Azure Dependencies
Azure-specific requirements only. Everything cloud-agnostic (PostgreSQL extensions, artifact access, domain names, secrets handling) is defined once in the Environment Dependencies registry; this page refines those rows for AKS.
Cluster
| Dependency | Requirement | Why It Is Needed | Verify |
|---|---|---|---|
| AKS cluster | A provisioned AKS cluster with a CNI plugin (Azure CNI or Cilium), CoreDNS, and the Azure Disk CSI driver providing the default managed-csi StorageClass. Node auto-provisioning or autoscaling enabled for CPU and GPU capacity. | These add-ons back pod networking, service discovery, and volume provisioning for the platform. | kubectl get pods -n kube-system shows CNI, CoreDNS, and Azure Disk CSI pods Running; a test PersistentVolume provisions via managed-csi. |
| Workload identity | AKS Workload Identity federation configured for workloads that access Azure resources. | Pods use federated identities instead of static credentials. | A test pod acquires a token for its target resource. |
Compute
| Dependency | Requirement | Why It Is Needed | Verify |
|---|---|---|---|
| GPU nodes | A passthrough GPU SKU whose driver satisfies the core CUDA requirement (currently CUDA 13.0), for example NC A100 v4 (Standard_NC24ads_A100_v4). Regional GPU quota approved for the chosen family. | DynamoGuard inference images require CUDA 13; only passthrough SKUs receive a CUDA 13-capable driver (see Known Issues). | Quota approved; GPU nodes provision and advertise nvidia.com/gpu; DynamoGuard inference pods schedule and run. |
| CPU nodes | General-purpose SKUs (for example D-series) provisioned through autoscaling. | DynamoGuard base functions and DynamoEval run on these nodes. | Autoscaling provisions D-series nodes on demand. |
Databases and Storage
| Dependency | Requirement | Why It Is Needed | Verify |
|---|---|---|---|
| Azure Database for PostgreSQL | A Flexible Server instance with pg_partman and vector allow-listed in the azure.extensions server parameter, TLS per your security policy, zone-redundant HA recommended for production, satisfying the core PostgreSQL row. | On Azure, extensions must be explicitly allow-listed before CREATE EXTENSION can succeed. | pg_partman and vector appear in azure.extensions; endpoint reachable from the cluster via VNet integration, Private Link, or firewall rules. |
| Object storage | S3-compatible storage: validated deployments use an in-cluster MinIO instance deployed by DynamoAI, with two logical stores (models, platform artifacts). | Concrete Azure form of the core object-storage requirement. | Endpoint, store names, and credentials configured and reachable from the cluster. |
Networking and Ingress
| Dependency | Requirement | Why It Is Needed | Verify |
|---|---|---|---|
| Ingress | An ingress path for the three platform endpoints (apps., auth., api.) with certificates. Validated patterns include Azure Application Gateway and in-cluster NGINX ingress. | Exposes the platform to the customer network; the final handover check depends on it. | All three endpoints respond over HTTPS from the customer network. |
Known Issues
| Issue | Impact | Mitigation |
|---|---|---|
| A10 v5 (NVadsA10 v5) SKUs are vGPU-based; the Azure GRID driver is limited to CUDA 12.8. | Does not satisfy the CUDA 13 requirement; DynamoGuard inference fails to run. | Use a passthrough SKU (for example NC A100 v4) that receives a CUDA 13-capable driver. |
| The platform does not support TLS connections to Redis on Azure (Azure Cache for Redis enforces TLS). | Managed Azure Redis cannot be used. | Deploy the in-cluster Redis shipped with the platform. |
| Keycloak behind a reverse proxy requires explicit proxy-headers configuration. | Authentication redirect loops or wrong externally visible URLs when misconfigured. | Follow the Keycloak 24 to 26 Upgrade Guide proxy-headers section. |
Pre-Deployment Checklist
Your progress is saved in your browser. Use Download to export the current state as Markdown.
Azure Pre-Deployment0/10