Internal Developer Platform  ·  View 16 of 21  ·  Operations

Deployment Architecture on Azure

Management groups, subscriptions, a shared-cluster fleet, and where the shared-fate boundary actually sits.

Editable source SVG draw.io All views
Tenant root management group — Azure Policy floor set by the landing zone Platform subscription Control Plane AKS 3 zones · uk-south Catalog PostgreSQL zone redundant Container Registry geo-replicated Key Vault HSM backed Workload subscription — production Shared AKS · uk-south namespace per component Shared AKS · uk-west paired region Managed Databases Service Bus Workload subscription — non-production Shared AKS · dev and stage cheaper node pools Managed Databases no production data Sandbox subscription Experimental Workloads lifecycle: experimental Inside every shared cluster Platform namespaces Admission Webhook 3 replicas · local bundle Argo CD Shard Telemetry Agents Tenant namespaces Component Namespace quota · limits · identity Default-Deny Network Policy Microsoft Entra ID tenant wide GitHub Enterprise Azure Monitor applies pulls bundle workload identity Internal Developer Platform — Deployment Architecture on Azure Security / platform Data store Queue / topic Application we own External / third party synchronous event / async The cluster is the shared-fate unit: a namespace boundary is cheap and an upgrade is not. The paired region carries the platform's own recovery, not an active second copy of every tenant. v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Namespace per component in shared clusters, split by environment and by subscription rather than by team. A cluster per team would multiply fleet operations by 140 against a twelve-person team (ADR-14).
  • The platform control plane runs in its own subscription with its own guardrails, and is not exempt from the controls it enforces (ADR-15).
  • The paired region carries the platform's recovery, not an active second copy of every tenant — tenant multi-region is a component's own decision.

Assumptions

  • uk-south primary with uk-west as the paired region; three availability zones for the control plane (stated assumptions).
  • Experimental workloads run in a separate sandbox subscription with lighter guardrails and no production data.

Risks

  • Shared clusters make every cluster upgrade a shared-fate event, handled by staged fleet rollout with tenant smoke checks and abort-and-hold (ADR-14).
  • Noisy neighbours are contained by enforced requests and limits as a binding guardrail plus per-namespace quota — a control, not a convention.
◀  One Policy Source, Two Evaluation Points All views Shared Pipeline and Environments  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 21 views · 16 architecture decision records16-deployment-architecture