Customer 360 Enterprise Data Platform — Denodo on Azure  ·  View 28 of 39  ·  Operations

Deployment

What runs where, what survives a zone, and what a region failure actually costs.

Editable source SVG draw.io All views
Azure North Europe — primary, active Availability zone 1 VDP Interactive 1 pod, 8 vCPU VDP Data Services 1 pod, 8 vCPU MPP workers 2 nodes Availability zone 2 VDP Interactive 1 pod, 8 vCPU VDP Data Services 1 pod, 8 vCPU MPP workers 2 nodes Availability zone 3 VDP Interactive 1 pod, 8 vCPU VDP Analytical 2 pods, 16 vCPU MPP workers 2 nodes Zone-redundant services PostgreSQL Flexible ZRS, HA pair ADLS Gen2 ZRS Key Vault zone redundant Event Hubs ZRS namespace Azure West Europe — warm standby Compute, scaled down VDP pods 1 per pool, idle Solution Manager standby node Replicated state PostgreSQL replica geo, RPO 5 min ADLS GRS asynchronous Metadata replica revision synced Salesforce SAP S/4HANA ServiceNow Traffic Manager health-probed failover geo-replication GRS failover Deployment — Three Zones Live, One Region Warm Application we own Data store Security / platform Queue / topic External / third party Interface / broker event / async failure / alternate Losing a zone loses a third of capacity and no session state. Losing the region costs 30 minutes to RTO, and the cache is deliberately not replicated because it is rebuildable. v 1.0 · owner Data & AI Global Practice · date 2026-09

Failure domains

  • Three availability zones, each holding a share of every query pool. Losing a zone loses a third of capacity and no session state — Denodo sessions are re-established rather than replicated.
  • The cache is deliberately not replicated to the secondary region. It is rebuildable, and paying to replicate a disposable store is how a DR bill doubles for no recovery benefit.
  • The standby region runs one pod per pool so the estate is warm, not cold: no image pull, no metadata restore, no licence activation on the critical path of a failover.

Numbers

  • RTO 30 minutes, RPO 5 minutes on the crosswalk through geo-replication. Availability target 99.9%.
  • Zone-redundant PostgreSQL, ADLS and Event Hubs; Traffic Manager health probes drive the regional failover.

Assumptions

  • Source systems remain reachable from the secondary region. If a source is network-restricted to the primary region, failing over gains a running Denodo with nothing to read — this must be confirmed per source.
◀  A Merge Propagates All views Workload Isolation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 39 views · Denodo Platform, Microsoft Azure and open source28-deployment-architecture