openvidu/openvidu-deployment/pro/ha/azure/DOC-CHANGES-ha-optimizations.md

HA / Azure optimizations — documentation changes

Target template: pro/ha/azure/cf-openvidu-ha.bicep (and its recompiled cf-openvidu-ha.json).

[!NOTE] The full HA deployment-time optimization notes live on the ha-optimizations branch (they were intentionally excluded from the merge into master). This copy carries only the section below, added on the elastic-hardening branch.

Managed identities for the Key Vault dependency inversion

The four master VMs and the media-node scale set no longer use system-assigned identities. The template now creates two user-assigned identities up front, <stackName>-master-identity and <stackName>-media-identity, and the Key Vault access policies reference those instead of the machine identities.

• No public parameters changed. The ARM / Marketplace parameter set and every createUiDefinition.json field are identical to the previous version, so parameter tables, screenshots and step-by-step instructions in the docs need no edit. The identity client IDs travel through internal template variables only.
• Two extra resources appear in the resource group (<stackName>-master-identity and <stackName>-media-identity, type Managed Identity). This is cosmetic: if the docs show a screenshot or a list of the created resources, it will now include these two entries. The permission split is preserved — the master identity keeps get/set/list on secrets, the media identity only get.
• No doc text change: the boot scripts now select the identity explicitly at login (az login --identity --client-id <id>), and the pinned Azure CLI moves from 2.87.0 to 2.88.0, which is the version that guarantees --client-id support.
• Deployment may complete roughly 1-3 minutes faster. The Key Vault used to be created after all five compute resources because its inline access policies referenced their system-assigned identities; it now deploys in parallel with them, so the bounded boot-time wait for Key Vault availability in the node scripts is essentially eliminated. Do not publish a new figure from this estimate: re-measure with ov-cloud-tester before touching any deployment-time number already in the documentation.