Standalone Deployment of kdb Insights Enterprise Overview¶

This page details an example infrastructure architecture for deploying kdb Insights Enterprise on the Kubernetes container orchestration system.

Example infrastructure¶

To support the deployment of kdb Insights Enterprise, we provide an Infrastructure as Code (IaC) bundle. The bundle contains a Dockerized environment with OpenTofu code and the tools required to create a managed Kubernetes cluster in any of the three major cloud providers.

The infrastructure provisioned satisfies the base requirements for deploying kdb Insights Enterprise and provides additional integrations including Cloud Logging and Metrics. The result is a secure, but not production hardened infrastructure, with the Kubernetes cluster deployed into a private network and is only accessible through a VPN.

The following diagram shows a high-level overview of the cloud infrastructure provisioned by the IaC bundle.

Architecture

OpenTofu¶

OpenTofu is an open-source infrastructure as code tool, managed by the Linux Foundation as a community-driven fork of HashiCorp Terraform. It lets you define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share.

We chose OpenTofu as it is multi-cloud, with providers for AWS, Azure, GCP and others. This allows you to spin up the same architecture regardless of your chosen cloud provider, with only minor difference in the configuration steps.

Migration from Terraform to OpenTofu

The IaC bundle previously used HashiCorp Terraform and now runs OpenTofu. For compatibility, the artifact, directory, script, and variable names retain the original terraform naming — for example kxi-terraform, scripts/terraform.sh, the terraform/ directory, and TF_VAR_* environment variables. The provided scripts handle this for you; however, if you run any commands manually inside the Docker container, use the tofu CLI — the terraform binary is no longer included.

Resources provisioned¶

The IaC bundle provisions resources at both the cloud service provider and Kubernetes level.

Cloud Provider resources¶

Virtual Private Cloud (VPC)
Public subnets used by the bastion host and any resources created by the Kubernetes cluster (for example, Load Balancer)
Private subnets to deploy the Kubernetes worker nodes
Bastion host running on a compute instance which acts as a VPN server to provide access to the Kubernetes cluster
Managed Kubernetes Cluster (AKS,EKS,GKE).

Kubernetes resources¶

cert-manager 1.19.3 - (generates certificates for any endpoint exposed by nginx-ingress)
ingress-nginx 4.14.3 - (legacy ingress controller, soon to be EOL; exposes kdb Insights Enterprise endpoint which can be either REST API or Web Interface)
nginx-community (F5) 2.4.1 - (next-generation ingress controller, exposes kdb Insights Enterprise endpoint which can be either REST API or Web Interface)

Architecture profile¶

The IaC bundle offers the following three different Architecture Profiles:

Profile	Compute Node vCPUs	Compute Node RAM (GB)	Compute Node Count	Availability Zones
High Availability	16	128	Min 3 / Max 10	3
Performance Optimized	30 (GKE) / 32 (AKS/EKS)	240 (GKE) / 256 (AKS/EKS)	Min 3 / Max 10	1 (AKS/GKE) / 2 (EKS)
Cost Optimized	8	64	Min 3 / Max 10	1 (AKS/GKE) / 2 (EKS)