azurerm_machine_learning_workspace - Add support for serverless_compute
#25660
Conversation
| MaxItems: 1, | ||
| Elem: &pluginsdk.Resource{ | ||
| Schema: map[string]*pluginsdk.Schema{ | ||
| "custom_subnet_id": { |
There was a problem hiding this comment.
This could be shortened to
| "custom_subnet_id": { | |
| "subnet_id": { |
| Optional: true, | ||
| ValidateFunc: networkValidate.SubnetID, | ||
| }, | ||
| "no_public_ip_enabled": { |
There was a problem hiding this comment.
Prefixing a boolean with no_ violates the naming standard we use for bools. This needs to become
| "no_public_ip_enabled": { | |
| "public_ip_enabled": { |
There was a problem hiding this comment.
Can we keep this to no_public_ip_enabled? If renamed to public_ip_enabled we need to reverse the value before send to service or set to state. Also service will return the validation error such like: ValidationError: Not supported to update ServerlessComputeNoPublicIP from false to true when public network access is enabled and this validation may changed in the future. Users may confused by the error message because the name is not same to public_ip_enabled
There was a problem hiding this comment.
We have many instances where we flip the boolean values around in the provider to conform to the standards the provider has. In addition that error message indicates a limitation on when public_ip_enabled can be updated which means we should probably have some validation around this in the Create and Update methods and can thus return our own error message instead of relying on the API to error.
Given the above this property still needs to become public_ip_enabled.
There was a problem hiding this comment.
we nhave a test failure
------- Stdout: -------
=== RUN TestAccMachineLearningWorkspace_serverlessCompute
=== PAUSE TestAccMachineLearningWorkspace_serverlessCompute
=== CONT TestAccMachineLearningWorkspace_serverlessCompute
testcase.go:113: Step 1/2 error: Error running apply: exit status 1
Error: Not supported to set `public_ip_enabled` to `false` without `subnet_id` when `public_network_access_enabled` is `false`
with azurerm_machine_learning_workspace.test,
on terraform_plugin_test.tf line 86, in resource "azurerm_machine_learning_workspace" "test":
86: resource "azurerm_machine_learning_workspace" "test" {
--- FAIL: TestAccMachineLearningWorkspace_serverlessCompute (342.14s)
FAIL
|
| * `no_public_ip_enabled` - (Optional) Is serverless compute nodes deployed in custom vNet would have no public IP addresses enabled for a workspace with private endpoint? Defaults to `false`. | ||
|
|
||
| ~> **Note:** Not supported to set `public_ip_enabled` to `false` without `subnet_id` when `public_network_access_enabled` is `false`. | ||
|
|
||
| ~> **Note:** Not supported to update `public_ip_enabled` from `true` to `false` when `subnet_id` is null or empty |
There was a problem hiding this comment.
to name the property serverlessComputeNoPublicIP to public_ip_enabled, value has been flipped. I add the constraint in the resource and also the doc.
| "subnet_id": { | ||
| Type: pluginsdk.TypeString, | ||
| Optional: true, | ||
| ValidateFunc: networkValidate.SubnetID, |
There was a problem hiding this comment.
We should use the Validation function from the commonids package for subnets
| ValidateFunc: networkValidate.SubnetID, | |
| ValidateFunc: commonids.ValidateSubnetID, |
| serverlessCompute := expandMachineLearningWorkspaceServerlessCompute(d.Get("serverless_compute").([]interface{})) | ||
| if serverlessCompute != nil { | ||
| if *serverlessCompute.ServerlessComputeNoPublicIP && serverlessCompute.ServerlessComputeCustomSubnet == nil && !networkAccessBehindVnetEnabled { | ||
| return fmt.Errorf(" Not supported to set `public_ip_enabled` to `false` without `subnet_id` when `public_network_access_enabled` is `false`") |
There was a problem hiding this comment.
Can we re-phrase this to something more actionable for the user
| return fmt.Errorf(" Not supported to set `public_ip_enabled` to `false` without `subnet_id` when `public_network_access_enabled` is `false`") | |
| return fmt.Errorf("`public_ip_enabled` must be set to `true` if `subnet_id` is not set and `public_network_access_enabled` is `false`") |
| if serverlessCompute.ServerlessComputeCustomSubnet == nil { | ||
| oldVal, newVal := d.GetChange("serverless_compute.0.public_ip_enabled") | ||
| if oldVal.(bool) && !newVal.(bool) { | ||
| return fmt.Errorf(" Not supported to update `public_ip_enabled` from `true` to `false` when `subnet_id` is null or empty") | ||
| } | ||
| } |
There was a problem hiding this comment.
This logic looks like it belongs in a CustomizeDiff
There was a problem hiding this comment.
will add a CustomizeDiff for this
There was a problem hiding this comment.
Tried several ways to update this property, customers can still update it but it takes several steps. We can omit `CustomizeDiff``, cx can update the settings according to the error message.
- Set the
serverless_compute.subnet_id - They may need to add the a private link for this machine learning workspace.
- Update the
serverless_compute.public_ip_enabledfromtruetofalse
Error message cx may get:
Error: creating/updating Workspace (Subscription: "<sub id>"
Resource Group Name: "<rg name>"
Workspace Name: "xz3workspace16"): unexpected status 400 (400 Bad Request) with error: ValidationError: Found errors while validating Subnet Id <subnet id>. Subnet Diagnostic Result = WorkspaceVnet:ErrorCode=WorkspaceVnetConflictErrorMessage=The workspace does not have public access and does not have a VNET. Pleas
e either add a VNET to the workspace or enable public access. For more information, please refer to https://docs.microsoft.com/en-us/azure/machine-learning/how-to-configure-private-link?tabs=python#add-a-private-endpoint-to-a-workspace.
There was a problem hiding this comment.
Thanks for the explanation @xuzhang3.
Is this something we can do in the resource by calling the CreateOrUpdate method twice in the same apply if public_ip_enabled changes from true -> false?
e.g. First CreateOrUpdate call sets subnet_id
Second CreateOrUpdate call updated public_ip_enabled from true -> false
There was a problem hiding this comment.
no, the operation needs to be split into several steps
There was a problem hiding this comment.
Is that because of
- They may need to add the a private link for this machine learning workspace.
Is this an external thing that they need to configure? What is meant by may are there situations where they don't need to?
There was a problem hiding this comment.
For example, I create a new MLW with following config and I want to set the serverless_compute.public_ip_enabled to false, I need to update the public_network_access_enabled and serverless_compute.subnet_id and I need add a private endpoint for this MLW then I can update the serverless_compute.public_ip_enabled, this is one of the scenario. Other scenario depends on the MLW configurations.
resource "azurerm_machine_learning_workspace" "example" {
name = "mymlwexample"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
application_insights_id = azurerm_application_insights.example.id
key_vault_id = azurerm_key_vault.example.id
storage_account_id = azurerm_storage_account.example.id
# public_network_access_enabled = true
image_build_compute_name = "terraformComputeUpdate11"
serverless_compute {
# subnet_id = azurerm_subnet.test.id
public_ip_enabled = true
}
identity {
type = "SystemAssigned"
}
}| serverless_compute { | ||
| subnet_id = azurerm_subnet.test.id | ||
| } |
There was a problem hiding this comment.
We should also add a test for the case where we don't supply subnet_id
| @@ -422,6 +424,18 @@ An `managed_network` block supports the following: | |||
|
|
|||
| --- | |||
|
|
|||
| An `serverless_compute` block supports the following: | |||
There was a problem hiding this comment.
| An `serverless_compute` block supports the following: | |
| A `serverless_compute` block supports the following: |
| @@ -422,6 +424,18 @@ An `managed_network` block supports the following: | |||
|
|
|||
| --- | |||
|
|
|||
| An `serverless_compute` block supports the following: | |||
|
|
|||
| * `custom_subnet_id` - (Optional) The ID of an existing virtual network subnet in which serverless compute nodes should be deployed. | |||
There was a problem hiding this comment.
This is just called subnet_id in the schema
| * `custom_subnet_id` - (Optional) The ID of an existing virtual network subnet in which serverless compute nodes should be deployed. | |
| * `subnet_id` - (Optional) The ID of an existing Virtual Network Subnet in which the serverless compute nodes should be deployed to. |
|
|
||
| * `custom_subnet_id` - (Optional) The ID of an existing virtual network subnet in which serverless compute nodes should be deployed. | ||
|
|
||
| * `no_public_ip_enabled` - (Optional) Is serverless compute nodes deployed in custom vNet would have no public IP addresses enabled for a workspace with private endpoint? Defaults to `false`. |
There was a problem hiding this comment.
| * `no_public_ip_enabled` - (Optional) Is serverless compute nodes deployed in custom vNet would have no public IP addresses enabled for a workspace with private endpoint? Defaults to `false`. | |
| * `public_ip_enabled` - (Optional) Should serverless compute nodes deployed in a custom Virtual Network have public IP addresses enabled for a workspace with private endpoint? Defaults to `false`. |
| ~> **Note:** Not supported to set `public_ip_enabled` to `false` without `subnet_id` when `public_network_access_enabled` is `false`. | ||
|
|
||
| ~> **Note:** Not supported to update `public_ip_enabled` from `true` to `false` when `subnet_id` is null or empty |
There was a problem hiding this comment.
We can consolidate these
| ~> **Note:** Not supported to set `public_ip_enabled` to `false` without `subnet_id` when `public_network_access_enabled` is `false`. | |
| ~> **Note:** Not supported to update `public_ip_enabled` from `true` to `false` when `subnet_id` is null or empty | |
| ~> **Note:** `public_ip_enabled` cannot be updated from `true` to `false` when `subnet_id` is not set. `public_ip_enabled` must be set to `true` if `subnet_id` is not set and when `public_network_access_enabled` is `false`. |
2. rename no_public_ip_enabled to public_ip_enabled 3. add test case for serverless compute 4. update document
|
|
@stephybun all changes has been updated |
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions. |
Add support for
serverless_compute.custom_subnet_id, serverless_compute.no_public_ip_enabled`Community Note
Description
PR Checklist
For example: “
resource_name_here- description of change e.g. adding propertynew_property_name_here”Changes to existing Resource / Data Source
Testing
Change Log
Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.
azurerm_resource- support for thething1property [GH-00000]This is a (please select all that apply):
Related Issue(s)
Fixes #0000
Note
If this PR changes meaningfully during the course of review please update the title and description as required.