Azure deployment architecture

This page offers insight into the deployment architecture on Azure along with the required components.

Architecture Diagram

Complete Component List

• User Assigned Identity (Microsoft.ManagedIdentity/userAssignedIdentities) – configured on the server virtual machine scale set and used for the following:
  • to allow the server virtual machine scale set to query the VMSS and identify the first server where the installation will run;
  • to validate if the hardware requirements and quotas on the subscription are met;
  • to set instance protection on the server nodes to make sure they are not accidentally removed. As part of the installation process, we add instance protection from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk.
  • to perform cluster operations via Automation Account Runbooks.
• Role assignment, contributor (Microsoft.Authorization/roleAssignments) – used to allow the managed identity to perform the aforementioned operations.
• Deployment Scripts (Microsoft.Resources/deploymentScripts):
  • one executed at the beginning of the deployment to validate the configuration selected (quota, availability, etc);
  • one executed at the end of the deployment to validate the status of the deployment since some tasks are asynchronous.
• Key Vault (Microsoft.KeyVault/vaults) – used to store various usernames and secrets (e.g.: SQL username and password, ArgoCD password).
• SQL Server (Microsoft.Sql/servers) – the server used to create the SQL databases.
• SQL Databases (Microsoft.Sql/servers/databases) – the databases needed for each enabled service.
• SQL Elastic Pool (Microsoft.Sql/servers/elasticPools) – elastic pool used to keep costs low.
• Virtual machine scale sets (Microsoft.Compute/virtualMachineScaleSets) – the nodes of the cluster:
  • one scale set is used for server nodes (cluster control plane). As part of the installation process, we add instance protection from scale set operations to all nodes of the Server Scales Set. Since these operations are performed from Azure, without the server context, cluster malfunction is prevented. For more about Scale Set Instance Protection, see Azure documentation. Server nodes also run workloads and have a dedicated data disk. They also have the Identity assigned (User Assigned Identity). Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
    • 512GiB or 2TiB data disk (basic or complete, Premium_LRS)
    • 16GiB UltraSSD_LRS if enabled otherwise Premium_LRS
  • one scale set is used for agent nodes. Designed to only run workloads (they have no control plane services). If the number of desired Agent nodes is 0, an empty scale set is created. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256 GiB binaries disk (Premium_LRS)
  • GPU nodes. Optional. Nodes used specifically for ML models that have video cards. If the number of desired GPU nodes is 0, no scale set is created. Disks for each node:
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • Virtual Machine (Microsoft.Compute/virtualMachines) – Task Mining node.
  • VM Extension (Microsoft.Compute/virtualMachines/extensions) – used to install Automation Suite
  • Disks (Microsoft.Compute/disks):
    • 256GiB OS disk (Premium_LRS)
    • 256GiB binaries disk (Premium_LRS)
  • Network interface (Microsoft.Network/networkInterfaces)
• Automation Account (Microsoft.Automation/automationAccounts) – automation account used for cluster operations.
  • InstanceRefresh (Microsoft.Automation/automationAccounts/runbooks) – runbook to initiate an instance refresh operation on an Automation Suite cluster.
  • RemoveServers (Microsoft.Automation/automationAccounts/runbooks) – runbook to perform server removal from the Automation Suite cluster.
  • RemoveNodes (Microsoft.Automation/automationAccounts/runbooks) – runbook to perform specific node removal from the Automation Suite cluster.
  • CheckServerZoneResilience (Microsoft.Automation/automationAccounts/runbooks) - runbook to check the server zone resilience and distribute a node to other Availability Zone if needed.
  • ImportASModules (Microsoft.Automation/automationAccounts/runbooks) - runbook to import the modules (Microsoft.Automation/automationAccounts/modules) needed by the Automation Suite runbooks.
• Virtual network (Microsoft.Network/virtualNetworks) – virtual network used to deploy the node virtual machines.
  • Virtual Network Subnet (Microsoft.Network/virtualNetworks/subnets) – where all nodes reside
  • Virtual Network Subnet (Microsoft.Network/virtualNetworks/subnets) – used for Azure Bastion (Optional, created if Azure Bastion is enabled, and you did not select an existing Virtual Network)
• Public load balancer (Microsoft.Network/loadBalancers) – used to balance traffic to nodes
  • 443 – HTTPS traffic to the cluster
  • 6443 – HTTPS traffic to Kubernetes API
• Internal load balancer (Microsoft.Network/loadBalancers) – used during the installation for node registration. It has a fixed IP and allows traffic on all ports.
• Bastion (Microsoft.Network/bastionHosts) – used as a jump box for accessing the nodes of the cluster. Optional. This is not deployed if you selected an existing Virtual Network.
• Network security group (Microsoft.Network/networkSecurityGroups) – used to secure subnet traffic. It allows HTTPS (443) and internal VNet connections.
• NAT (Network Address Translation) Gateway (Microsoft.Network/natGateways) – used for outbound connectivity during installation. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Public IP Addresses (Microsoft.Network/publicIpAddresses)
  • one used for Azure Bastion. This is deployed if you selected a new Virtual Network and if Azure Bastion is enabled.
  • one used for the public load balancer
  • one used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Public IP Prefixes (Microsoft.Network/publicIPPrefixes) – used for the NAT Gateway. If using an existing VNet outbound connectivity needs to be provided as this will not be deployed.
• Private DNS zone (Microsoft.Network/privateDnsZones) – since this deployment can also be used without a public DNS zone a private DNS zone is created.
  • DNS records as required
  • Virtual network link
• Storage account (Microsoft.Storage/storageAccounts)
  • One used for installation orchestration and exposing logs.
  • Optional. One deployed if the backup is enabled and used as NFS file share.