Skip to content

Commit 942b2c6

Browse files
jgbradley1jgbradley1
authored
Move cosmosdb database creation to bicep deployment and fix AI Search private endpoint (#255)
1 parent bd11643 commit 942b2c6

22 files changed

+350
-153
lines changed

Diff for: ‎backend/graphrag_app/main.py

+9-7
Original file line numberDiff line numberDiff line change
@@ -46,22 +46,24 @@ async def catch_all_exceptions_middleware(request: Request, call_next):
4646
return Response("Unexpected internal server error.", status_code=500)
4747

4848

49+
# NOTE: this function is not currently used, but it is a placeholder for future use once RBAC issues have been resolved
4950
def intialize_cosmosdb_setup():
50-
"""Initialise CosmosDB (if necessary) by setting up a database and containers that are expected at startup time."""
51+
"""Initialise database setup (if necessary) and configure CosmosDB containers that are expected at startup time if they do not exist."""
5152
azure_client_manager = AzureClientManager()
5253
client = azure_client_manager.get_cosmos_client()
53-
db_client = client.create_database_if_not_exists("graphrag")
54-
# create containers with default settings
5554
throughput = ThroughputProperties(
5655
auto_scale_max_throughput=1000, auto_scale_increment_percent=1
5756
)
57+
db_client = client.create_database_if_not_exists(
58+
"graphrag", offer_throughput=throughput
59+
)
60+
# create containers with default settings
5861
db_client.create_container_if_not_exists(
59-
id="jobs", partition_key=PartitionKey(path="/id"), offer_throughput=throughput
62+
id="jobs", partition_key=PartitionKey(path="/id")
6063
)
6164
db_client.create_container_if_not_exists(
6265
id="container-store",
6366
partition_key=PartitionKey(path="/id"),
64-
offer_throughput=throughput,
6567
)
6668

6769

@@ -78,8 +80,8 @@ async def lifespan(app: FastAPI):
7880
yield
7981
return
8082

81-
# Initialize CosmosDB setup
82-
intialize_cosmosdb_setup()
83+
# TODO: must identify proper CosmosDB RBAC roles before databases and containers can be created by this web app
84+
# intialize_cosmosdb_setup()
8385

8486
try:
8587
# Check if the cronjob exists and create it if it does not exist

Diff for: ‎infra/abbreviations.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
"networkNetworkSecurityGroupsSecurityRules": "nsgsr-",
8585
"networkNetworkWatchers": "nw-",
8686
"networkPrivateDnsZones": "pdnsz-",
87+
"networkPrivateLinkScope": "pls-",
8788
"networkPrivateLinkServices": "pl-",
8889
"networkPublicIPAddresses": "pip-",
8990
"networkPublicIPPrefixes": "ippre-",
@@ -134,4 +135,4 @@
134135
"webSitesAppServiceEnvironment": "ase-",
135136
"webSitesFunctions": "func-",
136137
"webStaticSites": "stapp-"
137-
}
138+
}

Diff for: ‎infra/core/ai-search/ai-search.bicep

+7-3
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ param location string = resourceGroup().location
1010
@allowed(['enabled', 'disabled'])
1111
param publicNetworkAccess string = 'enabled'
1212

13-
resource aiSearch 'Microsoft.Search/searchServices@2024-03-01-preview' = {
13+
resource search 'Microsoft.Search/searchServices@2024-06-01-preview' = {
1414
name: name
1515
location: location
1616
sku: {
@@ -21,9 +21,13 @@ resource aiSearch 'Microsoft.Search/searchServices@2024-03-01-preview' = {
2121
replicaCount: 1
2222
partitionCount: 1
2323
publicNetworkAccess: publicNetworkAccess
24+
networkRuleSet: {
25+
ipRules: []
26+
bypass: 'AzureServices'
27+
}
2428
semanticSearch: 'disabled'
2529
}
2630
}
2731

28-
output name string = aiSearch.name
29-
output id string = aiSearch.id
32+
output name string = search.name
33+
output id string = search.id

Diff for: ‎infra/core/aks/aks.bicep

+2-4
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ param subnetId string
5050

5151
param privateDnsZoneName string
5252

53-
@description('Array of object ids that will have admin role of the cluster')
53+
@description('Array of object ids of admins that will have admin control over the cluster')
5454
param clusterAdmins array = []
5555

5656
resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = {
@@ -187,11 +187,10 @@ resource aksManagedAutoUpgradeSchedule 'Microsoft.ContainerService/managedCluste
187187
schedule: {
188188
weekly: {
189189
intervalWeeks: 1
190-
dayOfWeek: 'Monday'
190+
dayOfWeek: 'Sunday'
191191
}
192192
}
193193
durationHours: 4
194-
startDate: '2024-06-11'
195194
startTime: '12:00'
196195
}
197196
}
@@ -209,7 +208,6 @@ resource aksManagedNodeOSUpgradeSchedule 'Microsoft.ContainerService/managedClus
209208
}
210209
}
211210
durationHours: 4
212-
startDate: '2024-06-11'
213211
startTime: '12:00'
214212
}
215213
}

Diff for: ‎infra/core/apim/apim.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Licensed under the MIT License.
33

44
@description('The name of the API Management service instance')
5-
param apiManagementName string = 'apiservice${uniqueString(resourceGroup().id)}'
5+
param apiManagementName string
66

77
@description('The email address of the owner of the service')
88
@minLength(1)

Diff for: ‎infra/core/cosmosdb/cosmosdb.bicep

+97-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ param location string = resourceGroup().location
1010
@allowed(['Enabled', 'Disabled'])
1111
param publicNetworkAccess string = 'Disabled'
1212

13+
var maxThroughput = 1000
14+
1315
resource cosmosDb 'Microsoft.DocumentDB/databaseAccounts@2024-11-15' = {
1416
name: cosmosDbName
1517
location: location
@@ -64,7 +66,101 @@ resource cosmosDb 'Microsoft.DocumentDB/databaseAccounts@2024-11-15' = {
6466
}
6567
networkAclBypassResourceIds: []
6668
capacity: {
67-
totalThroughputLimit: 4000
69+
totalThroughputLimit: maxThroughput
70+
}
71+
}
72+
}
73+
74+
// create a single database that is used to maintain state information for graphrag indexing
75+
// NOTE: The current CosmosDB role assignments are not sufficient to allow the aks workload identity to create databases and containers so we must do it in bicep at deployment time.
76+
// TODO: Identify and assign appropriate RBAC roles that allow the workload identity to create new databases and containers instead of relying on this bicep implementation.
77+
resource graphragDatabase 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2024-11-15' = {
78+
parent: cosmosDb
79+
name: 'graphrag'
80+
properties: {
81+
options: {
82+
autoscaleSettings: {
83+
maxThroughput: maxThroughput
84+
}
85+
}
86+
resource: {
87+
id: 'graphrag'
88+
}
89+
}
90+
}
91+
92+
resource jobsContainer 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-11-15' = {
93+
parent: graphragDatabase
94+
name: 'jobs'
95+
properties: {
96+
resource: {
97+
id: 'jobs'
98+
indexingPolicy: {
99+
indexingMode: 'consistent'
100+
automatic: true
101+
includedPaths: [
102+
{
103+
path: '/*'
104+
}
105+
]
106+
excludedPaths: [
107+
{
108+
path: '/"_etag"/?'
109+
}
110+
]
111+
}
112+
partitionKey: {
113+
paths: [
114+
'/id'
115+
]
116+
kind: 'Hash'
117+
version: 2
118+
}
119+
uniqueKeyPolicy: {
120+
uniqueKeys: []
121+
}
122+
conflictResolutionPolicy: {
123+
mode: 'LastWriterWins'
124+
conflictResolutionPath: '/_ts'
125+
}
126+
}
127+
}
128+
}
129+
130+
resource containerStoreContainer 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-11-15' = {
131+
parent: graphragDatabase
132+
name: 'container-store'
133+
properties: {
134+
resource: {
135+
id: 'container-store'
136+
indexingPolicy: {
137+
indexingMode: 'consistent'
138+
automatic: true
139+
includedPaths: [
140+
{
141+
path: '/*'
142+
}
143+
]
144+
excludedPaths: [
145+
{
146+
path: '/"_etag"/?'
147+
}
148+
]
149+
}
150+
partitionKey: {
151+
paths: [
152+
'/id'
153+
]
154+
kind: 'Hash'
155+
version: 2
156+
}
157+
uniqueKeyPolicy: {
158+
uniqueKeys: []
159+
}
160+
conflictResolutionPolicy: {
161+
mode: 'LastWriterWins'
162+
conflictResolutionPath: '/_ts'
163+
}
68164
}
69165
}
70166
}

Diff for: ‎infra/core/identity/identity.bicep

+1
Original file line numberDiff line numberDiff line change
@@ -24,5 +24,6 @@ resource federatedCredentialResources 'Microsoft.ManagedIdentity/userAssignedIde
2424
]
2525

2626
output name string = identity.name
27+
output id string = identity.id
2728
output clientId string = identity.properties.clientId
2829
output principalId string = identity.properties.principalId

Diff for: ‎infra/core/monitor/app-insights.bicep

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
2525
}
2626
}
2727

28+
output name string = appInsights.name
2829
output id string = appInsights.id
2930
output connectionString string = appInsights.properties.ConnectionString
3031
output instrumentationKey string = appInsights.properties.InstrumentationKey

Diff for: ‎infra/core/monitor/private-link-scope.bicep

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ param privateLinkScopedResources array = []
66
param queryAccessMode string = 'Open'
77
param ingestionAccessMode string = 'PrivateOnly'
88

9-
resource privateLinkScope 'microsoft.insights/privateLinkScopes@2021-07-01-preview' = {
9+
resource privateLinkScope 'microsoft.Insights/privateLinkScopes@2021-07-01-preview' = {
1010
name: privateLinkScopeName
1111
location: 'global'
1212
properties: {
@@ -17,7 +17,7 @@ resource privateLinkScope 'microsoft.insights/privateLinkScopes@2021-07-01-previ
1717
}
1818
}
1919

20-
resource scopedResources 'microsoft.insights/privateLinkScopes/scopedResources@2021-07-01-preview' = [
20+
resource scopedResources 'Microsoft.Insights/privateLinkScopes/scopedResources@2021-07-01-preview' = [
2121
for id in privateLinkScopedResources: {
2222
name: uniqueString(id)
2323
parent: privateLinkScope

0 commit comments

Comments
 (0)