Self-Hosting on Azure
Run the full Confident AI platform on Azure, inside your own subscription and region. A published Terraform module stands up an AKS cluster, a managed PostgreSQL Flexible Server, and a Storage account with Blob containers, and the confident-ai Helm chart deploys the application on top. On Azure the app reaches Blob storage through a connection string held as a secret.
You run it in two steps: Infrastructure provisions the cloud resources with Terraform, then Deploy with Helm installs the app and exposes it over HTTPS. Plan for roughly 15 to 20 minutes of Terraform time plus a few minutes for the chart to come up.
What Terraform provisions
The module deploys into a resource group and VNet you already have. It never creates them.
AKS
A private cluster with a worker node pool, OIDC issuer and Workload Identity enabled.
PostgreSQL Flexible Server
The app's primary database, VNet-integrated and private, with high availability.
Azure Storage
A Storage account with two Blob containers, one for test cases and one for payloads.
Connection-string access
The app reaches Blob storage with a connection string held as a secret.
Azure Function code executor
Required for code-based and transformer metrics: a Function that runs the mirrored image.
Key Vault + Managed Redis
Recommended: a vault for the External Secrets Operator, and managed Redis.
ClickHouse runs inside the cluster (the Helm chart installs it). The recommended setup keeps secrets in Key Vault and runs Redis on Azure Managed Redis; in-cluster Redis and a Kubernetes Secret remain available as a simpler option. Cluster add-ons such as an ingress controller or the External Secrets Operator are your choice and are not installed by Terraform.
How it fits together
- Blob uses a connection string; the rest is keyless. The app reaches Blob storage with
AZURE_STORAGE_CONNECTION_STRING, held as a secret. AKS still has Workload Identity enabled, which the External Secrets Operator uses to read Key Vault through a federated credential. - The data plane is private. AKS nodes and the Flexible Server sit in the VNet, with the database on a delegated subnet and a private DNS zone. You choose whether the cluster API endpoint is public (handy for
kubectlandhelmfrom your laptop) or private-only. - Traffic flows one way in. Your applications send traces to
confident-otel, which writes them to ClickHouse. The dashboard and API read from the Flexible Server and ClickHouse. Evaluations run inconfident-evalsand its workers, calling your model provider and the Azure Function sandbox for code and transformer metrics. Datasets and payloads live in Blob storage.
Deployed services
The Helm chart installs these workloads into the confident-ai namespace:
| Service | Role |
|---|---|
confident-backend | Core API |
confident-frontend | The dashboard |
confident-evals | Evaluation service |
confident-evals-worker | Async evaluation jobs |
confident-ingestion-worker | Trace ingestion |
confident-worker | Background jobs |
confident-otel | OTLP and trace collector |
| ClickHouse and Keeper | Trace and span store |
| Redis | Cache and queues (in-cluster unless you use Azure Managed Redis) |
See Scaling for how each of these grows with load.
Defaults
| Component | Default |
|---|---|
| Node pool | 4 x Standard_D8s_v5 |
| Region | centralus |
| Cluster endpoint | Private (confident_public_aks = true to reach it from your machine) |
| PostgreSQL | GP_Standard_D4s_v3, private, high availability |
| Storage class | managed-csi (in-cluster ClickHouse and Redis disks) |
Everything above is overridable in the Terraform module. See the module inputs for the full list.
The module
The module is published to the Terraform Registry and its source lives on GitHub.
Prerequisites
terraform(≥ 1.5), theazCLI,kubectl,helm(≥ 3.8), anddocker(to mirror the code sandbox image).az login, with the subscription set for the provider:export ARM_SUBSCRIPTION_ID=$(az account show --query id -o tsv).- From Confident AI: image pull credentials and a
CONFIDENT_LICENSE_KEY(see Deploy with Helm).
Next steps
Infrastructure
Provision AKS, PostgreSQL, and Blob storage with Terraform.
Deploy with Helm
Install the app and expose it over HTTPS.