Skip to content

Commit e46c1be

Browse files
harsh97harsh97
committed
Fixing release issue
1 parent 75f330b commit e46c1be

File tree

9 files changed

+371
-7
lines changed

9 files changed

+371
-7
lines changed

‎.github/workflows/stack.yml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
# Creates and Publishes the Oracle Resource Manager stack - v0.0.5
6+
7+
name: Generate stacks and publish release
8+
9+
on:
10+
push:
11+
branches: [ main ]
12+
paths: ['VERSION']
13+
14+
jobs:
15+
16+
publish_stack:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v3
21+
22+
- name: Create stacks
23+
id: create_stacks
24+
run: |
25+
26+
STACKNAME=oci-ods-aqua
27+
STACK_FILES="ai-quick-actions/policies/terraform/*"
28+
RELEASE=$(cat VERSION)
29+
ASSETS+="${STACKNAME}.zip"
30+
echo "::group::Processing $STACKNAME"
31+
zip -r ${STACKNAME}-stack.zip $STACK_FILES || { printf '\n⛔ Unable to create %s stack.\n'; exit 1; }
32+
cp ${STACKNAME}-stack.zip ${STACKNAME}.zip || { printf '\n⛔ Unable to create %s stack.\n'; exit 1; }
33+
echo "::endgroup::"
34+
echo "::set-output name=assets::$ASSETS"
35+
echo "::set-output name=release::$RELEASE"
36+
echo "::set-output name=prefix::$STACKNAME"
37+
38+
- name: Prepare Release Notes
39+
run: |
40+
#
41+
printf '%s\n' '${{ steps.create_stacks.outputs.prefix }} Stack - v${{ steps.create_stacks.outputs.release }}' >release.md
42+
printf '%s\n' '' '## [![Deploy to Oracle Cloud][magic_button]][magic_stack]' >>release.md
43+
printf '%s\n' '' '' >>release.md
44+
printf '%s\n' '' '[magic_button]: https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg' >>release.md
45+
printf '%s\n' '' '[magic_stack]: https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/${{ github.repository }}/releases/download/${{ steps.create_stacks.outputs.release }}/${{ steps.create_stacks.outputs.prefix }}.zip' >>release.md
46+
47+
- name: Create Release
48+
run: gh release create ${{ steps.create_stacks.outputs.release }} --generate-notes -F release.md ${{ steps.create_stacks.outputs.assets }}
49+
env:
50+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎VERSION

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1.1

‎ai-quick-actions/policies/README.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,7 @@ allow group <your_admin_group> to manage policies in TENANCY
3030
allow group <your_admin_group> to read compartments in TENANCY
3131
```
3232

33-
Download terraform configuration file [oci-ods-aqua-orm.zip](./oci-ods-aqua-orm.zip) with the infrastructure instructions for the dynamic groups and polices. For steps on creating stacks, see [Creating a Stack from a Zip File](https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Tasks/create-stack-local.htm#top).
34-
35-
36-
![Setup 1](../web_assets/policies1.png)
37-
38-
![Setup 2](../web_assets/policies2.png)
33+
Click to deploy the stack [![Deploy to Oracle Cloud][magic_button]][magic_stack]
3934

4035
> **Note:** To save fine-tuned models, versioning has to be enabled in the selected Object Storage bucket. See [here](https://docs.oracle.com/iaas/data-science/using/ai-quick-actions-fine-tuning.htm) for more information.
4136
@@ -118,7 +113,8 @@ These policies and dynamic groups set up the necessary permissions to enable AI
118113
> **Note:** To save fine-tuned models, versioning has to be enabled in the selected Object Storage bucket. See [here](https://docs.oracle.com/iaas/data-science/using/ai-quick-actions-fine-tuning.htm) for more information.
119114
120115
![Setup 3](../web_assets/policies3.png)
121-
116+
- [magic_button]: https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg
117+
- [magic_stack]: https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/harsh97/oci-data-science-ai-samples/releases/latest/download/oci-ods-aqua.zip
122118
- [Home](../README.md)
123119
- [CLI](../cli-tips.md)
124120
- [Model Deployment](../model-deployment-tips.md)

‎ai-quick-actions/policies/oci-ods-aqua-orm.zip

-2.21 KB
Binary file not shown.

‎ai-quick-actions/policies/terraform/iam.tf

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
resource "oci_identity_dynamic_group" "aqua-dynamic-group" {
2+
compartment_id = var.tenancy_ocid
3+
description = "Data Science Aqua Dynamic Group"
4+
name = var.aqua_dg_name
5+
matching_rule = local.is_resource_policy_required? local.aqua_dg_match: local.aqua_admin_only_dg_match
6+
}
7+
8+
resource "oci_identity_dynamic_group" "distributed_training_job_runs" {
9+
count = local.is_resource_policy_required ? 1 : 0
10+
compartment_id = var.tenancy_ocid
11+
description = "Data Science Distributed Training Job Runs Group"
12+
name = var.distributed_training_dg_name
13+
matching_rule = "any {all {resource.type='datasciencejobrun',resource.compartment.id='${var.compartment_ocid}'}}"
14+
}
15+
16+
17+
locals {
18+
is_admin_policies_only = var.deployment_type == "Only admin policies"
19+
is_resource_policy_only = var.deployment_type == "Only resource policies"
20+
is_all_policies = var.deployment_type == "All policies"
21+
is_resource_policy_required = var.deployment_type != "Only admin policies"
22+
// Aqua dg matching rules
23+
aqua_admin_only_dg_match = "all {resource.type='datasciencenotebooksession'}"
24+
aqua_dg_match = "any {all {resource.type='datasciencenotebooksession',resource.compartment.id='${var.compartment_ocid}'}, all {resource.type='datasciencemodeldeployment',resource.compartment.id='${var.compartment_ocid}'}, all {resource.type='datasciencejobrun',resource.compartment.id='${var.compartment_ocid}'}}"
25+
is_compartment_tenancy = length(regexall(".*tenancy.*", var.compartment_ocid)) > 0
26+
compartment_policy_string = local.is_compartment_tenancy ? "tenancy" : "compartment id ${var.compartment_ocid}"
27+
policy_tenancy = local.is_resource_policy_only? var.compartment_ocid : var.tenancy_ocid
28+
// Contains only necessary admin policies. These policies will be created in the tenancy. When the user selects "Only admin policies" these policies will be created.
29+
aqua_admin_only_policies = [
30+
"Define tenancy datascience as ocid1.tenancy.oc1..aaaaaaaax5hdic7ya6r5rxsgpifff4l6xdxzltnrncdzp3m75ubbvzqqzn3q",
31+
"Endorse any-user to read data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}",
32+
"Endorse any-user to inspect data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}",
33+
"Endorse any-user to read object in tenancy datascience where ALL {target.compartment.name='service-managed-models', target.bucket.name='service-managed-models'}",
34+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to inspect compartments in tenancy"
35+
]
36+
37+
// These are encompassing policies that will be created in the tenancy. When the user selects "All policies" these policies will be created.
38+
aqua_all_policies = [
39+
"Define tenancy datascience as ocid1.tenancy.oc1..aaaaaaaax5hdic7ya6r5rxsgpifff4l6xdxzltnrncdzp3m75ubbvzqqzn3q",
40+
"Endorse any-user to read data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}",
41+
"Endorse any-user to inspect data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}",
42+
"Endorse any-user to read object in tenancy datascience where ALL {target.compartment.name='service-managed-models', target.bucket.name='service-managed-models'}",
43+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-model-deployments in ${local.compartment_policy_string}",
44+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-models in ${local.compartment_policy_string}",
45+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to use logging-family in ${local.compartment_policy_string}",
46+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-jobs in ${local.compartment_policy_string}",
47+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-job-runs in ${local.compartment_policy_string}",
48+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to use virtual-network-family in ${local.compartment_policy_string}",
49+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to read resource-availability in ${local.compartment_policy_string}",
50+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-projects in ${local.compartment_policy_string}",
51+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-notebook-sessions in ${local.compartment_policy_string}",
52+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-modelversionsets in ${local.compartment_policy_string}",
53+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to read buckets in ${local.compartment_policy_string}",
54+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to read objectstorage-namespaces in ${local.compartment_policy_string}",
55+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to inspect compartments in tenancy"
56+
]
57+
58+
// Aqua resource only policies. These policies will be created in a specific compartment. When the user selects "Only resource policies" these policies will be created.
59+
aqua_resource_only_policies = [
60+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-model-deployments in ${local.compartment_policy_string}",
61+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-models in ${local.compartment_policy_string}",
62+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to use logging-family in ${local.compartment_policy_string}",
63+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-jobs in ${local.compartment_policy_string}",
64+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-job-runs in ${local.compartment_policy_string}",
65+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to use virtual-network-family in ${local.compartment_policy_string}",
66+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to read resource-availability in ${local.compartment_policy_string}",
67+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-projects in ${local.compartment_policy_string}",
68+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-notebook-sessions in ${local.compartment_policy_string}",
69+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage data-science-modelversionsets in ${local.compartment_policy_string}",
70+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to read buckets in ${local.compartment_policy_string}",
71+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to read objectstorage-namespaces in ${local.compartment_policy_string}",
72+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to inspect compartments in ${local.compartment_policy_string}"
73+
]
74+
75+
policies_to_use = local.is_admin_policies_only ? local.aqua_admin_only_policies : local.is_resource_policy_only ? local.aqua_resource_only_policies : local.aqua_all_policies
76+
77+
all_buckets = concat(var.user_model_buckets, var.user_data_buckets)
78+
bucket_names = join(", ", formatlist("target.bucket.name='%s'", local.all_buckets))
79+
bucket_names_oss = join(", ", formatlist("all{target.bucket.name='%s', any {request.permission='OBJECT_CREATE', request.permission='OBJECT_INSPECT'}}", local.all_buckets))
80+
dt_jr_policies = local.is_resource_policy_required?[
81+
"Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to use logging-family in ${local.compartment_policy_string}",
82+
"Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to manage data-science-models in ${local.compartment_policy_string}",
83+
"Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to read data-science-jobs in ${local.compartment_policy_string}"
84+
]: []
85+
dt_jr_policies_target_buckets = local.is_resource_policy_required? [
86+
"Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to manage objects in ${local.compartment_policy_string} where any {${local.bucket_names}}",
87+
"Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to read buckets in ${local.compartment_policy_string} where any {${local.bucket_names}}"
88+
]: []
89+
aqua_policies_target_buckets = local.is_resource_policy_required?[
90+
"Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group.id} to manage object-family in ${local.compartment_policy_string} where any {${local.bucket_names_oss}}"
91+
]:[]
92+
93+
}
94+
95+
resource "oci_identity_policy" "aqua-policy" {
96+
compartment_id = local.policy_tenancy
97+
description = "Data Science Aqua Policies"
98+
name = var.aqua_policy_name
99+
statements = length(local.bucket_names) > 0 ? concat(local.policies_to_use, local.aqua_policies_target_buckets): local.policies_to_use
100+
}
101+
102+
resource "oci_identity_policy" "distributed_training_job_runs_policy" {
103+
count = local.is_resource_policy_required ? 1 : 0
104+
compartment_id = local.policy_tenancy
105+
description = "Distributed Training Job Runs Policies"
106+
name = var.distributed_training_policy_name
107+
statements = length(local.bucket_names) > 0 ? concat(local.dt_jr_policies, local.dt_jr_policies_target_buckets) : local.dt_jr_policies
108+
}
109+
110+

‎ai-quick-actions/policies/terraform/outputs.tf

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "deployment_type" {
2+
value = var.deployment_type
3+
}
4+
5+
output "aqua_info" {
6+
value = "https://docs.oracle.com/en-us/iaas/data-science/using/ai-quick-actions.htm"
7+
}

‎ai-quick-actions/policies/terraform/provider.tf

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
terraform {
3+
required_version = ">= 1.0"
4+
}
5+
6+
provider "oci" {
7+
region = var.region
8+
tenancy_ocid = var.tenancy_ocid
9+
# auth = "SecurityToken"
10+
# config_file_profile = "DEFAULT"
11+
}
12+

‎ai-quick-actions/policies/terraform/schema.yaml

+141
Large diffs are not rendered by default.

‎ai-quick-actions/policies/terraform/variables.tf

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#*************************************
2+
# IAM Specific
3+
#*************************************
4+
variable "aqua_policy_name" {
5+
default = "DataScienceAquaPolicies"
6+
}
7+
8+
variable "aqua_dg_name" {
9+
default = "DataScienceAquaDynamicGroup"
10+
}
11+
12+
variable "distributed_training_dg_name" {
13+
default = "DistributedTrainingJobRunsDynamicGroup"
14+
}
15+
16+
variable "distributed_training_policy_name" {
17+
default = "DistributedTrainingJobRunsPolicies"
18+
}
19+
20+
#*************************************
21+
# TF Requirements
22+
#*************************************
23+
variable "tenancy_ocid" {
24+
}
25+
variable "region" {
26+
}
27+
variable "compartment_ocid" {
28+
}
29+
variable "user_model_buckets" {
30+
default = []
31+
type = list(string)
32+
description = "List buckets for storing fine tuning models and evaluation. Important: To save fine-tuned models, versioning has to be enabled in the selected Object Storage bucket."
33+
}
34+
variable "user_data_buckets" {
35+
default = []
36+
type = list(string)
37+
description = "List buckets for storing dataset used for fine tuning and evaluation."
38+
}
39+
40+
variable "deployment_type" {
41+
type = string
42+
description = "Type of deployment"
43+
validation {
44+
condition = contains(["All policies", "Only admin policies", "Only resource policies"], var.deployment_type)
45+
error_message = "The deployment_type must be one of: 'All policies', 'Only admin policies', 'Only resource policies'."
46+
}
47+
}

0 commit comments

Comments
 (0)