Skip to content

Commit 66f3915

Browse files
rmca14rmca14
authored
Merge pull request #100200 from Blackmist/existing-key-vault
update to address a github issue.
2 parents a98e946 + d264f5a commit 66f3915

File tree

1 file changed

+87
-141
lines changed

1 file changed

+87
-141
lines changed

‎articles/machine-learning/how-to-create-workspace-template.md

Lines changed: 87 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -31,143 +31,7 @@ For more information, see [Deploy an application with Azure Resource Manager tem
3131

3232
The following Resource Manager template can be used to create an Azure Machine Learning workspace and associated Azure resources:
3333

34-
```json
35-
{
36-
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
37-
"contentVersion": "1.0.0.0",
38-
"parameters": {
39-
"workspaceName": {
40-
"type": "string",
41-
"metadata": {
42-
"description": "Specifies the name of the Azure Machine Learning workspace."
43-
}
44-
},
45-
"location": {
46-
"type": "string",
47-
"defaultValue": "southcentralus",
48-
"allowedValues": [
49-
"eastus",
50-
"eastus2",
51-
"southcentralus",
52-
"southeastasia",
53-
"westcentralus",
54-
"westeurope",
55-
"westus2"
56-
],
57-
"metadata": {
58-
"description": "Specifies the location for all resources."
59-
}
60-
},
61-
"sku":{
62-
"type": "string",
63-
"defaultValue": "basic",
64-
"allowedValues": [
65-
"basic",
66-
"enterprise"
67-
],
68-
"metadata": {
69-
"description": "Specifies the sku, also referred as 'edition' of the Azure Machine Learning workspace."
70-
}
71-
}
72-
},
73-
"variables": {
74-
"storageAccountName": "[concat('sa',uniqueString(resourceGroup().id))]",
75-
"storageAccountType": "Standard_LRS",
76-
"keyVaultName": "[concat('kv',uniqueString(resourceGroup().id))]",
77-
"tenantId": "[subscription().tenantId]",
78-
"applicationInsightsName": "[concat('ai',uniqueString(resourceGroup().id))]",
79-
"containerRegistryName": "[concat('cr',uniqueString(resourceGroup().id))]"
80-
},
81-
"resources": [
82-
{
83-
"type": "Microsoft.Storage/storageAccounts",
84-
"apiVersion": "2018-07-01",
85-
"name": "[variables('storageAccountName')]",
86-
"location": "[parameters('location')]",
87-
"sku": {
88-
"name": "[variables('storageAccountType')]"
89-
},
90-
"kind": "StorageV2",
91-
"properties": {
92-
"encryption": {
93-
"services": {
94-
"blob": {
95-
"enabled": true
96-
},
97-
"file": {
98-
"enabled": true
99-
}
100-
},
101-
"keySource": "Microsoft.Storage"
102-
},
103-
"supportsHttpsTrafficOnly": true
104-
}
105-
},
106-
{
107-
"type": "Microsoft.KeyVault/vaults",
108-
"apiVersion": "2018-02-14",
109-
"name": "[variables('keyVaultName')]",
110-
"location": "[parameters('location')]",
111-
"properties": {
112-
"tenantId": "[variables('tenantId')]",
113-
"sku": {
114-
"name": "standard",
115-
"family": "A"
116-
},
117-
"accessPolicies": []
118-
}
119-
},
120-
{
121-
"type": "Microsoft.Insights/components",
122-
"apiVersion": "2015-05-01",
123-
"name": "[variables('applicationInsightsName')]",
124-
"location": "[if(or(equals(parameters('location'),'eastus2'),equals(parameters('location'),'westcentralus')),'southcentralus',parameters('location'))]",
125-
"kind": "web",
126-
"properties": {
127-
"Application_Type": "web"
128-
}
129-
},
130-
{
131-
"type": "Microsoft.ContainerRegistry/registries",
132-
"apiVersion": "2017-10-01",
133-
"name": "[variables('containerRegistryName')]",
134-
"location": "[parameters('location')]",
135-
"sku": {
136-
"name": "Standard"
137-
},
138-
"properties": {
139-
"adminUserEnabled": true
140-
}
141-
},
142-
{
143-
"type": "Microsoft.MachineLearningServices/workspaces",
144-
"apiVersion": "2019-11-01",
145-
"name": "[parameters('workspaceName')]",
146-
"location": "[parameters('location')]",
147-
"dependsOn": [
148-
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]",
149-
"[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]",
150-
"[resourceId('Microsoft.Insights/components', variables('applicationInsightsName'))]",
151-
"[resourceId('Microsoft.ContainerRegistry/registries', variables('containerRegistryName'))]"
152-
],
153-
"identity": {
154-
"type": "systemAssigned"
155-
},
156-
"sku": {
157-
"tier": "[parameters('sku')]",
158-
"name": "[parameters('sku')]"
159-
},
160-
"properties": {
161-
"friendlyName": "[parameters('workspaceName')]",
162-
"keyVault": "[resourceId('Microsoft.KeyVault/vaults',variables('keyVaultName'))]",
163-
"applicationInsights": "[resourceId('Microsoft.Insights/components',variables('applicationInsightsName'))]",
164-
"containerRegistry": "[resourceId('Microsoft.ContainerRegistry/registries',variables('containerRegistryName'))]",
165-
"storageAccount": "[resourceId('Microsoft.Storage/storageAccounts/',variables('storageAccountName'))]"
166-
}
167-
}
168-
]
169-
}
170-
```
34+
[!code-json[create-azure-machine-learning-service-workspace](~/quickstart-templates/101-machine-learning-create/azuredeploy.json)]
17135

17236
This template creates the following Azure services:
17337

@@ -221,7 +85,7 @@ This example assumes that you have saved the template to a file named `azuredepl
22185
New-AzResourceGroup -Name examplegroup -Location "East US"
22286
new-azresourcegroupdeployment -name exampledeployment `
22387
-resourcegroupname examplegroup -location "East US" `
224-
-templatefile .\azuredeploy.json -workspaceName "exampleworkspace"
88+
-templatefile .\azuredeploy.json -workspaceName "exampleworkspace" -sku "basic"
22589
```
22690

22791
For more information, see [Deploy resources with Resource Manager templates and Azure PowerShell](../azure-resource-manager/resource-group-template-deploy.md) and [Deploy private Resource Manager template with SAS token and Azure PowerShell](../azure-resource-manager/secure-template-with-sas-token.md).
@@ -236,7 +100,7 @@ az group deployment create \
236100
--name exampledeployment \
237101
--resource-group examplegroup \
238102
--template-file azuredeploy.json \
239-
--parameters workspaceName=exampleworkspace location=eastus
103+
--parameters workspaceName=exampleworkspace location=eastus sku=basic
240104
```
241105

242106
For more information, see [Deploy resources with Resource Manager templates and Azure CLI](../azure-resource-manager/resource-group-template-deploy-cli.md) and [Deploy private Resource Manager template with SAS token and Azure CLI](../azure-resource-manager/secure-template-with-sas-token.md).
@@ -251,8 +115,90 @@ To avoid this problem, we recommend one of the following approaches:
251115

252116
* Do not deploy the template more than once for the same parameters. Or delete the existing resources before using the template to recreate them.
253117

254-
* Examine the Key Vault access policies and then use these policies to set the accessPolicies property of the template.
255-
* Check if the Key Vault resource already exists. If it does, do not recreate it through the template. For example, add a parameter that allows you to disable the creation of the Key Vault resource if it already exists.
118+
* Examine the Key Vault access policies and then use these policies to set the `accessPolicies` property of the template. To view the access policies, use the following Azure CLI command:
119+
120+
```azurecli-interactive
121+
az keyvault show --name mykeyvault --resource-group myresourcegroup --query properties.accessPolicies
122+
```
123+
124+
For more information on using the `accessPolicies` section of the template, see the [AccessPolicyEntry object reference](https://docs.microsoft.com/azure/templates/Microsoft.KeyVault/2018-02-14/vaults#AccessPolicyEntry).
125+
126+
* Check if the Key Vault resource already exists. If it does, do not recreate it through the template. For example, to use the existing Key Vault instead of creating a new one, make the following changes to the template:
127+
128+
* **Add** a parameter that accepts the ID of an existing Key Vault resource:
129+
130+
```json
131+
"keyVaultId":{
132+
"type": "string",
133+
"metadata": {
134+
"description": "Specify the existing Key Vault ID."
135+
}
136+
}
137+
```
138+
139+
* **Remove** the section that creates a Key Vault resource:
140+
141+
```json
142+
{
143+
"type": "Microsoft.KeyVault/vaults",
144+
"apiVersion": "2018-02-14",
145+
"name": "[variables('keyVaultName')]",
146+
"location": "[parameters('location')]",
147+
"properties": {
148+
"tenantId": "[variables('tenantId')]",
149+
"sku": {
150+
"name": "standard",
151+
"family": "A"
152+
},
153+
"accessPolicies": [
154+
]
155+
}
156+
},
157+
```
158+
159+
* **Remove** the `"[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]",` line from the `dependsOn` section of the workspace. Also **Change** the `keyVault` entry in the `properties` section of the workspace to reference the `keyVaultId` parameter:
160+
161+
```json
162+
{
163+
"type": "Microsoft.MachineLearningServices/workspaces",
164+
"apiVersion": "2019-11-01",
165+
"name": "[parameters('workspaceName')]",
166+
"location": "[parameters('location')]",
167+
"dependsOn": [
168+
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]",
169+
"[resourceId('Microsoft.Insights/components', variables('applicationInsightsName'))]"
170+
],
171+
"identity": {
172+
"type": "systemAssigned"
173+
},
174+
"sku": {
175+
"tier": "[parameters('sku')]",
176+
"name": "[parameters('sku')]"
177+
},
178+
"properties": {
179+
"friendlyName": "[parameters('workspaceName')]",
180+
"keyVault": "[parameters('keyVaultId')]",
181+
"applicationInsights": "[resourceId('Microsoft.Insights/components',variables('applicationInsightsName'))]",
182+
"storageAccount": "[resourceId('Microsoft.Storage/storageAccounts/',variables('storageAccountName'))]"
183+
}
184+
}
185+
```
186+
187+
After these changes, you can specify the ID of the existing Key Vault resource when running the template. The template will then re-use the Key Vault by setting the `keyVault` property of the workspace to its ID.
188+
189+
To get the ID of the Key Vault, you can reference the output of the original template run or use the Azure CLI. The following command is an example of using the Azure CLI to get the Key Vault resource ID:
190+
191+
```azurecli-interactive
192+
az keyvault show --name mykeyvault --resource-group myresourcegroup --query id
193+
```
194+
195+
This command returns a value similar to the following text:
196+
197+
```text
198+
/subscriptions/{subscription-guid}/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mykeyvault
199+
```
200+
201+
256202
257203
## Next steps
258204

0 commit comments

Comments
 (0)