infrastructure

name	infrastructure
description	Deploy and manage Azure infrastructure for the Physical AI Toolchain including Terraform IaC, Kubernetes setup, GPU configuration, and network topology

Infrastructure Skill

Deploy and manage Azure cloud infrastructure for the Physical AI Toolchain — Terraform IaC, AKS cluster configuration, GPU node pools, and network topology.

Prerequisites

Tool	Requirement
Azure CLI	az login authenticated
Terraform	1.5+
kubectl	Matching cluster version
Helm	4.2+
shellcheck	For script validation

Deployment Workflow

Follow these steps in order for a complete deployment.

Step 1 — Initialize Azure subscription

source infrastructure/terraform/prerequisites/az-sub-init.sh

Exports ARM_SUBSCRIPTION_ID and validates Azure CLI authentication.

Step 2 — Configure Terraform variables

cd infrastructure/terraform
cp terraform.tfvars.example terraform.tfvars

Edit terraform.tfvars with environment-specific values. Example configurations are in infrastructure/examples/:

File	Scenario
terraform.tfvars.dev	Single spot GPU pool, public networking
terraform.tfvars.prod	Multiple GPU pools, full private networking, HA
terraform.tfvars.hybrid	Private data services, public AKS API server

Step 3 — Provision infrastructure

terraform init
terraform plan -var-file=terraform.tfvars
terraform apply -var-file=terraform.tfvars

Step 4 — Deploy VPN (private clusters only)

Required when should_enable_private_aks_cluster = true:

cd infrastructure/terraform/vpn
terraform init && terraform apply

Step 5 — Connect to cluster

az aks get-credentials --resource-group <rg> --name <aks>
kubectl cluster-info

Step 6 — Run setup scripts

cd infrastructure/setup
./01-deploy-robotics-charts.sh
./02-deploy-azureml-extension.sh
./03-deploy-osmo.sh

Scripts must run in numeric order. Each supports --config-preview for dry-run output.

Network Mode Selection

Three network modes control connectivity and security:

Mode	should_enable_private_endpoint	should_enable_private_aks_cluster	VPN Required
Full Private	true	true	Yes
Hybrid	true	false	No
Full Public	false	false	No

Full Private is the default and recommended for production. Hybrid mode allows kubectl access without VPN while keeping data services private.

Common Operations

Plan changes

cd infrastructure/terraform
terraform plan -var-file=terraform.tfvars

Apply changes

terraform apply -var-file=terraform.tfvars

Destroy infrastructure

terraform destroy -var-file=terraform.tfvars

VPN setup

cd infrastructure/terraform/vpn
terraform init && terraform apply

DNS configuration

cd infrastructure/terraform/dns
terraform init && terraform apply

Validate setup scripts

shellcheck infrastructure/setup/01-deploy-robotics-charts.sh
infrastructure/setup/01-deploy-robotics-charts.sh --config-preview

Check Terraform formatting

terraform fmt -check -recursive infrastructure/terraform/

Directory Structure

infrastructure/
├── terraform/                         # Infrastructure as Code
│   ├── main.tf                        # Module composition
│   ├── variables.tf                   # Input variables
│   ├── outputs.tf                     # Output values
│   ├── versions.tf                    # Provider requirements
│   ├── terraform.tfvars.example       # Example configuration
│   ├── prerequisites/                 # Azure subscription setup
│   ├── modules/                       # Terraform modules
│   ├── vpn/                           # Standalone VPN deployment
│   ├── automation/                    # Standalone automation deployment
│   └── dns/                           # Standalone DNS deployment
├── setup/                             # Post-deploy cluster configuration
│   ├── 01-deploy-robotics-charts.sh   # GPU Operator, KAI Scheduler
│   ├── 02-deploy-azureml-extension.sh # AzureML K8s extension
│   ├── 03-deploy-osmo.sh             # OSMO control plane and backend
│   ├── defaults.conf                  # Central version and namespace config
│   └── lib/                           # Shared shell libraries
├── specifications/                    # Domain specification documents
└── examples/                          # Example tfvars configurations

GPU Configuration Reference

GPU	VM SKU	Driver Source	gpu_driver	MIG Strategy
A10	Standard_NV36ads_A10_v5	AKS-managed	Install	N/A
RTX PRO 6000	Standard_NC128ds_xl_RTXPRO6000BSE_v6	GRID DaemonSet	None	single
H100	Standard_NC40ads_H100_v5	GPU Operator	None	Disabled

RTX PRO 6000 nodes require nvidia.com/gpu.deploy.driver=false label to prevent GPU Operator driver conflicts.

Documentation

Guide	Description
Infrastructure README	Domain overview and quick start
Terraform README	Terraform configuration reference
Setup README	Setup script reference
Infrastructure Deployment	Full deployment walkthrough
GPU Configuration	Detailed GPU driver and operator reference