Automated script-based installation

Complete the steps provided in this section to deploy PPC in Microsoft Azure AKS.

Before you begin

  • Ensure that all the required resources are in the same resource-group. If the resources are in different resource groups, then ensure to move the resources to the same group before proceeding for PPC deployment.

  • The repository provides a bootstrap script that automatically installs or updates the following tools on the jump box:

    • Azure CLI - Required to communicate with your Microsoft Azure account.
    • Helm - Required to manage Kubernetes packages.
    • jq - Required to parse JSON.
    • kubectl - Required to communicate with the Kubernetes cluster.
    • OpenTofu - Required to manage infrastructure as code.
    • oras: Required to pull non‑container, generic OCI artifacts from the registry that are not handled by standard container tooling.

Note: If you are performing a non-FIPS deployment, ensure that you have already completed the steps in the section Configuring PPC for Non-FIPS Deployment on Microsoft Azure before proceeding. Do not revert fips_enabled to true or change node_os back to a FIPS-compliant image during the steps below.

Architecture Selection

The step [1b] Select Node Architecture in the bootstrap script prompts to select the node architecture interactively during deployment.

  • amd64 (x86-64)
Node PoolVM SizevCPUsMemory
SystemStandard_D2as_v528 GB
UserStandard_D8as_v5832 GB
  • arm64
Node PoolVM SizevCPUsMemory
SystemStandard_D2ps_v528 GB
UserStandard_D8ps_v5832 GB

The bootstrap script prompts you to select the node architecture interactively during deployment (step 1b).

Deploying the PPC

The bootstrap script prompts for variables to be set to complete the deployment. Run the following command and follow the instructions on the screen.

./bootstrap.sh --cloud azure

The script prompts for the following variables.

  1. Enter AKS Cluster Name

    The following characters are allowed:

    • Lowercase letters: a-z
    • Numbers: 0-9
    • Hyphens: -

    The following characters are not allowed:

    • Uppercase letters: A-Z
    • Underscores: _
    • Spaces
    • Any special characters such as: / ? * + % ! @ # $ ^ & ( ) = [ ] { } : ; , .
    • Leading or trailing hyphens
    • Names longer than 10 characters (the cluster name must be 10 characters or fewer)

    Note: Ensure that the cluster name does not exceed 10 characters. Cluster names longer than this limit can cause the bootstrap script to fail in subsequent installation steps. If the installation fails because the cluster name exceeds the 10-character limit, correct the name and re-run the script.

    • Correction: Choose a cluster name with 31 characters or fewer.
    • Retry: Execute the installation command again with the updated name. The script will automatically handle the update and proceed with the bootstrap process.

    After the cluster name is accepted, the script prompts you to select the node architecture.

    [1b] Select Node Architecture

    [1b] Select Node Architecture
  1) amd64 (x86_64) — e.g. Standard_D8as_v5
  2) arm64 (ARM/Ampere) — e.g. Standard_D8ps_v5

    Enter 1 to select amd64 or 2 to select arm64.

    Note: Select amd64 for standard Intel/AMD 64-bit environments. Select arm64 for ARM-based environments such as AWS Graviton instances.

  2. Querying for available Resource Groups

    The script queries for the available Resource Groups.

    Enter the Resource Group name from the table []

    The script then automatically detects the location and subscription ID of the resource group.

  3. Enter UAMI Resource ID

    Provide the complete Azure resource ID for the UAMI used by AKS in the following format:

    /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name>

    The UAMI client ID is detected automatically.

  4. Enter AKS Subnet Resource ID

    Provide the complete resource ID of the pre-existing subnet used for AKS nodes in the following format:

    /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>

  5. Enter Private DNS Zone Resource ID

    Provide the Private DNS zone ID used by the AKS private cluster in the following format:

    /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/privateDnsZones/privatelink.<region>.azmk8s.io

    The script attempts to automatically detect network settings:

    • Virtual network address space
    • Service CIDR
    • DNS service IP

    If the detection fails, then default values configured in the terraform.tfvars file are used.

  1. Enter FQDN [name.domain.com]

    This is the Fully Qualified Domain Name for the ingress.

    Warning: Ensure that the FQDN does not exceed 50 characters and only the following characters are used:

    • Lowercase letters: a-z
    • Numbers: 0-9
    • Special characters: - .

  2. Storage Account and Key Vault provisioning

    Choose whether to use existing resources or create new resources:

    1) Use existing
2) Provision new via Tofu

    • Enter 1 if an encrypted Storage Account and Key Vault are already provisioned for this cluster. The installer prompts for the Storage Account name, Key Vault name, backup container, Key Vault key name, and the Velero UAMI Resource ID.

    • Enter 2 to allow the installer to create a new Storage Account and Key Vault with the velero container, the pty-backup-key encryption key, and a Velero UAMI automatically. Only the new resource names are required.

  3. Enter Velero UAMI Resource ID (required)

    Enter the resource ID of the dedicated Velero User-Assigned Managed Identity (UAMI) in the format:

    /subscriptions/<subscription-id>/resourceGroups/<velero-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>

    The script automatically validates the UAMI and detects the UAMI Client ID.

  4. Enter OpenSearch UAMI Resource ID (required)

    Enter the resource ID of the OpenSearch Velero User-Assigned Managed Identity (UAMI) in the format:

    /subscriptions/<subscription-id>/resourceGroups/<opensearch-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>

    The script automatically validates the UAMI and detects the UAMI Client ID.

  5. Enter Image Registry Endpoint

The image repository from where the container images are retrieved.

Expected format: <hostname>[:port].

Do not include ‘https://’

  1. Enter Registry Username

Enter the username for the registry mentioned in the previous step. Leave this entry blank if the registry does not require authentication.

  1. Enter Registry Password or Access Token

Enter Password or Access Token for the registry.

Input is masked with * characters. Press Enter to keep the current value.

Leave this entry blank if the registry does not require authentication.

  1. Enter Owner Email (for cluster tagging)

Enter email address in the format name@domain.tld. This email is used for the cluster ‘Owner’ tag and the platform owner contact.

Note: The cluster creation process can take 10-15 minutes.

If the session is terminated during installation due to network issues, power outage, and so on, then the installation stops. To restart the installation, run the script again:

# Navigate to setup directory 
./bootstrap.sh --cloud azure

After the bootstrap script is completed, verify the cluster and workloads using the following commands:

# Confirm nodes are Ready
kubectl get nodes

# Confirm NFA workloads are Running
kubectl get pods -A

Last modified : July 29, 2026