-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Azdevify chat-with-your-data-solution-accelerator. #2
Changes from 11 commits
24be759
fbfd9b7
d32d977
552f254
c00f55a
b2e62b2
b1a97b7
625487e
65ac3c5
43b09e7
bd29d31
8587450
afd3ca8
654762e
cc3e957
9dc6a78
9bcb2a7
1a9212b
eb11eab
a403d25
b88ee5f
4bdf8c3
1ecb9be
75f230e
969aa25
ffee3f8
778e1d4
5892d5d
ce7d48d
2b683de
397ab11
1e21f2a
9481a66
b25cce5
332402a
bd092df
5406c5a
d2145ec
c83a409
aa86081
06bb879
1a7303a
2c8abfb
5dcf10c
779065f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
{ | ||
"name": "Chat with your data Solution Accelerator", | ||
"image": "mcr.microsoft.com/devcontainers/python:3.11", | ||
"features": { | ||
"ghcr.io/devcontainers/features/node:1": { | ||
"version": "16", | ||
"nodeGypDependencies": false | ||
}, | ||
"ghcr.io/devcontainers/features/powershell:1.1.1": {}, | ||
"ghcr.io/devcontainers/features/azure-cli:1.2.1": {}, | ||
"ghcr.io/azure/azure-dev/azd:latest": {} | ||
}, | ||
"customizations": { | ||
"vscode": { | ||
"extensions": [ | ||
"ms-azuretools.azure-dev", | ||
"ms-azuretools.vscode-bicep", | ||
"ms-python.python", | ||
"esbenp.prettier-vscode" | ||
] | ||
} | ||
}, | ||
"forwardPorts": [ | ||
50505 | ||
], | ||
"postCreateCommand": "", | ||
"remoteUser": "vscode", | ||
"hostRequirements": { | ||
"memory": "8gb" | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
# yaml-language-server: $schema=https://raw.githubusercontent.com/Azure/azure-dev/main/schemas/v1.0/azure.yaml.json | ||
|
||
name: chat-with-your-data-solution-accelerator | ||
|
||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
services: | ||
web: | ||
project: . | ||
language: py | ||
host: appservice | ||
hooks: | ||
prepackage: | ||
windows: | ||
shell: pwsh | ||
run: cd ./frontend;npm install;npm run build | ||
interactive: true | ||
continueOnError: false | ||
|
||
adminweb: | ||
project: ./backend | ||
language: py | ||
host: appservice | ||
|
||
function: | ||
project: ./backend | ||
language: py | ||
host: function |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
param name string | ||
param location string = resourceGroup().location | ||
param tags object = {} | ||
|
||
param allowedOrigins array = [] | ||
param appServicePlanId string | ||
param appCommandLine string = 'python -m streamlit run Admin.py --server.port 8000 --server.address 0.0.0.0 --server.enableXsrfProtection false' | ||
param applicationInsightsName string = '' | ||
param keyVaultName string = '' | ||
param azureOpenAIName string = '' | ||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
param azureCognitiveSearchName string = '' | ||
|
||
@secure() | ||
param appSettings object = {} | ||
param serviceName string = 'adminweb' | ||
|
||
module adminweb '../core/host/appservice.bicep' = { | ||
name: '${name}-app-module' | ||
params: { | ||
name: name | ||
location: location | ||
tags: union(tags, { 'azd-service-name': serviceName }) | ||
allowedOrigins: allowedOrigins | ||
appCommandLine: appCommandLine | ||
applicationInsightsName: applicationInsightsName | ||
appServicePlanId: appServicePlanId | ||
appSettings: union(appSettings, { | ||
AZURE_OPENAI_KEY: listKeys('Microsoft.CognitiveServices/accounts/${azureOpenAIName}', '2023-05-01').key1 | ||
AZURE_SEARCH_KEY: listAdminKeys('Microsoft.Search/searchServices/${azureCognitiveSearchName}', '2021-04-01-preview').primaryKey | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This only works if the openai and search are in the same resource group. You will have to pass the keys into this from main.bicep or better yet, put the keys in keyvault and then just store the names here to be retrieved by the application. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Hi, @jongio - We've tried a lot of things here on how to set 1.If we want to set
Based on the results of our investigation so far, if you have any questions or if you have other best practices on how to set keys to appSettings in main.bicep, please let us know. Thank you very much! 2.About put the
Do you have any ideas on this? Our current idea is to add the function of storing There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @jongio Any ideas about this issue? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We really shouldn't be using KEYS and instead use RBAC like we do in all the other samples. Example: You assign the right roles to the service principal of the azure resources that need to access those services and don't use KEYs in app settings at all.
Use this as example for how to use RBAC https://github.com/Azure-Samples/azure-search-openai-demo/blob/main/infra/main.bicep#L353 For 'keys'
It's like what you had before, but you also include the subscriptionId and RgName There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Currently we use There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I see what you mean. Could you come up with a version of the code that shows what it would look like to instantiate the objects based on rbac or keys? Just so I can see what the code would look like. Doesn't have to be for them all. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @jongio - Sorry for the delay. We have done some exploration and attempts on how to use Currently, a total of five We divide it into three categories:
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Oh, I didn't know they aren't using the search SDK. I'm asking them about that and will get back to you. |
||
}) | ||
keyVaultName: keyVaultName | ||
runtimeName: 'python' | ||
runtimeVersion: '3.11' | ||
scmDoBuildDuringDeployment: true | ||
} | ||
} | ||
|
||
output WEBSITE_ADMIN_IDENTITY_PRINCIPAL_ID string = adminweb.outputs.identityPrincipalId | ||
output WEBSITE_ADMIN_NAME string = adminweb.outputs.name | ||
output WEBSITE_ADMIN_URI string = adminweb.outputs.uri |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,61 @@ | ||
param name string | ||
param location string = '' | ||
param appServicePlanId string | ||
param storageAccountName string = '' | ||
param tags object = {} | ||
|
||
@secure() | ||
param appSettings object = {} | ||
param serviceName string = 'function' | ||
param runtimeName string = 'python' | ||
param runtimeVersion string = '3.11' | ||
|
||
@secure() | ||
param clientKey string | ||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
param azureOpenAIName string = '' | ||
param azureCognitiveSearchName string = '' | ||
|
||
|
||
module function '../core/host/functions.bicep' = { | ||
name: '${name}-app-module' | ||
params: { | ||
name: name | ||
location: location | ||
tags: union(tags, { 'azd-service-name': serviceName }) | ||
appServicePlanId: appServicePlanId | ||
storageAccountName: storageAccountName | ||
runtimeName: runtimeName | ||
runtimeVersion: runtimeVersion | ||
appSettings: union(appSettings, { | ||
AZURE_OPENAI_KEY: listKeys('Microsoft.CognitiveServices/accounts/${azureOpenAIName}', '2023-05-01').key1 | ||
AZURE_SEARCH_KEY: listAdminKeys('Microsoft.Search/searchServices/${azureCognitiveSearchName}', '2021-04-01-preview').primaryKey | ||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
}) | ||
} | ||
} | ||
|
||
resource functionNameDefaultClientKey 'Microsoft.Web/sites/host/functionKeys@2018-11-01' = { | ||
name: '${name}/default/clientKey' | ||
properties: { | ||
name: 'ClientKey' | ||
value: clientKey | ||
} | ||
dependsOn: [ | ||
function | ||
waitFunctionDeploymentSection | ||
] | ||
} | ||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
resource waitFunctionDeploymentSection 'Microsoft.Resources/deploymentScripts@2020-10-01' = { | ||
kind: 'AzurePowerShell' | ||
name: 'WaitFunctionDeploymentSection' | ||
location: location | ||
properties: { | ||
azPowerShellVersion: '3.0' | ||
scriptContent: 'start-sleep -Seconds 300' | ||
cleanupPreference: 'Always' | ||
retentionInterval: 'PT1H' | ||
} | ||
dependsOn: [ | ||
function | ||
] | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
param name string | ||
param location string = resourceGroup().location | ||
param tags object = {} | ||
|
||
param allowedOrigins array = [] | ||
param appCommandLine string = '' | ||
param appServicePlanId string | ||
param applicationInsightsName string = '' | ||
param keyVaultName string = '' | ||
param azureOpenAIName string = '' | ||
param azureCognitiveSearchName string = '' | ||
|
||
@secure() | ||
param appSettings object = {} | ||
param serviceName string = 'web' | ||
|
||
module web '../core/host/appservice.bicep' = { | ||
name: '${name}-app-module' | ||
params: { | ||
name: name | ||
location: location | ||
tags: union(tags, { 'azd-service-name': serviceName }) | ||
allowedOrigins: allowedOrigins | ||
appCommandLine: appCommandLine | ||
applicationInsightsName: applicationInsightsName | ||
appServicePlanId: appServicePlanId | ||
appSettings: union(appSettings, { | ||
AZURE_OPENAI_KEY: listKeys('Microsoft.CognitiveServices/accounts/${azureOpenAIName}', '2023-05-01').key1 | ||
AZURE_SEARCH_KEY: listAdminKeys('Microsoft.Search/searchServices/${azureCognitiveSearchName}', '2021-04-01-preview').primaryKey | ||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
}) | ||
|
||
keyVaultName: keyVaultName | ||
runtimeName: 'python' | ||
runtimeVersion: '3.11' | ||
scmDoBuildDuringDeployment: true | ||
} | ||
} | ||
|
||
output FRONTEND_API_IDENTITY_PRINCIPAL_ID string = web.outputs.identityPrincipalId | ||
output FRONTEND_API_NAME string = web.outputs.name | ||
output FRONTEND_API_URI string = web.outputs.uri |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,42 @@ | ||
metadata description = 'Creates an Azure Cognitive Services instance.' | ||
zedy-wj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
param name string | ||
param location string = resourceGroup().location | ||
param tags object = {} | ||
@description('The custom subdomain name used to access the API. Defaults to the value of the name parameter.') | ||
param customSubDomainName string = name | ||
param deployments array = [] | ||
param kind string = 'OpenAI' | ||
param publicNetworkAccess string = 'Enabled' | ||
param sku object = { | ||
name: 'S0' | ||
} | ||
|
||
resource account 'Microsoft.CognitiveServices/accounts@2023-05-01' = { | ||
name: name | ||
location: location | ||
tags: tags | ||
kind: kind | ||
properties: { | ||
customSubDomainName: customSubDomainName | ||
publicNetworkAccess: publicNetworkAccess | ||
} | ||
sku: sku | ||
} | ||
|
||
@batchSize(1) | ||
resource deployment 'Microsoft.CognitiveServices/accounts/deployments@2023-05-01' = [for deployment in deployments: { | ||
parent: account | ||
name: deployment.name | ||
properties: { | ||
model: deployment.model | ||
raiPolicyName: contains(deployment, 'raiPolicyName') ? deployment.raiPolicyName : null | ||
} | ||
sku: contains(deployment, 'sku') ? deployment.sku : { | ||
name: 'Standard' | ||
capacity: 20 | ||
} | ||
}] | ||
|
||
output endpoint string = account.properties.endpoint | ||
output id string = account.id | ||
output name string = account.name |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
metadata description = 'Updates app settings for an Azure App Service.' | ||
@description('The name of the app service resource within the current resource group scope') | ||
param name string | ||
|
||
@description('The app settings to be applied to the app service') | ||
@secure() | ||
param appSettings object | ||
|
||
resource appService 'Microsoft.Web/sites@2022-03-01' existing = { | ||
name: name | ||
} | ||
|
||
resource settings 'Microsoft.Web/sites/config@2022-03-01' = { | ||
name: 'appsettings' | ||
parent: appService | ||
properties: appSettings | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you investigate this flow:
The above adds more complexity, but allows the user to store the keys in KV as an option.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just linking this as we should revisit the Speech Service using this method too: - Azure-Samples#101 (not for this PR!)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use of
KeyVault
has been added and is currently testing well.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry for the back and forth on this. Let's do this:
Default to using rbac.
If AUTH_TYPE is rbac, then assume the developer wants to also use key vault. Put the keys in keyvault and then read them from keyvault.
If the user sets AUTH_TYPE to keys, then read the keys from the environment and set the keys using listKeys function.
I think that will be cleaner.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In our understanding, if
AUTH_TYPE
isrbac
, then someApp Services
andUser
should be assigned corresponding permissions in themain.bicep
file. This means that keys will no longer be needed in the code, but the service will be accessed directly through something likeDefaultAzureCredential()
.So regarding what you mention here,
If AUTH_TYPE is rbac, then assume the developer wants to also use key vault.
, which confuses us. Because in our concept, one of them is enough.If we have any misunderstandings about
rbac
or your comments, please let me know, thanks.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, only use a key vault if there's no RBAC option for the service.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's the logic in our code so far, please re-review it, thanks!
Default to using rbac: https://github.com/jongio/chat-with-your-data-solution-accelerator/pull/2/files#diff-c274a6091f4ca06948f0fe1ab8681ec4eb6b4e98c4be09717a2e3cacd1344727R9-R12
If AUTH_TYPE is rbac, the developer must choose not to use the KeyVault, if AUTH_TYPE is keys, the developer can choose to use the KeyVault or directly use
listKeys()
.