145 lines
5.6 KiB
HCL
145 lines
5.6 KiB
HCL
# Virtual Network
|
|
resource "azurerm_virtual_network" "default" {
|
|
name = "vnet-${var.name}-${var.environment}"
|
|
address_space = var.vnet_address_space
|
|
location = azurerm_resource_group.default.location
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
dns_servers = [azurerm_firewall.azure_firewall_instance.ip_configuration[0].private_ip_address]
|
|
depends_on = [
|
|
azurerm_virtual_network.hub,
|
|
azurerm_firewall.azure_firewall_instance
|
|
]
|
|
}
|
|
|
|
resource "azurerm_subnet" "snet-training" {
|
|
name = "snet-training"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
virtual_network_name = azurerm_virtual_network.default.name
|
|
address_prefixes = var.training_subnet_address_space
|
|
enforce_private_link_endpoint_network_policies = true
|
|
}
|
|
|
|
resource "azurerm_subnet" "snet-aks" {
|
|
name = "snet-aks"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
virtual_network_name = azurerm_virtual_network.default.name
|
|
address_prefixes = var.aks_subnet_address_space
|
|
enforce_private_link_endpoint_network_policies = true
|
|
}
|
|
|
|
resource "azurerm_subnet" "snet-workspace" {
|
|
name = "snet-workspace"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
virtual_network_name = azurerm_virtual_network.default.name
|
|
address_prefixes = var.ml_subnet_address_space
|
|
enforce_private_link_endpoint_network_policies = true
|
|
}
|
|
|
|
# Network Security Groups
|
|
|
|
resource "azurerm_network_security_group" "nsg-training" {
|
|
name = "nsg-training"
|
|
location = azurerm_resource_group.default.location
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
|
|
security_rule {
|
|
name = "BatchNodeManagement"
|
|
priority = 100
|
|
direction = "Inbound"
|
|
access = "Allow"
|
|
protocol = "Tcp"
|
|
source_port_range = "*"
|
|
destination_port_range = "29876-29877"
|
|
source_address_prefix = "BatchNodeManagement"
|
|
destination_address_prefix = "*"
|
|
}
|
|
|
|
security_rule {
|
|
name = "AzureMachineLearning"
|
|
priority = 110
|
|
direction = "Inbound"
|
|
access = "Allow"
|
|
protocol = "Tcp"
|
|
source_port_range = "*"
|
|
destination_port_range = "44224"
|
|
source_address_prefix = "AzureMachineLearning"
|
|
destination_address_prefix = "*"
|
|
}
|
|
}
|
|
|
|
resource "azurerm_subnet_network_security_group_association" "nsg-training-link" {
|
|
subnet_id = azurerm_subnet.snet-training.id
|
|
network_security_group_id = azurerm_network_security_group.nsg-training.id
|
|
}
|
|
|
|
resource "azurerm_network_security_group" "nsg-aks" {
|
|
name = "nsg-aks"
|
|
location = azurerm_resource_group.default.location
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
}
|
|
|
|
resource "azurerm_subnet_network_security_group_association" "nsg-aks-link" {
|
|
subnet_id = azurerm_subnet.snet-aks.id
|
|
network_security_group_id = azurerm_network_security_group.nsg-aks.id
|
|
}
|
|
|
|
# User Defined Routes
|
|
|
|
# UDR for compute instance and compute clusters
|
|
resource "azurerm_route_table" "rt-training" {
|
|
name = "rt-training"
|
|
location = azurerm_resource_group.default.location
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
}
|
|
|
|
resource "azurerm_route" "training-Internet-Route" {
|
|
name = "udr-Default"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
route_table_name = azurerm_route_table.rt-training.name
|
|
address_prefix = "0.0.0.0/0"
|
|
next_hop_type = "VirtualAppliance"
|
|
next_hop_in_ip_address = azurerm_firewall.azure_firewall_instance.ip_configuration[0].private_ip_address
|
|
}
|
|
|
|
resource "azurerm_route" "training-AzureMLRoute" {
|
|
name = "udr-AzureML"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
route_table_name = azurerm_route_table.rt-training.name
|
|
address_prefix = "AzureMachineLearning"
|
|
next_hop_type = "Internet"
|
|
}
|
|
|
|
resource "azurerm_route" "training-BatchRoute" {
|
|
name = "udr-Batch"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
route_table_name = azurerm_route_table.rt-training.name
|
|
address_prefix = "BatchNodeManagement"
|
|
next_hop_type = "Internet"
|
|
}
|
|
|
|
resource "azurerm_subnet_route_table_association" "rt-training-link" {
|
|
subnet_id = azurerm_subnet.snet-training.id
|
|
route_table_id = azurerm_route_table.rt-training.id
|
|
}
|
|
|
|
# Inferencing (AKS) Route
|
|
resource "azurerm_route_table" "rt-aks" {
|
|
name = "rt-aks"
|
|
location = azurerm_resource_group.default.location
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
}
|
|
|
|
resource "azurerm_route" "aks-default-Route" {
|
|
name = "udr-Default"
|
|
resource_group_name = azurerm_resource_group.default.name
|
|
route_table_name = azurerm_route_table.rt-aks.name
|
|
address_prefix = "0.0.0.0/0"
|
|
next_hop_type = "VirtualAppliance"
|
|
next_hop_in_ip_address = azurerm_firewall.azure_firewall_instance.ip_configuration[0].private_ip_address
|
|
}
|
|
|
|
resource "azurerm_subnet_route_table_association" "rt-aks-link" {
|
|
subnet_id = azurerm_subnet.snet-aks.id
|
|
route_table_id = azurerm_route_table.rt-aks.id
|
|
}
|