Azure rendering solution deployment framework

2023-07-26 08:29:55 -07:00 · 2023-07-26 08:29:55 -07:00 · aaedd80f60
--- a/src/terraform/examples/e2e/.github/workflows/terraform.apply.yml
+++ b/src/terraform/examples/e2e/.github/workflows/terraform.apply.yml
@ -52,7 +52,7 @@ jobs:
    steps:
      - uses: hashicorp/setup-terraform@v2
        with:
-          terraform_version: 1.4.6
+          terraform_version: 1.5.3

      - uses: actions/checkout@v3
        with:
--- a/src/terraform/examples/e2e/.github/workflows/terraform.plan.yml
+++ b/src/terraform/examples/e2e/.github/workflows/terraform.plan.yml
@ -51,7 +51,7 @@ jobs:
    steps:
      - uses: hashicorp/setup-terraform@v2
        with:
-          terraform_version: 1.4.6
+          terraform_version: 1.5.3

      - uses: actions/checkout@v3
        with:
--- a/src/terraform/examples/e2e/0.Global.Foundation/config.auto.tfvars
+++ b/src/terraform/examples/e2e/0.Global.Foundation/config.auto.tfvars
@ -64,7 +64,7 @@ monitor = {
  workspace = {
    sku = "PerGB2018"
  }
-  appInsights = {
+  insight = {
    type = "Node.JS"
  }
  retentionDays = 90
--- a/src/terraform/examples/e2e/0.Global.Foundation/main.tf
+++ b/src/terraform/examples/e2e/0.Global.Foundation/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
    time = {
      source  = "hashicorp/time"
@ -101,7 +101,7 @@ variable "monitor" {
          sku = string
        }
      )
-      appInsights = object(
+      insight = object(
        {
          type = string
        }
@ -256,13 +256,15 @@ resource "azurerm_log_analytics_workspace" "monitor" {
 }

 resource "azurerm_application_insights" "monitor" {
-  count               = module.global.monitor.name != "" ? 1 : 0
-  name                = module.global.monitor.name
-  location            = azurerm_resource_group.studio.location
-  resource_group_name = azurerm_resource_group.studio.name
-  workspace_id        = azurerm_log_analytics_workspace.monitor[0].id
-  application_type    = var.monitor.appInsights.type
-  retention_in_days   = var.monitor.retentionDays
+  count                      = module.global.monitor.name != "" ? 1 : 0
+  name                       = module.global.monitor.name
+  location                   = azurerm_resource_group.studio.location
+  resource_group_name        = azurerm_resource_group.studio.name
+  workspace_id               = azurerm_log_analytics_workspace.monitor[0].id
+  application_type           = var.monitor.insight.type
+  retention_in_days          = var.monitor.retentionDays
+  internet_ingestion_enabled = false
+  internet_query_enabled     = false
 }

 output "resourceGroupName" {
@ -275,7 +277,7 @@ output "monitor" {
      name = module.global.monitor.name
      id   = module.global.monitor.name != "" ? azurerm_log_analytics_workspace.monitor[0].workspace_id : ""
    }
-    appInsights = {
+    insight = {
      name = module.global.monitor.name
      id   = module.global.monitor.name != "" ? azurerm_application_insights.monitor[0].app_id : ""
    }
--- a/src/terraform/examples/e2e/0.Global.Foundation/module/variables.tf
+++ b/src/terraform/examples/e2e/0.Global.Foundation/module/variables.tf
@ -4,7 +4,7 @@

 variable "regionNames" { # Set Azure region names from "az account list-locations --query [].name"
  default = [
-    "WestUS2"
+    "WestUS3"
  ]
 }

--- a/src/terraform/examples/e2e/1.Virtual.Network/gateway.vpn.tf
+++ b/src/terraform/examples/e2e/1.Virtual.Network/gateway.vpn.tf
@ -136,6 +136,9 @@ resource "azurerm_local_network_gateway" "vpn" {
      bgp_peering_address = var.vpnGatewayLocal.bgp.peeringAddress
    }
  }
+  depends_on = [
+    azurerm_resource_group.network
+  ]
 }

 resource "azurerm_virtual_network_gateway_connection" "site_to_site" {
@ -144,7 +147,7 @@ resource "azurerm_virtual_network_gateway_connection" "site_to_site" {
  resource_group_name        = azurerm_resource_group.network[0].name
  location                   = local.computeNetworks[0].regionName
  type                       = "IPsec"
-  virtual_network_gateway_id = azurerm_virtual_network_gateway.vpn[local.virtualGatewayNetworks[0].name].id
+  virtual_network_gateway_id = azurerm_virtual_network_gateway.vpn[local.virtualGatewayNetworks[0].key].id
  local_network_gateway_id   = azurerm_local_network_gateway.vpn[count.index].id
  shared_key                 = module.global.keyVault.name != "" ? data.azurerm_key_vault_secret.gateway_connection[0].value : var.vpnGateway.sharedKey
  enable_bgp                 = var.vpnGatewayLocal.bgp.enable
--- a/src/terraform/examples/e2e/1.Virtual.Network/main.tf
+++ b/src/terraform/examples/e2e/1.Virtual.Network/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
  }
  backend "azurerm" {
--- a/src/terraform/examples/e2e/1.Virtual.Network/monitor.tf
+++ b/src/terraform/examples/e2e/1.Virtual.Network/monitor.tf
@ -4,6 +4,12 @@ data "azurerm_log_analytics_workspace" "studio" {
  resource_group_name = module.global.resourceGroupName
 }

+data "azurerm_application_insights" "studio" {
+  count               = module.global.monitor.name != "" ? 1 : 0
+  name                = module.global.monitor.name
+  resource_group_name = module.global.resourceGroupName
+}
+
 ######################################################################
 # Monitor (https://learn.microsoft.com/azure/azure-monitor/overview) #
 ######################################################################
@ -99,10 +105,18 @@ resource "azurerm_monitor_private_link_scope" "monitor" {
  resource_group_name = azurerm_resource_group.network[0].name
 }

-resource "azurerm_monitor_private_link_scoped_service" "monitor" {
+resource "azurerm_monitor_private_link_scoped_service" "monitor_workspace" {
  count               = module.global.monitor.name != "" ? 1 : 0
-  name                = module.global.monitor.name
+  name                = "${module.global.monitor.name}.workspace"
  resource_group_name = azurerm_resource_group.network[0].name
  linked_resource_id  = data.azurerm_log_analytics_workspace.studio[0].id
  scope_name          = azurerm_monitor_private_link_scope.monitor[0].name
 }
+
+resource "azurerm_monitor_private_link_scoped_service" "monitor_insight" {
+  count               = module.global.monitor.name != "" ? 1 : 0
+  name                = "${module.global.monitor.name}.insight"
+  resource_group_name = azurerm_resource_group.network[0].name
+  linked_resource_id  = data.azurerm_application_insights.studio[0].id
+  scope_name          = azurerm_monitor_private_link_scope.monitor[0].name
+}
--- a/src/terraform/examples/e2e/2.Artificial.Intelligence/config.auto.tfvars
+++ b/src/terraform/examples/e2e/2.Artificial.Intelligence/config.auto.tfvars
@ -6,25 +6,35 @@ resourceGroupName = "ArtistAnywhere.AI" # Alphanumeric, underscores, hyphens, pe

 openAI = {
  regionName    = "EastUS"
-  accountName   = "azstudio"
-  domainName    = "azstudio"
+  accountName   = "zai"
+  domainName    = "zai"
  serviceTier   = "S0"
  enableStorage = false
  networkAccess = {
    enablePublic     = true
    restrictOutbound = false
  }
+  modelDeployments = [
+    {
+      name    = "gpt-35-turbo"
+      format  = "OpenAI"
+      version = "0613"
+      scale   = "Standard"
+    }
+  ]
 }

-#################################################################################
-# Logic Apps (https://learn.microsoft.com/azure/logic-apps/logic-apps-overview) #
-#################################################################################
+####################################################################
+# Function App (https://learn.microsoft.com/azure/azure-functions) #
+####################################################################

-appWorkflows = [
-  {
-    name = "animatic"
+functionApp = {
+  name = "zai"
+  servicePlan = {
+    computeTier = "S1"
+    alwaysOn    = true
  }
-]
+}

 #######################################################################
 # Resource dependency configuration for pre-existing deployments only #
--- a/src/terraform/examples/e2e/2.Artificial.Intelligence/function.app.tf
+++ b/src/terraform/examples/e2e/2.Artificial.Intelligence/function.app.tf
@ -0,0 +1,114 @@
+variable "functionApp" {
+  type = object(
+    {
+      name = string
+      servicePlan = object(
+        {
+          computeTier = string
+          alwaysOn    = bool
+        }
+      )
+    }
+  )
+}
+
+resource "azurerm_storage_account" "studio" {
+  name                     = var.functionApp.name
+  resource_group_name      = azurerm_resource_group.ai.name
+  location                 = azurerm_resource_group.ai.location
+  account_kind             = "StorageV2"
+  account_tier             = "Standard"
+  account_replication_type = "LRS"
+}
+
+resource "azurerm_application_insights" "studio" {
+  name                = var.functionApp.name
+  location            = azurerm_resource_group.ai.location
+  resource_group_name = azurerm_resource_group.ai.name
+  application_type    = "web"
+}
+
+resource "azurerm_service_plan" "studio" {
+  name                = var.functionApp.name
+  resource_group_name = azurerm_resource_group.ai.name
+  location            = azurerm_resource_group.ai.location
+  sku_name            = var.functionApp.servicePlan.computeTier
+  os_type             = "Windows"
+}
+
+resource "azurerm_windows_function_app" "studio" {
+  name                          = var.functionApp.name
+  resource_group_name           = azurerm_resource_group.ai.name
+  location                      = azurerm_resource_group.ai.location
+  service_plan_id               = azurerm_service_plan.studio.id
+  storage_account_name          = azurerm_storage_account.studio.name
+  storage_uses_managed_identity = true
+  identity {
+    type = "SystemAssigned, UserAssigned"
+    identity_ids = [
+      data.azurerm_user_assigned_identity.studio.id
+    ]
+  }
+  site_config {
+    application_insights_connection_string = azurerm_application_insights.studio.connection_string
+    application_insights_key               = azurerm_application_insights.studio.instrumentation_key
+    always_on                              = var.functionApp.servicePlan.alwaysOn
+    application_stack {
+      dotnet_version = "v7.0"
+    }
+    cors {
+      allowed_origins = [
+        "https://portal.azure.com"
+      ]
+    }
+  }
+  app_settings = {
+    AzureWebJobsStorage     = "DefaultEndpointsProtocol=https;AccountName=${azurerm_storage_account.studio.name};AccountKey=${azurerm_storage_account.studio.primary_access_key}"
+    AzureOpenAI_ApiEndpoint = azurerm_cognitive_account.open_ai.endpoint
+    AzureOpenAI_ApiKey      = azurerm_cognitive_account.open_ai.primary_access_key
+  }
+}
+
+resource "azurerm_function_app_function" "image_generate" {
+  name            = "image-generate"
+  language        = "CSharp"
+  function_app_id = azurerm_windows_function_app.studio.id
+  config_json = jsonencode({
+    bindings = [
+      {
+        name      = "request"
+        type      = "httpTrigger"
+        direction = "in"
+        authLevel = "function"
+        methods = [
+          "post"
+        ]
+      },
+      {
+        name      = "$return"
+        type      = "http"
+        direction = "out"
+      }
+    ]
+  })
+  test_data = jsonencode({
+    chat = {
+      modelName      = "gpt-35-turbo"
+      historyContext = "You are the lead singer in a rock band"
+      requestMessage = "What do you look like"
+    }
+    image = {
+      description = ""
+      height      = 1024
+      width       = 1024
+    }
+  })
+  file {
+    name    = "function.proj"
+    content = file("image.generate/function.proj")
+  }
+  file {
+    name    = "run.csx"
+    content = file("image.generate/run.csx")
+  }
+}
--- a/src/terraform/examples/e2e/2.Artificial.Intelligence/image.generate/function.proj
+++ b/src/terraform/examples/e2e/2.Artificial.Intelligence/image.generate/function.proj
@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.SemanticKernel" Version="0.17.230718.1-preview" />
+  </ItemGroup>
+</Project>
--- a/src/terraform/examples/e2e/2.Artificial.Intelligence/image.generate/run.csx
+++ b/src/terraform/examples/e2e/2.Artificial.Intelligence/image.generate/run.csx
@ -0,0 +1,54 @@
+#r "Newtonsoft.Json"
+
+using Newtonsoft.Json;
+using Microsoft.AspNetCore.Mvc;
+
+using Microsoft.SemanticKernel;
+using Microsoft.SemanticKernel.AI.ChatCompletion;
+using Microsoft.SemanticKernel.AI.ImageGeneration;
+
+public static async Task<IActionResult> Run(HttpRequest request, ILogger logger)
+{
+  string requestBody = await new StreamReader(request.Body).ReadToEndAsync();
+  dynamic requestData = JsonConvert.DeserializeObject(requestBody);
+
+  dynamic chat = requestData.chat;
+  string chatModelName = chat.modelName;
+  string chatHistoryContext = chat.historyContext;
+  string chatRequestMessage = chat.requestMessage;
+
+  dynamic image = requestData.image;
+  string imageDescription = image.description;
+  int imageHeight = image.height;
+  int imageWidth = image.width;
+
+  string openAI_apiEndpoint = Environment.GetEnvironmentVariable("AzureOpenAI_ApiEndpoint");
+  string openAI_apiKey = Environment.GetEnvironmentVariable("AzureOpenAI_ApiKey");
+
+  KernelBuilder kernelBuilder = new KernelBuilder();
+  kernelBuilder.WithAzureChatCompletionService(chatModelName, openAI_apiEndpoint, openAI_apiKey);
+  kernelBuilder.WithAzureOpenAIImageGenerationService(openAI_apiEndpoint, openAI_apiKey);
+  IKernel kernel = kernelBuilder.Build();
+
+  Dictionary<string, string> functionResult = new Dictionary<string, string>();
+  try
+  {
+    IChatCompletion chatGPT = kernel.GetService<IChatCompletion>();
+    ChatHistory chatHistory = chatGPT.CreateNewChat(chatHistoryContext);
+    chatHistory.AddUserMessage(chatRequestMessage);
+    functionResult["chatResponse"] = await chatGPT.GenerateMessageAsync(chatHistory);
+
+    if (imageDescription == "") {
+      imageDescription = functionResult["chatResponse"];
+    }
+
+    IImageGeneration dallE = kernel.GetService<IImageGeneration>();
+    functionResult["imageUrl"] = await dallE.GenerateImageAsync(imageDescription, imageWidth, imageHeight);
+  }
+  catch (Exception ex)
+  {
+    functionResult["exception"] = ex.ToString();
+  }
+
+  return new OkObjectResult(functionResult);
+}
--- a/src/terraform/examples/e2e/2.Artificial.Intelligence/main.tf
+++ b/src/terraform/examples/e2e/2.Artificial.Intelligence/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
  }
  backend "azurerm" {
@ -30,32 +30,6 @@ variable "resourceGroupName" {
  type = string
 }

-variable "openAI" {
-  type = object(
-    {
-      regionName    = string
-      accountName   = string
-      domainName    = string
-      serviceTier   = string
-      enableStorage = bool
-      networkAccess = object(
-        {
-          enablePublic     = bool
-          restrictOutbound = bool
-        }
-      )
-    }
-  )
-}
-
-variable "appWorkflows" {
-  type = list(object(
-    {
-      name = string
-    }
-  ))
-}
-
 variable "computeNetwork" {
  type = object(
    {
@ -66,10 +40,6 @@ variable "computeNetwork" {
  )
 }

-data "http" "client_address" {
-  url = "https://api.ipify.org?format=json"
-}
-
 data "azurerm_user_assigned_identity" "studio" {
  name                = module.global.managedIdentity.name
  resource_group_name = module.global.resourceGroupName
@ -110,136 +80,6 @@ resource "azurerm_resource_group" "ai" {
  location = var.openAI.regionName != "" ? var.openAI.regionName : module.global.regionNames[0]
 }

-resource "azurerm_private_dns_zone" "cognitive_services" {
-  name                = "privatelink.cognitiveservices.azure.com"
-  resource_group_name = azurerm_resource_group.ai.name
-}
-
-resource "azurerm_private_dns_zone" "open_ai" {
-  name                = "privatelink.openai.azure.com"
-  resource_group_name = azurerm_resource_group.ai.name
-}
-
-resource "azurerm_private_dns_zone_virtual_network_link" "cognitive_services" {
-  name                  = "${data.azurerm_virtual_network.compute.name}.cognitive-services"
-  resource_group_name   = azurerm_resource_group.ai.name
-  private_dns_zone_name = azurerm_private_dns_zone.cognitive_services.name
-  virtual_network_id    = data.azurerm_virtual_network.compute.id
-}
-
-resource "azurerm_private_dns_zone_virtual_network_link" "open_ai" {
-  name                  = "${data.azurerm_virtual_network.compute.name}.open-ai"
-  resource_group_name   = azurerm_resource_group.ai.name
-  private_dns_zone_name = azurerm_private_dns_zone.open_ai.name
-  virtual_network_id    = data.azurerm_virtual_network.compute.id
-}
-
-# resource "azurerm_private_endpoint" "cognitive_services" {
-#   name                = "${data.azurerm_virtual_network.compute.name}.cognitive-services"
-#   resource_group_name = azurerm_resource_group.ai.name
-#   location            = azurerm_resource_group.ai.location
-#   subnet_id           = data.azurerm_subnet.farm.id
-#   private_service_connection {
-#     name                           = azurerm_cognitive_account.open_ai.name
-#     private_connection_resource_id = azurerm_cognitive_account.open_ai.id
-#     is_manual_connection           = false
-#     subresource_names = [
-#       "account"
-#     ]
-#   }
-#   private_dns_zone_group {
-#     name = azurerm_cognitive_account.open_ai.name
-#     private_dns_zone_ids = [
-#       azurerm_private_dns_zone.cognitive_services.id
-#     ]
-#   }
-# }
-
-# resource "azurerm_private_endpoint" "open_ai" {
-#   name                = "${data.azurerm_virtual_network.compute.name}.open-ai"
-#   resource_group_name = azurerm_resource_group.ai.name
-#   location            = azurerm_resource_group.ai.location
-#   subnet_id           = data.azurerm_subnet.farm.id
-#   private_service_connection {
-#     name                           = azurerm_cognitive_account.open_ai.name
-#     private_connection_resource_id = azurerm_cognitive_account.open_ai.id
-#     is_manual_connection           = false
-#     subresource_names = [
-#       "account"
-#     ]
-#   }
-#   private_dns_zone_group {
-#     name = azurerm_cognitive_account.open_ai.name
-#     private_dns_zone_ids = [
-#       azurerm_private_dns_zone.open_ai.id
-#     ]
-#   }
-# }
-
-resource "azurerm_cognitive_account" "open_ai" {
-  name                               = var.openAI.accountName
-  resource_group_name                = azurerm_resource_group.ai.name
-  location                           = azurerm_resource_group.ai.location
-  public_network_access_enabled      = var.openAI.networkAccess.enablePublic
-  outbound_network_access_restricted = var.openAI.networkAccess.restrictOutbound
-  custom_subdomain_name              = var.openAI.domainName != "" ? var.openAI.domainName : null
-  sku_name                           = var.openAI.serviceTier
-  kind                               = "OpenAI"
-  identity {
-    type = "UserAssigned"
-    identity_ids = [
-      data.azurerm_user_assigned_identity.studio.id
-    ]
-  }
-  network_acls {
-    default_action = "Deny"
-    virtual_network_rules {
-      subnet_id = data.azurerm_subnet.farm.id
-    }
-    ip_rules = [
-      jsondecode(data.http.client_address.response_body).ip
-    ]
-  }
-  dynamic storage {
-    for_each = var.openAI.enableStorage ? [1] : []
-    content {
-      storage_account_id = data.azurerm_storage_account.studio.id
-    }
-  }
-}
-
-#################################################################################
-# Logic Apps (https://learn.microsoft.com/azure/logic-apps/logic-apps-overview) #
-#################################################################################
-
-resource "azurerm_logic_app_workflow" "ai" {
-  for_each = {
-    for appWorkflow in var.appWorkflows : appWorkflow.name => appWorkflow
-  }
-  name                = each.value.name
-  location            = azurerm_resource_group.ai.location
-  resource_group_name = azurerm_resource_group.ai.name
-  identity {
-    type = "UserAssigned"
-    identity_ids = [
-      data.azurerm_user_assigned_identity.studio.id
-    ]
-  }
-}
-
 output "resourceGroupName" {
  value = azurerm_resource_group.ai.name
 }
-
-output "openAI" {
-  value = azurerm_cognitive_account.open_ai.endpoint
-}
-
-output "appWorkflows" {
-  value = [
-    for appWorkflow in azurerm_logic_app_workflow.ai : {
-      name     = appWorkflow.name
-      endpoint = "${appWorkflow.access_endpoint}?api-version=2019-05-01"
-    }
-  ]
-}
--- a/src/terraform/examples/e2e/2.Artificial.Intelligence/open.ai.tf
+++ b/src/terraform/examples/e2e/2.Artificial.Intelligence/open.ai.tf
@ -0,0 +1,149 @@
+variable "openAI" {
+  type = object(
+    {
+      regionName    = string
+      accountName   = string
+      domainName    = string
+      serviceTier   = string
+      enableStorage = bool
+      networkAccess = object(
+        {
+          enablePublic     = bool
+          restrictOutbound = bool
+        }
+      )
+      modelDeployments = list(object(
+        {
+          name    = string
+          format  = string
+          version = string
+          scale   = string
+        }
+      ))
+    }
+  )
+}
+
+resource "azurerm_private_dns_zone" "cognitive_services" {
+  count               = var.openAI.networkAccess.enablePublic ? 0 : 1
+  name                = "privatelink.cognitiveservices.azure.com"
+  resource_group_name = azurerm_resource_group.ai.name
+}
+
+resource "azurerm_private_dns_zone" "open_ai" {
+  count               = var.openAI.networkAccess.enablePublic ? 0 : 1
+  name                = "privatelink.openai.azure.com"
+  resource_group_name = azurerm_resource_group.ai.name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "cognitive_services" {
+  count                 = var.openAI.networkAccess.enablePublic ? 0 : 1
+  name                  = "${data.azurerm_virtual_network.compute.name}.cognitive-services"
+  resource_group_name   = azurerm_resource_group.ai.name
+  private_dns_zone_name = azurerm_private_dns_zone.cognitive_services[0].name
+  virtual_network_id    = data.azurerm_virtual_network.compute.id
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "open_ai" {
+  count                 = var.openAI.networkAccess.enablePublic ? 0 : 1
+  name                  = "${data.azurerm_virtual_network.compute.name}.open-ai"
+  resource_group_name   = azurerm_resource_group.ai.name
+  private_dns_zone_name = azurerm_private_dns_zone.open_ai[0].name
+  virtual_network_id    = data.azurerm_virtual_network.compute.id
+}
+
+# resource "azurerm_private_endpoint" "cognitive_services" {
+#   count               = var.openAI.networkAccess.enablePublic ? 0 : 1
+#   name                = "${data.azurerm_virtual_network.compute.name}.cognitive-services"
+#   resource_group_name = azurerm_resource_group.ai.name
+#   location            = azurerm_resource_group.ai.location
+#   subnet_id           = data.azurerm_subnet.farm.id
+#   private_service_connection {
+#     name                           = azurerm_cognitive_account.open_ai.name
+#     private_connection_resource_id = azurerm_cognitive_account.open_ai.id
+#     is_manual_connection           = false
+#     subresource_names = [
+#       "account"
+#     ]
+#   }
+#   private_dns_zone_group {
+#     name = azurerm_cognitive_account.open_ai.name
+#     private_dns_zone_ids = [
+#       azurerm_private_dns_zone.cognitive_services.id
+#     ]
+#   }
+# }
+
+# resource "azurerm_private_endpoint" "open_ai" {
+#   name                = "${data.azurerm_virtual_network.compute.name}.open-ai"
+#   resource_group_name = azurerm_resource_group.ai.name
+#   location            = azurerm_resource_group.ai.location
+#   subnet_id           = data.azurerm_subnet.farm.id
+#   private_service_connection {
+#     name                           = azurerm_cognitive_account.open_ai.name
+#     private_connection_resource_id = azurerm_cognitive_account.open_ai.id
+#     is_manual_connection           = false
+#     subresource_names = [
+#       "account"
+#     ]
+#   }
+#   private_dns_zone_group {
+#     name = azurerm_cognitive_account.open_ai.name
+#     private_dns_zone_ids = [
+#       azurerm_private_dns_zone.open_ai.id
+#     ]
+#   }
+# }
+
+resource "azurerm_cognitive_account" "open_ai" {
+  name                               = var.openAI.accountName
+  resource_group_name                = azurerm_resource_group.ai.name
+  location                           = azurerm_resource_group.ai.location
+  public_network_access_enabled      = var.openAI.networkAccess.enablePublic
+  outbound_network_access_restricted = var.openAI.networkAccess.restrictOutbound
+  custom_subdomain_name              = var.openAI.domainName != "" ? var.openAI.domainName : null
+  sku_name                           = var.openAI.serviceTier
+  kind                               = "OpenAI"
+  identity {
+    type = "UserAssigned"
+    identity_ids = [
+      data.azurerm_user_assigned_identity.studio.id
+    ]
+  }
+  dynamic network_acls {
+    for_each = var.openAI.networkAccess.enablePublic ? [] : [1]
+    content {
+      default_action = "Deny"
+      virtual_network_rules {
+        subnet_id = data.azurerm_subnet.farm.id
+      }
+    }
+  }
+  dynamic storage {
+    for_each = var.openAI.enableStorage ? [1] : []
+    content {
+      storage_account_id = data.azurerm_storage_account.studio.id
+    }
+  }
+}
+
+resource "azurerm_cognitive_deployment" "open_ai" {
+  for_each = {
+    for modelDeployment in var.openAI.modelDeployments : modelDeployment.name => modelDeployment if modelDeployment.name != ""
+  }
+  name                   = each.value.name
+  cognitive_account_id   = azurerm_cognitive_account.open_ai.id
+  # version_upgrade_option = "OnceCurrentVersionExpired"
+  model {
+    name    = each.value.name
+    format  = each.value.format
+    version = each.value.version
+  }
+  scale {
+    type = each.value.scale
+  }
+}
+
+output "openAI" {
+  value = azurerm_cognitive_account.open_ai.endpoint
+}
--- a/src/terraform/examples/e2e/3.Image.Builder/main.tf
+++ b/src/terraform/examples/e2e/3.Image.Builder/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
  }
  backend "azurerm" {
@ -445,9 +445,6 @@ resource "azurerm_resource_group_template_deployment" "image_builder" {
                      "[concat('C:\\AzureData\\customize.ps1 -buildConfigEncoded ', base64(string(union(parameters('imageTemplate').build, createObject('binStorage', parameters('binStorage')), createObject('renderManager', parameters('renderManager')), createObject('servicePassword', parameters('servicePassword'))))))]"
                    ],
                    "runElevated": "[if(and(contains(parameters('renderManager'), 'Deadline'), equals(parameters('imageTemplate').build.machineType, 'Scheduler')), true(), false())]"
-                  },
-                  {
-                    "type": "WindowsRestart"
                  }
                ]
              }
--- a/src/terraform/examples/e2e/4.Storage/main.tf
+++ b/src/terraform/examples/e2e/4.Storage/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
    time = {
      source  = "hashicorp/time"
--- a/src/terraform/examples/e2e/4.Storage/weka.tf
+++ b/src/terraform/examples/e2e/4.Storage/weka.tf
@ -150,7 +150,7 @@ locals {
  wekaObjectTier = merge(var.weka.objectTier, {
    storage = {
      accountName   = var.weka.objectTier.storage.accountName != "" ? var.weka.objectTier.storage.accountName : try(data.azurerm_storage_account.blob[0].name, "")
-      accountKey    = var.weka.objectTier.storage.accountKey != "" ? var.weka.objectTier.storage.accountKey : try(data.azurerm_storage_account.blob[0].secondary_access_key, "")
+      accountKey    = var.weka.objectTier.storage.accountKey != "" ? var.weka.objectTier.storage.accountKey : try(data.azurerm_storage_account.blob[0].primary_access_key, "")
      containerName = var.weka.objectTier.storage.containerName != "" ? var.weka.objectTier.storage.containerName : "weka"
    }
  })
--- a/src/terraform/examples/e2e/5.Storage.Cache/main.tf
+++ b/src/terraform/examples/e2e/5.Storage.Cache/main.tf
@ -1,13 +1,13 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
    azuread = {
      source  = "hashicorp/azuread"
-      version = "~>2.39.0"
+      version = "~>2.40.0"
    }
    avere = {
      source  = "hashicorp/avere"
--- a/src/terraform/examples/e2e/6.Render.Manager/main.tf
+++ b/src/terraform/examples/e2e/6.Render.Manager/main.tf
@ -1,13 +1,13 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
    azuread = {
      source  = "hashicorp/azuread"
-      version = "~>2.39.0"
+      version = "~>2.40.0"
    }
  }
  backend "azurerm" {
--- a/src/terraform/examples/e2e/7.Render.Farm/main.tf
+++ b/src/terraform/examples/e2e/7.Render.Farm/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
  }
  backend "azurerm" {
--- a/src/terraform/examples/e2e/8.Artist.Workstation/main.tf
+++ b/src/terraform/examples/e2e/8.Artist.Workstation/main.tf
@ -1,9 +1,9 @@
 terraform {
-  required_version = ">= 1.4.6"
+  required_version = ">= 1.5.3"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
-      version = "~>3.64.0"
+      version = "~>3.66.0"
    }
  }
  backend "azurerm" {
--- a/src/terraform/examples/e2e/README.md
+++ b/src/terraform/examples/e2e/README.md
@ -13,7 +13,7 @@ The following *core principles* are implemented throughout the Azure Artist Anyw
 | - | - | - | - |
 | [0 Global Foundation](#0-global-foundation) | Defines&#160;global&#160;config&#160;([Azure&#160;regions](https://azure.microsoft.com/regions))&#160;and&#160;core&#160;solution resources ([Terraform state storage](https://developer.hashicorp.com/terraform/language/settings/backends/azurerm), [Monitor log storage](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview)). | Yes | Yes |
 | [1 Virtual Network](#1-virtual-network) | Deploys [Virtual Network](https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview), [Private DNS](https://learn.microsoft.com/azure/dns/private-dns-overview), [Network Security Groups](https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview), etc with [VPN](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways) or [ExpressRoute](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) gateway services. | Yes,&#160;if&#160;[Virtual&#160;Network](https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview) not yet deployed | Yes,&#160;if&#160;[Virtual&#160;Network](https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview) not yet deployed |
-| [2&#160;Artificial&#160;Intelligence](#2-artificial-intelligence) | Deploys [Open AI](https://learn.microsoft.com/azure/cognitive-services/openai/overview) services ([GPT-4](https://learn.microsoft.com/azure/cognitive-services/openai/concepts/models#gpt-4-models), [DALL-E 2](https://openai.com/product/dall-e-2), etc) and sample [Logic App](https://learn.microsoft.com/azure/logic-apps/logic-apps-overview) workflow for [Animatics](https://en.wikipedia.org/wiki/Storyboard#Animatics) video generation (TBD). | No | No |
+| [2&#160;Artificial&#160;Intelligence](#2-artificial-intelligence) | Deploys [Open AI](https://learn.microsoft.com/azure/cognitive-services/openai/overview) ([GPT-4](https://learn.microsoft.com/azure/cognitive-services/openai/concepts/models#gpt-4-models) and [DALL-E 2](https://openai.com/product/dall-e-2) models) securely with orchestration via [Semantic Kernel](https://learn.microsoft.com/semantic-kernel/overview/) and [Functions](https://learn.microsoft.com/azure/azure-functions/functions-overview). | No | No |
 | [3 Image Builder](#3-image-builder) | Deploys [Compute Gallery](https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries) image definitions and templates for custom images built via the [Image Builder](https://learn.microsoft.com/azure/virtual-machines/image-builder-overview) service. | No, use your custom images via [image.id](https://github.com/Azure/Avere/blob/main/src/terraform/examples/e2e/7.Render.Farm/config.auto.tfvars#L14) | No, use your custom images via [image.id](https://github.com/Azure/Avere/blob/main/src/terraform/examples/e2e/7.Render.Farm/config.auto.tfvars#L14) |
 | [4 Storage](#4-storage) | Deploys native ([Blob NFS](https://learn.microsoft.com/azure/storage/blobs/network-file-system-protocol-support), [Files](https://learn.microsoft.com/azure/storage/files/storage-files-introduction), [NetApp Files](https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-introduction)) and/or hosted ([Weka](https://azuremarketplace.microsoft.com/marketplace/apps/weka1652213882079.weka_data_platform), [Hammerspace](https://azuremarketplace.microsoft.com/marketplace/apps/hammerspace.hammerspace_4_6_5), [Qumulo](https://azuremarketplace.microsoft.com/marketplace/apps/qumulo1584033880660.qumulo-saas-mpp)) storage services with optional sample data load for [Blender](https://www.blender.org) and [PBRT](https://pbrt.org). | No | Yes |
 | [5 Storage Cache](#5-storage-cache) | Deploys [HPC Cache](https://learn.microsoft.com/azure/hpc-cache/hpc-cache-overview) or [Avere vFXT](https://learn.microsoft.com/azure/avere-vfxt/avere-vfxt-overview) cluster for highly-available and scalable storage file caching on-demand. | Yes | No |