terraform-ibm-modules/terraform-ibm-watsonx-saas-da

A deployable architecture solution to deploy IBM Watsonx SaaS resources.

watsonx SaaS Deployable Architecture (DA)

The watsonx SaaS Deployment Architecture is designed to automate the deployment and configuration of the IBM watsonx platform in an IBM Cloud account. The IBM watsonx platform is made of several services working together to offer AI capabilities to end users, who can explore them using IBM watsonx projects.

In addition, this deployable architecture configures a starter project for an IBM Cloud user.

Overview

• terraform-ibm-watsonx-saas-da
• Examples
  • Basic example
  • Complete example
• Contributing

terraform-ibm-watsonx-saas-da

The solution supports the following:

• Creating a new resource group, or taking an existing one.
• Provisioning the following services:
  • Watson Machine Learning
  • Watson Studio
  • Cloud Object Storage.
• Configuring the IBM watsonx profile and creating a starter IBM watsonx project. for an IBM Cloud user, who becomes the admin of the IBM watsonx project.

As result the IBM watsonx admin can log into IBM watsonx in the target account and start experimenting with the starter project.

Optionally, the solution supports:

• Provisioning of one or more of the services, with a selectable service plan:
  • watsonx.governance
  • watsonx Assistant
  • Watson Discovery

Required IAM access policies

The following permissions are required to deploy this solution.

• Administrator role on All Account Management services to create a new resource group.
• Editor platform role on Watson Machine Learning to create and delete the service.
• Editor platform role on Watson Studio to create or delete the service.
• Editor platform role on Cloud Object Storage to create and delete the service.
• Editor platform role on watsonx.governance if you must provision.
• Editor platform role on watsonx Assistant if you must provision.
• Editor platform role on Watson Discovery if you must provision.

The IBM watsonx administrator needs the following permissions:

• Administrator role on All Account Management services.
• Administrator role on All Identity and Access enabled services.
• Manager service role on Cloud Object Storage to create service credentials.

You can use the IBM provided IAM Access Group Terraform Module to configure deployers and watsonx admins access groups and add members to them.

Requirements

Name	Version
terraform	>= 1.5.0, <1.7.0
ibm	>= 1.62.0

Modules

Name	Source	Version
configure_project	./configure_project	n/a
configure_user	./configure_user	n/a
cos	terraform-ibm-modules/cos/ibm//modules/fscloud	8.2.6
resource_group	terraform-ibm-modules/resource-group/ibm	1.1.5

Resources

Name	Type
ibm_resource_instance.assistant_instance	resource
ibm_resource_instance.discovery_instance	resource
ibm_resource_instance.governance_instance	resource
ibm_resource_instance.machine_learning_instance	resource
ibm_resource_instance.studio_instance	resource

Inputs

Name	Description	Type	Default	Required
cos_plan	The plan that's used to provision the Cloud Object Storage instance.	string	"standard"	no
ibmcloud_api_key	The API key that's used with the IBM Cloud Terraform IBM provider.	string	n/a	yes
location	The location that's used with the IBM Cloud Terraform IBM provider. It's also used during resource creation.	string	"us-south"	no
resource_group_name	The name of a new or an existing resource group where the resources are created.	string	n/a	yes
resource_prefix	The name to be used on all Watson resources as a prefix.	string	"watsonx-poc"	no
use_existing_resource_group	Determines whether to use an existing resource group.	bool	false	no
watson_discovery_plan	The plan that's used to provision the Watson Discovery instance.	string	"do not install"	no
watson_machine_learning_plan	The plan that's used to provision the Watson Machine Learning instance.	string	"v2-standard"	no
watson_studio_plan	The plan that's used to provision the Watson Studio instance. The plan you choose for Watson Studio affects the features and capabilities that you can use.	string	"professional-v1"	no
watsonx_admin_api_key	The API key of the IBM watsonx administrator in the target account. The API key is used to configure the user and the project.	string	null	no
watsonx_assistant_plan	The plan that's used to provision the watsonx Assistance instance.	string	"do not install"	no
watsonx_governance_plan	The plan used to provision the watsonx.governance instance. The available plans depend on the region where you are provisioning the service from the IBM Cloud catalog.	string	"do not install"	no
watsonx_project_description	A description of the watson project that's created by the WatsonX.ai SaaS Deployable Architecture.	string	"Watson project created by the watsonx-ai SaaS deployable architecture."	no
watsonx_project_name	The name of the watson project.	string	"demo"	no
watsonx_project_tags	A list of tags associated with the watsonx project. Each tag consists of a single string containing up to 255 characters. These tags can include spaces, letters, numbers, underscores, dashes, as well as the symbols # and @.	list(string)	[ "watsonx-ai-SaaS" ]	no

Outputs

Name	Description
resource_group_id	The resource group ID that's used to provision the resources.
watson_discovery_crn	The CRN of the Watson Discovery instance.
watson_discovery_dashboard_url	The dashboard URL of the Watson Discovery instance.
watson_discovery_guid	The GUID of the Watson Discovery instance.
watson_discovery_name	The name of the Watson Discovery instance.
watson_discovery_plan_id	The plan ID of the Watson Discovery instance.
watson_machine_learning_crn	The CRN of the Watson Machine Learning instance.
watson_machine_learning_dashboard_url	The dashboard URL of the Watson Machine Learning instance.
watson_machine_learning_guid	The GUID of the Watson Machine Learning instance.
watson_machine_learning_name	The name of the Watson Machine Learning instance.
watson_machine_learning_plan_id	The plan ID of the Watson Machine Learning instance.
watson_studio_crn	The CRN of the Watson Studio instance.
watson_studio_dashboard_url	The dashboard URL of the Watson Studio instance.
watson_studio_guid	The GUID of the Watson Studio instance.
watson_studio_name	The name of the Watson Studio instance.
watson_studio_plan_id	The plan ID of the Watson Studio instance.
watsonx_assistant_crn	The CRN of the watsonx Assistant instance.
watsonx_assistant_dashboard_url	The dashboard URL of the watsonx Assistant instance.
watsonx_assistant_guid	The GUID of the watsonx Assistant instance.
watsonx_assistant_name	The name of the watsonx Assistant instance.
watsonx_assistant_plan_id	The plan ID of the watsonx Assistant instance.
watsonx_governance_crn	The CRN of the watsonx.governance instance.
watsonx_governance_dashboard_url	The dashboard URL of the watsonx.governance instance.
watsonx_governance_guid	The GUID of the watsonx.governance instance.
watsonx_governance_name	The name of the watsonx.governance instance.
watsonx_governance_plan_id	The plan ID of the watsonx.governance instance.
watsonx_platform_endpoint	The endpoint of the watsonx platform.
watsonx_project_id	The ID watsonx project that's created.
watsonx_project_location	The location watsonx project that's created.
watsonx_project_url	The URL of the watsonx project that's created.

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.

terraform-ibm-watsonx-saas-da's Issues

Align references to watson and watsonx products in the output variables to their proper brand names.

Affected modules

• watsonx_saas

Terraform CLI and Terraform provider versions

• Terraform version:
• Provider version:

Terraform output

Debug output

Expected behavior

all Brand names should be accurate.
Watsonx Discovery -> Watson Discovery
watson platform -> watsonx platform
Watson Governance -> watsonx.governance

Actual behavior

Steps to reproduce (including links and screen captures)

1. Run terraform apply

Anything else

---

By submitting this issue, you agree to follow our Code of Conduct

split api key used for provisioning and configuration

currently we use ibmcloud_api_key for everything, we should split what is used from TF provider to provision resources and what we use to call watson APIs. In this way we can use a trusted profile to provision the services.

demo project already exists - initial run

Seen this error a few times when deploying the DA in an existing account. It seems that the project name is unique per account (regardless of the number of machine learning instance), so suggesting to add a random suffix to the name to avoid clashes.

configure_project | Failed | unexpected response code '400': Project name 'demo' already used.

Split user and project configuration into separate modules

Description

As we need to create a new user (to be confirmed) and a new project (this is confirmed) in the RAG App DA, it makes sense to reuse the same modules used to provision WatsonX AI users/projects in the terraform-ibm-watsonx-saas-da module. Therefore, could we split those modules into their own repositories so they can be reused?

New or affected modules

terraform-ibm-watsonx-saas-da

new:
terraform-ibm-watsonx-saas-user
terraform-ibm-watsonx-saas-project

---

By submitting this issue, you agree to follow our Code of Conduct

Include resource group ID as output

Description

Include created resource group ID as output - as discussed, we will probably need this in the RAG App DA later.

New or affected modules

terraform-ibm-watsonx-saas-da

---

Improve description of the variables

#4 (comment)

onboard watsonx da into catalog from release in this repo

Description

@ocofaigh - could we plug the catalog onboarding pipeline here?

resource group handling

terraform-ibm-watsonx-saas-da/main.tf

Line 14 in ea3f756

module "resource_group" {

Replace by

module "resource_group" {
  source                       = "terraform-ibm-modules/resource-group/ibm"
  version                      = "1.1.5"
  resource_group_name          = var.existing_resource_group == false ? var.resource_group_name : null
  existing_resource_group_name = var.existing_resource_group == true ? var.resource_group_name : null
}

for consistency.

The boolean also allows to execute the logic in the case where group name is not known at apply time (eg: when terraform logic call the DA)

Set paid plans as default

Free plans have some restrictions, we should use paid plans to enable all the capabilities.