Azure deployment architecture

This page offers insight into the deployment architecture on Azure along with the required components.

Architecture diagram

Complete component list

• User Assigned Identity (Microsoft.ManagedIdentity/userAssignedIdentities) – configured on the server virtual machine scale set and used for the following:
  • to allow the server virtual machine scale set to query the VMSS and identify the first server where the installation will run;
  • to validate if the hardware requirements and quotas on the subscription are met;
  • to set instance protection on the server nodes to make sure they are not accidentally removed. As part of the installation process, we add instance protection from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk.
  • to perform cluster operations via Automation Account Runbooks.
• Role assignment, contributor (Microsoft.Authorization/roleAssignments) – used to allow the managed identity to perform the aforementioned operations.
• Deployment Scripts (Microsoft.Resources/deploymentScripts):
  • one executed at the beginning of the deployment to validate the configuration selected (quota, availability, etc);
  • one executed at the end of the deployment to validate the status of the deployment since some tasks are asynchronous.
• Key Vault (Microsoft.KeyVault/vaults) – used to store various usernames and secrets (e.g.: SQL username and password, ArgoCD password).
• SQL Server (Microsoft.Sql/servers) – the server used to create the SQL databases.
• SQL Databases (Microsoft.Sql/servers/databases) – the databases needed for each enabled service. Note that if you choose to install Process Mining in a multi-node HA-ready production setup, a database called AutomationSuite_ProcessMining_Warehouse separate from the elastic pool is required. This is because, for production workloads, this database is considerably more resource-demanding than the others.
• SQL Elastic Pool (Microsoft.Sql/servers/elasticPools) – elastic pool used to keep costs low.
• Virtual machine scale sets (Microsoft.Compute/virtualMachineScaleSets) – the nodes of the cluster:
  • one scale set is used for server nodes (cluster control plane). As part of the installation process, we add instance protection from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk. They also have the Identity assigned (User Assigned Identity). Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
    • 512GiB or 2TiB data disk (basic or complete, Premium_LRS)
    • 16GiB UltraSSD_LRS if enabled otherwise Premium_LRS
  • one scale set is used for agent nodes. Designed to only run workloads (they have no control plane services). If the number of desired Agent nodes is 0, an empty scale set is created. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256 GiB binaries disk (Premium_LRS)
  • GPU nodes. Optional. Nodes used specifically for ML models that have video cards. If the number of desired GPU nodes is 0, the scaleset is created, but with a non-GPU VM family sku. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • Automation Suite Robots nodes. Optional. Nodes used specifically for Automation Suite Robots. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
    • 32GiB caching disk (Premium_LRS)
  • Virtual Machine (Microsoft.Compute/virtualMachines) – Task Mining node.
  • VM Extension (Microsoft.Compute/virtualMachines/extensions) – used to install Automation Suite
  • Disks (Microsoft.Compute/disks):
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • Network interface (Microsoft.Network/networkInterfaces)
• Automation Account (Microsoft.Automation/automationAccounts) – automation account used for cluster operations.
  • InstanceRefresh (Microsoft.Automation/automationAccounts/runbooks) – runbook to initiate an instance refresh operation on an Automation Suite cluster.
  • RemoveServers (Microsoft.Automation/automationAccounts/runbooks) – runbook to perform server removal from the Automation Suite cluster.
  • RemoveNodes (Microsoft.Automation/automationAccounts/runbooks) – runbook to perform specific node removal from the Automation Suite cluster.
  • CheckServerZoneResilience (Microsoft.Automation/automationAccounts/runbooks) - runbook to check the server zone resilience and distribute a node to other Availability Zone if needed.
  • ImportASModules (Microsoft.Automation/automationAccounts/runbooks) - runbook to import the modules (Microsoft.Automation/automationAccounts/modules) needed by the Automation Suite runbooks.
  • AddGpuNode – Runbook to add a GPU node to the GPU Scaleset in an Automation Suite cluster.
  • RegisterAiCenterExternalOrchestrator – Runbook to perform perform the registration of an AiCenter installation with external Orchestrator and Identity Service.
  • BackupCluster – Runbook to perform instance refresh on an Automation Suite cluster.
  • GetAllBackups – Runbook to perform instance refresh on an Automation Suite cluster.
  • RestoreClusterInitialize – Runbook to perform the infra restore on an Automation Suite cluster.
  • RestoreClusterSnapshot – Runbook to perform the restore of the snapshot on an Automation Suite cluster. Do not run this manually. This will run as part of a sequence of runbooks for a restore.
• Virtual network (Microsoft.Network/virtualNetworks) – virtual network used to deploy the node virtual machines.
  • Virtual Network Subnet (Microsoft.Network/virtualNetworks/subnets) – where all nodes reside
  • Virtual Network Subnet (Microsoft.Network/virtualNetworks/subnets) – used for Azure Bastion (Optional, created if Azure Bastion is enabled, and you did not select an existing Virtual Network)
• Public load balancer (Microsoft.Network/loadBalancers) – used to balance traffic to nodes
  • 443 – HTTPS traffic to the cluster
  • 6443 – HTTPS traffic to Kubernetes API
• Internal load balancer (Microsoft.Network/loadBalancers) – used during the installation for node registration. It has a fixed IP and allows traffic on all ports.
• Bastion (Microsoft.Network/bastionHosts) – used as a jump box for accessing the nodes of the cluster. Optional. This is not deployed if you selected an existing Virtual Network.
• Network security group (Microsoft.Network/networkSecurityGroups) – used to secure subnet traffic. It allows HTTPS (443) and internal VNet connections.
• NAT (Network Address Translation) Gateway (Microsoft.Network/natGateways) – used for outbound connectivity during installation. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Public IP Addresses (Microsoft.Network/publicIpAddresses)
  • one used for Azure Bastion. This is deployed if you selected a new Virtual Network and if Azure Bastion is enabled.
  • one used for the public load balancer
  • one used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Public IP Prefixes (Microsoft.Network/publicIPPrefixes) – used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Private DNS zone (Microsoft.Network/privateDnsZones) – since this deployment can also be used without a public DNS zone a private DNS zone is created.
  • DNS records as required
  • Virtual network link
• Storage account (Microsoft.Storage/storageAccounts)
  • One used for installation orchestration and exposing logs (ends in st).
  • One used by the cluster for extended storage (ends in est)
  • Optional. One deployed if the backup is enabled and used as an NFS file share.