用 Terraform 部署 Microsoft Foundry 托管智能体

set -euo pipefail

ACR_NAME="<registry-name>"
IMAGE_NAME="<image-name>"
IMAGE_TAG="<unique-release-tag>"
LOGIN_SERVER=$(az acr show --name "$ACR_NAME" \
  --query loginServer --output tsv)

az acr login --name "$ACR_NAME"
docker build --platform linux/amd64 \
  --tag "$LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG" .
docker push "$LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG"

DIGEST=$(az acr repository show --name "$ACR_NAME" \
  --image "$IMAGE_NAME:$IMAGE_TAG" --query digest --output tsv)
if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
  echo "The registry didn't return a valid image digest." >&2
  exit 1
fi

printf 'image_uri = "%s/%s@%s"\n' "$LOGIN_SERVER" "$IMAGE_NAME" "$DIGEST"

terraform {
  required_version = ">= 1.4.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = ">= 2.9.0, < 3.0.0"
    }
  }
}

provider "azapi" {}

variable "project_endpoint" {
  type        = string
  description = "HTTPS Foundry project data-plane endpoint."

  validation {
    condition = can(regex(
      "^https://[^/?#]+/api/projects/[^/?#]+/?$",
      var.project_endpoint
    ))
    error_message = "Use an HTTPS project endpoint without a query."
  }
}

variable "agent_name" {
  type        = string
  description = "Name of the agent managed by this configuration."
}

variable "image_uri" {
  type        = string
  description = "Container image URI including its sha256 digest."

  validation {
    condition     = can(regex("@sha256:[0-9a-f]{64}$", var.image_uri))
    error_message = "Use an immutable image URI ending in @sha256:digest."
  }
}

variable "model_deployment_name" {
  type        = string
  description = "Existing model deployment used by the container."
}

variable "cpu" {
  type        = string
  description = "CPU cores for the hosted container."
  default     = "0.5"
  nullable    = false
}

variable "memory" {
  type        = string
  description = "Memory for the hosted container."
  default     = "1Gi"
  nullable    = false
}

variable "environment_variables" {
  type        = map(string)
  description = "Additional nonsecret container environment variables."
  default     = {}
}

variable "rai_policy_id" {
  type        = string
  description = "Full ARM resource ID of an existing RAI policy."
  nullable    = false

  validation {
    condition = can(regex(join("", [
      "(?i)^/subscriptions/[^/]+/resourceGroups/[^/]+",
      "/providers/Microsoft\\.CognitiveServices/accounts/[^/]+",
      "/raiPolicies/[^/]+$"
    ]), var.rai_policy_id))
    error_message = "Provide the full account-scoped RAI policy ARM ID."
  }
}

project_endpoint = "https://<account>.services.ai.azure.com/api/projects/<project>"
agent_name       = "<agent-name>"
image_uri        = "<registry>/<repository>@sha256:<64-character-digest>"

model_deployment_name = "<existing-model-deployment>"
rai_policy_id         = "<full-rai-policy-arm-resource-id>"

cpu    = "0.5"
memory = "1Gi"

/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>

locals {
  project_endpoint = trimsuffix(var.project_endpoint, "/")

  agent_definition = {
    kind = "hosted"
    container_configuration = {
      image = var.image_uri
    }
    cpu    = var.cpu
    memory = var.memory
    protocol_versions = [
      {
        protocol = "responses"
        version  = "2.0.0"
      }
    ]
    environment_variables = merge(var.environment_variables, {
      AZURE_AI_MODEL_DEPLOYMENT_NAME = var.model_deployment_name
    })
    rai_config = {
      rai_policy_name = var.rai_policy_id
    }
  }
}

resource "azapi_data_plane_resource" "hosted_agent" {
  type      = "Microsoft.Foundry/agents@v1"
  name      = var.agent_name
  parent_id = trimprefix(local.project_endpoint, "https://")

  body = {
    name       = var.agent_name
    definition = local.agent_definition
  }

  response_export_values = ["versions.latest.version"]

  lifecycle {
    prevent_destroy = true

    precondition {
      condition = contains(
        ["0.5:1Gi", "1:2Gi", "2:4Gi"], "${var.cpu}:${var.memory}"
      )
      error_message = "Choose a supported CPU and memory pair."
    }
  }
}

$ErrorActionPreference = "Stop"
Set-StrictMode -Version Latest

function Get-RequiredEnvironmentValue([string] $Name) {
    $value = [Environment]::GetEnvironmentVariable($Name)
    if ([string]::IsNullOrWhiteSpace($value)) {
        throw "Missing required environment variable: $Name."
    }
    return $value
}

function Get-PositiveInteger([string] $Name) {
    $value = Get-RequiredEnvironmentValue $Name
    $number = 0
    if (-not [int]::TryParse($value, [ref] $number) -or $number -le 0) {
        throw "$Name must be a positive integer."
    }
    return $number
}

$endpoint = Get-RequiredEnvironmentValue "PROJECT_ENDPOINT"
$name = Get-RequiredEnvironmentValue "AGENT_NAME"
$version = Get-RequiredEnvironmentValue "AGENT_VERSION"
$expectedImage = Get-RequiredEnvironmentValue "EXPECTED_IMAGE_URI"
$timeout = Get-PositiveInteger "TIMEOUT_SECONDS"
$interval = Get-PositiveInteger "POLL_INTERVAL_SECONDS"

$projectUri = $null
if (-not [Uri]::TryCreate($endpoint, [UriKind]::Absolute,
        [ref] $projectUri) -or
    $projectUri.Scheme -ne "https" -or
    $projectUri.UserInfo -or $projectUri.Query -or $projectUri.Fragment) {
    throw "PROJECT_ENDPOINT must be an HTTPS endpoint without credentials."
}

$agentPath = [Uri]::EscapeDataString($name)
$versionPath = [Uri]::EscapeDataString($version)
$url = $endpoint.TrimEnd("/") +
    "/agents/$agentPath/versions/${versionPath}?api-version=v1"

$tokenOutput = & az account get-access-token `
    --resource https://ai.azure.com --query accessToken `
    --output tsv --only-show-errors 2>$null
if ($LASTEXITCODE -ne 0) {
    throw "Azure CLI token acquisition failed. Check the runner sign-in."
}
$token = ($tokenOutput -join "").Trim()
if ([string]::IsNullOrWhiteSpace($token)) {
    throw "Azure CLI returned an empty access token."
}
$headers = @{ Authorization = "Bearer $token" }
$clock = [Diagnostics.Stopwatch]::StartNew()

while ($clock.Elapsed.TotalSeconds -lt $timeout) {
    $remaining = $timeout - $clock.Elapsed.TotalSeconds
    $requestTimeout = [int][Math]::Min(30, [Math]::Ceiling($remaining))
    $response = $null
    $delay = [double] $interval

    try {
        $response = Invoke-WebRequest -Method Get -Uri $url `
            -Headers $headers -TimeoutSec $requestTimeout `
            -MaximumRedirection 0 -SkipHttpErrorCheck
    }
    catch [System.Net.Http.HttpRequestException],
          [System.OperationCanceledException] {
        Write-Host "Transient status-request failure; retrying."
    }

    if ($clock.Elapsed.TotalSeconds -ge $timeout) {
        break
    }

    if ($null -ne $response) {
        $httpStatus = [int] $response.StatusCode
        if ($httpStatus -eq 200) {
            try {
                $body = ConvertFrom-Json -InputObject $response.Content `
                    -AsHashtable
            }
            catch [System.ArgumentException] {
                throw "The version endpoint returned invalid JSON."
            }
            if ($body -isnot [System.Collections.IDictionary] -or
                -not $body.Contains("status") -or
                $body["status"] -isnot [string]) {
                throw "The version response is missing a valid status."
            }

            $status = $body["status"]
            switch -CaseSensitive ($status) {
                "active" {
                    $image = $body.definition.container_configuration.image
                    if ($image -cne $expectedImage) {
                        throw "Candidate image doesn't match the release."
                    }
                    Write-Host "Candidate version is active; image matches."
                    exit 0
                }
                "creating" { Write-Host "Candidate is creating." }
                "failed" { throw "Candidate provisioning failed." }
                "deleting" { throw "Candidate is being deleted." }
                "deleted" { throw "Candidate has been deleted." }
                default { throw "Unrecognized version status." }
            }
        }
        elseif ($httpStatus -in @(408, 429, 500, 502, 503, 504)) {
            Write-Host "Transient HTTP $httpStatus; retrying."
            $retryAfter = [string] $response.Headers["Retry-After"]
            $retrySeconds = 0
            $retryDate = [DateTimeOffset]::MinValue
            if ([int]::TryParse($retryAfter, [ref] $retrySeconds)) {
                $delay = [Math]::Max($delay, $retrySeconds)
            }
            elseif ([DateTimeOffset]::TryParse($retryAfter,
                    [ref] $retryDate)) {
                $seconds = ($retryDate - [DateTimeOffset]::UtcNow).TotalSeconds
                $delay = [Math]::Max($delay, $seconds)
            }
        }
        else {
            throw "Version lookup failed with HTTP $httpStatus."
        }
    }

    $remaining = $timeout - $clock.Elapsed.TotalSeconds
    if ($remaining -gt 0) {
        Start-Sleep -Seconds ([Math]::Min($delay, $remaining))
    }
}

throw "Timed out waiting for the candidate version to become active."

resource "terraform_data" "hosted_agent_status" {
  triggers_replace = {
    endpoint = local.project_endpoint
    name     = var.agent_name
    version = tostring(
      azapi_data_plane_resource.hosted_agent.output.versions.latest.version
    )
  }

  provisioner "local-exec" {
    working_dir = path.module
    interpreter = ["pwsh", "-NoProfile", "-NonInteractive", "-Command"]
    command     = "& './scripts/Get-HostedAgentStatus.ps1'"

    environment = {
      PROJECT_ENDPOINT = local.project_endpoint
      AGENT_NAME       = var.agent_name
      AGENT_VERSION = tostring(
        azapi_data_plane_resource.hosted_agent.output.versions.latest.version
      )
      EXPECTED_IMAGE_URI    = var.image_uri
      TIMEOUT_SECONDS       = "600"
      POLL_INTERVAL_SECONDS = "10"
    }
  }
}

output "agent_version" {
  description = "Captured version from this serialized deployment."
  value = tostring(
    azapi_data_plane_resource.hosted_agent.output.versions.latest.version
  )
  depends_on = [terraform_data.hosted_agent_status]
}

terraform init
terraform fmt -check
terraform validate
terraform plan -out=tfplan

terraform apply tfplan
terraform output -raw agent_version