Azure
Ensure all of the following are configured before linking your Azure account in Onehouse.
Networking
VNet
Create a VNet with a /16 address space (e.g. 10.0.0.0/16).
Subnets
| Type | CIDR | Purpose |
|---|---|---|
| Node subnet | /20 | AKS nodes run here. Must have Microsoft.Storage service endpoint enabled. |
Pod and Service CIDRs
Azure AKS uses Azure CNI Overlay mode — pods get IPs from a dedicated CIDR separate from the node subnet, similar to GCP's secondary ranges.
| Range | CIDR | Example |
|---|---|---|
| Pod CIDR | /16 | 10.244.0.0/16 |
| Service CIDR | /16 | 10.1.0.0/16 |
| DNS Service IP | Single IP within service CIDR | 10.1.0.10 |
NAT Gateway
Deploy a NAT Gateway for outbound internet access from the node subnet. All outbound traffic to the Onehouse control plane routes through this gateway on port 443.
AKS Cluster Endpoint Access
The AKS cluster API endpoint is private. The Onehouse control plane connects to it from its NAT IP — you must ensure this is not blocked by your VNet or NSG rules:
54.153.81.1/32
VNet Peering
If your data sources (Kafka clusters, databases) live in a separate VNet or subscription, configure VNet peering between that VNet and your Onehouse VNet so the AKS cluster can reach them. See Azure docs.
Domain Allowlist
Required only if your environment has an egress firewall:
Domains to allowlist
Azure Subscription
You need an active Azure subscription with permissions to:
- Create and manage User-Assigned Managed Identities
- Create Role Assignments (RBAC) on storage accounts
- Create Resource Groups (or use an existing one)
- Register Federated Identity Credentials on managed identities
Resource Group
You can either provide an existing resource group or allow Onehouse to create one. If providing your own, it must already exist in your subscription before running the Terraform stack.
Storage
Terraform State
The Onehouse customer stack uses Azure Blob Storage for Terraform state. A storage account and container are provisioned by Onehouse — you will receive the storage account details along with your request ID. No manual bucket creation is required.
Onehouse Storage Account
A storage account managed by Onehouse will be pre-created in your subscription region. You will need its Azure resource ID before running the customer stack — this is provided by the Onehouse team.
Lakehouse Storage (optional)
If you want Onehouse to read data from your own Azure Blob Storage accounts, provide the resource ID(s) of those storage accounts. The customer stack will configure the appropriate RBAC role assignments for read access.
Workload Identity Federation
Onehouse's Azure deployment uses Workload Identity Federation — no client secrets or passwords are stored. The managed identities created by the customer stack can be assumed by Onehouse's existing AWS and GCP infrastructure using federated credentials.
This means:
- No credentials stored in Onehouse systems
- Token exchange happens via Azure AD, AWS STS, and Google token endpoints
- Supports both production and staging Onehouse environments
Tooling
| Tool | Version | Purpose |
|---|---|---|
| Terraform | ≥ 1.11.0 | Infrastructure deployment |
| Azure CLI | Any recent | Azure authentication |
Ensure you are authenticated to the correct Azure subscription before running Terraform:
az login
az account set --subscription "<subscription-id>"