Skip to content

Commit 0351918

Browse files
Kanchan-MicrosoftKanchan-Microsoft
committed
Merge branch 'dev' into psl-agentsdk
2 parents 8d97e3d + a279612 commit 0351918

15 files changed

+793
-464
lines changed

‎.github/workflows/deploy-KMGeneric.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ jobs:
4040
export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
4141
export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
4242
export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
43-
export GPT_MIN_CAPACITY="150"
44-
export TEXT_EMBEDDING_MIN_CAPACITY="80"
43+
export GPT_MIN_CAPACITY=${{ env.GPT_MIN_CAPACITY }}
44+
export TEXT_EMBEDDING_MIN_CAPACITY=${{ env.TEXT_EMBEDDING_MIN_CAPACITY }}
4545
export AZURE_REGIONS="${{ vars.AZURE_REGIONS_KM }}"
4646
chmod +x infra/scripts/checkquota_km.sh
4747
if ! infra/scripts/checkquota_km.sh; then

‎documents/QuotaCheck.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ azd auth login
1010

1111
### 📌 Default Models & Capacities:
1212
```
13-
gpt-4o:30, gpt-4o-mini:30, gpt-4:30, text-embedding-ada-002:80
13+
gpt-4o:150, gpt-4o-mini:150, gpt-4:150, text-embedding-ada-002:80
1414
```
1515
### 📌 Default Regions:
1616
```
@@ -36,19 +36,19 @@ eastus, uksouth, eastus2, northcentralus, swedencentral, westus, westus2, southc
3636
```
3737
✔️ Check specific model(s) in default regions:
3838
```
39-
./quota_check_params.sh --models gpt-4o:30,text-embedding-ada-002:80
39+
./quota_check_params.sh --models gpt-4o:150,text-embedding-ada-002:80
4040
```
4141
✔️ Check default models in specific region(s):
4242
```
4343
./quota_check_params.sh --regions eastus,westus
4444
```
4545
✔️ Passing Both models and regions:
4646
```
47-
./quota_check_params.sh --models gpt-4o:30 --regions eastus,westus2
47+
./quota_check_params.sh --models gpt-4o:150 --regions eastus,westus2
4848
```
4949
✔️ All parameters combined:
5050
```
51-
./quota_check_params.sh --models gpt-4:30,text-embedding-ada-002:80 --regions eastus,westus --verbose
51+
./quota_check_params.sh --models gpt-4:150,text-embedding-ada-002:80 --regions eastus,westus --verbose
5252
```
5353

5454
### **Sample Output**

‎infra/create-sql-user-and-role.bicep‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
targetScope = 'resourceGroup'
2+
3+
@description('The Azure region for the resource.')
4+
param location string
5+
6+
@description('The tags to associate with this resource.')
7+
param tags object = {}
8+
9+
@description('The database roles to assign to the user.')
10+
param databaseRoles string[] = ['db_datareader']
11+
12+
@description('The name of the User Assigned Managed Identity to be used.')
13+
param managedIdentityName string
14+
15+
@description('The principal (or object) ID of the user to create.')
16+
param principalId string
17+
18+
@description('The name of the user to create.')
19+
param principalName string
20+
21+
@description('The name of the SQL Database resource.')
22+
param sqlDatabaseName string
23+
24+
@description('The name of the SQL Server resource.')
25+
param sqlServerName string
26+
27+
@description('Do not set - unique script ID to force the script to run.')
28+
param uniqueScriptId string = newGuid()
29+
30+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
31+
name: managedIdentityName
32+
}
33+
34+
resource createSqlUserAndRole 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
35+
name: 'sqlUserRole-${guid(principalId, sqlServerName, sqlDatabaseName)}'
36+
location: location
37+
tags: tags
38+
kind: 'AzurePowerShell'
39+
identity: {
40+
type: 'UserAssigned'
41+
userAssignedIdentities: {
42+
'${managedIdentity.id}': {}
43+
}
44+
}
45+
properties: {
46+
forceUpdateTag: uniqueScriptId
47+
azPowerShellVersion: '7.2'
48+
retentionInterval: 'PT1H'
49+
cleanupPreference: 'OnSuccess'
50+
arguments: join(
51+
[
52+
'-SqlServerName \'${sqlServerName}\''
53+
'-SqlDatabaseName \'${sqlDatabaseName}\''
54+
'-ClientId \'${principalId}\''
55+
'-DisplayName \'${principalName}\''
56+
'-DatabaseRoles \'${join(databaseRoles, ',')}\''
57+
],
58+
' '
59+
)
60+
scriptContent: loadTextContent('./scripts/add_user_scripts/create-sql-user-and-role.ps1')
61+
}
62+
}

‎infra/deploy_ai_foundry.bicep‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -250,18 +250,19 @@ module assignFoundryRoleToMIExisting 'deploy_foundry_role_assignment.bicep' = if
250250
params: {
251251
roleDefinitionId: aiUser.id
252252
roleAssignmentName: guid(resourceGroup().id, managedIdentityObjectId, aiUser.id, 'foundry')
253-
aiServicesName: !empty(azureExistingAIProjectResourceId) ? existingAIServicesName : aiServicesName
254-
aiProjectName: !empty(azureExistingAIProjectResourceId) ? existingAIProjectName : aiProjectName
253+
aiServicesName: existingAIServicesName
254+
aiProjectName: existingAIProjectName
255255
principalId: managedIdentityObjectId
256-
aiLocation: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.location : solutionLocation
257-
aiKind: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.kind : 'AIServices'
258-
aiSkuName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.skuName : 'S0'
259-
customSubDomainName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.customSubDomainName : aiServicesName
260-
publicNetworkAccess: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.publicNetworkAccess : 'Enabled'
256+
aiLocation: existing_aiServicesModule.outputs.location
257+
aiKind: existing_aiServicesModule.outputs.kind
258+
aiSkuName: existing_aiServicesModule.outputs.skuName
259+
customSubDomainName: existing_aiServicesModule.outputs.customSubDomainName
260+
publicNetworkAccess: existing_aiServicesModule.outputs.publicNetworkAccess
261261
enableSystemAssignedIdentity: true
262-
defaultNetworkAction: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.defaultNetworkAction : 'Allow'
263-
vnetRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.vnetRules : []
264-
ipRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.ipRules : []
262+
defaultNetworkAction: existing_aiServicesModule.outputs.defaultNetworkAction
263+
vnetRules: existing_aiServicesModule.outputs.vnetRules
264+
ipRules: existing_aiServicesModule.outputs.ipRules
265+
aiModelDeployments: aiModelDeployments // Pass the model deployments to the module if model not already deployed
265266
}
266267
}
267268

@@ -279,24 +280,26 @@ resource cognitiveServicesOpenAIUser 'Microsoft.Authorization/roleDefinitions@20
279280
name: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
280281
}
281282

282-
module assignOpenAIRoleToAISearch 'deploy_foundry_role_assignment.bicep' = {
283-
name: 'assignOpenAIRoleToAISearch'
283+
resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (empty(azureExistingAIProjectResourceId)) {
284+
name: guid(resourceGroup().id, aiServices.id, cognitiveServicesOpenAIUser.id)
285+
scope: aiServices
286+
properties: {
287+
principalId: aiSearch.identity.principalId
288+
roleDefinitionId: cognitiveServicesOpenAIUser.id
289+
principalType: 'ServicePrincipal'
290+
}
291+
}
292+
293+
module assignOpenAIRoleToAISearchExisting 'deploy_foundry_role_assignment.bicep' = if (!empty(azureExistingAIProjectResourceId)) {
294+
name: 'assignOpenAIRoleToAISearchExisting'
284295
scope: resourceGroup(existingAIServiceSubscription, existingAIServiceResourceGroup)
285296
params: {
286297
roleDefinitionId: cognitiveServicesOpenAIUser.id
287298
roleAssignmentName: guid(resourceGroup().id, aiSearch.id, cognitiveServicesOpenAIUser.id, 'openai-foundry')
288-
aiServicesName: !empty(azureExistingAIProjectResourceId) ? existingAIServicesName : aiServicesName
289-
aiProjectName: !empty(azureExistingAIProjectResourceId) ? existingAIProjectName : aiProjectName
299+
aiServicesName: existingAIServicesName
300+
aiProjectName: existingAIProjectName
290301
principalId: aiSearch.identity.principalId
291-
aiLocation: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.location : solutionLocation
292-
aiKind: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.kind : 'AIServices'
293-
aiSkuName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.skuName : 'S0'
294-
customSubDomainName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.customSubDomainName : aiServicesName
295-
publicNetworkAccess: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.publicNetworkAccess : 'Enabled'
296-
enableSystemAssignedIdentity: true
297-
defaultNetworkAction: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.defaultNetworkAction : 'Allow'
298-
vnetRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.vnetRules : []
299-
ipRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.ipRules : []
302+
enableSystemAssignedIdentity: false
300303
}
301304
}
302305

@@ -318,7 +321,7 @@ resource assignSearchIndexDataReaderToExistingAiProject 'Microsoft.Authorization
318321
name: guid(resourceGroup().id, existingAIProjectName, searchIndexDataReader.id, 'Existing')
319322
scope: aiSearch
320323
properties: {
321-
principalId: assignOpenAIRoleToAISearch.outputs.aiProjectPrincipalId
324+
principalId: assignOpenAIRoleToAISearchExisting.outputs.aiProjectPrincipalId
322325
roleDefinitionId: searchIndexDataReader.id
323326
principalType: 'ServicePrincipal'
324327
}
@@ -342,7 +345,7 @@ resource assignSearchServiceContributorToExistingAiProject 'Microsoft.Authorizat
342345
name: guid(resourceGroup().id, existingAIProjectName, searchServiceContributor.id, 'Existing')
343346
scope: aiSearch
344347
properties: {
345-
principalId: assignOpenAIRoleToAISearch.outputs.aiProjectPrincipalId
348+
principalId: assignOpenAIRoleToAISearchExisting.outputs.aiProjectPrincipalId
346349
roleDefinitionId: searchServiceContributor.id
347350
principalType: 'ServicePrincipal'
348351
}

‎infra/deploy_backend_docker.bicep‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -185,15 +185,7 @@ module assignAiUserRoleToAiProject 'deploy_foundry_role_assignment.bicep' = {
185185
roleAssignmentName: guid(appService.name, aiServices.id, aiUser.id)
186186
aiServicesName: !empty(azureExistingAIProjectResourceId) ? existingAIServicesName : aiServicesName
187187
aiProjectName: !empty(azureExistingAIProjectResourceId) ? split(azureExistingAIProjectResourceId, '/')[10] : ''
188-
aiLocation: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.location : aideploymentsLocation
189-
aiKind: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.kind : 'AIServices'
190-
aiSkuName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.skuName : 'S0'
191-
customSubDomainName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.customSubDomainName : aiServicesName
192-
publicNetworkAccess: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.publicNetworkAccess : 'Enabled'
193-
enableSystemAssignedIdentity: true
194-
defaultNetworkAction: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.defaultNetworkAction : 'Allow'
195-
vnetRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.vnetRules : []
196-
ipRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.ipRules : []
188+
enableSystemAssignedIdentity: false
197189
}
198190
}
199191

‎infra/deploy_foundry_role_assignment.bicep‎

Lines changed: 52 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,19 @@ param aiProjectName string = ''
66
param aiLocation string=''
77
param aiKind string=''
88
param aiSkuName string=''
9-
param enableSystemAssignedIdentity bool = true
9+
param enableSystemAssignedIdentity bool = false
1010
param customSubDomainName string = ''
1111
param publicNetworkAccess string = ''
12-
param defaultNetworkAction string
12+
param defaultNetworkAction string = ''
1313
param vnetRules array = []
1414
param ipRules array = []
15+
param aiModelDeployments array = []
1516

16-
// AI Services with Identity (enabled only if flag is true)
17-
resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if (enableSystemAssignedIdentity) {
17+
resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' existing = if (!enableSystemAssignedIdentity) {
18+
name: aiServicesName
19+
}
20+
21+
resource aiServicesWithIdentity 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if (enableSystemAssignedIdentity) {
1822
name: aiServicesName
1923
location: aiLocation
2024
kind: aiKind
@@ -37,10 +41,31 @@ resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' =
3741
}
3842
}
3943

40-
// AI Project with Identity (only if name provided and flag is true)
41-
resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' = if (!empty(aiProjectName) && enableSystemAssignedIdentity) {
44+
@batchSize(1)
45+
resource aiServicesDeployments 'Microsoft.CognitiveServices/accounts/deployments@2025-04-01-preview' = [for aiModeldeployment in aiModelDeployments: if (!empty(aiModelDeployments)) {
46+
parent: aiServicesWithIdentity
47+
name: aiModeldeployment.name
48+
properties: {
49+
model: {
50+
format: 'OpenAI'
51+
name: aiModeldeployment.model
52+
}
53+
raiPolicyName: aiModeldeployment.raiPolicyName
54+
}
55+
sku:{
56+
name: aiModeldeployment.sku.name
57+
capacity: aiModeldeployment.sku.capacity
58+
}
59+
}]
60+
61+
resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' existing = if (!empty(aiProjectName) && !enableSystemAssignedIdentity) {
4262
name: aiProjectName
4363
parent: aiServices
64+
}
65+
66+
resource aiProjectWithIdentity 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' = if (!empty(aiProjectName) && enableSystemAssignedIdentity) {
67+
name: aiProjectName
68+
parent: aiServicesWithIdentity
4469
location: aiLocation
4570
identity: {
4671
type: 'SystemAssigned'
@@ -49,7 +74,16 @@ resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-pre
4974
}
5075

5176
// Role Assignment to AI Services
52-
resource roleAssignmentToFoundry 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
77+
resource roleAssignmentToFoundryExisting 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableSystemAssignedIdentity) {
78+
name: roleAssignmentName
79+
scope: aiServicesWithIdentity
80+
properties: {
81+
roleDefinitionId: roleDefinitionId
82+
principalId: principalId
83+
}
84+
}
85+
86+
resource roleAssignmentToFoundry 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!enableSystemAssignedIdentity) {
5387
name: roleAssignmentName
5488
scope: aiServices
5589
properties: {
@@ -58,6 +92,14 @@ resource roleAssignmentToFoundry 'Microsoft.Authorization/roleAssignments@2022-0
5892
}
5993
}
6094

61-
// Outputs
62-
output aiServicesPrincipalId string = aiServices.identity.principalId
63-
output aiProjectPrincipalId string = !empty(aiProjectName) ? aiProject.identity.principalId : ''
95+
// ========== Outputs ==========
96+
97+
output aiServicesPrincipalId string = enableSystemAssignedIdentity
98+
? aiServicesWithIdentity.identity.principalId
99+
: aiServices.identity.principalId
100+
101+
output aiProjectPrincipalId string = !empty(aiProjectName)
102+
? (enableSystemAssignedIdentity
103+
? aiProjectWithIdentity.identity.principalId
104+
: aiProject.identity.principalId)
105+
: ''

‎infra/deploy_index_scripts.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
@description('Specifies the location for resources.')
2+
param solutionLocation string
3+
4+
param baseUrl string
5+
param keyVaultName string
6+
param managedIdentityResourceId string
7+
param managedIdentityClientId string
8+
9+
resource create_index 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
10+
kind:'AzureCLI'
11+
name: 'create_search_indexes'
12+
location: solutionLocation
13+
identity: {
14+
type: 'UserAssigned'
15+
userAssignedIdentities: {
16+
'${managedIdentityResourceId}' : {}
17+
}
18+
}
19+
properties: {
20+
azCliVersion: '2.52.0'
21+
primaryScriptUri: '${baseUrl}infra/scripts/run_create_index_scripts.sh'
22+
arguments: '${baseUrl} ${keyVaultName} ${managedIdentityClientId}'
23+
timeout: 'PT1H'
24+
retentionInterval: 'PT1H'
25+
cleanupPreference:'OnSuccess'
26+
}
27+
}

0 commit comments

Comments
 (0)