Before deploying Confident AI, you need to prepare your local environment and gather required information. This page covers:
Complete all items on this page before proceeding to Configuration.
Install the following tools on your local machine (or wherever you’ll run the deployment from):
Verify installations:
Corporate laptop restrictions: Many organizations restrict software installation on managed devices. If you can’t install these tools locally, consider: - Using a cloud-based VM (Azure VM) as your deployment workstation - Requesting exceptions from your IT security team - Using pre-approved container images that include these tools
Terraform needs Azure credentials to create resources on your behalf. The identity you use must have Contributor and User Access Administrator roles on the target subscription.
If running Terraform from an Azure VM with a system-assigned managed identity, no explicit login is needed. Ensure the identity has the required role assignments.
Verify access works:
This should return your subscription ID and tenant.
Permission errors are the #1 cause of failed deployments. Before starting, verify your identity has permissions to create:
If your organization requires pre-approved service principals, work with your cloud security team to get the necessary permissions before proceeding.
Using a service principal? Many organizations prohibit using personal credentials for infrastructure provisioning. If you need to use a service principal, ensure it has the permissions listed above and that you can authenticate with it from your deployment workstation.
Confident AI provides a private GitHub repository containing the deployment code:
Your Confident AI representative will grant your GitHub account access to this repository. Once granted, clone it:
SSH key issues: If the clone fails with “Permission denied (publickey)”, you need to add your SSH key to GitHub. See GitHub’s SSH key documentation.
Corporate proxy/firewall: If git commands hang or timeout, your network may block SSH (port 22). Try using HTTPS instead:
Before running Terraform, you need several pieces of information. Gather these now to avoid interruptions during configuration.
You need the subscription ID where resources will be deployed:
Ensure the correct subscription is selected. If your organization has multiple subscriptions, verify you’re targeting the right one. Deploying to the wrong subscription can be difficult to undo.
Confident AI needs three URLs configured. These determine where your users and applications access the platform:
Why separate frontend and backend URLs? The frontend serves the web dashboard, while the backend handles API requests. Separating them allows independent scaling and clearer security boundaries. Both URLs will point to the same load balancer but route to different services.
DNS control required: You must be able to create DNS records (CNAME or A records) for these domains. If your DNS is managed by a different team, loop them in early—DNS changes often require change tickets and approvals.
If using Google for user authentication, you need OAuth credentials. Skip this if using a different identity provider (Okta, Azure AD, etc.—these are configured separately).
https://<your-backend-url>/api/auth/callback/googleOAuth redirect URI must be exact. The redirect URI must match exactly what
you configure in Confident AI. A common mistake is forgetting the
/api/auth/callback/google path or using HTTP instead of HTTPS.
Confident AI container images are stored in a private AWS Elastic Container Registry (ECR). Your Confident AI representative will provide credentials that allow your AKS cluster to pull these images:
Why AWS ECR on Azure? Confident AI hosts container images in AWS ECR. Terraform configures a CronJob in your AKS cluster that periodically refreshes ECR pull credentials. Your cluster authenticates to ECR, pulls the images, and runs them in your environment—the images never leave your infrastructure after the initial pull.
You need to generate several secure random values. These are used for encrypting sessions, database passwords, and admin access:
Save these values securely. You’ll need them during configuration. Use a password manager or secure notes—don’t save them in plain text files or commit them to git. If you lose these values, you may need to redeploy or reset credentials.
Confident AI uses OpenAI (or compatible LLM providers) to run evaluations. You need an API key with access to models like GPT-4.
Outbound network access: Your AKS cluster needs outbound HTTPS access to
api.openai.com for evaluations to work. If your organization restricts
outbound traffic, ensure this is allowlisted. Alternatively, if you use Azure
OpenAI or a self-hosted model, provide those credentials instead.
Terraform can either create a new VNet or deploy into an existing one. Understanding this decision is important because it affects network isolation, connectivity, and security.
A Virtual Network (VNet) is your isolated network in Azure. Think of it as your own private data center in the cloud. Resources inside the VNet can talk to each other, but external access is controlled by gateways and security rules.
Terraform creates a dedicated VNet for Confident AI with:
Default IP ranges:
CIDR conflicts: If these IP ranges overlap with your corporate network
(e.g., if you already use 10.0.x.x internally), you’ll have routing problems
when setting up VPN connectivity. Check with your network team and choose
non-overlapping ranges.
If your organization requires deploying into an existing VNet (common for compliance or network policy reasons), gather:
/subscriptions/.../resourceGroups/.../providers/Microsoft.Network/virtualNetworks/...)10.0.0.0/16)Microsoft.DBforPostgreSQL/flexibleServers service delegationDatabase subnet delegation is required. PostgreSQL Flexible Server requires a dedicated subnet with Microsoft.DBforPostgreSQL/flexibleServers service delegation. Without this delegation, the database provisioning will fail.
If using an existing VNet, verify the database subnet has this delegation configured or add it before proceeding.
Corporate VNet restrictions: Many organizations have strict policies on what can be created in shared VNets:
Work with your network/cloud team to understand these constraints before choosing this option.
Before moving to Configuration, verify:
terraform, az, kubectl, helm, git)az account show succeedsOnce you have all prerequisites in place, proceed to Configuration to set up your Terraform variables.