-
Notifications
You must be signed in to change notification settings - Fork 475
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use RBAC and bicep provisioning for Azure OpenAI
Fixes #2490
- Loading branch information
1 parent
c67d3c4
commit 73a0715
Showing
9 changed files
with
190 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
16 changes: 8 additions & 8 deletions
16
playground/OpenAIEndToEnd/OpenAIEndToEnd.AppHost/aspire-manifest.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
playground/OpenAIEndToEnd/OpenAIEndToEnd.AppHost/aspire.hosting.azure.bicep.openai.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| // c.f., https://learn.microsoft.com/azure/ai-services/create-account-bicep | ||
|
|
||
| param name string | ||
| param principalId string | ||
| param principalType string = 'ServicePrincipal' | ||
| param deployments array = [] // This is a placeholder. Deployments provisioning is not supported yet. | ||
|
|
||
| @description('Tags that will be applied to all resources') | ||
| param tags object = {} | ||
|
|
||
| @description('Location for all resources.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @allowed([ | ||
| 'S0' | ||
| ]) | ||
| param sku string = 'S0' | ||
|
|
||
| var resourceToken = uniqueString(resourceGroup().id) | ||
|
|
||
| resource cognitiveService 'Microsoft.CognitiveServices/accounts@2021-10-01' = { | ||
| name: '${name}-${resourceToken}' | ||
| location: location | ||
| sku: { | ||
| name: sku | ||
| } | ||
| kind: 'OpenAI' | ||
| properties: { | ||
| apiProperties: { | ||
| statisticsEnabled: false | ||
| } | ||
| } | ||
| tags: tags | ||
| } | ||
|
|
||
| // Find list of roles and GUIDs in https://learn.microsoft.com/azure/role-based-access-control/built-in-roles | ||
|
|
||
| // Cognitive Services OpenAI Contributor | ||
| var contributorRole = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442') | ||
| resource cognitiveServiceContributorRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| name: guid(cognitiveService.id, principalId, contributorRole) | ||
| scope: cognitiveService | ||
| properties: { | ||
| principalId: principalId | ||
| principalType: principalType | ||
| roleDefinitionId: contributorRole | ||
| } | ||
| } | ||
|
|
||
| output connectionString string = 'Endpoint=${cognitiveService.properties.endpoint}' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| // c.f., https://learn.microsoft.com/azure/ai-services/create-account-bicep | ||
|
|
||
| param name string | ||
| param principalId string | ||
| param principalType string = 'ServicePrincipal' | ||
| param deployments array = [] // This is a placeholder. Deployments provisioning is not supported yet. | ||
|
|
||
| @description('Tags that will be applied to all resources') | ||
| param tags object = {} | ||
|
|
||
| @description('Location for all resources.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @allowed([ | ||
| 'S0' | ||
| ]) | ||
| param sku string = 'S0' | ||
|
|
||
| var resourceToken = uniqueString(resourceGroup().id) | ||
|
|
||
| resource cognitiveService 'Microsoft.CognitiveServices/accounts@2021-10-01' = { | ||
| name: '${name}-${resourceToken}' | ||
| location: location | ||
| sku: { | ||
| name: sku | ||
| } | ||
| kind: 'OpenAI' | ||
| properties: { | ||
| apiProperties: { | ||
| statisticsEnabled: false | ||
| } | ||
| } | ||
| tags: tags | ||
| } | ||
|
|
||
| // Find list of roles and GUIDs in https://learn.microsoft.com/azure/role-based-access-control/built-in-roles | ||
|
|
||
| // Cognitive Services OpenAI Contributor | ||
| var contributorRole = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442') | ||
| resource cognitiveServiceContributorRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| name: guid(cognitiveService.id, principalId, contributorRole) | ||
| scope: cognitiveService | ||
| properties: { | ||
| principalId: principalId | ||
| principalType: principalType | ||
| roleDefinitionId: contributorRole | ||
| } | ||
| } | ||
|
|
||
| output connectionString string = 'Endpoint=${cognitiveService.properties.endpoint}' |
42 changes: 42 additions & 0 deletions
42
src/Aspire.Hosting.Azure/Extensions/AzureOpenAIExtensions.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| // Licensed to the .NET Foundation under one or more agreements. | ||
| // The .NET Foundation licenses this file to you under the MIT license. | ||
|
|
||
| using Aspire.Hosting.ApplicationModel; | ||
| using Aspire.Hosting.Azure; | ||
|
|
||
| namespace Aspire.Hosting; | ||
|
|
||
| /// <summary> | ||
| /// Provides extension methods for adding the Azure OpenAI resources to the application model. | ||
| /// </summary> | ||
| public static class AzureOpenAIExtensions | ||
| { | ||
| /// <summary> | ||
| /// Adds an Azure OpenAI resource to the application model. | ||
| /// </summary> | ||
| /// <param name="builder">The <see cref="IDistributedApplicationBuilder"/>.</param> | ||
| /// <param name="name">The name of the resource. This name will be used as the connection string name when referenced in a dependency.</param> | ||
| /// <returns>A reference to the <see cref="IResourceBuilder{AzureOpenAIResource}"/>.</returns> | ||
| public static IResourceBuilder<AzureOpenAIResource> AddAzureOpenAI(this IDistributedApplicationBuilder builder, string name) | ||
| { | ||
| var resource = new AzureOpenAIResource(name); | ||
| return builder.AddResource(resource) | ||
| .WithParameter("name", resource.CreateBicepResourceName()) | ||
| .WithParameter("deployments", resource.Deployments.Select(x => x.Name)) | ||
| .WithParameter(AzureBicepResource.KnownParameters.PrincipalId) | ||
| .WithParameter(AzureBicepResource.KnownParameters.PrincipalType) | ||
| .WithManifestPublishingCallback(resource.WriteToManifest); | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Adds an Azure OpenAI Deployment resource to the application model. This resource requires an <see cref="AzureOpenAIResource"/> to be added to the application model. | ||
| /// </summary> | ||
| /// <param name="serverBuilder">The Azure SQL Server resource builder.</param> | ||
| /// <param name="name">The name of the deployment.</param> | ||
| /// <returns>A reference to the <see cref="IResourceBuilder{AzureSqlDatabaseResource}"/>.</returns> | ||
| public static IResourceBuilder<AzureOpenAIDeploymentResource> AddDeployment(this IResourceBuilder<AzureOpenAIResource> serverBuilder, string name) | ||
| { | ||
| var resource = new AzureOpenAIDeploymentResource(name, serverBuilder.Resource); | ||
| return serverBuilder.ApplicationBuilder.AddResource(resource); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters