Luna.ai

end-to-end-solutions/Luna/Resources/Deployment/CheckPermissions.ps1

@@ -0,0 +1,38 @@
+## Copyright (c) Microsoft Corporation.
+## Licensed under the MIT license.
+
+param (
+    [Parameter(Mandatory=$true)]
+    [string]$tenantId = "default", 
+
+    [Parameter(Mandatory=$true)]
+    [string]$subscriptionId = "default",
+
+    [Parameter(Mandatory=$true)]
+    [string]$userId = "default", 
+
+    [Parameter(Mandatory=$true)]
+    [string]$location = "default"
+)
+
+$rpList = @('Microsoft.Network','Microsoft.Compute','Microsoft.ContainerInstance','Microsoft.ContainerService','Microsoft.Insights','Microsoft.Sql','Microsoft.MachineLearningServices','Microsoft.Storage','Microsoft.ApiManagement','Microsoft.KeyVault','Microsoft.Web','Microsoft.OperationalInsights')
+
+Connect-AzAccount -Tenant $tenantId
+
+Set-AzContext -Subscription $subscriptionId
+
+Write-Host "Enabling required Resource Providers and check the region availability"
+
+$rpList | ForEach-Object -Process {
+            $rp = Register-AzResourceProvider -ProviderNamespace $_;
+            If (-not $rp.Locations.Contains($location)){Write-Error "Resource Provider" $_ "is not enabled in region " $location}}
+
+Write-Host "Check if you are owner or contributor of the Azure subscription"
+
+$scope = "/subscriptions/"+$subscriptionId
+$assignment = Get-AzRoleAssignment -Scope $scope | Where-Object {$_.Scope -eq $scope -and $_.SignInName -eq $userId -and ($_.RoleDefinitionName -eq "Owner" -or $_.RoleDefinitionName -eq "Contributor")}
+
+If ($assignment.Length -le 0){
+    Write-Error "You are neither owner nor contributor of Azure subscription " $subscriptionId
+}
+

end-to-end-solutions/Luna/Resources/Deployment/Deploy.ps1

@@ -1,3 +1,6 @@
+## Copyright (c) Microsoft Corporation.
+## Licensed under the MIT license.
+
 param (
     [Parameter(Mandatory=$true)]
     [string]$uniqueName = "default", 
@@ -35,6 +38,16 @@
 
     [string]$apiWebAppInsightsName = "default",
 
+    [string]$apimName = "default",
+
+    [string]$apimTier = "Developer",
+
+    [string]$apimCapacity = 1,
+
+    [string]$amlWorkspaceName = "default",
+
+    [string]$amlWorkspaceSku = "Basic",
+
     [string]$azureMarketplaceAADApplicationName = "default",
 
     [string]$azureMarketplaceAADApplicationId = "00000000-0000-0000-0000-000000000000",
@@ -130,7 +143,7 @@ function Create-AzureADApplication{
 function GrantKeyVaultAccessToWebApp{
     param($resourceGroupName, $keyVaultName, $webAppName)
     $webapp = Get-AzWebApp -ResourceGroupName $resourceGroupname -Name $webAppName
-    Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ObjectId $webapp.Identity.PrincipalId -PermissionsToSecrets list,get
+    Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ObjectId $webapp.Identity.PrincipalId -PermissionsToSecrets list,get,set,delete
 }
 
 function Get-PublishingProfileCredentials($resourceGroupName, $webAppName){
@@ -240,6 +253,8 @@ $enduserWebAppName = GetNameForAzureResources -defaultName $enduserWebAppName -r
 $apiWebAppName = GetNameForAzureResources -defaultName $apiWebAppName -resourceTypeSuffix "-apiapp" -uniqueName $uniqueName
 $apiWebJobName = GetNameForAzureResources -defaultName $apiWebJobName -resourceTypeSuffix "-apiwebjob" -uniqueName $uniqueName
 $apiWebAppInsightsName = GetNameForAzureResources -defaultName $apiWebAppInsightsName -resourceTypeSuffix "-apiappinsights" -uniqueName $uniqueName
+$apimName = GetNameForAzureResources -defaultName $apimName -resourceTypeSuffix "-apim" -uniqueName $uniqueName
+$amlWorkspaceName = GetNameForAzureResources -defaultName $amlWorkspaceName -resourceTypeSuffix "-aml" -uniqueName $uniqueName
 
 $azureMarketplaceAADApplicationName = GetNameForAzureResources -defaultName $azureMarketplaceAADApplicationName -resourceTypeSuffix "-azuremarketplace-aad" -uniqueName $uniqueName
 $azureResourceManagerAADApplicationName = GetNameForAzureResources -defaultName $azureResourceManagerAADApplicationName -resourceTypeSuffix "-azureresourcemanager-aad" -uniqueName $uniqueName
@@ -271,7 +286,7 @@ if ($userApplicationSubscriptionId -eq "default"){
     $userApplicationSubscriptionId = $currentContext.Subscription.Id
 }
 
-$currentUser = Get-AzADUser -Mail $accountId
+$currentUser = Get-AzADUser -UserPrincipalName $accountId
 
 
 if ($adminAccounts -eq "default"){
@@ -284,6 +299,8 @@ Write-Host "Create resource group" $resourceGroupName
 New-AzResourceGroup -Name $resourceGroupName -Location $location
 
 Write-Host "Deploy ARM template in resource group" $resourceGroupName
+$deployAPIM = $enableV2 -eq 'true'
+$deployAML = $enableV2 -eq 'true'
 New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName `
                               -TemplateFile .\main.json `
                               -keyVaultName $keyVaultName `
@@ -300,7 +317,16 @@ New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName `
                               -sqlAdministratorUsername $sqlServerAdminUsername `
                               -tenantId $tenantId `
                               -objectId $objectId `
-                              -buildLocation $buildLocation
+                              -buildLocation $buildLocation `
+                              -apimAdminEmail $accountId `
+                              -orgName $companyName `
+                              -apimName $apimName `
+                              -apimTier $apimTier `
+                              -apimCapacity $apimCapacity `
+                              -deployAPIM $deployAPIM `
+                              -workspaceName $amlWorkspaceName `
+                              -workspaceSku $amlWorkspaceSku `
+                              -deployAML $deployAML
 
 
 $filter = "AppId eq '"+$webAppAADApplicationId+"'"
@@ -375,6 +401,10 @@ if ($isNewApp){
     Write-Host "Assign subscription contribution role to the service principal."
     $scope = '/subscriptions/'+$userApplicationSubscriptionId
     NewAzureRoleAssignment -objectId $principalId -scope $scope -retryCount 10
+
+    Write-Host "Assign contribution role on the AML workspace to the service principal."
+    $scope = '/subscriptions/'+$userApplicationSubscriptionId+'/resourceGroups/'+$resourceGroupName+'/providers/Microsoft.MachineLearningServices/workspaces/'+$amlWorkspaceName
+    NewAzureRoleAssignment -objectId $principalId -scope $scope -retryCount 10
 }
 
 #grant key vault access to API app
@@ -421,6 +451,25 @@ $connectionString = "Server=tcp:" + $sqlServerInstanceName + ",1433;Initial Cata
 $secretvalue = ConvertTo-SecureString $connectionString -AsPlainText -Force
 Set-AzKeyVaultSecret -VaultName $keyVaultName -Name 'connection-string' -SecretValue $secretvalue
 
+$apimTenantAccessId = 'integration'
+$controllerBaseUrl = ''
+
+if ($enableV2 -eq 'true'){
+    Write-Host "Get APIM management key"
+    $apimContext = New-AzApiManagementContext -ResourceGroupName $resourceGroupName -ServiceName $apimName
+    Set-AzApiManagementTenantAccess -Context $apimContext -Enabled $True
+
+    $tenantAccess = Get-AzApiManagementTenantAccess -Context $apimContext
+    $tenantAccessSecret = Get-AzApiManagementTenantAccessSecret -Context $apimContext
+    $apimPrimaryKey = $tenantAccessSecret.PrimaryKey
+    $secretvalue = ConvertTo-SecureString $apimPrimaryKey -AsPlainText -Force
+    Set-AzKeyVaultSecret -VaultName $keyVaultName -Name 'apim-key' -SecretValue $secretvalue
+
+    $apimTenantAccessId = $tenantAccess.Id
+    $controllerBaseUrl = "https://"+ $apiWebAppName +".azurewebsites.net"
+}
+
+
 Write-Host "Update app settings"
 $appsettings = @{}
 $appsettings["SecuredCredentials:VaultName"] = $keyVaultName;
@@ -438,6 +487,15 @@ $appsettings["AzureAD:TenantId"] = $tenantId;
 $appsettings["ISVPortal:AdminAccounts"] = $adminAccounts;
 $appsettings["ISVPortal:AdminTenant"] = $adminTenantId;
 
+$appsettings["SecuredCredentials:APIM:Config:VaultName"] = $keyVaultName;
+$appsettings["SecuredCredentials:APIM:Config:SubscriptionId"] = $lunaServiceSubscriptionId;
+$appsettings["SecuredCredentials:APIM:Config:ResourceGroupName"] = $resourceGroupName;
+$appsettings["SecuredCredentials:APIM:Config:APIMServiceName"] = $apimName;
+$appsettings["SecuredCredentials:APIM:Config:APIVersion"] = '2019-12-01';
+$appsettings["SecuredCredentials:APIM:Config:UId"] = $apimTenantAccessId;
+$appsettings["SecuredCredentials:APIM:Config:Key"] = 'apim-key';
+$appsettings["SecuredCredentials:APIM:Config:ControllerBaseUrl"] = $controllerBaseUrl;
+
 $appInsightsApp = Get-AzApplicationInsights -ResourceGroupName $resourceGroupName -name $apiWebAppInsightsName
 $appsettings["ApplicationInsights:InstrumentationKey"] = $appInsightsApp.InstrumentationKey;
 $appsettings["WebJob:APIServiceUrl"] = "https://" + $apiWebAppName + ".azurewebsites.net/api";

end-to-end-solutions/Luna/Resources/Deployment/SqlScripts/latest/db_provisioning.sql

@@ -1,3 +1,6 @@
+-- Copyright (c) Microsoft Corporation.
+-- Licensed under the MIT license.
+
 SET ANSI_NULLS ON
 GO
 
@@ -47,9 +50,9 @@ DROP TABLE [dbo].[AadSecretTmps]
 END
 GO
 
-IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'SubscriptionCustomMeterUsage' AND sch.name = 'dbo')
+IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'SubscriptionCustomMeterUsages' AND sch.name = 'dbo')
 BEGIN
-DROP TABLE [dbo].[SubscriptionCustomMeterUsage]
+DROP TABLE [dbo].[SubscriptionCustomMeterUsages]
 END
 GO
 
@@ -149,6 +152,36 @@ DROP TABLE [dbo].[Offers]
 END
 GO
 
+IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'APISubscriptions' AND sch.name = 'dbo')
+BEGIN
+DROP TABLE [dbo].[APISubscriptions]
+END
+GO
+
+IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'APIVersions' AND sch.name = 'dbo')
+BEGIN
+DROP TABLE [dbo].[APIVersions]
+END
+GO
+
+
+IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'Deployments' AND sch.name = 'dbo')
+BEGIN
+DROP TABLE [dbo].[Deployments]
+END
+GO
+
+IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'Products' AND sch.name = 'dbo')
+BEGIN
+DROP TABLE [dbo].[Products]
+END
+GO
+
+IF EXISTS (select * from sys.tables tb join sys.schemas sch on tb.schema_id = sch.schema_id where tb.name = 'AMLWorkspaces' AND sch.name = 'dbo')
+BEGIN
+DROP TABLE [dbo].[AMLWorkspaces]
+END
+GO
 
 CREATE TABLE [dbo].[Offers](
 	[Id] [bigint] IDENTITY(1,1) NOT NULL,
@@ -458,8 +491,106 @@ CREATE TABLE [dbo].[WebhookWebhookParameters](
 	CONSTRAINT FK_WebhookParameterId_WebhookWebhookParameters FOREIGN KEY (WebhookParameterId) REFERENCES WebhookParameters(Id)
 )
 
+CREATE TABLE [dbo].[AMLWorkspaces](
+	[Id] [bigint] IDENTITY(1,1) NOT NULL,
+	[WorkspaceName] [nvarchar](50) NOT NULL,
+	[Region] [nvarchar](64) NOT NULL,
+	[ResourceId] [nvarchar](max) NOT NULL,
+	[AADApplicationId] [uniqueidentifier] NOT NULL,
+	[AADTenantId] [uniqueidentifier] NULL, -- allow null for backward compatibility
+	[AADApplicationSecrets] [nvarchar](128) NOT NULL,
+	PRIMARY KEY (Id)
+) ON [PRIMARY]
+GO
+
+CREATE TABLE [dbo].[Products](
+	[Id] [bigint] IDENTITY(1,1) NOT NULL,
+	[ProductName] [nvarchar](50) NOT NULL,
+	[ProductType] [nvarchar](64) NOT NULL,
+	[HostType] [nvarchar](64) NOT NULL,
+	[Owner] [nvarchar](512) NOT NULL,
+	[CreatedTime] [datetime2](7) NOT NULL,
+	[LastUpdatedTime] [datetime2](7) NOT NULL,
+	PRIMARY KEY (Id)
+) ON [PRIMARY]
+GO
+
+CREATE TABLE [dbo].[Deployments](
+	[Id] [bigint] IDENTITY(1,1) NOT NULL,
+	[ProductId] [bigint] NOT NULL,
+	[DeploymentName] [nvarchar](50) NOT NULL,
+	[Description] [nvarchar](1024) NOT NULL,
+	[CreatedTime] [datetime2](7) NOT NULL,
+	[LastUpdatedTime] [datetime2](7) NOT NULL,
+	PRIMARY KEY (Id),
+	CONSTRAINT FK_productId_Deployments FOREIGN KEY (ProductId) REFERENCES Products(Id)
+) ON [PRIMARY]
+GO
 
+CREATE TABLE [dbo].[APIVersions](
+	[Id] [bigint] IDENTITY(1,1) NOT NULL,
+	[DeploymentId] [bigint] NOT NULL,
+	[VersionName] [nvarchar](50) NOT NULL,
+	[RealTimePredictAPI] [nvarchar](max) NULL,
+	[TrainModelAPI] [nvarchar](max) NULL,
+	[BatchInferenceAPI] [nvarchar](max) NULL,
+	[DeployModelAPI] [nvarchar](max) NULL,
+	[AuthenticationType] [nvarchar](8) NOT NULL,
+	[AuthenticationKey] [nvarchar](64) NULL,
+	[AMLWorkspaceId] [bigint] NULL,
+	[AdvancedSettings] [nvarchar](max) NULL,
+	[CreatedTime] [datetime2](7) NOT NULL,
+	[LastUpdatedTime] [datetime2](7) NOT NULL,
+	PRIMARY KEY (Id),
+	CONSTRAINT FK_deploymentId_APIVersions FOREIGN KEY (DeploymentId) REFERENCES Deployments(Id),
+	-- CONSTRAINT FK_amlworkspaceId_APIVersions FOREIGN KEY (AMLWorkspaceId) REFERENCES AMLWorkspaces(Id)
+) ON [PRIMARY]
+GO
 
+CREATE TABLE [dbo].[APISubscriptions](
+	[SubscriptionId] [uniqueidentifier] NOT NULL,
+	[DeploymentId] [bigint] NOT NULL,
+	[SubscriptionName] [nvarchar](64) NOT NULL,
+	[userId] [nvarchar](512) NOT NULL,
+	[Status] [nvarchar](32) NULL,
+	[BaseUrl] [nvarchar](max) NULL,
+	[PrimaryKey] [nvarchar](64) NULL,
+	[SecondaryKey] [nvarchar](64) NULL,
+	[CreatedTime] [datetime2](7) NOT NULL,
+	[LastUpdatedTime] [datetime2](7) NOT NULL,
+	PRIMARY KEY (SubscriptionId),
+	CONSTRAINT FK_deploymentId_APISubscriptions FOREIGN KEY (DeploymentId) REFERENCES Deployments(Id)
+) ON [PRIMARY]
+GO
 
+CREATE TABLE [dbo].[APISubscriptions_tmp](
+    [Id] [bigint] identity(1,1) NOT NULL,
+	[SubscriptionId] [uniqueidentifier] NOT NULL,
+	[DeploymentId] [bigint] NOT NULL,
+	[SubscriptionName] [nvarchar](64) NOT NULL,
+	[userId] [nvarchar](512) NOT NULL,
+	[Status] [nvarchar](32) NULL,
+	[BaseUrl] [nvarchar](max) NULL,
+	[PrimaryKey] [nvarchar](64) NULL,
+	[SecondaryKey] [nvarchar](64) NULL,
+	[CreatedTime] [datetime2](7) NOT NULL,
+	[LastUpdatedTime] [datetime2](7) NOT NULL,
+	PRIMARY KEY CLUSTERED([SubscriptionId] ASC)WITH (STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF) ON [PRIMARY]
+) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
+GO
 
+insert into APISubscriptions_tmp select * from APISubscriptions
+GO
+
+drop table apisubscriptions
+GO
+
+EXEC sp_rename 'apisubscriptions_tmp', 'APISubscriptions'
+GO
+
+ALTER TABLE [dbo].[APISubscriptions]  WITH CHECK ADD  CONSTRAINT [FK_deploymentId_APISubscriptions] FOREIGN KEY([DeploymentId])
+REFERENCES [dbo].[Deployments] ([Id])
+GO
 
+ALTER TABLE [dbo].[APISubscriptions] CHECK CONSTRAINT [FK_deploymentId_APISubscriptions]
+GO

end-to-end-solutions/Luna/Resources/Deployment/SqlScripts/v1.0/db_provisioning.sql

@@ -1,3 +1,6 @@
+-- Copyright (c) Microsoft Corporation.
+-- Licensed under the MIT license.
+
 SET ANSI_NULLS ON
 GO
 

end-to-end-solutions/Luna/Resources/Deployment/SqlScripts/v1.1/db_provisioning.sql

@@ -1,3 +1,6 @@
+-- Copyright (c) Microsoft Corporation.
+-- Licensed under the MIT license.
+
 SET ANSI_NULLS ON
 GO