Audit Log Service  ·  View 29 of 40  ·  6 · Operations

Deployment — One Region, Three Zones

What runs where, what is zone-redundant by construction, and which subscription deliberately is not ours.

Editable source SVG draw.io All views
Azure · West Europe Availability zone 1 AKS Ingest Pool 3 × D16s v5 Kafka Brokers 4 of 12 ClickHouse Shards replica set A Custody Pool sealer, chain Availability zone 2 AKS Ingest Pool 3 × D16s v5 Kafka Brokers 4 of 12 ClickHouse Shards replica set B Custody Pool sealer, chain Availability zone 3 AKS Ingest Pool 3 × D16s v5 Kafka Brokers 4 of 12 ClickHouse Shards replica set C Custody Pool sealer, chain Zone-redundant by construction — no single zone holds the only copy Blob Storage ZRS immutable containers PostgreSQL Flexible zone-redundant HA Managed HSM 3-zone pool Front Door + WAF global anycast Private Endpoints in-estate producers Separate subscription, separate administrators, separate break-glass Confidential Ledger chain heads Checkpoint Signing Key own HSM pool Ledger Admin Group no segment access Microsoft Entra ID global tenant Timestamp Authority third party seal signs heads Deployment — One Region, Three Availability Zones Security / platform Queue / topic Data store Interface / broker External / third party event / async synchronous Loss of one zone removes a third of ingest capacity and no data: Kafka keeps isr ≥ 2, ClickHouse keeps two replicas, and the segment store is zone-redundant beneath the immutability policy. Producers see nothing but a brief drop in a connection pool. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Loss of a zone removes a third of ingest capacity and no data: Kafka keeps min.insync.replicas at 2, ClickHouse keeps two replicas, and the segment store is zone-redundant beneath the immutability policy. Producers see a brief connection-pool drop.
  • The checkpoint ledger and its signing key live in a separate subscription with separate administrators and a separate break-glass procedure. The ledger admin group holds no access to the segment store, and the segment admin group holds none to the ledger.
  • AKS node pools are separated by plane, so a compromise of the ingest pool does not put a custody workload's identity on the same node.

Sizing

  • 9 ingest nodes (3 per zone, D16s v5), 12 Kafka brokers (4 per zone), 16 ClickHouse nodes, custody and evidence pools sized for burst rather than steady state.
  • Managed HSM is a three-zone pool; PostgreSQL Flexible Server runs zone-redundant HA.
  • In-estate producers use private endpoints; Front Door serves only off-estate traffic and is not on the critical latency path for the 25 k/s steady load.

Assumptions

  • West Europe as primary is an assumption driven by the majority residency profile. Tenants with a different residency assignment get a dedicated storage account in their own region (view 19), which is why residency is a storage decision here and not a deployment one.
◀  Losing the Index All views Two Regions, and Custody That Belongs to Neither  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source29-deployment-architecture