Skip to content

Commit c416efd

Browse files
guilloadguilload
committed
CLOUDPREM-137: Add documentation for Azure
1 parent 07c452a commit c416efd

File tree

3 files changed

+415
-2
lines changed

3 files changed

+415
-2
lines changed

‎content/en/cloudprem/configure/azure-config.md

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
---
2+
title: Azure Configuration
3+
description: Learn how to configure Azure for CloudPrem
4+
private: true
5+
further_reading:
6+
- link: "/cloudprem/install/azure-aks/"
7+
tag: "Documentation"
8+
text: "Install CloudPrem on Azure AKS"
9+
- link: "/cloudprem/ingest-logs/"
10+
tag: "Documentation"
11+
text: "Configure Log Ingestion"
12+
---
13+
14+
## Overview
15+
16+
Before you install CloudPrem on your Azure account, you’ll need to set up a set of supporting infrastructure components. These resources provide the compute, storage, database, and networking services that CloudPrem depends on. This page lists everything you need to provision in your Azure account before moving on to the installation steps described in the [Azure AKS Installation Guide](../install/azure-aks/).
17+
18+
## Prerequites
19+
- Azure Kubernetes Service (AKS) – A running AKS cluster sized for your expected CloudPrem workload.
20+
- PostgreSQL Flexible Server – An Azure Database for PostgreSQL instance that CloudPrem will use to store its metadata.
21+
- Blob Storage Container – An Azure Storage container to hold CloudPrem logs.
22+
- Client Identity & Permissions – An Azure AD application with read/write access to the storage container.
23+
- NGINX Ingress Controller – Installed on the AKS cluster to route external traffic to CloudPrem services.
24+
- Datadog Agent – Deployed on the AKS cluster to collect and send logs to CloudPrem.
25+
26+
1. Azure Kubernetes Service (AKS)
27+
28+
CloudPrem runs entirely on Kubernetes. You’ll need an AKS cluster with sufficient CPU, memory, and disk space configured for your workload. See the Kubernetes cluster sizing recommendations for guidance.
29+
30+
• Quickstart: [Deploy an AKS cluster with the Azure CLI](https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-cli)
31+
• Quickstart: [Deploy an AKS cluster with Terraform](https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-terraform?pivots=development-environment-azure-cli)
32+
33+
Check:
34+
Run `kubectl get nodes` and confirm the cluster is reachable and nodes are in `Ready` state.
35+
36+
2. PostgreSQL Flexible Server
37+
38+
CloudPrem stores its metadata and configuration in a PostgreSQL database. An Azure Database for PostgreSQL Flexible Server is recommended. It must be reachable from the AKS cluster, ideally with private networking enabled. See the Postgres sizing recommendations for details.
39+
40+
• Quickstart: Create an Azure Database for PostgreSQL Flexible Server using the Azure CLI (https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/quickstart-create-server?tabs=portal-create-flexible%2Cportal-get-connection%2Cportal-delete-resources)
41+
• Quickstart: Create an Azure Database for PostgreSQL Flexible Server using Terraform (https://learn.microsoft.com/en-us/azure/developer/terraform/deploy-postgresql-flexible-server-database?tabs=azure-cli)
42+
43+
Check:
44+
Verify you can connect with psql from a bastion or from inside the AKS network, and that credentials work. Replace placeholders with your actual values:
45+
```bash
46+
psql "host=<SERVER_NAME>.postgres.database.azure.com \
47+
port=5432 \
48+
dbname=<DB_NAME> \
49+
user=<ADMIN_USER>@<SERVER_NAME> \
50+
password=<PASSWORD> \
51+
sslmode=require"
52+
```
53+
54+
If successful, you should see a prompt like:
55+
```
56+
psql (15.2)
57+
SSL connection (protocol: TLS, cipher: ...)
58+
Type "help" for help.
59+
60+
<DB_NAME>=>
61+
```
62+
63+
👉 For security, create a dedicated database and user for CloudPrem, and grant the user rights only on that database, not cluster-wide.
64+
65+
3. Blob Storage Container
66+
67+
CloudPrem uses Azure Blob Storage to persist logs. Create a dedicated container for this purpose.
68+
69+
• Quickstart: Create a Blob container with the Azure CLI
70+
• Tutorial: Create Blob storage resources with Terraform
71+
72+
Check:
73+
Upload a test file with az storage blob upload and confirm you can list and read it back.
74+
75+
Use a dedicated container per environment (e.g. cloudprem-prod, cloudprem-staging) and apply least-privilege IAM roles at the container scope, not account-wide.
76+
77+
4. Client Identity & Permissions
78+
79+
An Azure AD application must be granted read/write access to the Blob container. CloudPrem will use this identity to interact with storage.
80+
Check:
81+
Ensure the identity has the Storage Blob Data Contributor role assigned on the container or storage account.
82+
83+
5. NGINX Ingress Controller
84+
85+
CloudPrem services are exposed via HTTP(S). An NGINX ingress controller should be installed in your AKS cluster to provide routing and TLS termination.
86+
Check:
87+
Run `kubectl get pods -n ingress-nginx` and confirm controller pods are healthy.
88+
89+
6. Datadog Agent
90+
91+
<!-- For observability, deploy the Datadog Agent on your AKS cluster. The Agent collects metrics, logs, and traces from CloudPrem workloads.
92+
Check:
93+
Run kubectl get pods -n datadog and confirm the Agent pods are running, and check Datadog to see cluster metrics appearing. -->
94+
95+
96+
<!-- This guide covers how to configure your AWS account prerequisites for CloudPrem deployment. This configuration is required before installing CloudPrem on AWS EKS.
97+
98+
For the complete AKS installation process, see the [Azure AKS Installation Guide](../install/azure-aks/).
99+
100+
## AWS prerequisites
101+
102+
To deploy CloudPrem on AWS, you need to configure:
103+
- AWS credentials and authentication
104+
- AWS region selection
105+
- IAM permissions for S3 object storage
106+
- RDS PostgreSQL database (recommended)
107+
- EKS cluster with AWS Load Balancer Controller
108+
109+
## AWS credentials
110+
111+
When starting a node, CloudPrem attempts to find AWS credentials using the credential provider chain implemented by [rusoto\_core::ChainProvider][2] and looks for credentials in this order:
112+
113+
1. Environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, or `AWS_SESSION_TOKEN` (optional).
114+
2. Credential profiles file, typically located at `~/.aws/credentials` or otherwise specified by the `AWS_SHARED_CREDENTIALS_FILE` and `AWS_PROFILE` environment variables if set and not empty.
115+
3. Amazon ECS container credentials, loaded from the Amazon ECS container if the environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set.
116+
4. Instance profile credentials, used on Amazon EC2 instances, and delivered through the Amazon EC2 metadata service.
117+
118+
An error is returned if no credentials are found in the chain.
119+
120+
## AWS Region
121+
122+
CloudPrem attempts to find the AWS region from multiple sources, using the following order of precedence:
123+
124+
1. **Environment variables**: Checks `AWS_REGION`, then `AWS_DEFAULT_REGION`.
125+
2. **AWS config file**: Typically located at `~/.aws/config`, or at the path specified by the `AWS_CONFIG_FILE` environment variable (if set and not empty).
126+
3. **EC2 instance metadata**: Uses the region of the currently running Amazon EC2 instance.
127+
4. **Default**: Falls back to `us-east-1` if no other source provides a region.
128+
129+
## IAM permissions for S3
130+
131+
Required authorized actions:
132+
133+
* `ListBucket` (on the bucket directly)
134+
* `GetObject`
135+
* `PutObject`
136+
* `DeleteObject`
137+
* `ListMultipartUploadParts`
138+
* `AbortMultipartUpload`
139+
140+
Here is an example of a bucket policy:
141+
142+
```
143+
144+
{
145+
"Version": "2012-10-17",
146+
"Statement": [
147+
{
148+
"Effect": "Allow",
149+
"Action": [
150+
"s3:ListBucket"
151+
],
152+
"Resource": [
153+
"arn:aws:s3:::my-bucket"
154+
]
155+
},
156+
{
157+
"Effect": "Allow",
158+
"Action": [
159+
"s3:GetObject",
160+
"s3:PutObject",
161+
"s3:DeleteObject",
162+
"s3:ListMultipartUploadParts",
163+
"s3:AbortMultipartUpload"
164+
],
165+
"Resource": [
166+
"arn:aws:s3:::my-bucket/*"
167+
]
168+
}
169+
]
170+
}
171+
```
172+
173+
## Next steps
174+
175+
After completing the AWS configuration:
176+
177+
1. **Install CloudPrem on EKS** - Follow the [AWS EKS Installation Guide](../install/aws-eks/) to deploy CloudPrem
178+
2. **Configure ingress** - Set up [ingress configuration](./ingress/) for external access
179+
3. **Set up log ingestion** - Configure [log ingestion](../ingest-logs/) to start sending logs to CloudPrem
180+
181+
## Further reading
182+
183+
{{< partial name="whats-next/whats-next.html" >}}
184+
185+
[1]: /cloudprem/configure/ingress/
186+
[2]: https://docs.rs/rusoto_credential/latest/rusoto_credential/struct.ChainProvider.html -->

‎content/en/cloudprem/install/aws-eks.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ echo ""
143143
# 1. A public ingress for external access through the internet that will be used exclusively by Datadog's control plane and query service.
144144
# 2. An internal ingress for access within the VPC
145145
#
146-
# Both ingresses provision Application Load Balancers (ALBs) in AWS.
146+
# Both ingresses provision an Application Load Balancers (ALBs) in AWS.
147147
# The public ingress ALB is created in public subnets.
148148
# The internal ingress ALB is created in private subnets.
149149
#

0 commit comments

Comments
 (0)