How to deploy GraphDB in Azure

GraphDB can be deployed on Microsoft Azure by following the general installation instructions. You can find information regarding the costs of running a GraphDB instance on the Azure website.

Tip

We strongly recommend using the provided Terraform module, as it automates the procedure for deploying GraphDB on Azure and mitigates challenges commonly encountered during deployment. You can find the module in our GitHub repository. The Terraform module is also available in the Terraform registry.

See also

• Monitoring your Azure deployment

Architecture

The GraphDB architecture diagram showcases the deployment architecture for GraphDB on VM scale set instances in Azure cloud platform. The diagram illustrates the key components, and their interactions to provide a high-level understanding of the system’s architecture and how it should be deployed.

Note

There are no third-party integration points on the default GraphDB deployment.

Prerequisites

There are several prerequisites for running a GraphDB instance on Azure:

• Access to an Azure account and an active Azure subscription.

• Active GraphDB license required to use the Enterprise functionalities of the database.

• Create a shell script used to initialize the VM scale set instances.

• Accept a GraphDB BYOL offer.

Note

We highly recommend you use the the GraphDB Terraform module to deploy GraphDB on Azure. The module contains Terraform scripts that fully setup the GraphDB cluster and handle DNS records registration, and more. If you use these template files on their own, you will need to replace the placeholder values of all variables with your actual values. Please note that the scripts are template files and are therefore escaped.

Technical requirements

The following Azure services are required to complete the GraphDB deployment on Azure:

Service	Description
Resource Group	Container that holds closely related Azure resources and services that forms a solution.
Virtual Network	Private virtual network that enables Azure resources to communicate securely with each other.
VM scale set	Scalable compute service for creating and managing load balanced VM instances. Used to deploy GraphDB VM images build with GraphDB Azure Packer scripts that packages GraphDB and GraphDB external cluster proxy.
Managed disks	Block level storage for persistent data attached to VM instances. Used for persistent storage of GraphDB instance data, configurations and log files.
Application Gateway	Scalable layer 7 web load balancer managing traffic to applications in Azure. Used to load balance requests to GraphDB’s external cluster proxies running in the VM scale set.
NAT Gateway	Gateway for private outbound connectivity to the internet from VM instances. Provides GraphDB VM scale set instances with NAT based internet connectivity without directly exposing them.
Key Vault	Secure storage for secret keys and certificates.
App Configuration	Service for central storage and management of application settings and feature flags. Used to store GraphDB configurations and license.
Storage Account	Secure storage for files and objects. Used for scheduled GraphDB backups that are stored as BLOBs in a storage container.
Azure Monitor	Monitoring service that collects and aggregates data, metrics and service logs from different Azure resources.
DNS Private Zones	Secure DNS service for private DNS resolution between Azure resources. Used to establish stable network identifiers for GraphDB VM scale set instances.
Public IP	Dedicated IP address exposing Azure resources on the internet. Used to expose the Application Gateway and NAT gateway on the internet.
Network Security Groups	Security rules restricting the network traffic between Azure resources in an Azure Virtual Network. Used to restrict the traffic between the Virtual Network subnets.

Required skills

Note

Deploying GraphDB on Azure requires a combination of skills in Azure infrastructure management, database administration, and system troubleshooting. Acquiring these skills may involve hands-on experience, self-study, online resources, and formal training programs provided by Azure like Azure Fundamentals or other educational platforms.

The following skills and knowledge are typically required in order to successfully deploy GraphDB on Azure:

Azure Fundamentals	Familiarity with Microsoft Azure and understanding of its core concepts, such as subscriptions and resource groups, VM instances, virtual networks, security groups and RBAC roles. Knowledge of how to navigate the Azure Portal and interact with Azure resources is essential.
Azure Virtual Networks	Understanding network fundamentals and security, subnets and network security groups. Knowledge of how to set up inbound and outbound traffic rules with NSGs to allow communication with GraphDB.
Azure VM scale sets	Proficiency in creating and managing Azure VM instances. This includes selecting the appropriate machine size, configuring security settings, managing storage (Managed Disks), and understanding VM instance lifecycle management.
Monitoring and Troubleshooting	Proficiency in monitoring the health and performance of GraphDB instances on Azure. Understanding of logging, monitoring and troubleshooting techniques using Azure Monitor, VM instance logs, and GraphDB diagnostic tools.
Linux Administration	Proficiency in Linux command-line interface (CLI) and basic administration tasks. This includes SSH access to the VM instances using Azure Bastion, navigating the file system, managing permissions, installing packages, and configuring system settings.
Database Management	Knowledge of GraphDB and its deployment requirements. Understanding of how to configure GraphDB settings, including database storage, memory allocation, and repository creation.
Database Backup and Recovery	Familiarity with backup and recovery strategies for GraphDB on Azure. Knowledge of Azure services like Storage Account for data backups and restoration processes.
High Availability and Scalability	Knowledge of implementing high availability and scalability for GraphDB on Azure. This may involve using features like VMSS Auto Scaling, load balancers, and multi-Availability Zone (AZ) deployments.
Infrastructure as Code (IaC)	Familiarity with Infrastructure as Code principles and tools like Terraform. This enables automating the provisioning and configuration of GraphDB infrastructure.
Security Best Practices	Understanding of security best practices for Azure deployments, including data encryption, access controls, identity and access management, and compliance considerations.

Creating a Resource Group

Before you start deploying your resources, you need to create a resource group to contain them.

1. Go to the Azure Portal.

2. Click on Create a resource.

   

3. Search for Resource group and select it, then click on Create.

   

4. Fill in the required information:

   • Resource group name: Provide a unique name.

   • Region (Default region is East US)

     

5. Click on Review + Create, and then on Create.

Creating a Virtual Network

1. Navigate to the Resource Group you just created.

2. Click on + Create.

3. Search for Virtual Network and select it, then click on Create.

   

4. Fill in the required information:

   • Name

   • Address Space

   

5. Click on Review + Create, and then on Create.

Creating the two subnets

Inside the Virtual Network you just created, you need to create two subnets. One of the subnets will be used for the Virtual machine scale set, and the other will be used for the Application gateway.

1. Navigate to the Subnets tab inside the Virtual Network you just created.

   

   Note

   You can access the Virtual Network view through the Resource Group.

2. Click on + Subnet.

3. Provide a unique Name and Address Range.

4. Click on OK.

5. Under Service endpoints, search for the endpoint you need, and select it:

• When creating the Gateway subnet, select Microsoft.KeyVault.

• When creating the VMSS subnet, select Microsoft.Storage.

1. Scroll down to Network policy for private endpoints, and under Private endpoint network policy, select both Network security groups and Round tables.

   

2. Click Save, then repeat the process one more time for the second subnet.

   

Creating an Application Security Groups (ASG)

1. Navigate to your Resource Group and click on + Create.

2. Search for Application Security Group and select it, then click on Create.

3. Provide a unique name for your ASG.

4. Click on Review + Create, and then on Create.

Creating the two Network Security Groups (NSG)

You need to create two Network Security Groups (NSGs) — one for the VMSS, and one for the Gateway.

1. Navigate to your Resource Group and click on + Create.

2. Search for Network Security Group and select it, then click on Create.

3. Provide a unique name for your NSG.

   

4. Click on Review + Create, and then on Create.

5. Repeat the process one more time for the second NSG.

After both NSGs have been deployed, you need to associate each one of them with their respective subnet.

1. Navigate to the newly deployed NSG, and go to Subnets.

2. Click on Associate.

3. Select the virtual network you created earlier from the drop-down menu, and then select the respective subnet.

Configuring the security rules for the VMSS NSG

After you create the NSGs, you also need to configure the security rules for both of them. The VMSS NSG has both Inbound and Outbound security rules. You can use the table below for reference for each individual rule.

	Source	Source configuration	Source port ranges	Destination	Destination configuration	Service	Destination port ranges	Protocol	Action	Recommended priority
Inbound rule #1	IP Addresses	IP Address: 10.0.0.0/16	7200-7201	Application security group	The ASG you created.	Custom	7200-7201	TCP	Allow	100
Inbound rule #2	Application security group	The ASG you created.	*	Application security group	The ASG you created.	Custom	7200-7201	TCP	Allow	200
Inbound rule #3	Application security group	The ASG you created.	*	Application security group	The ASG you created.	Custom	7300-7301	TCP	Allow	210
Outbound rule #1	Application security group	The ASG you created.	*	Service tag	Destination service tag: Internet	Custom	*	Any	Allow	100
Outbound rule #2	Application security group	The ASG you created.	*	Application security group	The ASG you created.	Custom	7200-7201	TCP	Allow	200
Outbound rule #3	Application security group	The ASG you created.	*	Application security group	The ASG you created.	Custom	7300-7301	TCP	Allow	210

Configuring the security rules for the Gateway NSG

After you configure the security rules for the VMSS NSG, you also need to configure the security rules for the Gateway NSG. It requires only Inbound rules. You can use the table below for reference for each individual rule.

	Source	Source service tag	Source port ranges	Destination	Destination configuration	Service	Destination port ranges	Protocol	Action	Recommended priority
Inbound rule #1	Service tag	GatewayManager	*	Any	N/A	Custom	65200-65535	TCP	Allow	100
Inbound rule #2	Service tag	AzureLoadBalancer	*	IP Addresses	IP Address: 10.0.0.0/24	Custom	8080	TCP	Allow	110
Inbound rule #3	Service tag	Internet	*	IP Addresses	IP Address: 10.0.0.0/24	HTTP	80	TCP	Allow	120
Inbound rule #4	Service tag	Internet	*	IP Addresses	IP Address: 10.0.0.0/24	HTTPS	443	TCP	Allow	130
Inbound rule #5	Any	N/A	*	IP Addresses	IP Address: 10.0.0.0/24	Custom	8080	Any	Deny	4000

Creating the two Public IP addresses

You need to create two public IP addresses — one for the Application gateway, and one for the NAT gateway.

1. Navigate to your Resource Group and click on + Create.

2. Search for Public IP Address and select it, then click on Create.

3. Fill in the required information:

   • Name: Provide a unique name.

   • Zone: Zone redundant (recommended).

   • Assignment: Static or Dynamic (depending on your needs).

4. Click on Review + Create, and then on Create.

5. Repeat the process one more time for the second Public IP address.

Note

The idle connection timeout is 5 minutes (the Azure default is 4 minutes). To prevent timeouts, we recommend the inclusion of Keep-Alive messages with your requests.

Creating the NAT gateway

1. Navigate to your Resource Group and click on + Create.

2. Search for NAT Gateway and select it, then click on Create and provide a unique name.

3. Under Outbound IP, select the public IP you just created.

   

4. Under Subnet, select the virtual network created earlier from the drop-down menu, then select the VMSS subnet.

   

5. Click on Review + Create, and then on Create.

Creating a User-Assigned Managed Identity

1. Navigate to your Resource Group and click on + Create.

2. Search for User-Assigned Managed Identity and select it, then click on Create.

3. Provide a unique name for the User-assigned managed identity.

4. Click on Review + Create, and then on Create.

Note

• Make sure that Identity has enough rights to “Create” and “Read”

• You will need to assign identity to DNS Private Zone.

Creating the Storage Account

1. Navigate to your Resource Group and click on + Create.

2. Search for Storage Account and select it, then click on Create.

3. Under Networking, select the virtual network and choose the VMSS subnet.

   

4. Under Data Protection:

   • Check Enable soft delete for blobs, with Days to retain deleted blobs: 31.

   • Check Enable soft delete for containers, with Days to retain deleted containers: 31.

   • Check Enable blob change feed, and select Delete change feed logs after (in days): 31.

   • Uncheck everything else.

5. Click on Review + Create, and then on Create.

After the Storage Account has been deployed:

1. Navigate to the newly created Storage Account, and go to Containers.

2. Create containers for backup.

Creating the Application Gateway

1. Navigate to your Resource Group and click on + Create.

2. Search for Application Gateway and select it, then click on Create.

3. Set the following instance details:

   • Minimum instances: 1

   • Maximum instances: 2

   • Availability zone: Select all 3 availability zones.

   

4. Under Configure virtual network, select the gateway subnet.

   

5. Under Frontends, select the gateway IP created earlier.

6. Under Backends, add a backend pool with targets.

   Note

   Once you create and properly configure the VMSS, Azure should automatically add it as a target to the backend pool.

7. Under Configuration, define the Rule, Listener and Backend targets.

   • Configurations for the Listener:

     • Protocol: HTTPS

     • Port: 443

     • Certificate: Upload your certificate.

     

   • Configurations for the Backend targets:

     • Select the Backend pool you just created, and add new settings, as follows:

     • Protocol: HTTP

     • Port: 7201

     • Request time-out: 86400.

       Note

       86400 is the maximum number of seconds allowed. Such a long time is necessary for GraphDB to be able to operate.

     • Override backend path: /

     • Override with new host name: No

     

8. Set a high priority for the rule.

   Tip

   We recommend a value of 100.

9. Review and create the resource.

Warning

Deploying the application gateway can take longer than most of the other resources.

Creating the Virtual Machine Scale Set (VMSS)

Now that all other required resources have been deployed, the next step is to create the Virtual Machine Scale Sets (VMSS), where each instance functions as a cluster node. VMSS enables the deployment and management autoscaled, identical virtual machines, allowing you to dynamically scale in or out.

Additionally, this is where you can add a custom user data script if you want to use one.

Tip

You can use the custom user data script that is part of the Terraform module for reference when creating your script.

1. Navigate to your Resource Group and click on + Create.

2. Search for Virtual Machine Scale Set and select it, then click on Create.

3. Under Scale set details, provide a unique name and select all necessary availability zones.

4. Under Orchestration, choose Uniform.

5. Under Instance details, click on See all images and search for the GraphDB image in the Marketplace.

   

6. For each availability zone, add a managed disk — the recommended disk is Premium SSDv2 with 7500 IOPS and 250 throughput, 500GB.

   Warning

   At the end of the deployment process you must attach each a disk to each VMSS instance as LUN 2.

   

7. Add to the earlier created virtual network and select the VMSS subnet.

   • Under Load balancing options, select the Application Gateway created earlier.

8. Under Management, add the user-assigned managed identity you created earlier.

9. If you want to use a cluster, we recommend a value of 3, 5 or 7 under Scaling.

10. Enable health monitoring with the following configuration:

    • Type: Application health extension

    • Protocol: HTTP

    • Port number: 7200

    • Path: /rest/cluster/node/status

11. If you want to use a user data script, you can add it under Advanced.

    Tip

    You can use the custom user data script that is part of the Terraform module available on the Ontotext-AD github repo for reference when creating your script.

12. Review and create the resource.

Attaching the managed disks

After you have deployed your VMSS, you need to attach a disk to each of your VMSS instances.

Hint

The disk management script from the Terraform module can be used as a reference for attaching your managed disks.

1. Navigate to the newly created VMSS, and go to Instances.

2. Open the instance you want to attach a managed disk to.

3. Under Disks, click on Attach existing disks.

4. Add the disk you created earlier with LUN 2.

Setting up and managing your cluster

Once all the resources are installed and configured correctly, you can create a cluster by accessing Bastion and using the REST API.

Warning

If one of your instances dies or becomes unavailable, you will need to manually remove the node and add a new replacement node.

See also

• Overview of clusters

• Creating and managing a cluster

  • Using the REST API

  • Manage cluster membership

• Azure Bastion documentation

Accessing the Workbench through the Application Gateway

After all the resources are installed, the cluster has been created and all the instances are healthy, the Workbench can be accessed from the Application Gateway.

Warning

You cannot use the Workbench interface to create clusters in an Azure deployment. If you haven’t created a cluster yet, Workbench would not be loaded.

Scaling out and back in VMSS

1. Navigate to the Resource group containing your VMSS in the Azure Portal.

2. Go inside the VMSS and select Scaling in the navigation pane.

3. Under Configure, choose Manual scale or Custom autoscale based on your preference.

4. Under Scale-in Policy, select the NewestVM - Balance across the availability zones, and delete the newest created virtual machines.

5. Adjust the Instance count to the desired number of instances.

   Note

   If you require a GraphDB Cluster, the instance count is recommended to be 3, 5 or 7.

6. Click on Save to apply the scaling configuration.

Required manual maintenance of instances

If the Terraform script is not used, some manual maintenance of the instances will be required.

In case of a cluster failure, once the VMs are recreated, you will need to manually handle:

• Volume attaching and mounting

• DNS address updates

• Provisioning of GraphDB configurations and backup scripts.