Aller au contenu

Cloud zones#

This page describes the architecture of a Cloud Zone on Azure.

Overview#

azure cloud zone

Cloud zone architecture on Azure is pretty similar to what is deployed on other providers :

  • A Resource Group per zone to hold the resources
  • A VNet with a subnet
  • A Virtual Machine used a bastion
  • A Virtual Machine used a Concourse worker
  • An AKS cluster hosting client applications
  • Storage accounts used to store data from the different components (Velero, Loki, ...etc.)

Base#

Some resources are necessary to prepare for the zone deployment :

  • A resource group that will hold Azure resources
  • A public and private Route53 DNS zone that will expose both <ZONE>.caascad.com and <ZONE>.caascad.net domains
  • A SSH keypair that will be used to connect to VMs and AKS nodes. It is also stored on the corresponding infra vault.

The deployment is done via:

  • An azure_base envs-ng configuration.
  • An azure_base Terraform configuration which contains the necessary resources to be deployed.

IAM#

We also need some IAM resources in order to deploy / administer the zone :

  • AD groups dedicated to the zone. These will be used for both cloud and client zone access
  • Vault backend roles to generate dynamic credentials

This is done with :

  • An envs-ng configuration, azure_iam_cloud, deploying the VNet and its subnets. This is defined in the azure_iam_cloud.cue file.
  • A azure_iam_cloud Terraform configuration which contains the necessary resources to be deployed.

Network#

The network configuration is deployed through several resources:

  • An envs-ng configuration, azure_network, deploying the VNet and its subnet. This is defined in the azure_network.cue file.
  • A azure_network Terraform configuration which contains the necessary resources to be deployed.

Bastion#

To deploy the bastion, we need a few things:

  • A Virtual machine
  • A Public IP to expose the bastion through the internet
  • A Network security group to filter access to the bastion
  • Route53 DNS public and private records for the bastion instance

The corresponding configurations are :

AKS#

The Kubernetes cluster is deployed with :

  • An AKS cluster with a default node pool
  • Extra node pools if needed
  • A Public IP that will be used as an egress IP to ease IP filtering on Caascad infrastructure
  • A Role assignement needed by AKS to retrieve Public IPs information

This is done with :

  • aks envs-ng configuration
  • aks Terraform configuration

Storage accounts#

Storage accounts are also available for every component that needs external storage.

These are deployed with :