updating 201 AML

quickstart/201-machine-learning-moderately-secure/network.tf

@@ -6,11 +6,27 @@ resource "azurerm_virtual_network" "default" {
   resource_group_name = azurerm_resource_group.default.name
 }
 
-resource "azurerm_subnet" "mlsubnet" {
-  name                 = "mlsubnet"
+resource "azurerm_subnet" "training-subnet" {
+  name                 = "training-subnet"
   resource_group_name  = azurerm_resource_group.default.name
   virtual_network_name = azurerm_virtual_network.default.name
-  address_prefixes     = var.subnet_address_space
+  address_prefixes     = var.training_subnet_address_space
+  enforce_private_link_endpoint_network_policies = true
+}
+
+resource "azurerm_subnet" "aks-subnet" {
+  name                 = "aks-subnet"
+  resource_group_name  = azurerm_resource_group.default.name
+  virtual_network_name = azurerm_virtual_network.default.name
+  address_prefixes     = var.aks_subnet_address_space
+  enforce_private_link_endpoint_network_policies = true
+}
+
+resource "azurerm_subnet" "ml-subnet" {
+  name                 = "ml-subnet"
+  resource_group_name  = azurerm_resource_group.default.name
+  virtual_network_name = azurerm_virtual_network.default.name
+  address_prefixes     = var.ml_subnet_address_space
   enforce_private_link_endpoint_network_policies = true
 }
 
@@ -87,3 +103,110 @@ resource "azurerm_private_dns_zone_virtual_network_link" "vnetlinknbs" {
   private_dns_zone_name = azurerm_private_dns_zone.dnsnotebooks.name
   virtual_network_id    = azurerm_virtual_network.default.id
 }
+
+# Network Security Groups
+
+resource "azurerm_network_security_group" "training-NSG" {
+  name                = "training-NSG"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
+
+  security_rule {
+    name                       = "BatchNodeManagement"
+    priority                   = 100
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "29876-29877"
+    source_address_prefix      = "BatchNodeManagement"
+    destination_address_prefix = "*"
+  }
+  security_rule {
+    name                       = "AzureMachineLearning"
+    priority                   = 110
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "44224"
+    source_address_prefix      = "AzureMachineLearning"
+    destination_address_prefix = "*"
+  }
+}
+
+resource "azurerm_subnet_network_security_group_association" "training-NSG-link" {
+  subnet_id                 = azurerm_subnet.training-subnet.id
+  network_security_group_id = azurerm_network_security_group.training-NSG.id
+}
+
+resource "azurerm_network_security_group" "aks-NSG" {
+  name                = "aks-NSG"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
+
+
+}
+
+resource "azurerm_subnet_network_security_group_association" "aks-NSG-link" {
+  subnet_id                 = azurerm_subnet.aks-subnet.id
+  network_security_group_id = azurerm_network_security_group.aks-NSG.id
+}
+
+# User Defined Routes
+
+#UDR for Compute instance and compute clusters
+resource "azurerm_route_table" "training-UDR" {
+  name                = "training-UDR"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
+}
+
+resource "azurerm_route" "training-Internet-Route" {
+  name                = "Internet"
+  resource_group_name = azurerm_resource_group.default.name
+  route_table_name    = azurerm_route_table.training-UDR.name
+  address_prefix      = "0.0.0.0/0"
+  next_hop_type       = "Internet"
+}
+
+resource "azurerm_route" "training-AzureMLRoute" {
+  name                = "AzureMLRoute"
+  resource_group_name = azurerm_resource_group.default.name
+  route_table_name    = azurerm_route_table.training-UDR.name
+  address_prefix      = "AzureMachineLearning"
+  next_hop_type       = "Internet"
+}
+
+resource "azurerm_route" "training-BatchRoute" {
+  name                = "BatchRoute"
+  resource_group_name = azurerm_resource_group.default.name
+  route_table_name    = azurerm_route_table.training-UDR.name
+  address_prefix      = "BatchNodeManagement"
+  next_hop_type       = "Internet"
+}
+
+resource "azurerm_subnet_route_table_association" "training-UDRlink" {
+  subnet_id      = azurerm_subnet.training-subnet.id
+  route_table_id = azurerm_route_table.training-UDR.id
+}
+# Inferencing (AKS) Route
+
+resource "azurerm_route_table" "aks-UDR" {
+  name                = "aks-UDR"
+  location            = azurerm_resource_group.default.location
+  resource_group_name = azurerm_resource_group.default.name
+}
+
+resource "azurerm_route" "aks-Internet-Route" {
+  name                = "Internet"
+  resource_group_name = azurerm_resource_group.default.name
+  route_table_name    = azurerm_route_table.aks-UDR.name
+  address_prefix      = "0.0.0.0/0"
+  next_hop_type       = "Internet"
+}
+
+resource "azurerm_subnet_route_table_association" "aks-UDR-link" {
+  subnet_id      = azurerm_subnet.aks-subnet.id
+  route_table_id = azurerm_route_table.aks-UDR.id
+}