You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: deploy/aks/scripts/set_ingress_tls.ps1
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -101,7 +101,7 @@ if ($certificate) {
101
101
102
102
103
103
# Enable azure key vault as Secrets Store CSI driver for application routing add-on enabled
104
-
$keyVaultId= az keyvault show --name $kvName--query id -o tsv
104
+
$keyVaultId= az keyvault show -g $clusterRG--name $kvName--query id -o tsv
105
105
106
106
$secretsProvider= az aks show -g $clusterRG-n $clusterName--query "addonProfiles.azureKeyvaultSecretsProvider"-o json |ConvertFrom-Json
107
107
@@ -114,7 +114,7 @@ if ($secretsProvider -and $secretsProvider.PSObject.Properties['enabled'] -and (
114
114
$IngressServicePrincipalID= az ad sp list --display-name "webapprouting-$clusterName"--query "[].id"--output tsv
115
115
116
116
Write-Host"Assigning Key Vault access policies to the Ingress Service Principal [$IngressServicePrincipalID] for Key Vault [$kvName]"
117
-
az keyvault set-policy--name $kvName--object-id $IngressServicePrincipalID--secret-permissions get list --certificate-permissions get list
117
+
az keyvault set-policy-g $clusterRG--name $kvName--object-id $IngressServicePrincipalID--secret-permissions get list --certificate-permissions get list
# Add a DNS name ($adAppName) to the public IP address
@@ -102,8 +102,11 @@ else
102
102
if [ -f"aks-ingress-tls.pfx" ];then
103
103
echo"aks-ingress-tls.pfx found."
104
104
else
105
-
echo"Please create a aks-ingress-tls.pfx. For more info see https://learn.microsoft.com/en-us/azure/aks/app-routing-dns-ssl#create-and-export-a-self-signed-ssl-certificate"
106
-
exit 1
105
+
echo"aks-ingress-tls.pfx not found... trying to create a new for the hostname $appHostName"
echo"Azure Key Vault Secrets Provider add-on is ENABLED"
122
-
else
123
+
#if [ "$secretsProviderEnabled" = "true" ]; then
124
+
# echo "Azure Key Vault Secrets Provider add-on is ENABLED"
125
+
#else
123
126
echo"Enabling Azure Key Vault Secrets Provider add-on for aks ingress. KeyVault Id[$keyVaultId]"
124
127
az aks approuting update -g $clusterRG -n $clusterName --enable-kv --attach-kv $keyVaultId
125
128
126
129
IngressServicePrincipalID=$(az ad sp list --display-name "webapprouting-$clusterName" --query "[].id" --output tsv)
127
130
128
131
echo"Assigning Key Vault access policies to the Ingress Service Principal [$IngressServicePrincipalID] for Key Vault [$kvName]"
129
-
az keyvault set-policy --name $kvName --object-id $IngressServicePrincipalID --secret-permissions get list --certificate-permissions get list
130
-
fi
132
+
az keyvault set-policy -g $clusterRG --name $kvName --object-id $IngressServicePrincipalID --secret-permissions get list --certificate-permissions get list
133
+
#fi
131
134
132
135
# Create the Ingress resource with TLS configuration
Copy file name to clipboardExpand all lines: docs/aca/README-ACA.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -310,7 +310,7 @@ However, you can try the [Azure pricing calculator](https://azure.com/e/8ffbe5b1
310
310
The first 180,000 vCPU-seconds, 360,000 GiB-seconds, and 2 million requests each month are free for ACA. To reduce costs, you can switch to free SKUs Document Intelligence by changing the parameters file under the `infra` folder. There are some limits to consider; for example, the free Document Intelligence resource only analyzes the first 2 pages of each document.
311
311
312
312
⚠️ To avoid unnecessary costs, remember to take down your app if it's no longer in use,
313
-
either by deleting the resource group in the Portal or running `azd down`.
313
+
either by deleting the resource group in the Portal or running `azd down --purge`.
Copy file name to clipboardExpand all lines: docs/aca/login_and_acl.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ The [azure-search-openai-demo-java](/) project can set up a full RAG chat app on
22
22
23
23
This guide demonstrates how to add an optional login and document level access control system to the sample. This system can be used to restrict access to indexed data to specific users based their [user object id](https://learn.microsoft.com/partner-center/find-ids-and-domain-names#find-the-user-object-id).
-[Examples of an azd deployment changing the default chatgpt deployment model](#examples-of-an-azd-deployment-changing-the-default-chatgpt-deployment-model)
37
+
-[Examples of an azd deployment reusing an existing Azure OpenAI and Azure AI Search resources](#examples-of-an-azd-deployment-reusing-an-existing-azure-openai-and-azure-ai-search-resources)
-[Custom Data Ingestion and Indexing](#custom-data-ingestion-and-indexing)
45
45
-[Productionizing](#productionizing)
46
46
-[Cost estimation](#cost-estimation)
47
47
-[Note](#note)
@@ -72,7 +72,7 @@ All prerequisites are already installed in the container. You can skip to the [S
72
72
-**Important**: Ensure you can run `pwsh.exe` from a PowerShell command. If this fails, you likely need to upgrade PowerShell.
73
73
-[Docker Desktop](https://www.docker.com/products/docker-desktop/) or other docker agents
74
74
-[Helm](https://helm.sh/docs/intro/install/)
75
-
-_[K9s](https://k9scli.io/topics/install/) For K8s management - Optional_
75
+
-[K9s](https://k9scli.io/topics/install/) For K8s management - Optional
76
76
77
77
> [!WARNING] Your Azure Account must have `Microsoft.Authorization/roleAssignments/write` permissions, such as [User Access Administrator](https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#user-access-administrator) or [Owner](https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#owner).
78
78
@@ -106,6 +106,10 @@ It will look like the following:
106
106
107
107
108
108
109
+
4. When you enable login and ACL, the https url will be printed in the console output, and you can use that to access the application. For more information on enabling login and ACL, see [here](./login_and_acl.md).
110
+
111
+
112
+
109
113
> NOTE: It may take a minute for the application to be fully deployed.
110
114
111
115
### Deploying with existing Azure resources
@@ -187,22 +191,6 @@ azd env set AZURE_SEARCH_SERVICE_LOCATION "eastus2" # Region of the ACS service
187
191
188
192
azd up
189
193
```
190
-
### Running locally
191
-
192
-
1. Run
193
-
194
-
```shell
195
-
az login
196
-
```
197
-
198
-
2. Change dir to `deploy/aks`
199
-
200
-
```shell
201
-
cd deploy/aks
202
-
```
203
-
204
-
3. Run the `./start-compose.ps1` (Windows) or `./start-compose.sh` (Linux/Mac) scripts or run the "VS Code Task: Start App" to start the project locally.
205
-
4. Wait for the docker compose to start all the containers (web, api, indexer) and refresh your browser to [http://localhost](http://localhost)
206
194
207
195
### UI Navigation
208
196
@@ -232,30 +220,34 @@ Under "Trace & Events" panel you can review custom Java informational logs to be
232
220
233
221
To see any exceptions and server errors, navigate to the "Investigate -> Failures" blade and use the filtering tools to locate a specific exception. You can see Java stack traces on the right-hand side.
234
222
235
-
### Enabling authentication
223
+
### Enabling login and search filtering
224
+
225
+
See [here](./login_and_acl.md) for detailed guidance.
226
+
227
+
### Enabling client-side chat history
228
+
229
+
This feature allows users to view the chat history of their conversation, stored in the browser using [IndexedDB](https://developer.mozilla.org/docs/Web/API/IndexedDB_API). That means the chat history will be available only on the device where the chat was initiated. To enable browser-stored chat history, run:
236
230
237
231
```shell
238
-
azd env setAZURE_USE_EASY_AUTHtrue
232
+
azd env setUSE_CHAT_HISTORY_BROWSERtrue
239
233
```
234
+
This is useful especially for unauthenticated users. For authenticated ones see below.
240
235
241
-
By default, the deployed apps on AKS will have no authentication or access restrictions enabled, meaning anyone with routable network access to the web app can chat with your indexed data. If you enable easy authentication the deployment will use a script based on [EasyAuthForK8s](https://github.com/Azure/EasyAuthForK8s) and using [Cert Manager](https://cert-manager.io/) to manage easy authentication for you using Microsoft Entra.
236
+
### Enabling persistent chat history with Azure Cosmos DB
242
237
243
-
To then limit access to a specific setof users or groups, you can follow the steps from [Restrict your Microsoft Entra app to a set of users](https://learn.microsoft.com/entra/identity-platform/howto-restrict-your-app-to-a-set-of-users) by changing "Assignment Required?"option under the Enterprise Application, and then assigning users/groups access. Users not granted explicit access will receive the error message -AADSTS50105: Your administrator has configured the application <app_name> to block users
238
+
This feature allows authenticated users to view the chat history of their conversations, stored in the server-side storage using [Azure Cosmos DB](https://learn.microsoft.com/azure/cosmos-db/).This option requires that authentication be enabled. The chat history will be persistent and accessible from any device where the user logs in with the same account. To enable server-stored chat history, run:
244
239
245
-
### App Continuous Integration
240
+
```shell
241
+
azd env set USE_CHAT_HISTORY_COSMOS true
242
+
```
246
243
247
-
:sunny: :cloud: :construction_worker_man: WIP
244
+
When both the browser-stored and Cosmos DB options are enabled, Cosmos DB will take precedence over browser-stored chat history.
248
245
249
-
### Custom Data Ingestion and Indexing
250
246
251
-
The repository includes sample pdf documents in the data folder. They are ingested in blob container and then indexed in Azure AI Search during infra provisioning by Azure Developer CLI post provision hooks.
247
+
### App Continuous Integration
252
248
253
-
If you want to chat with your custom documents you can:
249
+
:sunny::cloud::construction_worker_man: WIP
254
250
255
-
1. Add your pdf documents in the [data folder](../../data).
256
-
2. Open a terminal and cd to repo root folder for app service deployment. Example `cd path/to/your/custom/dir/azure-search-openai-demo-java/deploy/aks`
257
-
3. Run `./scripts/prepdocs.ps1`if you are on windows or `./scripts/prepdocs.sh` on linux
258
-
4. Wait few minutes after the script complete so that the ingestion process, running on the indexer app, will ingest all the documents. This is not a 'delta' process, it's not updating **only** the new files you've added. Instead, on each run, all documents in data folder will be ingested. Feel free to add new files you want to ingest and delete/move the old documents from the data folder. Once you've run the script and it completes successfully, Azure AI Search index has been updated and stored (until you want to manually delete it from your azure Azure AI Search instance)
259
251
260
252
### Productionizing
261
253
@@ -307,7 +299,7 @@ However, you can try the [Azure pricing calculator](https://azure.com/e/8ffbe5b1
307
299
To reduce costs, you can switch to free SKUs Form Recognizer by changing the parameters file under the `infra` folder. There are some limits to consider; for example, the free Form Recognizer resource only analyzes the first 2 pages of each document. You can also reduce costs associated with the Form Recognizer by reducing the number of documents in the `data` folder, or changing the code to use the Itext document based parser, or by removing the postprovision hook in `azure.yaml` that runs the `indexer java cli`.
308
300
309
301
⚠️ To avoid unnecessary costs, remember to take down your app if it's no longer in use,
310
-
either by deleting the resource group in the Portal or running `azd down`.
302
+
either by deleting the resource group in the Portal or running `azd down --purge`.
0 commit comments