Skip to content

Commit 343f7e1

Browse files
amitkrprajapatimrDzurb
amitkrprajapati
and
mrDzurb
authored
[AQUA] CLI to verify policies to perform operations related to AQUA. (#1218)
Co-authored-by: Dmitrii Cherkasov <dmitrii.cherkasov@oracle.com>
1 parent fc092b0 commit 343f7e1

File tree

10 files changed

+1397
-1
lines changed

10 files changed

+1397
-1
lines changed

‎ads/aqua/cli.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
from ads.aqua.finetuning import AquaFineTuningApp
1515
from ads.aqua.model import AquaModelApp
1616
from ads.aqua.modeldeployment import AquaDeploymentApp
17+
from ads.aqua.verify_policies import AquaVerifyPoliciesApp
1718
from ads.common.utils import LOG_LEVELS
1819

1920

@@ -29,6 +30,7 @@ class AquaCommand:
2930
fine_tuning = AquaFineTuningApp
3031
deployment = AquaDeploymentApp
3132
evaluation = AquaEvaluationApp
33+
verify_policies = AquaVerifyPoliciesApp
3234

3335
def __init__(
3436
self,

‎ads/aqua/verify_policies/__init__.py

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*--
3+
4+
# Copyright (c) 2024 Oracle and/or its affiliates.
5+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
6+
from ads.aqua.verify_policies.verify import AquaVerifyPoliciesApp
7+
8+
__all__ = ["AquaVerifyPoliciesApp"]

‎ads/aqua/verify_policies/constants.py

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
OBS_MANAGE_TEST_FILE = "AQUA Policy Verification - OBJECT STORAGE"
2+
TEST_MODEL_NAME="AQUA Policy Verification - Model"
3+
TEST_MD_NAME="AQUA Policy Verification - Model Deployment"
4+
TEST_JOB_NAME="AQUA Policy Verification - Job"
5+
TEST_JOB_RUN_NAME="AQUA Policy Verification - Job Run"
6+
TEST_MVS_NAME="AQUA Policy Verification - Model Version Set"
7+
TEST_VM_SHAPE="VM.Standard.E4.Flex"
8+
TEST_DEFAULT_JOB_SHAPE = "VM.Standard.E3.Flex"
9+
TEST_LIMIT_NAME = "ds-gpu-a10-count"
10+
DUMMY_TEST_BYTE = b"7IV6cktUGcHIhur4bXTv"
11+
POLICY_HELP_LINK = "https://github.com/oracle-samples/oci-data-science-ai-samples/blob/main/ai-quick-actions/policies/README.md"
12+
13+

‎ads/aqua/verify_policies/entities.py

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
from dataclasses import dataclass
2+
from ads.common.extended_enum import ExtendedEnum
3+
from ads.common.serializer import DataClassSerializable
4+
5+
6+
class PolicyStatus(ExtendedEnum):
7+
SUCCESS = "SUCCESS"
8+
FAILURE = "FAILURE"
9+
UNVERIFIED = "UNVERIFIED"
10+
11+
12+
@dataclass(repr=False)
13+
class OperationResultSuccess(DataClassSerializable):
14+
operation: str
15+
status: PolicyStatus = PolicyStatus.SUCCESS
16+
17+
18+
@dataclass(repr=False)
19+
class OperationResultFailure(DataClassSerializable):
20+
operation: str
21+
error: str
22+
policy_hint: str
23+
status: PolicyStatus = PolicyStatus.FAILURE
24+
25+
26+
@dataclass(repr=False)
27+
class CommonSettings(DataClassSerializable):
28+
compartment_id: str
29+
project_id: str

‎ads/aqua/verify_policies/messages.py

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
from ads.aqua.verify_policies.utils import VerifyPoliciesUtils
2+
3+
utils = VerifyPoliciesUtils()
4+
operation_messages = {
5+
utils.list_compartments.__name__: {
6+
"name": "List Compartments",
7+
"error": "Unable to retrieve the list of compartments. Please verify that you have the required permissions to list compartments in your tenancy. ",
8+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to inspect compartments in tenancy"
9+
},
10+
utils.list_models.__name__: {
11+
"name": "List Models",
12+
"error": "Failed to fetch available models. Ensure that the policies allow you to list models from the Model Catalog in the selected compartment.",
13+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-models in compartment <your-compartment-name>"
14+
},
15+
utils.list_project.__name__: {
16+
"name": "List Projects",
17+
"error": "Failed to list Data Science projects. Verify that you have the appropriate permission to access projects in the selected compartment.",
18+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-projects in compartment <your-compartment-name>"
19+
},
20+
utils.list_model_version_sets.__name__: {
21+
"name": "List Model Version Sets",
22+
"error": "Unable to load model version sets. Check your access rights to list model version sets in the selected compartment.",
23+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-modelversionsets in compartment <your-compartment-name>"
24+
},
25+
utils.list_jobs.__name__: {
26+
"name": "List Jobs",
27+
"error": "Job list could not be retrieved. Please confirm that you have the necessary permissions to view jobs in the compartment.",
28+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-jobs in compartment <your-compartment-name>"
29+
},
30+
utils.list_job_runs.__name__: {
31+
"name": "List Job Runs",
32+
"error": "Job Runs list could not be retrieved. Please confirm that you have the necessary permissions to view job runs in the compartme",
33+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-job-runs in compartment <your-compartment-name>"
34+
},
35+
utils.list_buckets.__name__: {
36+
"name": "List Object Storage Buckets",
37+
"error": "Cannot fetch Object Storage buckets. Verify that you have access to list buckets within the specified compartment.",
38+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to read objectstorage-namespaces in compartment <your-compartment-name>\nAllow dynamic-group aqua-dynamic-group to read buckets in compartment <your-compartment-name>"
39+
},
40+
utils.manage_bucket.__name__: {
41+
"name": "Object Storage Access",
42+
"error": "Failed to access the Object Storage bucket. Verify that the bucket exists and you have write permissions.",
43+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage object-family in compartment <your-compartment-name> where any {target.bucket.name='<your-bucket-name>'}"
44+
},
45+
utils.list_log_groups.__name__: {
46+
"name": "List Log Groups",
47+
"error": "Log groups or logs could not be retrieved. Please confirm you have logging read access for the selected compartment.",
48+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to use logging-family in compartment <your-compartment-name>"
49+
},
50+
utils.get_resource_availability.__name__: {
51+
"name": "Verify Shape Limits",
52+
"error": "Failed to retrieve shape limits for your compartment. Make sure the required policies are in place to read shape and quota data.",
53+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to read resource-availability in compartment <your-compartment-name>"
54+
},
55+
utils.register_model.__name__: {
56+
"name": "Register Model",
57+
"error": "Model registration failed. Ensure you have the correct permissions to write to the Model Catalog and access Object Storage.",
58+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-models in compartment <your-compartment-name>"
59+
},
60+
utils.aqua_model.delete_model.__name__: {
61+
"name": "Delete Model",
62+
"error": "Could not delete model. Please confirm you have delete permissions for Model Catalog resources in the compartment.",
63+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-models in compartment <your-compartment-name>"
64+
},
65+
utils.create_job.__name__: {
66+
"name": "Create Job",
67+
"error": "Job could not be created. Please check if you have permissions to create Data Science jobs.",
68+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-jobs in compartment <your-compartment-name>"
69+
},
70+
utils.create_job_run.__name__: {
71+
"name": "Create Job Run",
72+
"error": "Job Run could not be created. Confirm that you are allowed to run jobs in the selected compartment.",
73+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-job-runs in compartment <your-compartment-name>"
74+
},
75+
"delete_job": {
76+
"name": "Delete Job",
77+
"error": "Job could not be deleted. Please check if you have permissions to delete Data Science jobs.",
78+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-jobs in compartment <your-compartment-name>"
79+
},
80+
utils.aqua_model.create_model_version_set.__name__: {
81+
"name": "Create Model Version Set",
82+
"error": "Unable to create a model version set for storing evaluation results. Ensure that required Model Catalog permissions are set.",
83+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-modelversionsets in compartment <your-compartment-name>"
84+
},
85+
utils.aqua_model.ds_client.delete_model_version_set.__name__: {
86+
"name": "Delete Model Version Set",
87+
"error": "Unable to delete a model version. Ensure that required Model Catalog permissions are set.",
88+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-modelversionsets in compartment <your-compartment-name>"
89+
},
90+
utils.create_model_deployment.__name__: {
91+
"name": "Create Model Deployment",
92+
"error": "Model deployment could not be created. Confirm you have correct permissions to deploy models to the Model Deployment service.",
93+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-model-deployments in compartment <your-compartment-name>"
94+
},
95+
utils.aqua_model.ds_client.delete_model_deployment.__name__: {
96+
"name": "Delete Model Deployment",
97+
"error": "Unable to delete the model deployment. Please check if you have appropriate permissions to manage deployments.",
98+
"policy_hint": "Allow dynamic-group aqua-dynamic-group to manage data-science-model-deployments in compartment <your-compartment-name>"
99+
}
100+
101+
}

0 commit comments

Comments
 (0)