mirror of https://github.com/OpenVidu/openvidu.git
36 lines
2.2 KiB
Markdown
36 lines
2.2 KiB
Markdown
# HA / Azure optimizations — documentation changes
|
|
|
|
Target template: `pro/ha/azure/cf-openvidu-ha.bicep` (and its recompiled
|
|
`cf-openvidu-ha.json`).
|
|
|
|
> [!NOTE]
|
|
> The full HA deployment-time optimization notes live on the `ha-optimizations` branch
|
|
> (they were intentionally excluded from the merge into `master`). This copy carries only
|
|
> the section below, added on the `elastic-hardening` branch.
|
|
|
|
## Managed identities for the Key Vault dependency inversion
|
|
|
|
The four master VMs and the media-node scale set no longer use system-assigned identities.
|
|
The template now creates two user-assigned identities up front,
|
|
`<stackName>-master-identity` and `<stackName>-media-identity`, and the Key Vault access
|
|
policies reference those instead of the machine identities.
|
|
|
|
- **No public parameters changed.** The ARM / Marketplace parameter set and every
|
|
`createUiDefinition.json` field are identical to the previous version, so parameter
|
|
tables, screenshots and step-by-step instructions in the docs need no edit. The identity
|
|
client IDs travel through internal template variables only.
|
|
- **Two extra resources appear in the resource group** (`<stackName>-master-identity` and
|
|
`<stackName>-media-identity`, type *Managed Identity*). This is cosmetic: if the docs show
|
|
a screenshot or a list of the created resources, it will now include these two entries.
|
|
The permission split is preserved — the master identity keeps `get`/`set`/`list` on
|
|
secrets, the media identity only `get`.
|
|
- **No doc text change:** the boot scripts now select the identity explicitly at login
|
|
(`az login --identity --client-id <id>`), and the pinned Azure CLI moves from 2.87.0 to
|
|
2.88.0, which is the version that guarantees `--client-id` support.
|
|
- **Deployment may complete roughly 1-3 minutes faster.** The Key Vault used to be created
|
|
after all five compute resources because its inline access policies referenced their
|
|
system-assigned identities; it now deploys in parallel with them, so the bounded
|
|
boot-time wait for Key Vault availability in the node scripts is essentially eliminated.
|
|
Do **not** publish a new figure from this estimate: re-measure with ov-cloud-tester before
|
|
touching any deployment-time number already in the documentation.
|