Infrastructure

Create the resource group and network (optional)

AKS needs a subnet of its own, and PostgreSQL Flexible Server needs a separate subnet delegated to it. Run the blocks in order.

Create the resource group:

$
az group create --name confident-prod-rg --location $LOCATION

Create the VNet with the AKS subnet:

$
az network vnet create \
>
  --resource-group confident-prod-rg --name confident-prod-vnet \
>
  --address-prefixes 10.40.0.0/16 \
>
  --subnet-name aks --subnet-prefixes 10.40.0.0/20

Add a second subnet delegated to PostgreSQL Flexible Server. It must hold nothing else:

$
az network vnet subnet create \
>
  --resource-group confident-prod-rg --vnet-name confident-prod-vnet \
>
  --name postgres --address-prefixes 10.40.16.0/28 \
>
  --delegations Microsoft.DBforPostgreSQL/flexibleServers

Print the network IDs to paste into the Terraform config:

$
echo "confident_virtual_network_id = \"$(az network vnet show -g confident-prod-rg -n confident-prod-vnet --query id -o tsv)\""
$
echo "confident_aks_subnet_id      = \"$(az network vnet subnet show -g confident-prod-rg --vnet-name confident-prod-vnet -n aks --query id -o tsv)\""
$
echo "confident_database_subnet_id = \"$(az network vnet subnet show -g confident-prod-rg --vnet-name confident-prod-vnet -n postgres --query id -o tsv)\""

Mirror the code sandbox image (required)

Code-based and transformer metrics run in a sandboxed Azure Function, which pulls the confident-code-sandbox-azure image from an Azure Container Registry you own. Mirror the public image into your ACR. The module expects the repository name confident-code-sandbox, so tag it that way.

Create the ACR and log Docker in to it (the name must be globally unique and lowercase):

$
az acr create --resource-group confident-prod-rg --name <youracr> --sku Basic
$
az acr login --name <youracr>

Pull the public image and push it to your ACR:

$
docker pull confidentai/confident-code-sandbox-azure:latest
$
docker tag confidentai/confident-code-sandbox-azure:latest <youracr>.azurecr.io/confident-code-sandbox:latest
$
docker push <youracr>.azurecr.io/confident-code-sandbox:latest

Write the Terraform config

Create a main.tf that references the published module, then fill in the IDs from the earlier steps. What each variable does:

• Resource group and network: confident_resource_group_name, confident_azure_region, and the network IDs from the network step.
• Naming: confident_environment and confident_environment_code stamp the prod naming convention onto every resource.
• Access: confident_public_aks exposes the cluster API to your machine; set it false for a private-only endpoint.
• Managed services: confident_create_key_vault and confident_managed_redis_enabled turn on the recommended secret store and Redis, and confident_redis_private_endpoint_subnet_id places Redis’s private endpoint (the aks subnet works).
• Code executor: confident_acr_login_server is the ACR holding the image you mirrored. If the Function cannot pull from a private ACR, also set confident_acr_admin_username and confident_acr_admin_password.

1
provider "azurerm" {
2
  features {}
3
}
4
5
module "confident_ai" {
6
  source  = "confident-ai/confident-ai/azurerm"
7
  version = "~> 0.1"
8
9
  confident_resource_group_name = "confident-prod-rg"
10
  confident_azure_region        = "centralus"
11
12
  confident_virtual_network_id = "/subscriptions/.../virtualNetworks/confident-prod-vnet"
13
  confident_aks_subnet_id      = "/subscriptions/.../subnets/aks"
14
  confident_database_subnet_id = "/subscriptions/.../subnets/postgres"
15
16
  confident_environment      = "prod"
17
  confident_environment_code = "p"
18
19
  confident_public_aks = true
20
21
  confident_create_key_vault                 = true
22
  confident_managed_redis_enabled            = true
23
  confident_redis_private_endpoint_subnet_id = "/subscriptions/.../subnets/aks"
24
25
  confident_code_executor_enabled = true
26
  confident_acr_login_server      = "<youracr>.azurecr.io"
27
}
28
29
output "helm_values" {
30
  value     = module.confident_ai.helm_values
31
  sensitive = true
32
}

Configure remote state (optional)

1
terraform {
2
  backend "azurerm" {
3
    resource_group_name  = "confident-prod-rg"
4
    storage_account_name = "confidenttfstate"
5
    container_name       = "tfstate"
6
    key                  = "confident-ai/azure.tfstate"
7
  }
8
}

Apply

$
terraform init
$
terraform plan
$
terraform apply

Creating the AKS cluster and Flexible Server takes roughly 15 to 20 minutes.

Connect to the cluster

$
eval "$(terraform output -raw configure_kubectl)"
$
kubectl get nodes

AKS has a default storage class (managed-csi), so the in-cluster ClickHouse and Redis disks work out of the box.

Read the outputs

The Helm chart on the next page needs these values. terraform output helm_values prints a ready-to-paste snippet, or read them individually. The comment on each line is the Helm value it feeds:

$
terraform output -raw database_url                 # secrets.data.DATABASE_URL
$
terraform output -raw storage_connection_string    # secrets.data.AZURE_STORAGE_CONNECTION_STRING
$
terraform output storage_account_name              # storage.azure.storageAccountName
$
terraform output test_cases_container              # storage.testCasesBucket
$
terraform output payloads_container                # storage.payloadsBucket
$
terraform output -raw code_executor_function_url   # codeExecutor.azure.functionUrl (append /api/execute)