Add support for running CFU-Playground natively with notebook in rad-lab env

modules/silicon_design/README.md

@@ -10,9 +10,9 @@ This RAD Lab module provides a managed environment for custom silicon design usi
 
 ## Samples notebooks
 
-- [Inverter](scripts/build/notebooks/inverter.md)
+- [Inverter](scripts/build/notebooks/inverter/experiment.md)
 
-![gds render](scripts/build/notebooks/inverter.svg)
+![gds render](scripts/build/notebooks/inverter/layout.svg)
 
 ## GCP Products/Services 
 
@@ -44,6 +44,7 @@ When deploying in an existing project, ensure the identity has the following per
 - `roles/resourcemanager.projectIamAdmin`
 - `roles/iam.serviceAccountAdmin`
 - `roles/iam.serviceAccountUser`
+- `roles/serviceusage.serviceUsageAdmin`
 
 NOTE: Additional [permissions](./radlab-launcher/README.md#iam-permissions-prerequisites) are required when deploying the RAD Lab modules via [RAD Lab Launcher](./radlab-launcher)
 

modules/silicon_design/main.tf

@@ -3,7 +3,7 @@
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+nnn * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
@@ -19,9 +19,16 @@ locals {
   project = (var.create_project
     ? try(module.project_radlab_silicon_design.0, null)
     : try(data.google_project.existing_project.0, null)
-  )
+    )
+  project_number = (var.create_project
+    ? try(module.project_radlab_silicon_design.0.project_number, null)
+    : try(data.google_project.existing_project.0.number, null)
+    )
   region = join("-", [split("-", var.zone)[0], split("-", var.zone)[1]])
 
+  network_name = var.network_name != null ? var.network_name : "${var.name}-network"
+  subnet_name = var.subnet_name != null ? var.subnet_name : "${var.name}-subnet"
+
   network = (
     var.create_network
     ? try(module.vpc_ai_notebook.0.network.network, null)
@@ -30,7 +37,7 @@ locals {
 
   subnet = (
     var.create_network
-    ? try(module.vpc_ai_notebook.0.subnets["${local.region}/${var.subnet_name}"], null)
+    ? try(module.vpc_ai_notebook.0.subnets["${local.region}/${local.subnet_name}"], null)
     : try(data.google_compute_subnetwork.default.0, null)
   )
 
@@ -39,17 +46,31 @@ locals {
     "roles/notebooks.admin",
     "roles/compute.instanceAdmin",
     "roles/iam.serviceAccountUser",
-    "roles/storage.objectViewer",
+    "roles/storage.admin",
+    "roles/aiplatform.admin",
+  ]
+
+  cloudbuild_sa_project_roles = [
+    "roles/compute.admin",
+    "roles/storage.admin",
+  ]
+
+  image_builder_sa_project_roles = [
+    "roles/compute.instanceAdmin",
+    "roles/compute.storageAdmin",
+    "roles/storage.admin",
   ]
 
   project_services = var.enable_services ? [
     "compute.googleapis.com",
     "notebooks.googleapis.com",
     "cloudbuild.googleapis.com",
     "artifactregistry.googleapis.com",
+    "aiplatform.googleapis.com",
   ] : []
 
-  notebook_names = length(var.notebook_names) > 0 ? var.notebook_names : [for i in range(var.notebook_count): "silicon-design-notebook-${i}"]
+  notebook_names = length(var.notebook_names) > 0 ? var.notebook_names : [for i in range(var.notebook_count): "${var.name}-nodebook-${i}"]
+  image_tag = var.image_tag != "" ? var.image_tag : formatdate("YYYYMMDDhhmm", timestamp())
 }
 
 resource "random_id" "default" {
@@ -61,14 +82,14 @@ resource "random_id" "default" {
 ############################
 
 data "google_project" "existing_project" {
-  count      = var.create_project ? 0 : 1
-  project_id = var.project_name
+  count       = var.create_project ? 0 : 1
+  project_id  = var.project_name
 }
 
 module "project_radlab_silicon_design" {
   count   = var.create_project ? 1 : 0
   source  = "terraform-google-modules/project-factory/google"
-  version = "~> 11.0"
+  version = "~> 13.0"
 
   name              = format("%s-%s", var.project_name, local.random_id)
   random_project_id = false
@@ -83,8 +104,12 @@ resource "google_project_service" "enabled_services" {
   for_each                   = toset(local.project_services)
   project                    = local.project.project_id
   service                    = each.value
-  disable_dependent_services = true
-  disable_on_destroy         = true
+  disable_dependent_services = false
+  disable_on_destroy         = false
+
+  lifecycle {
+    prevent_destroy = true
+  }
 
   depends_on = [
     module.project_radlab_silicon_design
@@ -94,29 +119,29 @@ resource "google_project_service" "enabled_services" {
 data "google_compute_network" "default" {
   count   = var.create_network ? 0 : 1
   project = local.project.project_id
-  name    = var.network_name
+  name    = local.network_name
 }
 
 data "google_compute_subnetwork" "default" {
   count   = var.create_network ? 0 : 1
   project = local.project.project_id
-  name    = var.subnet_name
+  name    = local.subnet_name
   region  = local.region
 }
 
 module "vpc_ai_notebook" {
   count   = var.create_network ? 1 : 0
   source  = "terraform-google-modules/network/google"
-  version = "~> 3.0"
+  version = "~> 5.0"
 
   project_id   = local.project.project_id
-  network_name = var.network_name
+  network_name = local.network_name
   routing_mode = "GLOBAL"
   description  = "VPC Network created via Terraform"
 
   subnets = [
     {
-      subnet_name           = var.subnet_name
+      subnet_name           = local.subnet_name
       subnet_ip             = var.ip_cidr_range
       subnet_region         = local.region
       description           = "Subnetwork inside *vpc-silicon-design* VPC network, created via Terraform"
@@ -126,7 +151,7 @@ module "vpc_ai_notebook" {
 
   firewall_rules = [
     {
-      name        = "fw-silicon-design-notebook-allow-internal"
+      name        = "${var.name}-allow-internal"
       description = "Firewall rule to allow traffic on all ports inside *vpc-silicon-design* VPC network."
       priority    = 65534
       ranges      = ["10.0.0.0/8"]
@@ -146,7 +171,7 @@ module "vpc_ai_notebook" {
 
 resource "google_service_account" "sa_p_notebook" {
   project      = local.project.project_id
-  account_id   = format("sa-p-notebook-%s", local.random_id)
+  account_id   = "${var.name}-n-sa"
   display_name = "Notebooks in trusted environment"
 }
 
@@ -157,24 +182,55 @@ resource "google_project_iam_member" "sa_p_notebook_permissions" {
   role     = each.value
 }
 
+resource "google_project_service_identity" "sa_cloudbuild_identity" {
+  provider = google-beta
+  project  = local.project.project_id  
+  service = "cloudbuild.googleapis.com"
+}
+
+resource "google_project_iam_member" "sa_cloudbuild_permissions" {
+  for_each = toset(local.cloudbuild_sa_project_roles)
+  member   = "serviceAccount:${google_project_service_identity.sa_cloudbuild_identity.email}"
+  project  = local.project.project_id
+  role     = each.value
+}
+
+resource "google_service_account_iam_member" "sa_cloudbuild_image_builder_access" {
+  member             = "serviceAccount:${google_project_service_identity.sa_cloudbuild_identity.email}"
+  role               = "roles/iam.serviceAccountUser"
+  service_account_id = google_service_account.sa_image_builder_identity.id
+}
+
+resource "google_service_account" "sa_image_builder_identity" {
+  project    = local.project.project_id
+  account_id = "${var.name}-i-sa"
+}
+
+resource "google_project_iam_member" "sa_image_builder_permissions" {
+  for_each = toset(local.image_builder_sa_project_roles)
+  project  = local.project.project_id
+  member   = "serviceAccount:${google_service_account.sa_image_builder_identity.email}"
+  role     = each.value
+}
+
 resource "google_service_account_iam_member" "sa_ai_notebook_user_iam" {
   for_each           = var.trusted_users
-  member             = each.value
+  member             = "user:${each.value}"
   role               = "roles/iam.serviceAccountUser"
   service_account_id = google_service_account.sa_p_notebook.id
 }
 
 resource "google_project_iam_member" "ai_notebook_user_role1" {
   for_each = var.trusted_users
   project  = local.project.project_id
-  member   = each.value
+  member   = "user:${each.value}"
   role     = "roles/notebooks.admin"
 }
 
 resource "google_project_iam_member" "ai_notebook_user_role2" {
   for_each = var.trusted_users
   project  = local.project.project_id  
-  member   = each.value
+  member   = "user:${each.value}"
   role     = "roles/viewer"
 }
 
@@ -186,10 +242,10 @@ resource "google_notebooks_instance" "ai_notebook" {
   machine_type = var.machine_type
 
   container_image {
-    repository = "${google_artifact_registry_repository.containers_repo.location}-docker.pkg.dev/${local.project.project_id}/${google_artifact_registry_repository.containers_repo.repository_id}/openlane-jupyterlab"
-    tag        = "latest"
+    repository = "${google_artifact_registry_repository.containers_repo.location}-docker.pkg.dev/${local.project.project_id}/${google_artifact_registry_repository.containers_repo.repository_id}/${var.image_name}"
+    tag        = local.image_tag
   }
-
+  
   service_account = google_service_account.sa_p_notebook.email
 
   install_gpu_driver = false
@@ -202,7 +258,7 @@ resource "google_notebooks_instance" "ai_notebook" {
   network = local.network.self_link
   subnet  = local.subnet.self_link
 
-  post_startup_script = "gs://${google_storage_bucket.notebooks_bucket.name}/copy-notebooks.sh"
+  post_startup_script = "gs://${google_storage_bucket.staging_bucket.name}/copy-notebooks.sh"
 
   labels = {
     module = "silicon-design"
@@ -223,7 +279,7 @@ resource "google_artifact_registry_repository" "containers_repo" {
 
   project       = local.project.project_id
   location      = local.region
-  repository_id = "containers"
+  repository_id = "${var.name}-containers"
   description   = "container image repository"
   format        = "DOCKER"
 
@@ -232,9 +288,9 @@ resource "google_artifact_registry_repository" "containers_repo" {
   ]
 }
 
-resource "google_storage_bucket" "notebooks_bucket" {
+resource "google_storage_bucket" "staging_bucket" {
   project                     = local.project.project_id
-  name                        = "${local.project.project_id}-silicon-design-notebooks"
+  name                        = "${local.project.project_id}-${var.name}-staging"
   location                    = local.region
   force_destroy               = true
   uniform_bucket_level_access = true
@@ -245,18 +301,25 @@ resource "google_storage_bucket" "notebooks_bucket" {
 resource "null_resource" "build_and_push_image" {
   triggers = {
     cloudbuild_yaml_sha = filesha1("${path.module}/scripts/build/cloudbuild.yaml")
-    build_script_sha    = filesha1("${path.module}/scripts/build/build.sh")
-    dockerfile_sha      = filesha1("${path.module}/scripts/build/containers/openlane-jupyterlab/Dockerfile")
-    notebook_sha        = filesha1("${path.module}/scripts/build/notebooks/inverter.md")
+    workflow_sha      = filesha1("${path.module}/scripts/build/images/compute_image.wf.json")    
+    dockerfile_sha      = filesha1("${path.module}/scripts/build/images/Dockerfile")
+    environment_sha        = filesha1("${path.module}/scripts/build/images/provision/environment.yml")    
+    env_sha        = filesha1("${path.module}/scripts/build/images/provision/install.tcl")    
+    profile_sha        = filesha1("${path.module}/scripts/build/images/provision/profile.sh")    
+    notebook_sha        = filesha1("${path.module}/scripts/build/notebooks/inverter/inverter.md")
+    image_tag = local.image_tag
   }
 
   provisioner "local-exec" {
     working_dir = path.module
-    command     = "scripts/build/build.sh ${local.project.project_id} ${google_artifact_registry_repository.containers_repo.location} ${google_artifact_registry_repository.containers_repo.repository_id} ${google_storage_bucket.notebooks_bucket.name}"
+    command     = "gcloud --project=${local.project.project_id} builds submit . --config ./scripts/build/cloudbuild.yaml --substitutions \"_ZONE=${var.zone},_COMPUTE_IMAGE=${var.image_name},_CONTAINER_IMAGE=${google_artifact_registry_repository.containers_repo.location}-docker.pkg.dev/${local.project.project_id}/${google_artifact_registry_repository.containers_repo.repository_id}/${var.image_name},_STAGING_BUCKET=${google_storage_bucket.staging_bucket.name},_COMPUTE_NETWORK=${local.network.id},_COMPUTE_SUBNET=${local.subnet.id},_IMAGE_TAG=${local.image_tag},_CLOUD_BUILD_SA=${google_service_account.sa_image_builder_identity.email}\""
   }
 
   depends_on = [
     google_artifact_registry_repository.containers_repo,
-    google_storage_bucket.notebooks_bucket,
+    google_storage_bucket.staging_bucket,
+    google_project_iam_member.sa_image_builder_permissions,
+    google_project_iam_member.sa_cloudbuild_permissions,
+    google_service_account_iam_member.sa_cloudbuild_image_builder_access,
   ]
 }

modules/silicon_design/outputs.tf

@@ -19,7 +19,7 @@ output "deployment_id" {
   value       = local.random_id
 }
 
-output "project_radlab_silicon_design_id" {
+output "project_id" {
   description = "Silicon Design RAD Lab Project ID"
   value       = local.project.project_id
 }
@@ -29,17 +29,22 @@ output "notebooks_instance_names" {
   value       = join(", ", google_notebooks_instance.ai_notebook[*].name)
 }
 
-output "notebooks_bucket_name" {
-  description = "Notebooks GCS Bucket Name"
-  value       = google_storage_bucket.notebooks_bucket.name
-}
-
 output "artifact_registry_repository_id" {
   description = "Artifact Registry Repository ID"
   value       = google_artifact_registry_repository.containers_repo.repository_id
 }
 
 output "notebooks_container_image" {
   description = "Container Image URI"
-  value       = "${google_notebooks_instance.ai_notebook[0].container_image[0].repository}:${google_notebooks_instance.ai_notebook[0].container_image[0].tag}"
+  value       = "${google_artifact_registry_repository.containers_repo.location}-docker.pkg.dev/${local.project.project_id}/${google_artifact_registry_repository.containers_repo.repository_id}/${var.image_name}:${local.image_tag}"
+}
+
+output "notebooks_vm_image" {
+  description = "GCE VM Image Name"
+  value       = "${var.image_name}-${local.image_tag}"
+}
+
+output "notebooks_staging_bucket" {
+  description = "Noteooks Staging bucket"
+  value       = "${google_storage_bucket.staging_bucket.name}"
 }