Azure deployment architecture

This page offers insight into the deployment architecture on Azure along with the required components.

Architecture Diagram

Note: A highly available architecture spans over three Availability Zones.

Complete Components List

• User Assigned Identity (Microsoft.ManagedIdentity/userAssignedIdentities) – configured on the server virtual machine scale set and used for the following:
  • to allow the server virtual machine scale set to query the VMSS and identify the first server where the installation will run;
  • to validate if the hardware requirements and quotas on the subscription are met.
• Role assignment, reader (Microsoft.Authorization/roleAssignments) – used to allow the managed identity to perform the aforementioned operations.
• Deployment Scripts (Microsoft.Resources/deploymentScripts):
  • one executed at the beginning of the deployment to validate the configuration selected (quota, availability, etc.);
  • one executed at the end of the deployment to validate the status of the deployment since some tasks are asyncronous.
• Key Vault (Microsoft.KeyVault/vaults) – used to store various usernames and secrets (e.g.: SQL username and password, ArgoCD password).
• SQL Server (Microsoft.Sql/servers) – the server used to create the SQL databases.
• SQL Databases (Microsoft.Sql/servers/databases) – the databases needed for each enabled service.
• Virtual machine scale sets (Microsoft.Compute/virtualMachineScaleSets) – the nodes of the cluster.
  • one scale set is used for server nodes (cluster control plane). Server nodes also run workloads and have a dedicated data disk. They also have the Identity assigned (User Assigned Identity). Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
    • 512GiB or 2TiB data disk (basic or complete, Premium_LRS)
    • 16GiB UltraSSD_LRS if enabled otherwise Premium_LRS
  • one scale set is used for agent nodes. Designed to only run workloads (they have no control plane services). If the number of desired Agent nodes is 0, an empty scale set is created. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • GPU nodes. Optional. Nodes used specifically for ML models that have video cards. If the number of desired GPU nodes is 0, no scale set is created. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • Virtual Machine (Microsoft.Compute/virtualMachines) – Task Mining node (the size is the same as the agent VMSS node size).
  • VM Extension (Microsoft.Compute/virtualMachines/extensions) - used to install Automation Suite
  • Disks (Microsoft.Compute/disks):
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • Network interface (Microsoft.Network/networkInterfaces)
• Virtual network (Microsoft.Network/virtualNetworks) – virtual network used to deploy the node virtual machines.
  • Virtual Network Subnet (Microsoft.Network/virtualNetworks/subnets) – where all nodes reside;
  • Virtual Network Subnet (Microsoft.Network/virtualNetworks/subnets) – used for Azure Bastion (Optional, created if Azure Bastion is enabled, and you did not select an existing Virtual Network).
• Public load balancer (Microsoft.Network/loadBalancers) – used to balance traffic to nodes:
  • 443 – HTTPS traffic to the cluster
  • 6443 – HTTPS traffic to Kubernetes API
• Internal load balancer (Microsoft.Network/loadBalancers) – used during installation for node registration. It has a fixed IP and allows traffic on all ports.
• Bastion (Microsoft.Network/bastionHosts) – used as a jump box for accessing the nodes of the cluster. Optional. This is not deployed if you selected an existing Virtual Network.
• Network security group (Microsoft.Network/networkSecurityGroups) – used to secure subnet traffic. It allows HTTPS (443) and internal VNet connections.
• NAT (Network Address Translation) Gateway (Microsoft.Network/natGateways) – used for outbound connectivity during installation. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Public IP Addresses (Microsoft.Network/publicIpAddresses)
  • one used for Azure Bastion. This is deployed if you selected a new Virtual Network and if Azure Bastion is enabled.
  • one used for the public load balancer
  • one used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Public IP Prefixes (Microsoft.Network/publicIPPrefixes) – used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Private DNS zone (Microsoft.Network/privateDnsZones) – since this deployment can also be used without a public DNS zone a private DNS zone is created.
  • DNS records as required
  • Virtual network link
• Storage account (Microsoft.Storage/storageAccounts)
  • One used for installation orchestration and exposing logs.