Deploying PPC on

Production configuration

Mon, 01 Jan 0001 00:00:00 +0000

The default terraform.tfvars values are optimized for development and staging environments. Before deploying to production, override the settings below to ensure high availability, data safety, and security compliance.

Applying the changes

Script-based installation: After the bootstrap script generates the terraform.tfvars files, edit them before the script runs tofu apply, or modify and re-apply individually using OpenTofu after installation.
Component-based installation: Edit the relevant terraform.tfvars for each module before running tofu apply.

Configuring PPC for Non-FIPS Deployment on Microsoft Azure

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

By default, the Azure PPC installation enables FIPS (Federal Information Processing Standards). Follow these steps only if you need to install a non-FIPS cluster. For the standard FIPS-enabled installation, refer to Installing PPC on Microsoft Azure.
Complete all prerequisites before proceeding.
Perform these steps after downloading and extracting the PCT and before proceeding with either the Script-based installation or the Component-based installation.

The following files require changes:

File	Setting	Value
`deployment/iac/azure/cluster/modules/02_aks_cluster/terraform.tfvars`	`fips_enabled`	`false`
`deployment/iac/azure/cluster/modules/03_node_pool/terraform.tfvars`	`fips_enabled`	`false`

Configuring PPC for Non-FIPS Deployment on Azure

For a non-FIPS PPC deployment on Azure AKS, perform the following steps:

Automated script-based installation

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Ensure that all the required resources are in the same resource-group. If the resources are in different resource groups, then ensure to move the resources to the same group before proceeding for PPC deployment.
The repository provides a bootstrap script that automatically installs or updates the following tools on the jump box:
- Azure CLI - Required to communicate with your Microsoft Azure account.
- Helm - Required to manage Kubernetes packages.
- jq - Required to parse JSON.
- kubectl - Required to communicate with the Kubernetes cluster.
- OpenTofu - Required to manage infrastructure as code.
- oras: Required to pull non‑container, generic OCI artifacts from the registry that are not handled by standard container tooling.

Note: If you are performing a non-FIPS deployment, ensure that you have already completed the steps in the section Configuring PPC for Non-FIPS Deployment on Microsoft Azure before proceeding. Do not revert fips_enabled to true or change node_os back to a FIPS-compliant image during the steps below.

Manual component-based installation

Mon, 01 Jan 0001 00:00:00 +0000

This section is intended for enterprise customers who need full control over each stage of the AKS cluster deployment. Use this path when individual infrastructure stages must be reviewed or approved separately, when integration with an existing CI/CD pipeline is required, or when corporate change-management controls prevent running an all-in-one automated script. Each stage is self-contained and can be executed by different teams on the same jump box.

Before deploying to production: The default values are optimized for development and staging. Review the Production configuration section to override settings for high availability, data safety, and security compliance before running tofu apply.