Skip to main content
This topic details how to install a in your Azure infrastructure using an Azure Container Instance (ACI) template provided by Matillion. It’s possible to install multiple s into a single resource group. Multiple installations require you to provide a different name for each container instance you launch a template into. Otherwise, the process is identical to that described here. For convenience, you might want to download and amend the template so that the s you install will have consistent properties. For troubleshooting and frequently asked questions encountered in this process, read Azure troubleshooting.

​
Resources deployed

The installation process will deploy the following resources in your Azure environment:
  • Resource group: A new or existing resource group to contain all deployed resources.
  • Virtual network and subnet: A virtual network with a specified subnet size (/23 or larger).
  • Key vault (optional): A key vault for storing secrets. If you prefer, the can use an existing key vault.
  • Managed identity: A managed identity to access the key vault and other resources securely.
  • Container instance: The container instance that runs the .
  • Log analytics workspace: A workspace for collecting and analyzing logs from the deployed resources.
  • Role assignments: Various role assignments to ensure appropriate permissions for the deployed resources.
  • Other associated resources: Additional resources required for the deployment, such as storage accounts and container registries, depending on the configuration specified in the template.

​
Prerequisites

To get started, you’ll need:
  • A account. To register, read Registration.
  • An Azure subscription with appropriate permissions to provision cloud resources in the Azure environment and manage access control, specifically for managing resource groups, virtual networks, key vaults, and container instances. Read ARM template permissions for details.
  • A suitable resource group and virtual network already defined in your Azure environment. Instructions for creating these—if they don’t already exist—are included below.
  • Optionally, a suitable key vault already defined in your environment. This isn’t a mandatory requirement, as the installation process will create a new key vault by default.
We recommend that you read the documentation and prerequisites before beginning this process. You may require input from your organization’s cloud administrator for access and permissions.

​
Create a resource group

You need an Azure resource group that will contain all of the Azure resources for the . The deployment template requests the name of the resource group to deploy into and will create all resources there. If you don’t have a suitable existing resource group, create a new one as follows:
  1. Log in to the Azure Portal.
  2. Use the search bar to search for “resource groups”, and click the Resource groups result.
  3. On the Resource groups screen, click + Create.
  4. On the Create resource group screen, select the Subscription you want to use for the from the drop-down.
  5. Enter a new name for the Resource group.
  6. Select an Azure Region for your resource group.
  7. If your organization has a policy that mandates resource group tags, click Tags and assign tags as required.
  8. Click Review + create, and then click Create if you are satisfied with your resource group configuration.
For more information, read Manage Azure resource groups by using the Azure portal in the Microsoft developer documentation.

​
Create a virtual network

You need a virtual network to secure access between the and other resources, reducing the scope of possible access to those resources. If you don’t have a suitable existing virtual network, create a new one as follows. Read the Azure documentation for more details.
  1. Log in to the Azure Portal.
  2. Use the search bar to search for “virtual networks”, and click the Virtual networks result.
  3. On the Virtual networks screen, click + Create.
  4. On the Create virtual network screen, select the resource group you created previously.
  5. Enter a new Virtual network name.
  6. Select an Azure Region for your virtual network. By default, this should be the same region as your resource group.
  7. Click the IP addresses tab and edit the default subnet, or create a new subnet.
    1. The virtual network’s IP range (CIDR) should be compatible with any other networks that it may be peered with (either other virtual networks or on-premises networks via site-to-site tunnel). If the virtual network is new and doesn’t require connectivity to other networks, the default CIDR range can be used.
    2. The subnet must be sized appropriately. For example, if you have only three IP addresses (subnet IP range /29), use subnet IP range /28 or above, so you can have at least one IP buffer per container group. This avoids having containers in states such as stuck or not able to start. For more information about working with subnets, read Add, change, or delete a virtual network subnet in the Azure documentation.
    3. Select a NAT gateway, or create a new one. Read the Azure documentation for detailed instructions on creating a NAT gateway.
    4. Configure the NAT gateway with the allowed IPs required for your specific use case. Refer to the IP allow list documentation for information about configuring allowed IPs.
    5. Select the required Service Endpoints. These are required if the subnet doesn’t have access to the Internet (via Internet gateway or NAT gateway). As a minimum, the following service endpoints will be required:
      • Microsoft.KeyVault
      • Microsoft.Storage
    6. Configure Subnet Delegation with the following permission:
      • Microsoft.ContainerInstance/containerGroups
      This delegation allows the deployment of container groups within the subnet. For more details, read the Azure documentation on subnet delegation.
    7. Click Save to save the subnet configuration.
  8. If your organization has a policy that mandates virtual network tags, click the Tags tab and assign tags as required.
  9. Click Review + create, then click Create if you are satisfied with your virtual network configuration.
When deploying the template, you need to provide the following extra parameters:
  • networkType: A string parameter that defines the network deployment type. The allowed values are “private” and “public”. The default value is “public”, however the doesn’t require public access, and public access isn’t recommended.
  • vNet: A string parameter that specifies the target virtual network for the deployment. This parameter is only required if the private subnet is being used.
  • subnetName: A string parameter that specifies the target subnet name for the deployment. This parameter is only required if the private subnet is being used.

​
Create a key vault

The requires access to an Azure key vault. However, you don’t need to create a key vault yourself; the deployment template will automatically create a key vault in the same resource group as the . If you prefer, the can reference a different key vault you have previously created. The existing key vault may be in the same or a different resource group. You might want to reference a key vault in a different resource group so that you can have multiple s referencing the same secrets. If you are using an existing key vault, you will need to complete the configuration steps described in Configuring a key vault for Azure .

​
Launch the ARM template in Azure

Ensure that the prerequisites of resource group, virtual network, and key vault (if required) have all been created, and that you are logged in to an Azure account with sufficient permissions to deploy the template in a container instance.
  1. In , follow the steps to create a new , with Streaming as the Type and Azure as the Cloud provider.
  2. On the Runner details screen, click Reveal credentials in the Credentials section and note the client_id and client_secret.
  3. Click the Launch button in the Install using ARM section. This will open the Azure portal at the Custom deployment page in a new browser tab.
  4. Complete the following details on the Custom deployment page.
  5. Click Review & Create.

​
Environment variables

Environment variables are properties that are passed to the to configure how it operates. All necessary environment variables are automatically set by the template during deployment, with no further action required on your part. However, if you choose to deploy the manually, you will need to set these environment variables yourself. The following table lists the required environment variables and where to find their values.

​
Custom DNS configuration

When you deploy a container group into an Azure virtual network, the containers don’t automatically inherit the DNS server settings configured on the virtual network itself. By default, ACI uses the standard Azure DNS resolver (168.63.129.16). If you need to resolve internal corporate hostnames, on-premises resources connected via ExpressRoute/VPN, or Azure Private DNS Zones, you must explicitly define a custom DNS configuration in your deployment file by including a dnsConfig block within the deployment ARM template and redeploying the container. Read Download and amend the Azure Resource Manager template for a for details. To update this in an existing , we recommend the following process:
  1. Download and amend the template as described above.
  2. Stop and/or delete the instance.
  3. Launch a new with the amended template, using the same Agent ID, Client ID, and Client Secret as the original.
For further details, read Deploy a container group with custom DNS settings in the Azure documentation.