Introduction to Azure deployment
Understand what an existing Microsoft Azure deployment includes, what it creates, and what you operate.
阅读时间4 分钟最后更新于 5 天前
If your organization runs Unity Asset Manager in Microsoft Azure, this section covers how to install, operate, and maintain that deployment. In an Azure deployment:
- You deploy the platform as an Azure managed application through a private Azure Marketplace offer, so your assets, metadata, and user activity stay inside your own Azure environment.
- Managed Azure services provide the Kubernetes cluster, the PostgreSQL database, secret storage, and log collection that the platform depends on.
注意
The Azure package is supported for existing deployments. For new deployments, including deployments on Azure AKS, use Self-Hosted Deployment on Kubernetes.
This page describes the deployment modes, what the deployment creates, what you provide and operate, and what Azure manages for you.
Deployment modes
You can deploy to Azure in one of the following modes:
- Full deployment: The Azure Marketplace offer creates all solution resources, including the virtual network (VNet).
- Bring your own VNet (BYO VNet): You prepare a VNet that meets the solution requirements, and the Azure Marketplace offer deploys into it.
- Manual deployment: You deploy without Azure Marketplace, for example into an existing Azure Kubernetes Service (AKS) cluster. Manual deployment offers more flexibility but requires more effort and expertise, and you arrange it with Unity.
For more information, refer to Overview of deployment modes in Microsoft Azure.
What the deployment creates
An Azure Marketplace deployment creates:
- A resource group that contains the managed application resource.
- A managed resource group that contains the solution's Azure resources, including a VNet, a key vault, an AKS cluster, PostgreSQL servers, and a Log Analytics workspace.
- An AKS infrastructure resource group that contains AKS-specific resources, such as virtual machine (VM) scale sets and load balancers. Azure manages this resource group.
The solution exposes a single endpoint for user access: the frontend of the AKS cluster's internal load balancer. An Azure Private Link service is attached to this frontend, so you can reach the solution from your corporate network through a private endpoint.
The deployment also installs Grafana, Prometheus, and Loki in the cluster for monitoring, and creates Azure Monitor alert rules.
For more information about the resources and endpoints, refer to Overview of the infrastructure.
Your responsibilities
You provide and operate the following:
- An Azure account, and a role with sufficient permissions to create and manage resources.
- A private Azure Marketplace offer, which Unity creates for your Azure billing account on request.
- The licenses that the deployment requires, including the Unity Asset Transformer SDK licenses and the Unity Version Control (UVCS) license.
- An Azure subscription with sufficient resource quotas and the required resource providers registered.
- IP ranges for the solution VNet, pods, and services that don't overlap with your corporate network.
- A VNet for the private endpoint.
- A fully qualified domain name (FQDN) for the solution, and a TLS certificate and private key for that domain.
- Network integration after deployment, including the private endpoint, the DNS record, and, optionally, firewall rules that control outbound internet access.
- Ongoing operations, including node pool scaling, monitoring, and identity configuration.
For the full list of what you need before you start, refer to Prerequisites.
What Azure manages
Azure manages the Kubernetes infrastructure, the PostgreSQL database, secret storage, and log collection.
Operational considerations
Consider the following for this deployment type:
- Microsoft charges you for the deployed Azure services.
- You need a private Azure Marketplace offer from Unity. The public offer isn't intended for production deployments.
- Your team needs working knowledge of Azure networking, including VNets, peering, private endpoints, and DNS.
- Until deployment completes, the solution needs outbound internet access that doesn't route through a network virtual appliance. You can lock down outbound access after deployment.
- You must not delete the resources in the managed resource group or modify the AKS infrastructure resource group. To prevent accidental deletion, create locks.
Delete - Choose the FQDN carefully. Changing it after deployment requires updates in several places.
- You can change the number of nodes in each node pool at any time after deployment. Note that to change the VM size of a node pool you must recreate the node pool, which causes downtime.
- You integrate your identity provider (IdP) or single sign-on (SSO) with the platform's bundled Keycloak.