+
3+
This deployment configuration specifies an [Azure Machine Learning workspace](https://docs.microsoft.com/en-us/azure/machine-learning/concept-workspace),
4+
and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry.
5+
6+
In addition to these core services, this configuration specifies any networking components that are required to set up Azure Machine Learning
7+
for private network connectivity using [Azure Private Link](https://docs.microsoft.com/en-us/azure/private-link/).
8+
9+
This configuration describes the minimal set of resources you require to get started with Azure Machine Learning in a network-isolated set-up.
10+
11+
To learn more about security configurations in Azure Machine Learning, see [Enterprise security and governance for Azure Machine Learning](https://docs.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security).
12+
13+
## Resources
14+
15+
| Terraform Resource Type | Description |
16+
| - | - |
17+
| `azurerm_resource_group` | The resource group all resources get deployed into |
18+
| `azurerm_application_insights` | An Azure Application Insights instance associated to the Azure Machine Learning workspace |
19+
| `azurerm_key_vault` | An Azure Key Vault instance associated to the Azure Machine Learning workspace |
20+
| `azurerm_storage_account` | An Azure Storage instance associated to the Azure Machine Learning workspace |
21+
| `azurerm_container_registry` | An Azure Container Registry instance associated to the Azure Machine Learning workspace |
22+
| `azurerm_machine_learning_workspace` | An Azure Machine Learning workspace instance |
23+
| `azurerm_virtual_network` | An Azure Machine Learning workspace instance |
24+
| `azurerm_subnet` | An Azure Machine Learning workspace instance |
25+
| `azurerm_private_dns_zone` | Private DNS Zones for FQDNs required for Azure Machine Learning and associated resources |
26+
| `azurerm_private_dns_zone_virtual_network_link` | Virtual network links of the Private DNS Zones to the virtual network resource |
27+
| `azurerm_private_endpoint` | Private Endpoints for the Azure Machine Learning workspace and associated resources |
28+
29+
## Variables
30+
31+
| Name | Description |
32+
|-|-|
33+
| name | Name of the deployment |
34+
| environment | The deployment environment name (used for pre- and postfixing resource names) |
35+
| location | The Azure region used for deployments |
36+
37+
38+
## Usage
39+
40+
```bash
41+
terraform plan -var name=azureml567 -out demo.tfplan
42+
43+
terraform apply "demo.tfplan"
44+
```

‎quickstart/202-machine-learning-moderately-secure-existing-VNet/variables.tf‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
variable "name" {
2+
type = string
3+
description = "Name of the deployment"
4+
}
5+
6+
variable "environment" {
7+
type = string
8+
description = "Name of the environment"
9+
default = "dev"
10+
}
11+
12+
variable "location" {
13+
type = string
14+
description = "Location of the resources"
15+
}
16+
17+
variable "image_build_compute_name" {
18+
type = string
19+
description = "Name of the compute cluster to be created and set to build docker images"
20+
default = "image-builder"
21+
}
22+
23+
# Existing subnets variables
24+
25+
variable "training_subnet_resource_id" {
26+
type = string
27+
description = "Resource ID of the existing training subnet"
28+
}
29+
30+
variable "aks_subnet_resource_id" {
31+
type = string
32+
description = "Resource ID of the existing aks subnet"
33+
}
34+
35+
variable "ml_subnet_resource_id" {
36+
type = string
37+
description = "Resource ID of the existing ML workspace subnet"
38+
}
39+
40+
41+
# Existing private DNS zones variables
42+
43+
variable "privatelink_api_azureml_ms_resource_id" {
44+
type = string
45+
description = "Resource ID of the existing privatelink.api.azureml.ms private dns zone"
46+
}
47+
48+
variable "privatelink_azurecr_io_resource_id" {
49+
type = string
50+
description = "Resource ID of the existing privatelink.azurecr.io private dns zone"
51+
}
52+
53+
variable "privatelink_notebooks_azure_net_resource_id" {
54+
type = string
55+
description = "Resource ID of the existing privatelink.notebooks.azure.net private dns zone"
56+
}
57+
58+
variable "privatelink_blob_core_windows_net_resource_id" {
59+
type = string
60+
description = "Resource ID of the existing privatelink.blob.core.windows.net private dns zone"
61+
}
62+
63+
variable "privatelink_file_core_windows_net_resource_id" {
64+
type = string
65+
description = "Resource ID of the existing privatelink.file.core.windows.net private dns zone"
66+
}
67+
68+
variable "privatelink_vaultcore_azure_net_resource_id" {
69+
type = string
70+
description = "Resource ID of the existing privatelink.vaultcore.azure.net private dns zone"
71+
}

0 commit comments

Comments
 (0)