Azure Machine Learning for InnerEye workspace service

[christoferlof]

High-level requirements

• Deployed to VNet and adheres to the TRE workspace egress rules.
• Only accessible from the Virtual Desktop service in the same workspace.
  • Azure AD authentication
• Ability to manage AML clusters and compute instances within the TRE workspace and not outside of the TRE workspace.
• AML storage provisioned in the TRE workspace.
• No public endpoints.
• Pass specified level of IG (Information Governance) - see Create doc on customer pre-reqs to be able to deploy the TRE solution #16
  • Capture potential show-stoppers.
• Configuration on which services within AML should be enabled and accessible. e.g. Interactive Notebooks on/off.
• Model export between AML instances , potentially in different TRE workspaces (This will be handled as part of the data sharing feature Airlock - workspace data export (Design) #33).
• Ability to deploy models.
• Ability to connect to AML compute from Virtual Machines within the same TRE workspace.

Spikes

• Explore AML configuration options and requirements for closed VNet setup Explore Azure ML configuration options and requirements for closed VNet setup #25

Implementation

• Refactor templates from spike Explore Azure ML configuration options and requirements for closed VNet setup #25
• Create workspace service bundle [Story] Refactor InnerEye AML spike into Workspace bundle #132
• App Package shared service App packages shared service #21
• Source code mirror shared service Source code mirror shared service #22
• [Story] InnerEye Hello world validated after installation from bundle #584

[iankelly-github]

• There is no mention of AML Compute Instances, can users of this workspace manage these also? I think they should be able to.
• AML work spaces can use privately provisioned clusters, we should clarify if this is a supported scenario for us?

[ant0nsc]

Should we think of a way of accessing private python packages? It's a setup we had to use with one customer. Code is stored in the organization's AzureDevOps instance, and gets built into a private Python package. This package is later accessed when building the docker image for runs in AML.
Or is that within the realms of #21 ?

[christoferlof]

• There is no mention of AML Compute Instances, can users of this workspace manage these also? I think they should be able to.
• AML work spaces can use privately provisioned clusters, we should clarify if this is a supported scenario for us?

Agree, @iankelly-github . We want to support as many features of AML as possible.

[christoferlof]

Should we think of a way of accessing private python packages? It's a setup we had to use with one customer. Code is stored in the organization's AzureDevOps instance, and gets built into a private Python package. This package is later accessed when building the docker image for runs in AML.
Or is that within the realms of #21 ?

Yes @ant0nsc. We plan to support that scenario with the Package Mirror #21 shared service.

[christoferlof]

ℹ Please note: "Workspace" is an overloaded term , especially in the context of AML which also has a definition of a workspace. An AML Workspace is part of the AML service which can be provisioned within a TRE workspace.