Add a managed app deployment as an option

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# @graphrag-core-team and @societal-resilience-graphrag will be requested for
+# review when someone opens a pull request.
+*       @Azure-Samples/graphrag-core-team @Azure-Samples/societal-resilience-graphrag

.gitignore

@@ -1,3 +1,7 @@
+# ignore temporary artifact files that users may create
+infra/managed-app/artifacts/graphrag/
+openapi.json
+
 # ignore vscode config files
 .vscode/
 

backend/graphrag_app/api/data.py

@@ -2,6 +2,7 @@
 # Licensed under the MIT License.
 
 import asyncio
+import os
 import re
 import traceback
 from math import ceil
@@ -26,12 +27,15 @@
     get_blob_container_client,
     get_cosmos_container_store_client,
     sanitize_name,
+    subscription_key_check,
 )
 
 data_route = APIRouter(
     prefix="/data",
     tags=["Data Management"],
 )
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    data_route.dependencies.append(Depends(subscription_key_check))
 
 
 @data_route.get(

backend/graphrag_app/api/graph.py

@@ -1,6 +1,7 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
+import os
 import traceback
 
 from fastapi import (
@@ -14,13 +15,16 @@
 from graphrag_app.utils.azure_clients import AzureClientManager
 from graphrag_app.utils.common import (
     sanitize_name,
+    subscription_key_check,
     validate_index_file_exist,
 )
 
 graph_route = APIRouter(
     prefix="/graph",
     tags=["Graph Operations"],
 )
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    graph_route.dependencies.append(Depends(subscription_key_check))
 
 
 @graph_route.get(

backend/graphrag_app/api/index.py

@@ -33,13 +33,16 @@
     delete_storage_container_if_exist,
     get_cosmos_container_store_client,
     sanitize_name,
+    subscription_key_check,
 )
 from graphrag_app.utils.pipeline import PipelineJob
 
 index_route = APIRouter(
     prefix="/index",
     tags=["Index Operations"],
 )
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    index_route.dependencies.append(Depends(subscription_key_check))
 
 
 @index_route.post(

backend/graphrag_app/api/prompt_tuning.py

@@ -1,6 +1,7 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
+import os
 import traceback
 from pathlib import Path
 
@@ -15,9 +16,11 @@
 
 from graphrag_app.logger.load_logger import load_pipeline_logger
 from graphrag_app.utils.azure_clients import AzureClientManager
-from graphrag_app.utils.common import sanitize_name
+from graphrag_app.utils.common import sanitize_name, subscription_key_check
 
 prompt_tuning_route = APIRouter(prefix="/index/config", tags=["Prompt Tuning"])
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    prompt_tuning_route.dependencies.append(Depends(subscription_key_check))
 
 
 @prompt_tuning_route.get(

backend/graphrag_app/api/query.py

@@ -1,12 +1,14 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
+import os
 import traceback
 from pathlib import Path
 
 import yaml
 from fastapi import (
     APIRouter,
+    Depends,
     HTTPException,
 )
 from graphrag.api.query import global_search, local_search
@@ -22,6 +24,7 @@
 from graphrag_app.utils.common import (
     get_df,
     sanitize_name,
+    subscription_key_check,
     validate_index_file_exist,
 )
 from graphrag_app.utils.pipeline import PipelineJob
@@ -30,6 +33,8 @@
     prefix="/query",
     tags=["Query Operations"],
 )
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    query_route.dependencies.append(Depends(subscription_key_check))
 
 
 @query_route.post(

backend/graphrag_app/api/query_streaming.py

@@ -10,6 +10,7 @@
 import yaml
 from fastapi import (
     APIRouter,
+    Depends,
     HTTPException,
 )
 from fastapi.responses import StreamingResponse
@@ -28,6 +29,7 @@
 from graphrag_app.utils.common import (
     get_df,
     sanitize_name,
+    subscription_key_check,
     validate_index_file_exist,
 )
 
@@ -37,6 +39,8 @@
     prefix="/query/streaming",
     tags=["Query Streaming Operations"],
 )
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    query_streaming_route.dependencies.append(Depends(subscription_key_check))
 
 
 @query_streaming_route.post(

backend/graphrag_app/api/source.py

@@ -1,7 +1,7 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
-
+import os
 import traceback
 
 import pandas as pd
@@ -18,6 +18,7 @@
 from graphrag_app.utils.common import (
     pandas_storage_options,
     sanitize_name,
+    subscription_key_check,
     validate_index_file_exist,
 )
 
@@ -26,6 +27,9 @@
     tags=["Sources"],
 )
 
+if os.getenv("KUBERNETES_SERVICE_HOST"):
+    source_route.dependencies.append(Depends(subscription_key_check))
+
 
 COMMUNITY_REPORT_TABLE = "output/create_final_community_reports.parquet"
 COVARIATES_TABLE = "output/create_final_covariates.parquet"

backend/graphrag_app/main.py

@@ -9,13 +9,13 @@
 import yaml
 from azure.cosmos import PartitionKey, ThroughputProperties
 from fastapi import (
+    Depends,
     FastAPI,
     Request,
     status,
 )
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import Response
-from fastapi_offline import FastAPIOffline
 from kubernetes import (
     client,
     config,
@@ -29,6 +29,7 @@
 from graphrag_app.api.source import source_route
 from graphrag_app.logger.load_logger import load_pipeline_logger
 from graphrag_app.utils.azure_clients import AzureClientManager
+from graphrag_app.utils.common import subscription_key_check
 
 
 async def catch_all_exceptions_middleware(request: Request, call_next):
@@ -96,12 +97,19 @@ async def lifespan(app: FastAPI):
         ROOT_DIR = Path(__file__).resolve().parent.parent
         with (ROOT_DIR / "manifests/cronjob.yaml").open("r") as f:
             manifest = yaml.safe_load(f)
+        # set docker image name
         manifest["spec"]["jobTemplate"]["spec"]["template"]["spec"]["containers"][0][
             "image"
         ] = pod.spec.containers[0].image
+        # set service account name
         manifest["spec"]["jobTemplate"]["spec"]["template"]["spec"][
             "serviceAccountName"
         ] = pod.spec.service_account_name
+        # set image pull secrets only if they were provided as part of the deployment.
+        if hasattr(pod.spec, "image_pull_secrets"):
+            manifest["spec"]["jobTemplate"]["spec"]["template"]["spec"][
+                "imagePullSecrets"
+            ] = pod.spec.image_pull_secrets
         # retrieve list of existing cronjobs
         batch_v1 = client.BatchV1Api()
         namespace_cronjobs = batch_v1.list_namespaced_cron_job(
@@ -125,7 +133,7 @@ async def lifespan(app: FastAPI):
     # shutdown/garbage collection code goes here
 
 
-app = FastAPIOffline(
+app = FastAPI(
     docs_url="/manpage/docs",
     openapi_url="/manpage/openapi.json",
     root_path=os.getenv("API_ROOT_PATH", ""),
@@ -157,6 +165,9 @@ async def lifespan(app: FastAPI):
 @app.get(
     "/health",
     summary="API health check",
+    dependencies=[Depends(subscription_key_check)]
+    if os.getenv("KUBERNETES_SERVICE_HOST")
+    else None,
 )
 def health_check():
     """Returns a 200 response to indicate the API is healthy."""

backend/graphrag_app/utils/common.py

@@ -4,13 +4,14 @@
 import hashlib
 import os
 import traceback
+from typing import Annotated
 
 import pandas as pd
 from azure.core.exceptions import ResourceNotFoundError
 from azure.cosmos import ContainerProxy, exceptions
 from azure.identity import DefaultAzureCredential
 from azure.storage.blob.aio import ContainerClient
-from fastapi import HTTPException
+from fastapi import Header, HTTPException
 
 from graphrag_app.logger.load_logger import load_pipeline_logger
 from graphrag_app.utils.azure_clients import AzureClientManager
@@ -189,3 +190,19 @@ def desanitize_name(sanitized_container_name: str) -> str | None:
         raise HTTPException(
             status_code=500, detail="Error retrieving original container name."
         )
+
+
+async def subscription_key_check(
+    Ocp_Apim_Subscription_Key: Annotated[str, Header()],
+):
+    """
+    Verifies if user has passed the Ocp_Apim_Subscription_Key (APIM subscription key) in the request header.
+    If it is not present, an HTTPException with a 400 status code is raised.
+    Note: this check is unnecessary (APIM validates subscription keys automatically), but this will add the key
+    as a required parameter in the swagger docs page, enabling users to send requests using the swagger docs "Try it out" feature.
+    """
+    if not Ocp_Apim_Subscription_Key:
+        raise HTTPException(
+            status_code=400, detail="Ocp-Apim-Subscription-Key required"
+        )
+    return Ocp_Apim_Subscription_Key