automation-suite
2022.4
false
- Overview
- Requirements
- Installation
- Post-installation
- Cluster administration
- Managing products
- Managing the cluster in ArgoCD
- Setting up the external NFS server
- Automated: Enabling the Backup on the Cluster
- Automated: Disabling the Backup on the Cluster
- Automated, Online: Restoring the Cluster
- Automated, Offline: Restoring the Cluster
- Manual: Enabling the Backup on the Cluster
- Manual: Disabling the Backup on the Cluster
- Manual, Online: Restoring the Cluster
- Manual, Offline: Restoring the Cluster
- Additional configuration
- Migrating objectstore from persistent volume to raw disks
- Monitoring and alerting
- Migration and upgrade
- Migration options
- Step 1: Moving the Identity organization data from standalone to Automation Suite
- Step 2: Restoring the standalone product database
- Step 3: Backing up the platform database in Automation Suite
- Step 4: Merging organizations in Automation Suite
- Step 5: Updating the migrated product connection strings
- Step 6: Migrating standalone Insights
- Step 7: Deleting the default tenant
- B) Single tenant migration
- Product-specific configuration
- Best practices and maintenance
- Troubleshooting
- How to Troubleshoot Services During Installation
- How to Uninstall the Cluster
- How to clean up offline artifacts to improve disk space
- How to clear Redis data
- How to enable Istio logging
- How to manually clean up logs
- How to clean up old logs stored in the sf-logs bucket
- How to disable streaming logs for AI Center
- How to debug failed Automation Suite installations
- How to delete images from the old installer after upgrade
- How to automatically clean up Longhorn snapshots
- How to disable TX checksum offloading
- How to address weak ciphers in TLS 1.2
- Unable to run an offline installation on RHEL 8.4 OS
- Error in Downloading the Bundle
- Offline installation fails because of missing binary
- Certificate issue in offline installation
- First installation fails during Longhorn setup
- SQL connection string validation error
- Prerequisite check for selinux iscsid module fails
- Azure disk not marked as SSD
- Failure After Certificate Update
- Automation Suite not working after OS upgrade
- Automation Suite Requires Backlog_wait_time to Be Set 1
- Volume unable to mount due to not being ready for workloads
- RKE2 fails during installation and upgrade
- Failure to upload or download data in objectstore
- PVC resize does not heal Ceph
- Failure to Resize Objectstore PVC
- Rook Ceph or Looker pod stuck in Init state
- StatefulSet volume attachment error
- Failure to create persistent volumes
- Storage reclamation patch
- Backup failed due to TooManySnapshots error
- All Longhorn replicas are faulted
- Setting a timeout interval for the management portals
- Update the underlying directory connections
- Cannot Log in After Migration
- Kinit: Cannot Find KDC for Realm <AD Domain> While Getting Initial Credentials
- Kinit: Keytab Contains No Suitable Keys for *** While Getting Initial Credentials
- GSSAPI Operation Failed With Error: An Invalid Status Code Was Supplied (Client's Credentials Have Been Revoked).
- Alarm Received for Failed Kerberos-tgt-update Job
- SSPI Provider: Server Not Found in Kerberos Database
- Login Failed for User <ADDOMAIN><aduser>. Reason: The Account Is Disabled.
- ArgoCD login failed
- Failure to get the sandbox image
- Pods not showing in ArgoCD UI
- Redis Probe Failure
- RKE2 Server Fails to Start
- Secret Not Found in UiPath Namespace
- After the Initial Install, ArgoCD App Went Into Progressing State
- MongoDB pods in CrashLoopBackOff or pending PVC provisioning after deletion
- Unexpected Inconsistency; Run Fsck Manually
- Degraded MongoDB or Business Applications After Cluster Restore
- Missing Self-heal-operator and Sf-k8-utils Repo
- Unhealthy Services After Cluster Restore or Rollback
- RabbitMQ pod stuck in CrashLoopBackOff
- Prometheus in CrashloopBackoff state with out-of-memory (OOM) error
- Missing Ceph-rook metrics from monitoring dashboards
- Pods cannot communicate with FQDN in a proxy environment
- Using the Automation Suite Diagnostics Tool
- Using the Automation Suite support bundle
- Exploring Logs
Azure deployment architecture

Automation Suite installation guide
Last updated Mar 17, 2025
Azure deployment architecture
This page offers insight into the deployment architecture on Azure along with the required components.
- User Assigned Identity (
Microsoft.ManagedIdentity/userAssignedIdentities
) – configured on the server virtual machine scale set and used for the following:- to allow the server virtual machine scale set to query the VMSS and identify the first server where the installation will run;
- to validate if the hardware requirements and quotas on the subscription are met;
- to set instance protection on the server nodes to make sure they are not accidentally removed. As part of the installation process, we add instance protection from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk.
- to perform cluster operations via Automation Account Runbooks.
- Role assignment, contributor (
Microsoft.Authorization/roleAssignments
) – used to allow the managed identity to perform the aforementioned operations. - Deployment Scripts (
Microsoft.Resources/deploymentScripts
):- one executed at the beginning of the deployment to validate the configuration selected (quota, availability, etc);
- one executed at the end of the deployment to validate the status of the deployment since some tasks are asynchronous.
- Key Vault (
Microsoft.KeyVault/vaults
) – used to store various usernames and secrets (e.g.: SQL username and password, ArgoCD password). - SQL Server (
Microsoft.Sql/servers
) – the server used to create the SQL databases. - SQL Databases (
Microsoft.Sql/servers/databases
) – the databases needed for each enabled service. - SQL Elastic Pool (
Microsoft.Sql/servers/elasticPools
) – elastic pool used to keep costs low. - Virtual machine scale sets (
Microsoft.Compute/virtualMachineScaleSets
) – the nodes of the cluster:- one scale set is used for server nodes (cluster control plane). As part of the installation process, we add instance protection
from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without
the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk. They also have the Identity assigned (User Assigned Identity).
Disks for each node:
- 256GiB OS disk (
Premium_LRS
) - 256GiB binaries disk (
Premium_LRS
) - 512GiB or 2TiB data disk (basic or complete,
Premium_LRS
) - 16GiB
UltraSSD_LRS
if enabled otherwisePremium_LRS
- 256GiB OS disk (
- one scale set is used for agent nodes. Designed to only run workloads (they have no control plane services). If the number
of desired Agent nodes is 0, an empty scale set is created. Disks for each node:
- 256GiB OS disk (
Premium_LRS
) - 256 GiB binaries disk (
Premium_LRS
)
- 256GiB OS disk (
- GPU nodes. Optional. Nodes used specifically for ML models that have video cards. If the number of desired GPU nodes is 0, no scale set is created.
Disks for each node:
- 256GiB OS disk (
Premium_LRS
) - 256GiB binaries disk (
Premium_LRS
)
- 256GiB OS disk (
- Virtual Machine (
Microsoft.Compute/virtualMachines
) – Task Mining node. - VM Extension (
Microsoft.Compute/virtualMachines/extensions
) – used to install Automation Suite - Disks (
Microsoft.Compute/disks
):- 256GiB OS disk (
Premium_LRS
) - 256GiB binaries disk (
Premium_LRS
)
- 256GiB OS disk (
- Network interface (
Microsoft.Network/networkInterfaces
)
- one scale set is used for server nodes (cluster control plane). As part of the installation process, we add instance protection
from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without
the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk. They also have the Identity assigned (User Assigned Identity).
Disks for each node:
- Automation Account (
Microsoft.Automation/automationAccounts
) – automation account used for cluster operations.InstanceRefresh
(Microsoft.Automation/automationAccounts/runbooks
) – runbook to initiate an instance refresh operation on an Automation Suite cluster.RemoveServers
(Microsoft.Automation/automationAccounts/runbooks
) – runbook to perform server removal from the Automation Suite cluster.RemoveNodes
(Microsoft.Automation/automationAccounts/runbooks
) – runbook to perform specific node removal from the Automation Suite cluster.CheckServerZoneResilience
(Microsoft.Automation/automationAccounts/runbooks
) - runbook to check the server zone resilience and distribute a node to other Availability Zone if needed.ImportASModules
(Microsoft.Automation/automationAccounts/runbooks
) - runbook to import the modules (Microsoft.Automation/automationAccounts/modules
) needed by the Automation Suite runbooks.
- Virtual network (
Microsoft.Network/virtualNetworks
) – virtual network used to deploy the node virtual machines.- Virtual Network Subnet (
Microsoft.Network/virtualNetworks/subnets
) – where all nodes reside - Virtual Network Subnet (
Microsoft.Network/virtualNetworks/subnets
) – used for Azure Bastion (Optional, created if Azure Bastion is enabled, and you did not select an existing Virtual Network)
- Virtual Network Subnet (
- Public load balancer (
Microsoft.Network/loadBalancers
) – used to balance traffic to nodes443
– HTTPS traffic to the cluster6443
– HTTPS traffic to Kubernetes API
- Internal load balancer (
Microsoft.Network/loadBalancers
) – used during the installation for node registration. It has a fixed IP and allows traffic on all ports. - Bastion (
Microsoft.Network/bastionHosts
) – used as a jump box for accessing the nodes of the cluster. Optional. This is not deployed if you selected an existing Virtual Network. - Network security group (
Microsoft.Network/networkSecurityGroups
) – used to secure subnet traffic. It allowsHTTPS
(443) and internal VNet connections. - NAT (Network Address Translation) Gateway (
Microsoft.Network/natGateways
) – used for outbound connectivity during installation. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed. - Public IP Addresses (
Microsoft.Network/publicIpAddresses
)- one used for Azure Bastion. This is deployed if you selected a new Virtual Network and if Azure Bastion is enabled.
- one used for the public load balancer
- one used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
- Public IP Prefixes (
Microsoft.Network/publicIPPrefixes
) – used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed. - Private DNS zone (
Microsoft.Network/privateDnsZones
) – since this deployment can also be used without a public DNS zone a private DNS zone is created.- DNS records as required
- Virtual network link
- Storage account (
Microsoft.Storage/storageAccounts
)- One used for installation orchestration and exposing logs.
- Optional. One deployed if the backup is enabled and used as NFS file share.