Deploying Prisme.ai on Azure

​

Recommended managed services

​

Persistent storage

​

Infrastructure as Code

​

DNS and TLS

api.<your-domain>     -> Application Gateway / NGINX ingress public IP
studio.<your-domain>  -> same

​

Microsoft Entra ID passwordless auth

​

Common setup

1. Create a managed identity:
   az identity create --name PrismeaiIdentity --resource-group RESOURCE_GROUP
   
2. Wire the identity to AKS. Pick one: Option A — bind to the cluster (simpler, applies to all workloads):
   az aks update --resource-group RESOURCE_GROUP --name CLUSTER_NAME \
     --enable-managed-identity \
     --assign-identity IDENTITY_ID --assign-kubelet-identity IDENTITY_ID
   
   Then set every azureSystemIdentity: true in your Helm values. Option B — federated credentials (per service account, recommended):
   az identity federated-credential create --name prismeai-core-fic \
     --identity-name PrismeaiIdentity --resource-group RESOURCE_GROUP \
     --issuer <aks_oidc_issuer> \
     --subject system:serviceaccount:CORE_NAMESPACE:prismeai-backends-sa \
     --audiences api://AzureADTokenExchange
   
   az identity federated-credential create --name prismeai-apps-fic \
     --identity-name PrismeaiIdentity --resource-group RESOURCE_GROUP \
     --issuer <aks_oidc_issuer> \
     --subject system:serviceaccount:APPS_NAMESPACE:prismeai-backends-sa \
     --audiences api://AzureADTokenExchange
   
   All backend services (everything except prismeai-console) need serviceAccount.name: prismeai-backends-sa in your Helm values. Replace CORE_NAMESPACE and APPS_NAMESPACE with your namespace names.
   Then set every azureManagedIdentityClientId in your Helm values to the managed identity’s clientId.

​

Redis

1. Open your Azure Managed Redis instance.
2. Go to Settings → Authentication.
3. Enable Microsoft Entra ID authentication and select the managed identity.

​

PostgreSQL

1. Connect with your Entra admin user:
   export AZ_DATABASE_SERVER_NAME=prismeai
   export AZ_DATABASE_NAME=<db>
   export CURRENT_USERNAME=$(az ad signed-in-user show --query userPrincipalName --output tsv)
   psql "host=$AZ_DATABASE_SERVER_NAME.postgres.database.azure.com \
         user=$CURRENT_USERNAME dbname=$AZ_DATABASE_NAME port=5432 \
         password=$(az account get-access-token --resource-type oss-rdbms --output tsv --query accessToken) \
         sslmode=require"
   
2. Create a Postgres user attached to the managed identity (same name):
   select * from pgaadauth_create_principal('PrismeaiIdentity', false, false);
   
3. Grant permissions:
   GRANT CREATE, USAGE ON SCHEMA public TO "PrismeaiIdentity";
   GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "PrismeaiIdentity";
   ALTER DEFAULT PRIVILEGES IN SCHEMA public
     GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "PrismeaiIdentity";
   
4. In your Helm values, set the managed identity name as the user for all three PostgreSQL clients:
   • global.storage.permissions.user
   • prismeai-api-gateway.storage.users.user
   • prismeai-runtime.storage.collections.user

​

Ingress annotations

• Backend request timeout (≈ 60 s, under the api-gateway server keep-alive of 70 s) — socket reuse between client requests.
• Idle request timeout (≈ 300 s) — kill an in-flight request only after this much inactivity, so SSE / long LLM streams aren’t dropped.

​

Next Steps