Azure

Use this profile when the target cluster runs on Azure and Azure supplies DNS, registry, or storage integrations. Render the desired state with the platform CLI and reconcile it through Argo CD.

Prepare Azure resources

Before rendering, provide:

• a reachable AKS cluster and repository-local kubeconfig;
• Azure storage classes for the selected RWO and RWX behavior;
• an ACR or approved OCI registry containing the release images and charts;
• a DNS zone and an identity allowed to update it when External DNS is enabled;
• certificate issuer credentials or custom TLS material; and
• a GitOps manifests repository.

Configure common values

Set the base domain, storage classes, registry name and repositories, registry credentials, and optional registry CA in platform.toml or environment overrides. Typical Azure overrides include:

COMMON_BASE_DOMAIN=ai.example.com
COMMON_RWO_STORAGECLASS=managed-csi
COMMON_RWX_STORAGECLASS=azurefile-csi
COMMON_REGISTRY_NAME=example.azurecr.io

Use the real storage-class names exposed by the target cluster.

Configure Azure integration

The [azure] section supports the subscription, tenant, client identity, DNS resource group, hosted zone, and DNS credential payload used by platform components. Keep client secrets and JSON credentials in the environment or site secret store, not in committed TOML.

Enable only the integration the site actually uses. A deployment can run on AKS while DNS or certificate ownership remains external.

Choose object storage

Rook-Ceph is the default platform-operated S3 path. If the site uses an external S3-compatible service, set [object_storage] provider = "external-s3" and supply the endpoint, CA, credentials, pre-created buckets, and accurate capability flags.

Azure Blob Storage is not automatically equivalent to the S3 contract. Use a verified S3-compatible endpoint or retain Rook-Ceph.

Validate before bootstrap

bsqai test-k8s
bsqai validate
bsqai load
bsqai apply all -r

Inspect the generated Gateway, registry, storage, and certificate values before pushing manifests.