-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #132 from alan-turing-institute/pulumi
Add pulumi set up for api bot
- Loading branch information
Showing
9 changed files
with
224 additions
and
67 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| import pulumi | ||
| from pulumi_azure_native import containerinstance, network, resources, storage | ||
|
|
||
| # Get some configuration variables | ||
| stack_name = pulumi.get_stack() | ||
| config = pulumi.Config() | ||
|
|
||
|
|
||
| # Create an resource group | ||
| resource_group = resources.ResourceGroup( | ||
| "resource_group", resource_group_name=f"rg-reginald-{stack_name}-deployment" | ||
| ) | ||
|
|
||
| # Create a network security group | ||
| network_security_group = network.NetworkSecurityGroup( | ||
| "network_security_group", | ||
| network_security_group_name=f"nsg-reginald-{stack_name}-containers", | ||
| resource_group_name=resource_group.name, | ||
| ) | ||
|
|
||
| # Create a virtual network and subnet | ||
| virtual_network = network.VirtualNetwork( | ||
| "virtual_network", | ||
| address_space=network.AddressSpaceArgs( | ||
| address_prefixes=["10.0.0.0/29"], | ||
| ), | ||
| resource_group_name=resource_group.name, | ||
| # Define subnets inline to avoid creation/deletion issues | ||
| subnets=[ | ||
| # Container subnet | ||
| network.SubnetArgs( | ||
| address_prefix="10.0.0.0/29", | ||
| delegations=[ | ||
| network.DelegationArgs( | ||
| name="SubnetDelegationContainerGroups", | ||
| service_name="Microsoft.ContainerInstance/containerGroups", | ||
| type="Microsoft.Network/virtualNetworks/subnets/delegations", | ||
| ), | ||
| ], | ||
| name="ContainersSubnet", | ||
| network_security_group=network.NetworkSecurityGroupArgs( | ||
| id=network_security_group.id | ||
| ), | ||
| ), | ||
| ], | ||
| virtual_network_name=f"vnet-reginald-{stack_name}", | ||
| virtual_network_peerings=[], | ||
| ) | ||
|
|
||
| # Define the container group | ||
| container_group = containerinstance.ContainerGroup( | ||
| "container_group", | ||
| container_group_name=f"aci-reginald-{stack_name}", | ||
| containers=[ | ||
| containerinstance.ContainerArgs( | ||
| image="ghcr.io/alan-turing-institute/reginald_slackbot:main", | ||
| name="reginald-llama-cpp", # maximum of 63 characters | ||
| environment_variables=[ | ||
| containerinstance.EnvironmentVariableArgs( | ||
| name="REGINALD_MODEL", | ||
| value="llama-index-llama-cpp", | ||
| ), | ||
| containerinstance.EnvironmentVariableArgs( | ||
| name="SLACK_APP_TOKEN", | ||
| secure_value=config.get_secret("LLAMA_CPP_SLACK_APP_TOKEN"), | ||
| ), | ||
| containerinstance.EnvironmentVariableArgs( | ||
| name="SLACK_BOT_TOKEN", | ||
| secure_value=config.get_secret("LLAMA_CPP_SLACK_BOT_TOKEN"), | ||
| ), | ||
| containerinstance.EnvironmentVariableArgs( | ||
| name="REGINALD_API_URL", | ||
| secure_value=config.get_secret("REGINALD_API_URL"), | ||
| ), | ||
| ], | ||
| ports=[], | ||
| resources=containerinstance.ResourceRequirementsArgs( | ||
| requests=containerinstance.ResourceRequestsArgs( | ||
| cpu=1, | ||
| memory_in_gb=4, | ||
| ), | ||
| ), | ||
| ), | ||
| ], | ||
| os_type=containerinstance.OperatingSystemTypes.LINUX, | ||
| resource_group_name=resource_group.name, | ||
| restart_policy=containerinstance.ContainerGroupRestartPolicy.ALWAYS, | ||
| sku=containerinstance.ContainerGroupSku.STANDARD, | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| #! /usr/bin/env bash | ||
|
|
||
| # Arguments | ||
| SUBSCRIPTION_NAME=${1:-"Reg Hack Week 2023: Reginald"} | ||
| STACK_NAME=${2:-"llama-cpp-api"} | ||
|
|
||
| # Fixed values | ||
| CONTAINER_NAME="pulumi" | ||
| ENCRYPTION_KEY_NAME="pulumi-encryption-key" | ||
| KEYVAULT_NAME=$(echo "kv-reginald-${STACK_NAME}" | head -c 24) | ||
| LOCATION="uksouth" | ||
| RESOURCE_GROUP_NAME="rg-reginald-${STACK_NAME}-backend" | ||
|
|
||
| # Ensure that the user is logged in | ||
| if ! (az account show > /dev/null); then | ||
| az login | ||
| fi | ||
|
|
||
| # Switch subscription | ||
| echo "Creating Pulumi backend resources in '$SUBSCRIPTION_NAME'..." | ||
| az account set --subscription "$SUBSCRIPTION_NAME" --only-show-errors > /dev/null || exit 1 | ||
|
|
||
| # Set up a resource group | ||
| az group create --location "$LOCATION" --name "$RESOURCE_GROUP_NAME" --only-show-errors > /dev/null || exit 2 | ||
| echo "✅ Resource group '$RESOURCE_GROUP_NAME'" | ||
|
|
||
| # Create keyvault and encryption key | ||
| if ! (az keyvault show --name "$KEYVAULT_NAME" --resource-group "$RESOURCE_GROUP_NAME" --only-show-errors > /dev/null 2>&1); then | ||
| az keyvault create --location "$LOCATION" --name "$KEYVAULT_NAME" --resource-group "$RESOURCE_GROUP_NAME" --only-show-errors > /dev/null || exit 5 | ||
| fi | ||
| echo "✅ Keyvault '$KEYVAULT_NAME'" | ||
| if ! (az keyvault key show --name "$ENCRYPTION_KEY_NAME" --vault-name "$KEYVAULT_NAME" --only-show-errors > /dev/null 2>&1); then | ||
| az keyvault key create --name "$ENCRYPTION_KEY_NAME" --vault-name "$KEYVAULT_NAME" --only-show-errors > /dev/null || exit 6 | ||
| fi | ||
| echo "✅ Encryption key '$ENCRYPTION_KEY_NAME'" | ||
|
|
||
| # Check whether this user has access to the storage account | ||
| echo "Checking whether this user has appropriate permissions..." | ||
| USER_ID=$(az ad signed-in-user show --query "id" | xargs) | ||
| if [ "$(az role assignment list --include-inherited --assignee "$USER_ID" --role "Storage Blob Data Contributor")" ]; then | ||
| echo "✅ User has 'Storage Blob Data Contributor' permissions on this subscription" | ||
| else | ||
| echo "You will need 'Storage Blob Data Contributor' access to this subscription in order to continue" | ||
| return 0 | ||
| fi | ||
| az keyvault set-policy --name "$KEYVAULT_NAME" --object-id "$USER_ID" --secret-permissions "all" --key-permissions "all" --certificate-permissions "all" --only-show-errors > /dev/null || exit 7 | ||
| echo "✅ User has read permissions on '$KEYVAULT_NAME'" | ||
|
|
||
| # Select the correct stack | ||
| if ! (pulumi stack select "$STACK_NAME" > /dev/null); then | ||
| echo "Creating new Pulumi stack..." | ||
| pulumi stack init "$STACK_NAME" --secrets-provider "azurekeyvault://$KEYVAULT_NAME.vault.azure.net/keys/$ENCRYPTION_KEY_NAME" | ||
| fi | ||
| echo "✅ Switched to Pulumi stack '$STACK_NAME'" | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi stack change-secrets-provider "azurekeyvault://$KEYVAULT_NAME.vault.azure.net/keys/$ENCRYPTION_KEY_NAME" | ||
| echo "✅ Using Azure KeyVault '$KEYVAULT_NAME' for encryption" | ||
|
|
||
| # Configure the azure-native plugin | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi config set azure-native:tenantId "$(az account list --all --query "[?isDefault].tenantId | [0]" --output tsv)" | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi config set azure-native:subscriptionId "$(az account list --all --query "[?isDefault].id | [0]" --output tsv)" | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi config set azure-native:location "$LOCATION" | ||
| echo "✅ Configured azure-native defaults" | ||
|
|
||
| # Set app secrets | ||
| LLAMA_CPP_SLACK_APP_TOKEN="" | ||
| LLAMA_CPP_SLACK_BOT_TOKEN="" | ||
| if [ -e ../.pulumi_env ]; then | ||
| LLAMA_CPP_SLACK_APP_TOKEN=$(grep "LLAMA_CPP_SLACK_APP_TOKEN" ../.pulumi_env | grep -v "^#" | cut -d '"' -f 2) | ||
| LLAMA_CPP_SLACK_BOT_TOKEN=$(grep "LLAMA_CPP_SLACK_BOT_TOKEN" ../.pulumi_env | grep -v "^#" | cut -d '"' -f 2) | ||
| fi | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi config set --secret LLAMA_CPP_SLACK_APP_TOKEN "$LLAMA_CPP_SLACK_APP_TOKEN" | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi config set --secret LLAMA_CPP_SLACK_BOT_TOKEN "$LLAMA_CPP_SLACK_BOT_TOKEN" | ||
|
|
||
| # Set API url | ||
| REGINALD_API_URL="" | ||
| if [ -e ../.pulumi_env ]; then | ||
| REGINALD_API_URL=$(grep "REGINALD_API_URL" ../.pulumi_env | grep -v "^#" | cut -d '"' -f 2) | ||
| fi | ||
| AZURE_KEYVAULT_AUTH_VIA_CLI=true pulumi config set REGINALD_API_URL "$REGINALD_API_URL" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| name: reginald | ||
| runtime: | ||
| name: python | ||
| description: Slack bot to respond to REG queries |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters