Skip to content

Commit 7baf2c3

Browse files
miro-novakmiro-novak
committed
adding ml-application examples
1 parent f9dbb3c commit 7baf2c3

File tree

105 files changed

+7813
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

105 files changed

+7813
-0
lines changed

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ Distributed training support with Jobs for machine learning for faster and more
4242

4343
Pipelines are essential for complex machine learning and data science tasks as they streamline and automate the model building and deployment process, enabling faster and more consistent results. They could be used when there is a need to build, train, and deploy complex models with multiple components and steps, and when there is a need to automate the machine learning process to reduce manual labor and errors. The Oracle Cloud Infrastructure [Data Science Pipelines](https://docs.oracle.com/en-us/iaas/data-science/using/pipelines-about.htm) services helps automates and streamlines the process of building and deploying machine learning pipelines.
4444

45+
### [ML Applications](ml-applications/)
46+
47+
[ML Applications](https://docs.oracle.com/en-us/iaas/data-science/using/ml-apps-about.htm) is a self-contained representation of ML use cases in Data Science. It delivers a robust MLOps platform for AI/ML delivery. It standardizes the packaging and deployment of AI/ML functionality, enabling you to build, deploy, and operate machine learning as a service. With ML Applications, you can leverage Data Science to implement AI/ML use cases and provision them into production for your applications or customers. By shortening the development lifecycle from months to weeks, ML Applications quickens the time to market while reducing operational complexity and total cost of ownership. It provides an end-to-end platform for deploying, validating, and promoting ML solutions through every stage - from development and QA to preproduction and production.
48+
4549
### [Data Labeling Examples](data_labeling_examples/)
4650

4751
The [data labeling service](https://docs.oracle.com/en-us/iaas/data-labeling/data-labeling/using/home.htm) helps identify properties (labels) of documents, text, and images (records) and annotates (labels) them with those properties. This section contains Python and Java scripts to annotate bulk numbers of records in OCI Data Labeling Service (DLS).

‎ml-applications/sample-project-policies/.gitignore

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.venv
2+
**/.venv
3+
.env
4+
**/.env
5+
ml-application/target/**
6+
.idea/**
7+
**/.terraform*
8+
**/.terraform/**
9+
**/terraform.tfstate.backup

‎ml-applications/sample-project-policies/README.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
Environments Creation
2+
======================
3+
4+
For creation/update of ML Application environment use standard Terraform commands.
5+
6+
| WARNING: For production usage, it is highly recommended to configure remote state files |
7+
|:--------------------------------------------------------------------------------|
8+
9+
10+
Go to environment specific directory (e.g. {project_root}/infrastructure/environments/dev) and use following commands:
11+
12+
To initialize terraform (just for the first time):
13+
```bash
14+
terraform init
15+
```
16+
To create/update infrastructure:
17+
```bash
18+
terraform apply -var-file input_variables.tfvars
19+
```
20+
To remove infrastructure:
21+
```bash
22+
terraform destroy -var-file input_variables.tfvars
23+
```
24+
25+
FAQ
26+
__________________________
27+
- **Can policies for ML Applications be created in non-root compartment?**
28+
- No, they cannot because policies contain some statements which must be in root compartment ("Endorse" statements and statements with "in tenancy" scope).
29+
- Note: These statements could be separated into another policy which would be in root and rest of the policies could be created in non-root compartment.

‎ml-applications/sample-project-policies/environments/README.md

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Deployment Environments
2+
==========================
3+
Each directory represents one deployment environment. Each environment has its main.tf which reference modules based on
4+
requirements for given environment and input_variables.tfvars containing parameter values.
5+
6+
Feel free to copy/rename example environments to configure your own deployment environments.
7+
8+
Example environments:
9+
- **dev**
10+
- Simple deployment environment suitable mainly for quick PoC
11+
- Creates single compartment, tags for tenant isolation and necessary policies for ML App and ML App developers/operators
12+
- **dev-multiapp**
13+
- Production ready deployment environment prepared for multiple ML Applications developed by multiple teams (having their IAM groups in same or in remote tenancy like Boat tenancy)
14+
- Creates:
15+
- Environment root compartment and compartment each application in it
16+
- Compartment for resources shared across all applications (like Vault)
17+
- Policies for ML App runtime as well as policies for each development team. Policies ensures ML App Instance (Saas tenant) isolation, application isolation and they follow least privilege principle.
18+
- Tags necessary for tenant isolation and shared resources. These tags are used by policies to ensure

‎ml-applications/sample-project-policies/environments/dev-multiapp/input_variables.tfvars

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# ML Application provider tenancy ID (where ML Application and underlying resources are supposed to be located)
2+
tenancy_id = "ocid1.tenancy.oc1..aaaaaaaafwgqzxcwlkkpl5i334qpv62s375upsw2j4ufgcizfnnhjd4l55ia"
3+
# OCI home region - policies can only be created in the home region
4+
region = "us-ashburn-1"
5+
# OCI Profile (defined in OCI config file)
6+
oci_config_profile = "DEFAULT"
7+
8+
# Name of deployment environment for ML App
9+
environment_name = "dev"
10+
11+
# Compartment ID of already existing subnet which should be reused for ML Application (leave empty string if you are going to create new subnet in application compartment later)
12+
external_subnet_compartment_id = ""
13+
14+
15+
16+

‎ml-applications/sample-project-policies/environments/dev-multiapp/main.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
module "app_list" {
2+
source = "../../shared_modules/application_list"
3+
}
4+
5+
module "multiapp-environment" {
6+
source = "../../shared_modules/multip_app_environment"
7+
environment_name = var.environment_name
8+
environment_root_compartment_name_prefix = "ml-apps"
9+
parent_compartment_id = var.tenancy_id
10+
tenancy_id = var.tenancy_id
11+
external_subnet_compartment_id = var.external_subnet_compartment_id
12+
network_in_shared_resources = false
13+
applications = module.app_list.applications
14+
}
15+
16+
output "application_compartment_ids" {
17+
value = module.multiapp-environment.application_compartment_ids
18+
}
19+
20+
output "environment_compartment_id" {
21+
value = module.multiapp-environment.environment_compartment_id
22+
}
23+
24+
output "shared_compartment_id" {
25+
value = module.multiapp-environment.shared_compartment_id
26+
}

‎ml-applications/sample-project-policies/environments/dev-multiapp/provider.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "oci" {
2+
region = var.region
3+
config_file_profile = var.oci_config_profile
4+
}

‎ml-applications/sample-project-policies/environments/dev-multiapp/variables.tf

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
variable "tenancy_id" {
2+
type = string
3+
nullable = false
4+
}
5+
variable "external_subnet_compartment_id" {
6+
description = "If an existing subnet should be reused for ML App, provide compartment where the subnet is located. If not provided, there is expectation that subnet for ML App will be created in compartment where ML App is located."
7+
type = string
8+
default = ""
9+
nullable = false
10+
}
11+
variable "environment_name" {
12+
type = string
13+
nullable = false
14+
}
15+
variable "region" {
16+
type = string
17+
nullable = false
18+
}
19+
variable "oci_config_profile" {
20+
type = string
21+
default = "DEFAULT"
22+
nullable = false
23+
}

‎ml-applications/sample-project-policies/environments/dev/input_variables.tfvars

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# ML Application provider tenancy ID (where ML Application and underlying resources are supposed to be located)
2+
tenancy_id = "ocid1.tenancy.oc1..aaaaaaaafwgqzxcwlkkpl5i334qpv62s375upsw2j4ufgcizfnnhjd4l55ia"
3+
# OCI home region - policies can only be created in the home region
4+
region = "us-ashburn-1"
5+
# OCI Profile (defined in OCI config file), if not provided DEFAULT is used
6+
oci_config_profile = "DEFAULT"
7+
8+
# ML Application name
9+
application_name = "fetalrisk"
10+
11+
# Name of deployment environment for ML App
12+
environment_name = "dev"
13+
14+
# Compartment ID of already existing subnet which should be reused for ML Application (leave empty string if you are going to create new subnet in application compartment later)
15+
subnet_compartment_id = ""
16+
17+
# ID of application team members group (if empty string no policies for application team members is created)
18+
app_team_group_id = ""
19+
20+
21+
22+

‎ml-applications/sample-project-policies/environments/dev/main.tf

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
module "identity_ml_app_tags" {
2+
source = "../../shared_modules/identity_ml_app_tags"
3+
namespace_suffix = var.application_name
4+
environment_name = var.environment_name
5+
compartment_id = var.tenancy_id
6+
}
7+
8+
resource "oci_identity_compartment" "app" {
9+
depends_on = [module.identity_ml_app_tags]
10+
11+
name = "ml-app-${var.application_name}-${var.environment_name}"
12+
description = "Compartment for ML Application '${var.application_name}'"
13+
compartment_id = var.tenancy_id
14+
15+
defined_tags = {"${module.identity_ml_app_tags.mlapp_env_namespace}.${module.identity_ml_app_tags.compartment_type_tag}" = "${module.identity_ml_app_tags.compartment_type_app}"}
16+
freeform_tags = {
17+
# For app deployments to be able to get environment specific tag namespace
18+
"MlApplicationTagNamespaceName" = "${module.identity_ml_app_tags.mlapps_namespace}"
19+
}
20+
}
21+
22+
module "identity_ml_app_runtime_policies" {
23+
source = "../../shared_modules/identity_ml_app_runtime"
24+
depends_on = [oci_identity_compartment.app]
25+
26+
tenancy_id = var.tenancy_id
27+
app_compartment_id = oci_identity_compartment.app.id
28+
policy_name_suffix = var.application_name
29+
environment_name = var.environment_name
30+
external_subnet_compartment_id = var.subnet_compartment_id
31+
32+
mlapps_tag_namespace = module.identity_ml_app_tags.mlapps_namespace
33+
mlapp_env_tag_namespace = module.identity_ml_app_tags.mlapp_env_namespace
34+
mlapp_instance_id_tag = module.identity_ml_app_tags.mlapp_instance_tag
35+
compartment_type_tag = module.identity_ml_app_tags.compartment_type_tag
36+
}
37+
38+
module "identity_ml_app_enablement" {
39+
source = "../../shared_modules/identity_ml_app_enablement"
40+
depends_on = [oci_identity_compartment.app]
41+
42+
policy_name_suffix = var.application_name
43+
environment_name = var.environment_name
44+
tenancy_id = var.tenancy_id
45+
mlapp_env_tag_namespace = module.identity_ml_app_tags.mlapp_env_namespace
46+
compartment_type_tag = module.identity_ml_app_tags.compartment_type_tag
47+
}
48+
49+
module "identity_ml_app_operators" {
50+
count = var.app_team_group_id != "" ? 1 : 0 # This will be created only if dev team group ID is provided
51+
source = "../../shared_modules/identity_ml_app_operators"
52+
depends_on = [oci_identity_compartment.app]
53+
54+
tenancy_id = var.tenancy_id
55+
app_compartment_id = oci_identity_compartment.app.id
56+
app_team_group_id = var.app_team_group_id
57+
application_name = var.application_name
58+
environment_naming_suffix = var.environment_name
59+
app_team_group_tenancy_id = var.app_team_group_tenancy_id
60+
}
61+
62+
output "tenancy_id" {
63+
value = var.tenancy_id
64+
}
65+
66+
output "environment_compartment_id" {
67+
value = oci_identity_compartment.app.id
68+
}
69+
70+
output "mlapps_tag_namespace" {
71+
value = module.identity_ml_app_tags.mlapps_namespace
72+
}
73+
74+

‎ml-applications/sample-project-policies/environments/dev/provider.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "oci" {
2+
region = var.region
3+
config_file_profile = var.oci_config_profile
4+
}

‎ml-applications/sample-project-policies/environments/dev/variables.tf

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
variable "application_name" {
2+
type = string
3+
nullable = false
4+
}
5+
variable "tenancy_id" {
6+
type = string
7+
nullable = false
8+
}
9+
variable "subnet_compartment_id" {
10+
description = "If an existing subnet should be reused for ML App, provide compartment where the subnet is located. If not provided, there is expectation that subnet for ML App will be created in compartment where ML App is located."
11+
type = string
12+
default = ""
13+
nullable = false
14+
}
15+
variable "app_team_group_id" {
16+
type = string
17+
nullable = false
18+
default = ""
19+
}
20+
variable "app_team_group_tenancy_id" {
21+
type = string
22+
default = ""
23+
}
24+
variable "environment_name" {
25+
type = string
26+
nullable = false
27+
}
28+
variable "region" {
29+
type = string
30+
nullable = false
31+
}
32+
variable "oci_config_profile" {
33+
type = string
34+
default = "DEFAULT"
35+
nullable = false
36+
}

‎ml-applications/sample-project-policies/shared_modules/application_list/main.tf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
locals {
2+
# List of applications with their attributes
3+
applications = [
4+
{
5+
name = "fetal-risk",
6+
# operator_boat_group_id = "xxx",
7+
operator_group_id = "ocid1.group.oc1..xxx",
8+
# provide only if the tenancy is different from tenancy where ML App is located. DO NOT PROVIDE tenancy of ML Application here.
9+
group_tenancy_id = null,
10+
},
11+
{
12+
name = "cardiovascular-risk",
13+
operator_group_id = "ocid1.group.oc1..yyy", #"yyy",
14+
# provide only if the tenancy is different from tenancy where ML App is located. DO NOT PROVIDE tenancy of ML Application here.
15+
group_tenancy_id = null,
16+
},
17+
# other applications ....
18+
]
19+
}
20+
21+
output "applications" {
22+
value = local.applications
23+
}
24+
25+
26+
27+

‎ml-applications/sample-project-policies/shared_modules/identity_ml_app_enablement/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Policies for enablement ML Application in Provider's Tenancy
2+
=====================================================================
3+
4+
This module contains polices for basic enablement of ML Application in given tenancy. It also contains defined tag for
5+
tenant isolation.

‎ml-applications/sample-project-policies/shared_modules/identity_ml_app_enablement/main.tf

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
locals {
2+
environment_name_resolved = var.environment_name != null && var.environment_name != "" ? var.environment_name : ""
3+
description_suffix = local.environment_name_resolved != "" ? "for environment '${local.environment_name_resolved}'" : "in tenancy"
4+
policy_name_suffix = var.policy_name_suffix != null && var.policy_name_suffix != "" ? "${var.policy_name_suffix}_${local.environment_name_resolved}" : local.environment_name_resolved
5+
}
6+
7+
resource "oci_identity_policy" "ml-application-enablement" {
8+
compartment_id = var.tenancy_id
9+
description = "Endorse policies ensuring ML Application enablement '${local.description_suffix}'"
10+
name = "ml_applications_enablement_${local.policy_name_suffix}"
11+
statements = [
12+
"Define tenancy DataScienceTenancy as ${local.odsc_service_tenancy_id}",
13+
"Endorse any-user to manage orm-stacks in tenancy DataScienceTenancy where all { request.principal.type='datasciencemlapp${local.mlapp_type_suffix}', request.principal.compartment.tag.${var.mlapp_env_tag_namespace}.${var.compartment_type_tag} = 'app' }",
14+
"Endorse any-user to manage orm-jobs in tenancy DataScienceTenancy where all { request.principal.type='datasciencemlappimpl${local.mlapp_type_suffix}', request.principal.compartment.tag.${var.mlapp_env_tag_namespace}.${var.compartment_type_tag} = 'app' }",
15+
"Endorse any-user to use orm-stacks in tenancy DataScienceTenancy where all { request.principal.type='datasciencemlappimpl${local.mlapp_type_suffix}', request.principal.compartment.tag.${var.mlapp_env_tag_namespace}.${var.compartment_type_tag} = 'app' }",
16+
]
17+
}
18+

‎ml-applications/sample-project-policies/shared_modules/identity_ml_app_enablement/odsc-env.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module "odsc_environments" {
2+
source = "../odsc_environments"
3+
data_science_service_environment = var.data_science_service_environment
4+
}
5+
6+
locals {
7+
odsc_service_tenancy_id = module.odsc_environments.odsc_service_tenancy_id
8+
mlapp_type_suffix = module.odsc_environments.mlapp_type_suffix
9+
}

‎ml-applications/sample-project-policies/shared_modules/identity_ml_app_enablement/variable.tf

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# ML Application Provider tenancy ID (tenancy where ML Application will be created)
2+
variable "tenancy_id" {
3+
type = string
4+
# nullable = false
5+
}
6+
7+
variable "policy_name_suffix" {
8+
description = "Resource name suffix (like policy name suffix). Environment name is appended to result name suffix: <name_base>_<name_sufix>_<environment_name>"
9+
default = ""
10+
type = string
11+
# nullable = false
12+
}
13+
14+
variable "environment_name" {
15+
type = string
16+
default = ""
17+
# nullable = false
18+
}
19+
20+
variable "mlapp_env_tag_namespace" {
21+
type = string
22+
default = "MLApplications"
23+
# nullable = false
24+
}
25+
26+
variable "compartment_type_tag" {
27+
description = "Defined tag name used for tenant isolation (resources belonging to certain ML App Instance should be tagged this tag)."
28+
type = string
29+
default = "CompartmentType"
30+
# nullable = false
31+
}
32+
33+
variable "data_science_service_environment" {
34+
description = "Use only if non-production Data Science Service environment should be used (default is production). Allowed values: int, preprod, production"
35+
type = string
36+
# nullable = false
37+
default = "production"
38+
validation {
39+
error_message = "Value can be one of: int, preprod, production."
40+
condition = can(regex("^(int|preprod|production)$", var.data_science_service_environment))
41+
}
42+
}

0 commit comments

Comments
 (0)