Deploying CloudCADI on Azure

CloudCADI deploys into your own Azure tenant as an ARM template that provisions AKS + Azure Database for PostgreSQL + Storage, then installs the app via Helm.

Flow - Manual

1. You'll receive the ARM template
2. Deploy the ARM template into your own resource group
3. Follow the CLI steps to create an App Registration and assign the required roles
4. Follow the CLI steps to run the Helm deploy

Manual Deployment Walkthrough

This walkthrough has two parts: getting the identities and permissions in place, then running the ARM template itself.

Step 1 - Register Resource Providers

1. Azure Portal → Subscriptions → select the target subscription → Settings→ Resource providers (left menu).
2. Search for and confirm Registered status for: Microsoft.ContainerService, Microsoft.DBforPostgreSQL, Microsoft.OperationalInsights, Microsoft.OperationsManagement, Microsoft.Storage, Microsoft.Insights, Microsoft.ManagedIdentity, Microsoft.Resources.
3. If any show NotRegistered, select it → Register → wait ~1–2 minutes.

Step 2 - App Registration (for clientId, tenantId, objectId)

1. Azure Portal → Microsoft Entra ID → App registrations → New registration.
2. Name it (e.g. CloudCADI-app), leave the supported account type as single tenant → Register.
3. On the Overview page, copy:
   • Application (client) ID → this is your clientId
   • Directory (tenant) ID → this is your tenantId
4. For objectId, go to Microsoft Entra ID → Enterprise applications → search the same app name → open it → copy its Object ID. This is different from the App registration's own object ID - the template wants the service principal's object ID, which lives under Enterprise Applications.
5. Assign the following roles to this service principal in whichever subscription you want to onboard - repeat sub-steps i–iv once per role:
   • Reader
   • Log Analytics Contributor
   • Monitoring Contributor
   • Virtual Machine Contributor
   • Azure Kubernetes Service Contributor Role
   • Cost Management Contributor
   • Storage Account Contributor
   • Storage Blob Data Reader - assign this one on the subscription where cost data is exported
   1. Azure Portal → Subscriptions → select the target subscription → Access control (IAM) → + Add → Add role assignment.
   2. On the Role tab, search for and select the role → Next.
   3. On the Members tab, leave Assign access to on User, group, or service principal → + Select members → search for the app registration created above (e.g. CloudCADI) → select it → Select.
   4. Confirm the service principal is listed under Members → Review + assign.

Step 3 - User-Assigned Managed Identity + RBAC

1. Azure Portal -> search Managed Identities → Create.

2. Pick the target resource group and region, name it (e.g. CloudCADI-deploy-identity) → Review + create → Create.

3. Once created, copy its Resource ID (Overview page → JSON view, or the "Resource ID" shown at the top) - this is your managedIdentity parameter value.

4. Go to the target resource group (the one you'll deploy CloudCADI into) → Access control (IAM) → Add role assignment.

5. Assign Azure Kubernetes Service Contributor Role and Reader to the identity. Run through the same four sub-steps once per role:

   1. On the Role tab, search for the role name and select it → Next.
   2. On the Members tab, choose Managed identity → + Select members.
   3. In the Select managed identities panel, pick the Subscription, then select the identity created in step 1–3 above from the list → Select.
   4. Back on the Members tab, confirm the identity is listed → Review + assign.

   Repeat i–iv a second time for the other role - first pass for Azure Kubernetes Service Contributor Role, second pass for Reader. (See Deploy Identity Permissions below for why exactly these two roles.)

6. Wait ~5 minutes for the role assignment to propagate before deploying.

Step 4 - Custom Deployment (ARM Template)

1. Azure Portal search bar → "deploy a custom template".

2. On the Select a template tab, choose Build your own template in the editor.

3. On the Edit template page, either paste in the CloudCADI ARM template JSON directly, or use Load file to upload it from disk, then Save. Verify the key parameters are present: clientId, tenantId, objectId, managedIdentity, acrUsername, acrPassword.

4. On the Basics tab, fill in:

   Field	Value
   Subscription	Target subscription
   Resource group	Select existing, or Create new
   Region	Deployment region (e.g. Central India)
   Client Id	Service principal client ID (Step 2)
   Tenant Id	Service principal tenant ID (Step 2)
   Object Id	Service principal object ID (Step 2)
   Managed Identity	Resource ID of the User-Assigned Managed Identity (Step 3)
   Acr Username	ACR repository-scoped token username
   Acr Password	ACR repository-scoped token password

5. Next (or straight to Review + create) → Azure validates the template and parameters → Create once validation passes.

6. Once all resources are created successfully, go to Outputs and use the frontendUrl field to access the application.

Step 5 - Federated Credential Setup (Azure Portal)

1. Open the App Registration: Azure Portal → search "App registrations" → select your app (the one matching the clientId used in the template).

2. Go to Certificates & secrets → Federated credentials tab → + Add credential.

   

3. In the Add a credential pane, fill in:

   • Federated credential scenario: Kubernetes accessing Azure resources
   • Cluster issuer URL - oidcIssuerURL from the deployment output
   • Namespace: CloudCADI
   • Service account name: CloudCADI-ksa
   • Name: e.g. CloudCADI-aks-federated-cred

   Then click Add.

   

Architecture

CloudCADI on Azure — Architecture & Flow

Enterprise FinOps Platform — Kubernetes Deployment (Manual flow)

Cluster: AKS | Database: PostgreSQL (Flexible Server) | Registry: ACR | Auth: Microsoft Entra ID (OIDC) | IaC: ARM Template + Helm

Deployment Flow (Manual)

1

Register Resource Providers

Confirm AKS, PostgreSQL, Storage, and related providers are registered on the subscription

→

2

Create App Registration

Service principal for clientId/tenantId/objectId; Reader, Log Analytics Contributor, Monitoring Contributor, and Storage Blob Data Reader roles assigned

→

3

Create Managed Identity + RBAC

User-assigned identity for the deploy script; AKS Contributor + Reader roles

→

4

Customer Deploys ARM Template

AKS + PostgreSQL + Storage provisioned in the customer's own resource group

→

5

Federated Credential Setup

OIDC trust between the AKS service account and the App Registration

→

6

Users Access the App

Over HTTPS, via the `frontendUrl` deployment output

Container Image Access Flow

1

Image Pushed to ACR

CloudCADI image built and pushed to our private registry

→

2

Scoped Token Issued

Repository-scoped, pull-only token created per customer

→

3

AKS Pulls the Image

Cluster authenticates to ACR with the scoped token

→

4

Pods Running

CloudCADI containers running inside the customer's AKS cluster

Deploy Identity Permissions

• AKS Contributor — run az aks command invoke
• Reader — resolve the Load Balancer / Public IP

Deployment Model

• Manual — ARM template steps, customer-run

Tech Stack

• AKS (Kubernetes)
• PostgreSQL (Flexible Server)
• Azure Container Registry
• OIDC via Microsoft Entra ID

💡CloudCADI runs entirely inside the customer's own Azure tenant — the cluster, database, and storage all stay within their subscription. Only the container image itself is pulled from our private registry, using a per-customer, pull-only token.