Skip to content

Commit 1a9b822

Browse files
Element9Element9
committed
Add Azure playbook
1 parent d9df6ba commit 1a9b822

34 files changed

+1736
-1
lines changed

‎.gitignore‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,5 +43,30 @@ aws/studio/values.yaml
4343
aws/studio/certificate.yaml
4444
secret_db.json
4545

46+
azure/deploy/_tf/*
47+
azure/deploy/.terraform/*
48+
azure/deploy/.terraform.lock.hcl
49+
azure/deploy/terraform.tfstate
50+
azure/deploy/terraform.tfstate.backup
51+
azure/configure/cert-manager-certificate-issuer.yaml
52+
azure/configure/cert-manager-values.yaml
53+
azure/configure/external-dns-secret.yaml
54+
azure/configure/external-dns-values.yaml
55+
azure/configure/test-ingress-certificate.yaml
56+
azure/configure/test-ingress-httpbin-values.yaml
57+
azure/configure/db-init.yaml
58+
azure/rasa/kafka/kafka.yaml
59+
azure/rasa/assistant/repos/*
60+
azure/rasa/assistant/values.yaml
61+
azure/rasa/ingress/ingress.yaml
62+
azure/rasa/ingress/certificate.yaml
63+
azure/studio/repos/*
64+
azure/studio/values.yaml
65+
azure/studio/certificate.yaml
66+
67+
68+
4669
# Dev
47-
aws/setup/environment-variables-dev.sh
70+
gcp/setup/environment-variables-dev.sh
71+
aws/setup/environment-variables-dev.sh
72+
azure/setup/environment-variables-dev.sh

‎azure/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Microsoft Azure Playbook
2+
This playbook outlines an opinionated, best-practice way to install Rasa Pro and Rasa Studio on Microsoft Azure. You may wish to adapt steps and configuration to meet your needs or organisational policies as required. The files here support you working through the Microsoft Azure Playbook which you can find [here](https://rasa.com/docs/learn/deployment/azure/azure-playbook-intro).
3+
4+
5+

‎azure/cleanup/cleanup.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
set -e
2+
3+
# Get the directory where this script is located
4+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
5+
6+
# Source common utilities
7+
source "$SCRIPT_DIR/../../utils/common.sh"
8+
source "$SCRIPT_DIR/../utils/common.sh"
9+
10+
auth_to_k8s
11+
12+
print_info "Starting cleanup of Azure infrastructure..."
13+
14+
print_info "Uninstalling Istio..."
15+
16+
export ISTIO_DIR=$(ls | grep -v istio-operator.yaml | grep istio- | sort --version-sort | tail -1)
17+
print_info "Istio dir: $ISTIO_DIR"
18+
export ISTIO="$ISTIO_DIR/bin/istioctl"
19+
$ISTIO version
20+
21+
# This makes sure the resources created by Istio and not managed by terraform are cleaned up properly.
22+
$ISTIO uninstall --purge -y
23+
24+
TARGET_DIR_RELATIVE="$SCRIPT_DIR/../deploy/_tf"
25+
TARGET_DIR_ABSOLUTE=$(realpath "$TARGET_DIR_RELATIVE")
26+
$TF_CMD -chdir=$TARGET_DIR_ABSOLUTE destroy -auto-approve
27+
28+
print_info "Cleanup completed! Check the output above for any errors."

‎azure/configure/cert-manager-certificate-issuer.template.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: letsencrypt
5+
spec:
6+
acme:
7+
email: $MY_EMAIL
8+
server: https://acme-v02.api.letsencrypt.org/directory
9+
privateKeySecretRef:
10+
name: letsencrypt-issuer-account-key
11+
solvers:
12+
- dns01:
13+
azureDNS:
14+
hostedZoneName: ${DOMAIN}
15+
resourceGroupName: ${NAME}
16+
subscriptionID: ${ARM_SUBSCRIPTION_ID}
17+
environment: AzurePublicCloud
18+
managedIdentity:
19+
clientID: ${SERVICE_ACCOUNT_DNS}

‎azure/configure/cert-manager-values.template.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
crds:
2+
enabled: true
3+
4+
serviceAccount:
5+
labels:
6+
azure.workload.identity/use: "true"
7+
8+
podLabels:
9+
azure.workload.identity/use: "true"
10+
11+
prometheus:
12+
enabled: true

‎azure/configure/configure-cluster.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
set -e
2+
3+
# Get the directory where this script is located
4+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
5+
6+
# Source common utilities
7+
source "$SCRIPT_DIR/../../utils/common.sh"
8+
source "$SCRIPT_DIR/../utils/common.sh"
9+
10+
auth_to_k8s
11+
12+
# Get the directory where this script is located
13+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
14+
15+
print_info "Setting up Istio..."
16+
# Download and install the istioctl tool for managing Istio, the service mesh that will ensure that communication between different Rasa product components is encrypted in transit, on your cluster:
17+
curl -L https://istio.io/downloadIstio | sh -
18+
# Configure required environment variables:
19+
export ISTIO_DIR=$(ls | grep -v istio-operator.yaml | grep istio- | sort --version-sort | tail -1)
20+
print_info "Istio dir: $ISTIO_DIR"
21+
export ISTIO="$ISTIO_DIR/bin/istioctl"
22+
$ISTIO version
23+
24+
# Install Istio onto Your Cluster
25+
# Use our preconfigured YAML files to install Istio onto your cluster.
26+
print_info "Installing Istio on your cluster..."
27+
$ISTIO install --set profile=demo --skip-confirmation -f "$SCRIPT_DIR/istio-operator.yaml"
28+
29+
# Here we'll create an Ingress Class that will help us handle network traffic coming inbound to the Rasa products.
30+
print_info "Creating the Istio Ingress Class on your cluster..."
31+
kubectl apply -f "$SCRIPT_DIR/istio-ingress-class.yaml"
32+
33+
# You will now need to update some DNS records on your domain. You will need to find where your DNS is configured for your domain - this may be a cloud provider like AWS or a domain registrar like GoDaddy or Cloudflare.
34+
print_info "Retrieving the nameservers of the zone you have just created in Azure..."
35+
print_info "You must now create an NS record for your domain $DOMAIN with the following values:"
36+
TARGET_DIR_RELATIVE="$SCRIPT_DIR/../deploy/_tf"
37+
TARGET_DIR_ABSOLUTE=$(realpath "$TARGET_DIR_RELATIVE")
38+
$TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output dns_name_servers

‎azure/configure/db-init.template.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: db-init
5+
spec:
6+
containers:
7+
- name: db-init
8+
image: postgres:$PG_VERSION
9+
imagePullPolicy: IfNotPresent
10+
command:
11+
- "/bin/bash"
12+
- "-c"
13+
- "--"
14+
args:
15+
- |
16+
echo "create assistant database and user"
17+
echo "CREATE USER $DB_ASSISTANT_USERNAME WITH PASSWORD '$DB_ASSISTANT_PASSWORD';" | psql -qtAX
18+
echo "CREATE DATABASE $DB_ASSISTANT_DATABASE WITH ENCODING = 'UTF8';" | psql -qtAX
19+
echo "GRANT ALL PRIVILEGES ON DATABASE $DB_ASSISTANT_DATABASE TO $DB_ASSISTANT_USERNAME;" | psql -qtAX
20+
echo "GRANT azure_pg_admin TO $DB_ASSISTANT_USERNAME;" | psql -qtAX
21+
echo "ALTER DATABASE $DB_ASSISTANT_DATABASE OWNER TO $DB_ASSISTANT_USERNAME;" | psql -qtAX
22+
23+
echo "create studio database and user"
24+
echo "CREATE USER $DB_STUDIO_USERNAME WITH PASSWORD '$DB_STUDIO_PASSWORD';" | psql -qtAX
25+
echo "CREATE DATABASE $DB_STUDIO_DATABASE WITH ENCODING = 'UTF8';" | psql -qtAX
26+
echo "GRANT ALL PRIVILEGES ON DATABASE $DB_STUDIO_DATABASE TO $DB_STUDIO_USERNAME;" | psql -qtAX
27+
echo "GRANT azure_pg_admin TO $DB_STUDIO_USERNAME;" | psql -qtAX
28+
echo "ALTER DATABASE $DB_STUDIO_DATABASE OWNER TO $DB_STUDIO_USERNAME;" | psql -qtAX
29+
30+
echo "create keycloak database and user"
31+
echo "CREATE USER $DB_KEYCLOAK_USERNAME WITH PASSWORD '$DB_KEYCLOAK_PASSWORD';" | psql -qtAX
32+
echo "CREATE DATABASE $DB_KEYCLOAK_DATABASE WITH ENCODING = 'UTF8';" | psql -qtAX
33+
echo "GRANT ALL PRIVILEGES ON DATABASE $DB_KEYCLOAK_DATABASE TO $DB_KEYCLOAK_USERNAME;" | psql -qtAX
34+
echo "GRANT azure_pg_admin TO $DB_KEYCLOAK_USERNAME;" | psql -qtAX
35+
echo "ALTER DATABASE $DB_KEYCLOAK_DATABASE OWNER TO $DB_KEYCLOAK_USERNAME;" | psql -qtAX
36+
37+
echo "granting schema public to keycloak user role..."
38+
echo "GRANT ALL PRIVILEGES ON SCHEMA public TO $DB_KEYCLOAK_USERNAME;" | psql -qtAX
39+
echo "granted schema public to keycloak"
40+
41+
sleep 10
42+
echo "done"
43+
env:
44+
- name: PGHOST
45+
value: $DB_HOST
46+
- name: PGUSER
47+
value: $DB_ROOT_UN
48+
- name: PGPASSWORD
49+
value: "$DB_ROOT_PW"
50+
- name: PGPORT
51+
value: "$DB_PORT"
52+
restartPolicy: Never

‎azure/configure/external-dns-secret.template.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: external-dns-azure
5+
namespace: external-dns
6+
type: Opaque
7+
stringData:
8+
azure.json: |
9+
{
10+
"tenantId": "${ARM_TENANT_ID}",
11+
"subscriptionId": "${ARM_SUBSCRIPTION_ID}",
12+
"resourceGroup": "${NAME}",
13+
"useWorkloadIdentityExtension": true
14+
}

‎azure/configure/external-dns-values.template.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
serviceAccount:
2+
create: true
3+
name: external-dns
4+
labels:
5+
azure.workload.identity/use: "true"
6+
annotations:
7+
azure.workload.identity/client-id: $SERVICE_ACCOUNT_DNS
8+
9+
podLabels:
10+
azure.workload.identity/use: "true"
11+
12+
extraVolumes:
13+
- name: azure-config-file
14+
secret:
15+
secretName: external-dns-azure
16+
17+
extraVolumeMounts:
18+
- name: azure-config-file
19+
mountPath: /etc/kubernetes
20+
readOnly: true
21+
22+
rbac:
23+
create: true
24+
25+
policy: sync
26+
27+
sources:
28+
- istio-gateway
29+
- ingress
30+
31+
txtOwnerId: $NAME
32+
33+
provider:
34+
name: azure
35+
36+
domainFilters:
37+
- $DOMAIN

‎azure/configure/get-infra-values.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
echo "Fetching some infrastructure values..."
2+
3+
# Authenticate with Kubernetes Cluster
4+
echo "Generating kubeconfig to authenticate with Azure Kubernetes cluster..."
5+
# To be able to interact with the Kubernetes cluster we deployed earlier, we need to obtain the credentials for it.
6+
# These credentials are saved in a file called kubeconfig which the cloud provider CLI tool can generate for us and kubectl can use.
7+
# Ensure we've got a path setup for the kubeconfig file:
8+
export KUBECONFIG=$(pwd)/kubeconfig
9+
echo "Kubeconfig path: $KUBECONFIG"
10+
rm -f $KUBECONFIG
11+
# Retrieve the credentials for the cluster:
12+
az aks get-credentials --resource-group "$NAME" --name "$NAME"
13+
14+
# Get the directory where this script is located
15+
# It also works when sourced from zsh
16+
if [[ -n "${BASH_SOURCE[0]}" ]]; then
17+
SOURCE_PATH="${BASH_SOURCE[0]}"
18+
else
19+
# For zsh compatibility
20+
SOURCE_PATH="${(%):-%x}"
21+
fi
22+
23+
SCRIPT_DIR="$(cd "$(dirname "$SOURCE_PATH")" && pwd)"
24+
TARGET_DIR_RELATIVE="$SCRIPT_DIR/../deploy/_tf"
25+
TARGET_DIR_ABSOLUTE=$(realpath "$TARGET_DIR_RELATIVE")
26+
27+
export DB_ROOT_UN=postgres
28+
export DB_ROOT_PW=$($TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output -raw pg_main_pw)
29+
export DB_PORT=5432
30+
export DB_HOST=$($TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output -raw db_host)
31+
32+
export REDIS_HOST=$($TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output -raw redis_host)
33+
export REDIS_AUTH=$($TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output -raw redis_pw)
34+
35+
export SERVICE_ACCOUNT_DNS=$($TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output -raw client_id_dns)
36+
export SERVICE_ACCOUNT_STUDIO=$($TF_CMD -chdir=$TARGET_DIR_ABSOLUTE output -raw client_id_studio)
37+
38+
echo "Infrastructure values fetched successfully:"
39+
echo "DB_ROOT_UN=$DB_ROOT_UN"
40+
echo "DB_ROOT_PW=$DB_ROOT_PW"
41+
echo "DB_PORT=$DB_PORT"
42+
echo "DB_HOST=$DB_HOST"
43+
echo "REDIS_HOST=$REDIS_HOST"
44+
echo "REDIS_AUTH=$REDIS_AUTH"
45+
echo "SERVICE_ACCOUNT_DNS=$SERVICE_ACCOUNT_DNS"
46+
echo "SERVICE_ACCOUNT_STUDIO=$SERVICE_ACCOUNT_STUDIO"

0 commit comments

Comments
 (0)