Deploy on Azure

Overview

Use this guide to evaluate PIG on an existing AKS cluster and have Terraform create its dedicated infrastructure. The Terraform example creates an Azure Database for PostgreSQL flexible server, a Blob Storage container for traces, and a workload identity for the analyzer. You then continue with the common Helm installation. If you already have these resources, go directly to that guide.

The guide reuses your cluster and network. It creates no cluster and installs no ingress controller, and it works with your existing secret-delivery and certificate-management systems. After installation, Terraform keeps ownership of the cloud infrastructure, and PIG maintains its own application releases.

Before you begin

Complete deployment planning, including your Promptless registration, Instruction Hub, and model access.
Have Terraform 1.11 or later, the Azure CLI, Helm, and kubectl. The 0.3.6 example requires Terraform >= 1.11.0, < 2.0.0.
Prepare an existing resource group and VNet with a delegated PostgreSQL subnet and a private endpoint subnet. Link private DNS zones for PostgreSQL and Blob Storage to the cluster’s VNet. Enable the AKS OIDC issuer and Microsoft Entra Workload ID.
Register the Azure resource providers the example uses. The example does not register them.
Have permission to provision the dedicated database, trace storage, and workload identity in that network.
Choose database capacity, availability, backup retention, trace retention, and encryption settings for your recovery requirements.

To hand the infrastructure work to a coding agent, copy this prompt. Set up PIG with a coding agent covers the whole setup.

Prepare Azure infrastructure for the PIG trace analyzer on our existing
AKS cluster with the versioned Terraform example. Follow
https://promptless.ai/docs/governance/deploy-the-worker/deploy-on-azure.md
and phase 5 of https://promptless.ai/docs/governance/agent-setup-guide.md

Outcome: an applied Terraform plan and the saved deployment_configuration
output.
Azure support is experimental; confirm with me before you continue.
Inputs (discover these before you ask me):
- Subscription, resource group, and region: [for example, acme-prod, pig-rg, eastus2]
- AKS cluster: [cluster name and kubectl context]
- VNet and subnets: [names or IDs, or "discover them"]
- PIG release: [release tag, or "latest published release"]
- Terraform state backend: [our backend, or where our Terraform lives]

Show me the plan summary and wait for my approval before `terraform apply`.
Report the resources created and the next step.

1. Get the versioned Terraform example

Download and verify the release files as described in Select and verify a release. In the same shell, from that release directory, extract the Terraform example from the verified archive:

cd "$PIG_RELEASE_DIR"
tar -xzf "pig-deploy-${PIG_VERSION}.tar.gz"
cd "pig-deploy-${PIG_VERSION}/examples/azure"

The example references the Azure module in the same archive, so the module matches the release. The example also includes its provider lock file. Keep -lockfile=readonly in the commands below so Terraform uses those reviewed provider checksums.

2. Configure and apply infrastructure

Confirm your account and cluster.

az account show --query '{subscription:id,tenant:tenantId}' -o table
kubectl config current-context

Copy the example inputs.
Terminal window
```
cp terraform.tfvars.example terraform.tfvars
```
Set subscription_id, location, resource_group_name, the AKS oidc_issuer_url, the existing postgres_subnet_id and private_endpoint_subnet_id, the linked postgres_private_dns_zone_id and blob_private_dns_zone_id, and a globally unique storage_account_name. Keep namespace = "pig" and service_account_name = "pig-analyzer", which the module binds to the analyzer’s federated identity, and set a dedicated trace_prefix such as acme/traces.

The defaults create PostgreSQL 16 on GP_Standard_D2s_v3 with 128 GiB of storage, zone-redundant high availability, and 14 days of backups. Trace storage uses zone-redundant replication, blob versioning, 90 days of soft delete, and 89 days of point-in-time restore.

Review these defaults and deletion protection in variables.tf against your workload and recovery requirements. Keep private database access and private trace storage. Supply the database password as TF_VAR_postgres_password from your secret manager, and keep real .tfvars files out of Git. Terraform stores the password in its encrypted remote state.
Initialize and review the plan. Copy backend.tfbackend.example to backend.tfbackend and set your existing encrypted, private state backend with locking. Limit its access to infrastructure operators.
Terminal window
```
cp backend.tfbackend.example backend.tfbackend
terraform init -backend-config=backend.tfbackend -lockfile=readonly
terraform validate
terraform plan -out=pig.tfplan
```
Review the dedicated database, storage, identity, and network bindings. Stop if the plan replaces your cluster, expands shared permissions, or destroys retained storage unexpectedly. Terraform state and saved plans can contain credentials; store them as secrets even when an output is marked sensitive.
Apply the reviewed plan.
Terminal window
```
terraform apply pig.tfplan
terraform output -json deployment_configuration > "$PIG_RELEASE_DIR/deployment-configuration.json"
```
The output file sits next to the verified release files. It contains database connection metadata, the Blob Storage block, the ServiceAccount annotation, and the workload identity pod label. It contains no credential values.

3. Connect the infrastructure to PIG

The deployment-configuration.json file in $PIG_RELEASE_DIR is the source of truth for the Kubernetes configuration in Install with Helm. Each output goes to one destination:

Output	Destination
`postgres` connection metadata	The application connection string in `pig-credentials/postgres-dsn`.
`storage`	The `azureBlob` block under `PIGDeployment.spec.storage`.
`service_account_annotations`	Annotations on ServiceAccount `pig/pig-analyzer`.
`pod_labels`	`PIGDeployment.spec.podLabels`.

For Azure, the ServiceAccount annotation is azure.workload.identity/client-id. Its value resembles REPLACE_MANAGED_IDENTITY_CLIENT_ID. Copy the identity from your output, not this illustrative value.

Copy the azure.workload.identity/use: "true" label from pod_labels into spec.podLabels in the PIGDeployment. The analyzer and its maintenance Jobs need this label for workload identity injection. The federated identity is scoped to system:serviceaccount:pig:pig-analyzer, and the Blob data role is scoped to the trace container.

Build the connection string in your secret manager from the postgres output and the database password, with sslmode=verify-full:

postgresql://USERNAME:URL_ENCODED_PASSWORD@HOST:5432/pig?sslmode=verify-full

Deliver the CA bundle that verifies your flexible server’s certificate as ConfigMap pig-postgres-ca with key ca.pem.

Replace the S3 block in the common Helm example with this block, using the provisioned location:

azureBlob:
  accountURL: https://REPLACE_STORAGE_ACCOUNT.blob.core.windows.net
  container: traces
  prefix: acme/traces

Choose the model separately. Select a supported endpoint from model providers. The Terraform module grants no model access.

4. Bootstrap and verify

In $PIG_RELEASE_DIR, where the verified chart and deployment-configuration.json are, continue with Install with Helm from step 2. Apply the ServiceAccount annotation, Secrets, CA ConfigMap, Blob Storage block, and pod label from this guide before you create the PIGDeployment. For the collector Ingress, use the Ingress with a TLS Secret values with your cluster’s ingress controller and certificate.

Keep the Helm bootstrap outside Terraform reconciliation. Terraform must not manage the self-updating supervisor through a helm_release resource or import its generated workloads.

Finish with Verify your deployment. Confirm native storage writes and reads, a successful analysis, and visible Promptless Dashboard status for one exact session.

Maintain the infrastructure

Use Terraform for database resizing, IAM changes, networking, backup policy, and object retention. PIG’s stable application channel updates only the application, so review each Terraform module upgrade as its own plan.

If PIG reports a blocked release that requires an infrastructure change, apply that change through Terraform. PIG resumes once its live checks and any required release-specific confirmations pass. Keep backups and trace retention coordinated, and follow recovery guidance before replacing storage.