Azure Components

Reference for every Azure offer in the Fractal Cloud catalogue. Each offer lists its parameters, required flags, and a fully-parameterized JSON example.

APIManagement

APIManagement.CaaS.Ambassador

Ambassador is an open-source API gateway and ingress controller deployed in a Kubernetes cluster.

Parameter	Description	Example / possible values	Required
host	Public hostname the gateway serves and requests a certificate for.	ambassador.example.com	No
hostOwnerEmail	Contact email registered with the ACME provider for certificate notifications.	admin@example.com	Yes
acmeProviderAuthority	ACME directory URL used to issue TLS certificates.	https://acme-v02.api.letsencrypt.org/directory	Yes
tlsSecretName	Kubernetes secret that stores the issued TLS certificate and key.	ambassador-tls-secret	Yes
licenseKey	Ambassador Edge Stack license key (leave blank for the open-source edition).	AES-1A2B-3C4D-5E6F-7G8H	No
namespace	Kubernetes namespace the gateway is deployed into.	ambassador	Yes

Example (fully parameterized):

{
  "type": "APIManagement.CaaS.Ambassador",
  "parameters": {
    "host": "ambassador.example.com",
    "hostOwnerEmail": "admin@example.com",
    "acmeProviderAuthority": "https://acme-v02.api.letsencrypt.org/directory",
    "tlsSecretName": "ambassador-tls-secret",
    "licenseKey": "AES-1A2B-3C4D-5E6F-7G8H",
    "namespace": "ambassador"
  }
}

APIManagement.CaaS.Traefik

Traefik is a modern reverse proxy and load balancer for Kubernetes, providing routing, TLS termination, and API gateway features.

Parameter	Description	Example / possible values	Required
entryPoints	Named listener entry points in name:port form.	["web:8000", "websecure:8443"]	Yes
hostname	Public hostname exposed by the proxy.	traefik.example.com	No
loadbalancerIp	Static IP to assign to the Traefik load balancer service.	10.0.1.50	No
oidcIssuerUrl	OIDC issuer/discovery URL for forward-auth.	https://login.microsoftonline.com/<tenant-id>/v2.0	Conditional — part of the all-or-nothing OIDC config group
oidcClientId	OIDC application (client) ID.	11111111-2222-3333-4444-555555555555	Conditional — part of the all-or-nothing OIDC config group
oidcClientSecretId	Secret store ID holding the OIDC client secret.	traefik-oidc-client-secret	Conditional — part of the all-or-nothing OIDC config group
forwardAuthSecretId	Secret store ID holding the forward-auth signing secret.	traefik-forward-auth-secret	Conditional — part of the all-or-nothing OIDC config group
securityHeadersSettings	HTTP security header middleware settings.	{"frameDeny": true, "browserXssFilter": true}	No
tlsCertificates	TLS certificate secret names presented by the proxy.	["traefik-default-cert"]	No
tlsSettings	TLS options such as minimum protocol version.	{"minVersion": "VersionTLS12"}	No
tracing	Distributed tracing backend configuration.	{"jaeger": {"samplingServerURL": "http://jaeger:5778/sampling"}}	No
namespace	Kubernetes namespace the proxy is deployed into.	traefik	Yes

Example (fully parameterized):

{
  "type": "APIManagement.CaaS.Traefik",
  "parameters": {
    "entryPoints": ["web:8000", "websecure:8443"],
    "hostname": "traefik.example.com",
    "loadbalancerIp": "10.0.1.50",
    "oidcIssuerUrl": "https://login.microsoftonline.com/11111111-2222-3333-4444-555555555555/v2.0",
    "oidcClientId": "11111111-2222-3333-4444-555555555555",
    "oidcClientSecretId": "traefik-oidc-client-secret",
    "forwardAuthSecretId": "traefik-forward-auth-secret",
    "securityHeadersSettings": {"frameDeny": true, "browserXssFilter": true},
    "tlsCertificates": ["traefik-default-cert"],
    "tlsSettings": {"minVersion": "VersionTLS12"},
    "tracing": {"jaeger": {"samplingServerURL": "http://jaeger:5778/sampling"}},
    "namespace": "traefik"
  }
}

APIManagement.PaaS.ApiManagement

Azure API Management is a fully managed service for publishing, managing, and securing APIs.

Parameter	Description	Example / possible values	Required
publisherName	Organization name shown on the developer portal.	Platform Team	No
publisherEmail	Administrative contact email for the service.	platform@fractal.cloud	No
skuName	API Management SKU and unit count.	Developer_1, Standard_2, Premium_1	No
publicNetworkAccessEnabled	Whether the service is reachable over the public internet.	true	No
identity	Managed identity assigned to the service.	{"type": "SystemAssigned"}	No

Example (fully parameterized):

{
  "type": "APIManagement.PaaS.ApiManagement",
  "parameters": {
    "publisherName": "Platform Team",
    "publisherEmail": "platform@fractal.cloud",
    "skuName": "Developer_1",
    "publicNetworkAccessEnabled": true,
    "identity": {"type": "SystemAssigned"}
  }
}

APIManagement.SaaS.Unmanaged

External API management service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-apim-secret	No
secretValue	Connection details / credentials for the external service.	https://apim.example.com;key=abc123	Yes

Example (fully parameterized):

{
  "type": "APIManagement.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-apim-secret",
    "secretValue": "https://apim.example.com;key=abc123"
  }
}

BigData

BigData.CaaS.MinioTenant

MinIO is a Kubernetes-hosted S3-compatible object storage system.

Parameter	Description	Example / possible values	Required
minioVersion	MinIO server release tag to deploy.	RELEASE.2025-03-12T18-04-18Z	No
servers	Number of MinIO server pods in the tenant.	4	No
volumesPerServer	Persistent volumes attached to each server.	4	No
volumeSize	Capacity of each persistent volume.	100Gi	No
storageClass	Kubernetes storage class backing the volumes.	managed-csi	No
cpuRequest	CPU requested per server pod.	500m	No
cpuLimit	CPU limit per server pod.	2	No
memoryRequest	Memory requested per server pod.	1Gi	No
memoryLimit	Memory limit per server pod.	4Gi	No
requestAutoCert	Enable MinIO's automatic TLS certificate generation.	true	No
namespace	Kubernetes namespace the tenant is deployed into.	minio	Yes

Example (fully parameterized):

{
  "type": "BigData.CaaS.MinioTenant",
  "parameters": {
    "minioVersion": "RELEASE.2025-03-12T18-04-18Z",
    "servers": 4,
    "volumesPerServer": 4,
    "volumeSize": "100Gi",
    "storageClass": "managed-csi",
    "cpuRequest": "500m",
    "cpuLimit": "2",
    "memoryRequest": "1Gi",
    "memoryLimit": "4Gi",
    "requestAutoCert": true,
    "namespace": "minio"
  }
}

BigData.CaaS.SparkCluster

Apache Spark cluster deployed on Kubernetes for distributed data processing.

Parameter	Description	Example / possible values	Required
sparkVersion	Apache Spark version to run.	3.5.3	No
image	Container image for the Spark driver and executors.	apache/spark:3.5.3	No
driverCores	CPU cores allocated to the driver.	1	No
driverMemory	Memory allocated to the driver.	1g	No
executorCores	CPU cores per executor.	2	No
executorMemory	Memory per executor.	2g	No
executorInstances	Number of executor pods.	2	No
sparkOperatorName	Name of the Spark Operator managing this cluster.	spark-operator	Yes
namespace	Kubernetes namespace the cluster is deployed into.	spark	Yes

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkCluster",
  "parameters": {
    "sparkVersion": "3.5.3",
    "image": "apache/spark:3.5.3",
    "driverCores": "1",
    "driverMemory": "1g",
    "executorCores": "2",
    "executorMemory": "2g",
    "executorInstances": 2,
    "sparkOperatorName": "spark-operator",
    "namespace": "spark"
  }
}

BigData.CaaS.SparkJob

Spark job that runs on a SparkApplication custom resource in a Kubernetes cluster.

Parameter	Description	Example / possible values	Required
type	Application language/type.	Java, Scala, Python, R	No
mode	Spark deploy mode.	cluster	No
image	Container image for driver and executors.	apache/spark:3.5.3	No
mainClass	Fully-qualified main class (JVM jobs).	com.example.MyApp	No
mainApplicationFile	URI of the application artifact to run.	s3a://jobs/app.jar	No
arguments	Arguments passed to the application.	["--date", "2026-07-03"]	No
sparkVersion	Apache Spark version to run.	3.5.3	No
sparkConf	Extra Spark configuration key/values.	{"spark.sql.shuffle.partitions": "200"}	No
driverCores	CPU cores allocated to the driver.	1	No
driverMemory	Memory allocated to the driver.	1g	No
executorCores	CPU cores per executor.	2	No
executorMemory	Memory per executor.	2g	No
executorInstances	Number of executor pods.	2	No
restartPolicy	Restart behavior on failure.	Never, Always, OnFailure	No
maxRetries	Retry attempts before the job is marked failed.	3	No
schedule	Cron expression for scheduled runs (blank for on-demand).	0 2 * * *	No
concurrencyPolicy	How concurrent scheduled runs are handled.	Forbid, Allow, Replace	No
sparkOperatorName	Name of the Spark Operator managing this job.	spark-operator	Yes
namespace	Kubernetes namespace the job runs in.	spark	Yes

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkJob",
  "parameters": {
    "type": "Java",
    "mode": "cluster",
    "image": "apache/spark:3.5.3",
    "mainClass": "com.example.MyApp",
    "mainApplicationFile": "s3a://jobs/app.jar",
    "arguments": ["--date", "2026-07-03"],
    "sparkVersion": "3.5.3",
    "sparkConf": {"spark.sql.shuffle.partitions": "200"},
    "driverCores": "1",
    "driverMemory": "1g",
    "executorCores": "2",
    "executorMemory": "2g",
    "executorInstances": 2,
    "restartPolicy": "Never",
    "maxRetries": 3,
    "schedule": "0 2 * * *",
    "concurrencyPolicy": "Forbid",
    "sparkOperatorName": "spark-operator",
    "namespace": "spark"
  }
}

BigData.CaaS.SparkMlExperiment

MLflow experiment server deployed in Kubernetes for machine learning experiment tracking.

Parameter	Description	Example / possible values	Required
mlflowVersion	MLflow server version to deploy.	2.21.3	No
backendStoreUri	Backend store URI for experiment metadata.	sqlite:///mlflow/mlflow.db	No
artifactRoot	Root path for storing run artifacts.	/mlflow/artifacts	No
replicas	Number of MLflow server replicas.	2	No
cpuRequest	CPU requested per replica.	250m	No
cpuLimit	CPU limit per replica.	1	No
memoryRequest	Memory requested per replica.	512Mi	No
memoryLimit	Memory limit per replica.	1Gi	No
servicePort	Port the MLflow UI/API listens on.	5000	No
namespace	Kubernetes namespace the server is deployed into.	mlflow	Yes

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkMlExperiment",
  "parameters": {
    "mlflowVersion": "2.21.3",
    "backendStoreUri": "sqlite:///mlflow/mlflow.db",
    "artifactRoot": "/mlflow/artifacts",
    "replicas": 2,
    "cpuRequest": "250m",
    "cpuLimit": "1",
    "memoryRequest": "512Mi",
    "memoryLimit": "1Gi",
    "servicePort": 5000,
    "namespace": "mlflow"
  }
}

BigData.CaaS.SparkOperator

Spark Operator controller enabling native Spark job submission in Kubernetes.

Parameter	Description	Example / possible values	Required
operatorVersion	Spark Operator chart/version to install.	2.5.0	No
sparkVersion	Default Spark version the operator targets.	3.5.3	No
enableWebhook	Enable the mutating admission webhook.	true	No
enableMetrics	Expose Prometheus metrics.	true	No
namespace	Kubernetes namespace the operator is deployed into.	spark-operator	Yes

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkOperator",
  "parameters": {
    "operatorVersion": "2.5.0",
    "sparkVersion": "3.5.3",
    "enableWebhook": true,
    "enableMetrics": true,
    "namespace": "spark-operator"
  }
}

BigData.CaaS.SparkUnityCatalog

Unity Catalog server for governing data and AI assets in a Spark ecosystem.

Parameter	Description	Example / possible values	Required
unityCatalogVersion	Unity Catalog server version to deploy.	0.3.0	No
replicas	Number of catalog server replicas.	2	No
cpuRequest	CPU requested per replica.	250m	No
cpuLimit	CPU limit per replica.	1	No
memoryRequest	Memory requested per replica.	512Mi	No
memoryLimit	Memory limit per replica.	1Gi	No
namespace	Kubernetes namespace the server is deployed into.	unity-catalog	Yes

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkUnityCatalog",
  "parameters": {
    "unityCatalogVersion": "0.3.0",
    "replicas": 2,
    "cpuRequest": "250m",
    "cpuLimit": "1",
    "memoryRequest": "512Mi",
    "memoryLimit": "1Gi",
    "namespace": "unity-catalog"
  }
}

BigData.PaaS.Databricks

Azure Databricks is a managed Apache Spark platform for big data analytics and machine learning.

Parameter	Description	Example / possible values	Required
pricingTier	Databricks workspace pricing tier.	premium, standard, trial	No
managedResourceGroupName	Name of the managed resource group Databricks creates.	databricks-managed-rg	No
enableNoPublicIp	Deploy workspace with no public IP (secure cluster connectivity).	false	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.Databricks",
  "parameters": {
    "pricingTier": "premium",
    "managedResourceGroupName": "databricks-managed-rg",
    "enableNoPublicIp": false
  }
}

BigData.PaaS.DatabricksCluster

Compute cluster in Databricks for running workloads, notebooks, and jobs.

Parameter	Description	Example / possible values	Required
clusterName	Display name of the cluster.	analytics-cluster	No
sparkVersion	Databricks Runtime version.	14.3.x-scala2.12	No
nodeTypeId	Azure VM SKU used for worker/driver nodes.	Standard_DS3_v2	No
numWorkers	Fixed number of workers (used when autoscaling is off).	2	No
minWorkers	Minimum workers when autoscaling.	1	No
maxWorkers	Maximum workers when autoscaling.	8	No
sparkConf	Extra Spark configuration key/values.	{"spark.databricks.delta.preview.enabled": "true"}	No
pypiLibraries	PyPI packages installed on the cluster.	["pandas==2.2.0"]	No
mavenLibraries	Maven coordinates installed on the cluster.	["com.microsoft.azure:azure-eventhubs-spark_2.12:2.3.22"]	No
autoTerminationMinutes	Idle minutes before auto-termination.	60	No
dataSecurityMode	Access/security mode of the cluster.	SINGLE_USER, USER_ISOLATION, NONE	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.DatabricksCluster",
  "parameters": {
    "clusterName": "analytics-cluster",
    "sparkVersion": "14.3.x-scala2.12",
    "nodeTypeId": "Standard_DS3_v2",
    "numWorkers": 2,
    "minWorkers": 1,
    "maxWorkers": 8,
    "sparkConf": {"spark.databricks.delta.preview.enabled": "true"},
    "pypiLibraries": ["pandas==2.2.0"],
    "mavenLibraries": ["com.microsoft.azure:azure-eventhubs-spark_2.12:2.3.22"],
    "autoTerminationMinutes": 60,
    "dataSecurityMode": "SINGLE_USER"
  }
}

BigData.PaaS.DatabricksJob

Job in Databricks that executes notebooks, Python files, or JAR tasks on schedule or on-demand.

Parameter	Description	Example / possible values	Required
jobName	Display name of the job.	nightly-etl	No
taskType	Kind of task the job runs.	NOTEBOOK, PYTHON, SPARK_JAR, PYTHON_WHEEL	No
notebookPath	Workspace path of the notebook to run.	/Repos/etl/main	Conditional — required when taskType=NOTEBOOK
pythonFile	Path/URI of the Python file to run.	dbfs:/scripts/job.py	Conditional — required when taskType=PYTHON
mainClassName	Main class for a Spark JAR task.	com.example.SparkJob	Conditional — required when taskType=SPARK_JAR
jarUri	URI of the JAR artifact.	dbfs:/jars/job.jar	No
parameters	Positional parameters passed to the task.	["--env", "prod"]	No
cronSchedule	Quartz cron expression for scheduled runs.	0 0 2 * * ?	No
maxRetries	Retry attempts on failure.	0	No
existingCluster	Run on an existing cluster instead of a job cluster.	false	No
artifactType	Artifact type for a wheel task.	whl	No
artifactUri	URI of the wheel/artifact to install.	dbfs:/artifacts/pipeline-1.0.0-py3-none-any.whl	No
packageName	Python wheel package name.	pipeline	No
entryPoint	Wheel entry point to invoke.	main	Conditional — required for a python_wheel task
entryPointArgs	Arguments passed to the wheel entry point.	["--full-refresh"]	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.DatabricksJob",
  "parameters": {
    "jobName": "nightly-etl",
    "taskType": "NOTEBOOK",
    "notebookPath": "/Repos/etl/main",
    "pythonFile": "dbfs:/scripts/job.py",
    "mainClassName": "com.example.SparkJob",
    "jarUri": "dbfs:/jars/job.jar",
    "parameters": ["--env", "prod"],
    "cronSchedule": "0 0 2 * * ?",
    "maxRetries": 0,
    "existingCluster": false,
    "artifactType": "whl",
    "artifactUri": "dbfs:/artifacts/pipeline-1.0.0-py3-none-any.whl",
    "packageName": "pipeline",
    "entryPoint": "main",
    "entryPointArgs": ["--full-refresh"]
  }
}

BigData.PaaS.DatabricksMlflowExperiment

MLflow experiment in Databricks for tracking and managing machine learning experiments.

Parameter	Description	Example / possible values	Required
experimentName	Workspace path/name of the experiment.	/Shared/fraud-detection	Yes
artifactLocation	Storage location for experiment artifacts.	dbfs:/mlflow/experiments	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.DatabricksMlflowExperiment",
  "parameters": {
    "experimentName": "/Shared/fraud-detection",
    "artifactLocation": "dbfs:/mlflow/experiments"
  }
}

BigData.PaaS.StorageAccount

Azure Storage Account (ADLS Gen2) for storing blobs, files, queues, and tables.

Parameter	Description	Example / possible values	Required
kind	Storage account kind.	StorageV2, BlobStorage, FileStorage	No
azureRegion	Azure region the account is created in.	westeurope	No
sku	Replication/performance SKU.	Standard_LRS, Standard_GRS, Premium_LRS	No
extendedLocation	Edge zone / extended location placement.	{"name": "losangeles", "type": "EdgeZone"}	No
identity	Managed identity assigned to the account.	{"type": "SystemAssigned"}	No
accessTier	Default blob access tier.	Hot, Cool	No
allowBlobPublicAccess	Allow anonymous public access to blobs.	false	No
allowCrossTenantReplication	Allow object replication across tenants.	false	No
allowSharedKeyAccess	Allow access via storage account keys.	true	No
allowedCopyScope	Restrict copy operations scope.	AAD, PrivateLink	No
azureFilesIdentityBasedAuthentication	Identity-based auth settings for Azure Files.	{"directoryServiceOptions": "AADDS"}	No
customDomain	Custom domain assigned to the account.	{"name": "storage.example.com"}	No
defaultToOAuthAuthentication	Default to Azure AD auth in the portal.	false	No
dnsEndpointType	DNS endpoint type.	Standard, AzureDnsZone	No
encryption	Encryption configuration.	{"keySource": "Microsoft.Storage"}	No
immutableStorageWithVersioning	Account-level immutability with versioning.	{"enabled": true}	No
isHnsEnabled	Enable hierarchical namespace (Data Lake Gen2).	true	No
isLocalUserEnabled	Enable local users for SFTP/NFS.	true	No
isNfsV3Enabled	Enable NFS v3 protocol.	true	No
isSftpEnabled	Enable SFTP access.	true	No
keyPolicy	Account key expiration policy.	{"keyExpirationPeriodInDays": 90}	No
largeFileSharesState	Enable large file shares.	Enabled, Disabled	No
minimumTlsVersion	Minimum TLS version accepted.	TLS1_2	No
networkRuleSet	Network access rules.	{"defaultAction": "Deny"}	No
publicNetworkAccess	Public network access state.	Enabled, Disabled	No
routingPreference	Network routing preference.	{"routingChoice": "MicrosoftRouting"}	No
sasPolicy	SAS token expiration policy.	{"sasExpirationPeriod": "1.00:00:00"}	No
supportsHttpsTrafficOnly	Require HTTPS for all traffic.	true	No
fileService	File service properties.	{"shareDeleteRetentionDays": 7}	No
backup	Backup configuration.	{"enabled": true, "retentionDays": 30}	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.StorageAccount",
  "parameters": {
    "kind": "StorageV2",
    "azureRegion": "westeurope",
    "sku": "Standard_LRS",
    "extendedLocation": {"name": "losangeles", "type": "EdgeZone"},
    "identity": {"type": "SystemAssigned"},
    "accessTier": "Hot",
    "allowBlobPublicAccess": false,
    "allowCrossTenantReplication": false,
    "allowSharedKeyAccess": true,
    "allowedCopyScope": "AAD",
    "azureFilesIdentityBasedAuthentication": {"directoryServiceOptions": "AADDS"},
    "customDomain": {"name": "storage.example.com"},
    "defaultToOAuthAuthentication": false,
    "dnsEndpointType": "Standard",
    "encryption": {"keySource": "Microsoft.Storage"},
    "immutableStorageWithVersioning": {"enabled": true},
    "isHnsEnabled": true,
    "isLocalUserEnabled": true,
    "isNfsV3Enabled": true,
    "isSftpEnabled": true,
    "keyPolicy": {"keyExpirationPeriodInDays": 90},
    "largeFileSharesState": "Enabled",
    "minimumTlsVersion": "TLS1_2",
    "networkRuleSet": {"defaultAction": "Deny"},
    "publicNetworkAccess": "Enabled",
    "routingPreference": {"routingChoice": "MicrosoftRouting"},
    "sasPolicy": {"sasExpirationPeriod": "1.00:00:00"},
    "supportsHttpsTrafficOnly": true,
    "fileService": {"shareDeleteRetentionDays": 7},
    "backup": {"enabled": true, "retentionDays": 30}
  }
}

BigData.SaaS.Unmanaged

External big data service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-bigdata-secret	No
secretValue	Connection details / credentials for the external service.	https://snowflake.example.com;token=abc123	Yes

Example (fully parameterized):

{
  "type": "BigData.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-bigdata-secret",
    "secretValue": "https://snowflake.example.com;token=abc123"
  }
}

CustomWorkloads

CustomWorkloads.CaaS.KubernetesWorkload

Generic Kubernetes workload deployed from a GitOps repository.

Parameter	Description	Example / possible values	Required
sshRepositoryURI	SSH URI of the GitOps repository.	git@github.com:org/repo.git	Yes
repoId	Identifier of the repository.	repo-name	Yes
branchName	Branch synced by GitOps.	main	Yes
privateSSHKeySecretId	Secret store ID holding the private SSH key.	workload-ssh-key	No
privateSSHKeyEnvironmentSecretShortName	Environment secret short name for the SSH key.	SSH_KEY	No
privateSSHKeyPassphraseSecretId	Secret store ID holding the SSH key passphrase.	workload-ssh-passphrase	No
privateSSHKeyPassphraseEnvironmentSecretShortName	Environment secret short name for the passphrase.	SSH_PASSPHRASE	No
ciCdProfileShortName	CI/CD profile applied to the workload.	default-cicd	No
environmentSecretShortNames	Environment secrets exposed to the workload.	["DB_PASSWORD", "API_KEY"]	No
roles	Platform roles granted to the workload.	["reader", "deployer"]	No
workloadSecretIdKey	Env var key for the workload client ID.	CLIENT_ID	No
workloadSecretPasswordKey	Env var key for the workload client secret.	CLIENT_SECRET	No
workloadIdentityEnabled	Enable Azure Workload Identity.	true	No
namespace	Kubernetes namespace the workload runs in.	default	Yes

Example (fully parameterized):

{
  "type": "CustomWorkloads.CaaS.KubernetesWorkload",
  "parameters": {
    "sshRepositoryURI": "git@github.com:org/repo.git",
    "repoId": "repo-name",
    "branchName": "main",
    "privateSSHKeySecretId": "workload-ssh-key",
    "privateSSHKeyEnvironmentSecretShortName": "SSH_KEY",
    "privateSSHKeyPassphraseSecretId": "workload-ssh-passphrase",
    "privateSSHKeyPassphraseEnvironmentSecretShortName": "SSH_PASSPHRASE",
    "ciCdProfileShortName": "default-cicd",
    "environmentSecretShortNames": ["DB_PASSWORD", "API_KEY"],
    "roles": ["reader", "deployer"],
    "workloadSecretIdKey": "CLIENT_ID",
    "workloadSecretPasswordKey": "CLIENT_SECRET",
    "workloadIdentityEnabled": true,
    "namespace": "default"
  }
}

CustomWorkloads.FaaS.AzureFunction

Serverless function hosted in Azure Functions runtime.

Parameter	Description	Example / possible values	Required
configuration	Function app runtime configuration.	{"runtime": "dotnet-isolated", "version": "~4"}	No
appSettings	Application settings / environment variables.	{"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated"}	No
identity	Managed identity assigned to the function app.	{"type": "SystemAssigned"}	No
appServicePlan	Hosting plan configuration.	{"sku": "Y1", "tier": "Dynamic"}	No
storageAccountConnectionString	Connection string of the backing storage account.	DefaultEndpointsProtocol=https;AccountName=funcstorage;AccountKey=...	No
sourceArtifact	URL of the deployment package.	https://storage.example.com/functions/app.zip	No
packageType	Deployment package type.	zip	No

Example (fully parameterized):

{
  "type": "CustomWorkloads.FaaS.AzureFunction",
  "parameters": {
    "configuration": {"runtime": "dotnet-isolated", "version": "~4"},
    "appSettings": {"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated"},
    "identity": {"type": "SystemAssigned"},
    "appServicePlan": {"sku": "Y1", "tier": "Dynamic"},
    "storageAccountConnectionString": "DefaultEndpointsProtocol=https;AccountName=funcstorage;AccountKey=abc123==",
    "sourceArtifact": "https://storage.example.com/functions/app.zip",
    "packageType": "zip"
  }
}

CustomWorkloads.PaaS.AzureContainerApp

Container application managed by Azure Container Apps, a serverless container hosting service.

Parameter	Description	Example / possible values	Required
image	Container image to deploy.	myregistry.azurecr.io/api:1.0.0	No
cpu	vCPU cores allocated to the container.	0.5	No
memory	Memory allocated to the container.	1Gi	No
port	Container port exposed by ingress.	8080	No
externalIngress	Expose the app to external traffic.	true	No
minReplicas	Minimum replica count.	0	No
maxReplicas	Maximum replica count.	10	No
region	Azure region for the container app.	westeurope	No
resourceGroup	Resource group hosting the container app.	my-container-apps-rg	No

Example (fully parameterized):

{
  "type": "CustomWorkloads.PaaS.AzureContainerApp",
  "parameters": {
    "image": "myregistry.azurecr.io/api:1.0.0",
    "cpu": 0.5,
    "memory": "1Gi",
    "port": 8080,
    "externalIngress": true,
    "minReplicas": 0,
    "maxReplicas": 10,
    "region": "westeurope",
    "resourceGroup": "my-container-apps-rg"
  }
}

CustomWorkloads.PaaS.AzureContainerInstance

Container instance managed by Azure Container Instances for quick, serverless deployment.

Parameter	Description	Example / possible values	Required
image	Container image to deploy.	mcr.microsoft.com/azuredocs/aci-helloworld:latest	No
cpu	vCPU cores allocated to the container.	1.0	No
memoryInGB	Memory in gigabytes.	1.5	No
port	Container port to expose.	8080	No
restartPolicy	Restart behavior.	Always, OnFailure, Never	No
publicIp	Assign a public IP address.	false	No
dnsNameLabel	DNS name label for the public FQDN.	my-aci-app	No
location	Azure region for the instance.	westeurope	No
resourceGroup	Resource group hosting the instance.	my-aci-rg	No

Example (fully parameterized):

{
  "type": "CustomWorkloads.PaaS.AzureContainerInstance",
  "parameters": {
    "image": "mcr.microsoft.com/azuredocs/aci-helloworld:latest",
    "cpu": 1.0,
    "memoryInGB": 1.5,
    "port": 8080,
    "restartPolicy": "Always",
    "publicIp": false,
    "dnsNameLabel": "my-aci-app",
    "location": "westeurope",
    "resourceGroup": "my-aci-rg"
  }
}

CustomWorkloads.PaaS.WebApp

Azure App Service web application for hosting web apps and APIs.

Parameter	Description	Example / possible values	Required
azureRegion	Azure region the web app runs in.	westeurope	No
containerSize	Container size for consumption/function-style hosting.	0	No
certificates	TLS certificate names bound to the app.	["www-example-com-cert"]	No
customDomains	Custom domains bound to the app.	["www.example.com"]	No
appServicePlan	App Service plan configuration.	{"sku": "P1v3", "tier": "PremiumV3"}	No
configuration	Site configuration (stack, always-on, etc.).	{"linuxFxVersion": "DOTNETCORE|8.0", "alwaysOn": true}	No
cloningInfo	Source app to clone from at creation.	{"sourceWebAppId": "/subscriptions/.../sites/source-app"}	No
clientAffinityEnabled	Enable ARR session affinity cookies.	false	No
clientCertEnabled	Require client certificates.	false	No
clientCertExclusionPaths	Paths excluded from client-cert auth.	/health	No
clientCertMode	Client certificate enforcement mode.	Required, Optional	No
customDomainVerificationId	Domain ownership verification token.	8A0B1C2D3E4F5A6B7C8D9E0F	No
hostingEnvironmentProfileId	App Service Environment resource ID.	/subscriptions/.../hostingEnvironments/my-ase	No
redundancyMode	Redundancy mode of the app.	None, ActiveActive, Failover	No
virtualNetworkSubnetId	Subnet ID for VNet integration.	/subscriptions/.../subnets/webapp-subnet	No
publishingUsername	Deployment (SCM) publishing username.	Fractal Cloud	No
httpsOnly	Redirect all traffic to HTTPS.	true	No
enabled	Whether the app is enabled.	true	No
hostNamesDisabled	Disable public hostnames.	false	No
hyperV	Run in a Hyper-V (Windows container) sandbox.	false	No
reserved	Reserved flag (true for Linux apps).	false	No
scmSiteAlsoStopped	Stop the SCM site when the app is stopped.	false	No
storageAccountRequired	Require a storage account for the app.	false	No
dailyMemoryTimeQuota	Daily memory-time quota (0 = unlimited).	0	No
repoId	Source repository identifier.	my-webapp	No
branchName	Branch to deploy from.	main	No
sshRepositoryURI	SSH URI of the source repository.	git@github.com:org/webapp.git	No
privateSSHKeySecretId	Secret store ID holding the private SSH key.	webapp-ssh-key	No
privateSSHKeyPassphraseSecretId	Secret store ID holding the SSH key passphrase.	webapp-ssh-passphrase	No
ciCdProfileShortName	CI/CD profile applied to the app.	default-cicd	No
roles	Platform roles granted to the app.	["contributor"]	No
workloadSecretIdKey	Env var key for the workload client ID.	CLIENT_ID	No
workloadSecretPasswordKey	Env var key for the workload client secret.	CLIENT_SECRET	No

Example (fully parameterized):

{
  "type": "CustomWorkloads.PaaS.WebApp",
  "parameters": {
    "azureRegion": "westeurope",
    "containerSize": 0,
    "certificates": ["www-example-com-cert"],
    "customDomains": ["www.example.com"],
    "appServicePlan": {"sku": "P1v3", "tier": "PremiumV3"},
    "configuration": {"linuxFxVersion": "DOTNETCORE|8.0", "alwaysOn": true},
    "cloningInfo": {"sourceWebAppId": "/subscriptions/00000000-0000-0000-0000-000000000000/sites/source-app"},
    "clientAffinityEnabled": false,
    "clientCertEnabled": false,
    "clientCertExclusionPaths": "/health",
    "clientCertMode": "Required",
    "customDomainVerificationId": "8A0B1C2D3E4F5A6B7C8D9E0F",
    "hostingEnvironmentProfileId": "/subscriptions/00000000-0000-0000-0000-000000000000/hostingEnvironments/my-ase",
    "redundancyMode": "None",
    "virtualNetworkSubnetId": "/subscriptions/00000000-0000-0000-0000-000000000000/subnets/webapp-subnet",
    "publishingUsername": "Fractal Cloud",
    "httpsOnly": true,
    "enabled": true,
    "hostNamesDisabled": false,
    "hyperV": false,
    "reserved": false,
    "scmSiteAlsoStopped": false,
    "storageAccountRequired": false,
    "dailyMemoryTimeQuota": 0,
    "repoId": "my-webapp",
    "branchName": "main",
    "sshRepositoryURI": "git@github.com:org/webapp.git",
    "privateSSHKeySecretId": "webapp-ssh-key",
    "privateSSHKeyPassphraseSecretId": "webapp-ssh-passphrase",
    "ciCdProfileShortName": "default-cicd",
    "roles": ["contributor"],
    "workloadSecretIdKey": "CLIENT_ID",
    "workloadSecretPasswordKey": "CLIENT_SECRET"
  }
}

CustomWorkloads.SaaS.Unmanaged

External custom workload service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-workload-secret	No
secretValue	Connection details / credentials for the external service.	https://workload.example.com;token=abc123	Yes

Example (fully parameterized):

{
  "type": "CustomWorkloads.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-workload-secret",
    "secretValue": "https://workload.example.com;token=abc123"
  }
}

Messaging

Messaging.CaaS.Kafka

Apache Kafka cluster deployed on Kubernetes for event streaming.

Parameter	Description	Example / possible values	Required
replicas	Number of Kafka broker replicas.	5	No
kafkaVersion	Kafka version to deploy.	4.2.0	No
memoryRequest	Memory requested per broker.	16Gi	No
memoryLimit	Memory limit per broker.	32Gi	No
cpuRequest	CPU requested per broker.	4	No
cpuLimit	CPU limit per broker.	8	No
storageSize	Persistent storage per broker.	1Ti	No
namespace	Kubernetes namespace the cluster is deployed into.	kafka	Yes

Example (fully parameterized):

{
  "type": "Messaging.CaaS.Kafka",
  "parameters": {
    "replicas": 5,
    "kafkaVersion": "4.2.0",
    "memoryRequest": "16Gi",
    "memoryLimit": "32Gi",
    "cpuRequest": "4",
    "cpuLimit": "8",
    "storageSize": "1Ti",
    "namespace": "kafka"
  }
}

Messaging.CaaS.KafkaTopic

Topic in a Kafka cluster for publishing and consuming messages.

Parameter	Description	Example / possible values	Required
partitions	Number of partitions for the topic.	50	No
replicas	Replication factor for the topic.	2	No
retentionMs	Message retention in milliseconds.	172800000	No
clusterName	Name of the Kafka cluster hosting the topic.	kafka-cluster	Yes
namespace	Kubernetes namespace of the Kafka cluster.	kafka	Yes

Example (fully parameterized):

{
  "type": "Messaging.CaaS.KafkaTopic",
  "parameters": {
    "partitions": 50,
    "replicas": 2,
    "retentionMs": 172800000,
    "clusterName": "kafka-cluster",
    "namespace": "kafka"
  }
}

Messaging.CaaS.KafkaUser

Kafka user with ACLs for secure access to Kafka cluster topics.

Parameter	Description	Example / possible values	Required
acls	Access control rules granted to the user.	[{"resource": "topic", "name": "orders", "operation": "Read"}]	No
clusterName	Name of the Kafka cluster the user belongs to.	kafka-cluster	Yes
namespace	Kubernetes namespace of the Kafka cluster.	kafka	Yes

Example (fully parameterized):

{
  "type": "Messaging.CaaS.KafkaUser",
  "parameters": {
    "acls": [{"resource": "topic", "name": "orders", "operation": "Read"}],
    "clusterName": "kafka-cluster",
    "namespace": "kafka"
  }
}

Messaging.PaaS.EventHubInstance

Event hub instance in Azure Event Hubs for capturing event streams.

Parameter	Description	Example / possible values	Required
partitionCount	Number of partitions in the event hub.	1	No
messageRetentionInDays	Days messages are retained.	1	No
userMetadata	Free-form metadata attached to the event hub.	ingest pipeline v2	No
retention	Retention/cleanup policy for the event hub.	{"cleanupPolicy": "Compact", "tombstoneTimeInHours": 12, "timeInHours": 12}	No

Example (fully parameterized):

{
  "type": "Messaging.PaaS.EventHubInstance",
  "parameters": {
    "partitionCount": 1,
    "messageRetentionInDays": 1,
    "userMetadata": "ingest pipeline v2",
    "retention": {
      "cleanupPolicy": "Compact",
      "tombstoneTimeInHours": 12,
      "timeInHours": 12
    }
  }
}

Messaging.PaaS.EventHubNamespace

Namespace in Azure Event Hubs containing event hubs and related infrastructure.

Parameter	Description	Example / possible values	Required
kafkaEnabled	Enable the Kafka-compatible endpoint.	true	No
alternateName	Alternate name for the namespace.	my-eventhub-alt-name	No
diableLocalAuth	Disable SAS key (local) authentication.	false	No
autoInflateEnabled	Automatically scale throughput units.	true	No
maximumThroughputUnits	Upper bound for auto-inflate throughput units.	20	No
minimumTlsVersion	Minimum TLS version accepted.	1.2	No
publicNetworkAccess	Public network access state.	Disabled, Enabled	No
sku	Namespace SKU tier, name, and capacity.	{"tier": "Standard", "name": "Standard", "capacity": 1}	No
zoneRedundant	Spread across availability zones.	false	No

Example (fully parameterized):

{
  "type": "Messaging.PaaS.EventHubNamespace",
  "parameters": {
    "kafkaEnabled": true,
    "alternateName": "my-eventhub-alt-name",
    "diableLocalAuth": false,
    "autoInflateEnabled": true,
    "maximumThroughputUnits": 20,
    "minimumTlsVersion": "1.2",
    "publicNetworkAccess": "Disabled",
    "sku": {
      "tier": "Standard",
      "name": "Standard",
      "capacity": 1
    },
    "zoneRedundant": false
  }
}

Messaging.PaaS.Relay

Azure Relay service for secure communication across network boundaries.

No configurable parameters.

Example (fully parameterized):

{
  "type": "Messaging.PaaS.Relay",
  "parameters": {}
}

Messaging.PaaS.ServiceBus

Azure Service Bus namespace for messaging, queues, topics, and subscriptions.

Parameter	Description	Example / possible values	Required
sku	Namespace SKU name and tier.	{"name": "Standard", "tier": "Standard"}	No
skuTier	Pricing tier of the namespace.	Standard, Premium, Basic	No
identity	Managed identity assigned to the namespace.	SystemAssigned	No
encryption	Customer-managed key encryption settings.	{"keySource": "Microsoft.KeyVault"}	No
disableLocalAuth	Disable SAS key (local) authentication.	false	No
zoneRedundant	Spread across availability zones.	false	No

Example (fully parameterized):

{
  "type": "Messaging.PaaS.ServiceBus",
  "parameters": {
    "sku": {"name": "Standard", "tier": "Standard"},
    "skuTier": "Standard",
    "identity": "SystemAssigned",
    "encryption": {"keySource": "Microsoft.KeyVault"},
    "disableLocalAuth": false,
    "zoneRedundant": false
  }
}

Messaging.PaaS.ServiceBusQueue

Message queue in Azure Service Bus for reliable message delivery.

Parameter	Description	Example / possible values	Required
autoDeleteOnIdle	Idle interval before the queue is auto-deleted (ISO 8601).	PT5M	No
deadLetteringOnMessageExpiration	Dead-letter messages that expire.	false	No
defaultMessageTimeToLive	Default message TTL (ISO 8601).	PT5M	No
duplicateDetectionHistoryTimeWindow	Duplicate detection window (ISO 8601).	PT5M	No
enableExpress	Enable express entities (in-memory).	false	No
enableBatchedOperations	Enable server-side batched operations.	false	No
enablePartitioning	Enable partitioning across brokers.	false	No
forwardTo	Queue/topic to auto-forward messages to.	orders-processing	No
forwardDeadLetteredMessagesTo	Entity to auto-forward dead-lettered messages to.	orders-dlq	No
lockDuration	Peek-lock duration (ISO 8601).	PT5M	No
maxDeliveryCount	Max delivery attempts before dead-lettering.	1	No
maxSizeInMegabytes	Maximum queue size in MB.	1024	No
maxMessageSizeInKilobytes	Maximum message size in KB.	256	No
requiresSession	Require sessions for message ordering.	false	No
requiresDuplicateDetection	Enable duplicate detection.	false	No
status	Entity status.	Active, Disabled, SendDisabled	No

Example (fully parameterized):

{
  "type": "Messaging.PaaS.ServiceBusQueue",
  "parameters": {
    "autoDeleteOnIdle": "PT5M",
    "deadLetteringOnMessageExpiration": false,
    "defaultMessageTimeToLive": "PT5M",
    "duplicateDetectionHistoryTimeWindow": "PT5M",
    "enableExpress": false,
    "enableBatchedOperations": false,
    "enablePartitioning": false,
    "forwardTo": "orders-processing",
    "forwardDeadLetteredMessagesTo": "orders-dlq",
    "lockDuration": "PT5M",
    "maxDeliveryCount": 1,
    "maxSizeInMegabytes": 1024,
    "maxMessageSizeInKilobytes": 256,
    "requiresSession": false,
    "requiresDuplicateDetection": false,
    "status": "Active"
  }
}

Messaging.PaaS.ServiceBusTopic

Topic in Azure Service Bus for pub/sub messaging patterns.

Parameter	Description	Example / possible values	Required
autoDeleteOnIdle	Idle interval before the topic is auto-deleted (ISO 8601).	PT5M	No
defaultMessageTimeToLive	Default message TTL (ISO 8601).	PT5M	No
duplicateDetectionHistoryTimeWindow	Duplicate detection window (ISO 8601).	PT5M	No
enableExpress	Enable express entities (in-memory).	false	No
enableBatchedOperations	Enable server-side batched operations.	false	No
enablePartitioning	Enable partitioning across brokers.	false	No
maxSizeInMegabytes	Maximum topic size in MB.	1024	No
maxMessageSizeInKilobytes	Maximum message size in KB.	256	No
requiresDuplicateDetection	Enable duplicate detection.	false	No
status	Entity status.	Active, Disabled, SendDisabled	No
supportOrdering	Preserve message ordering.	false	No

Example (fully parameterized):

{
  "type": "Messaging.PaaS.ServiceBusTopic",
  "parameters": {
    "autoDeleteOnIdle": "PT5M",
    "defaultMessageTimeToLive": "PT5M",
    "duplicateDetectionHistoryTimeWindow": "PT5M",
    "enableExpress": false,
    "enableBatchedOperations": false,
    "enablePartitioning": false,
    "maxSizeInMegabytes": 1024,
    "maxMessageSizeInKilobytes": 256,
    "requiresDuplicateDetection": false,
    "status": "Active",
    "supportOrdering": false
  }
}

Messaging.SaaS.Unmanaged

External messaging service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-messaging-secret	No
secretValue	Connection details / credentials for the external service.	amqps://broker.example.com;key=abc123	Yes

Example (fully parameterized):

{
  "type": "Messaging.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-messaging-secret",
    "secretValue": "amqps://broker.example.com;key=abc123"
  }
}

NetworkAndCompute

NetworkAndCompute.IaaS.AzureLoadBalancer

Azure Load Balancer distributes incoming traffic across backend resources.

Parameter	Description	Example / possible values	Required
lbType	Load balancer SKU.	Standard, Basic	No
lbScheme	Whether the load balancer is internal or public.	internal, public	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AzureLoadBalancer",
  "parameters": {
    "lbType": "Standard",
    "lbScheme": "internal"
  }
}

NetworkAndCompute.IaaS.AzureNetworkSecurityGroup

Network Security Group controls inbound and outbound traffic with security rules.

Parameter	Description	Example / possible values	Required
description	Human-readable description of the security group.	Allow inbound HTTPS from the app subnet	No
ingressRules	Inbound traffic rules. Each rule needs at least one of sourceCidr or sourceComponentId.	[{"protocol": "tcp", "fromPort": 443, "toPort": 443, "sourceCidr": "10.0.0.0/16"}]	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AzureNetworkSecurityGroup",
  "parameters": {
    "description": "Allow inbound HTTPS from the app subnet",
    "ingressRules": [{"protocol": "tcp", "fromPort": 443, "toPort": 443, "sourceCidr": "10.0.0.0/16"}]
  }
}

NetworkAndCompute.IaaS.AzureSecurityGroup

Network security group for controlling traffic flow to and from resources.

Parameter	Description	Example / possible values	Required
description	Human-readable description of the security group.	Allow inbound HTTPS from the app subnet	No
ingressRules	Inbound traffic rules. Each rule needs at least one of sourceCidr or sourceComponentId.	[{"protocol": "tcp", "fromPort": 443, "toPort": 443, "sourceCidr": "10.0.0.0/16"}]	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AzureSecurityGroup",
  "parameters": {
    "description": "Allow inbound HTTPS from the app subnet",
    "ingressRules": [{"protocol": "tcp", "fromPort": 443, "toPort": 443, "sourceCidr": "10.0.0.0/16"}]
  }
}

NetworkAndCompute.IaaS.AzureSubnet

Subnet within a virtual network for grouping and isolating resources.

Parameter	Description	Example / possible values	Required
cidrBlock	Address range of the subnet.	10.0.1.0/24	No
vnetName	Name of the parent virtual network.	my-vnet	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AzureSubnet",
  "parameters": {
    "cidrBlock": "10.0.1.0/24",
    "vnetName": "my-vnet"
  }
}

NetworkAndCompute.IaaS.AzureVirtualMachine

Virtual machine in Azure for computing workloads.

Parameter	Description	Example / possible values	Required
instanceType	VM size / SKU.	Standard_B1s, Standard_DS3_v2	No
imageId	OS image reference (publisher:offer:sku:version).	Canonical:UbuntuServer:18.04-LTS:latest	No
keyName	Name of the SSH key pair for login.	my-ssh-key	No
userData	Cloud-init / startup script.	#!/bin/bash\napt-get update	No
associatePublicIp	Assign a public IP address.	false	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AzureVirtualMachine",
  "parameters": {
    "instanceType": "Standard_B1s",
    "imageId": "Canonical:UbuntuServer:18.04-LTS:latest",
    "keyName": "my-ssh-key",
    "userData": "#!/bin/bash\napt-get update",
    "associatePublicIp": false
  }
}

NetworkAndCompute.IaaS.AzureVirtualNetwork

Virtual network in Azure providing isolated network environment.

Parameter	Description	Example / possible values	Required
cidrBlock	Address space of the virtual network. Defaults to 10.1.0.0/20 when omitted.	10.1.0.0/20	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AzureVirtualNetwork",
  "parameters": {
    "cidrBlock": "10.1.0.0/20"
  }
}

NetworkAndCompute.IaaS.SecurityGroup

Network security group for controlling inbound and outbound traffic.

Parameter	Description	Example / possible values	Required
description	Human-readable description of the security group.	Allow inbound HTTPS from the app subnet	No
ingressRules	Inbound traffic rules. Each rule needs at least one of sourceCidr or sourceComponentId.	[{"protocol": "tcp", "fromPort": 443, "toPort": 443, "sourceCidr": "10.0.0.0/16"}]	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.SecurityGroup",
  "parameters": {
    "description": "Allow inbound HTTPS from the app subnet",
    "ingressRules": [{"protocol": "tcp", "fromPort": 443, "toPort": 443, "sourceCidr": "10.0.0.0/16"}]
  }
}

NetworkAndCompute.IaaS.VNet

Virtual network providing isolated networking and connectivity for Azure resources.

Parameter	Description	Example / possible values	Required
cidrBlock	Address space of the virtual network.	10.0.0.0/16	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.VNet",
  "parameters": {
    "cidrBlock": "10.0.0.0/16"
  }
}

NetworkAndCompute.PaaS.AKS

Azure Kubernetes Service — managed Kubernetes cluster in Azure.

Parameter	Description	Example / possible values	Required
region	Azure region for the cluster. Blank → the environment region. Legacy alias: azureRegion.	westeurope	No
managedClusterSkuTier	Control plane SKU tier.	Free, Standard, Premium	No
azureActiveDirectoryProfile	Azure AD integration settings.	{"managed": true, "enableAzureRBAC": true}	No
outboundIps	Static outbound public IP addresses.	["20.50.1.10"]	No
cidrBlock	Virtual network address space.	10.0.0.0/16	No
vnetSubnetAddressIpRange	Subnet range for cluster nodes.	10.0.1.0/24	No
podIpRange	Address range for pods.	10.244.0.0/16	No
serviceIpRange	Address range for Kubernetes services.	10.0.2.0/24	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AKS",
  "parameters": {
    "managedClusterSkuTier": "Free",
    "azureActiveDirectoryProfile": {"managed": true, "enableAzureRBAC": true},
    "outboundIps": ["20.50.1.10"],
    "cidrBlock": "10.0.0.0/16",
    "vnetSubnetAddressIpRange": "10.0.1.0/24",
    "podIpRange": "10.244.0.0/16",
    "serviceIpRange": "10.0.2.0/24"
  }
}

NetworkAndCompute.PaaS.AzureAppService

Shared compute infrastructure for running App Service apps.

No configurable parameters.

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AzureAppService",
  "parameters": {}
}

NetworkAndCompute.PaaS.AzureContainerAppsEnvironment

Container Apps Environment providing container runtime and networking.

Parameter	Description	Example / possible values	Required
location	Azure region for the environment.	westeurope	No
resourceGroup	Resource group hosting the environment.	my-aca-env-rg	No
logAnalyticsWorkspaceId	Log Analytics workspace resource ID.	/subscriptions/.../workspaces/my-law	No
logAnalyticsSharedKey	Shared key for the Log Analytics workspace.	abcdEFGH1234ijklMNOP5678==	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AzureContainerAppsEnvironment",
  "parameters": {
    "location": "westeurope",
    "resourceGroup": "my-aca-env-rg",
    "logAnalyticsWorkspaceId": "/subscriptions/00000000-0000-0000-0000-000000000000/workspaces/my-law",
    "logAnalyticsSharedKey": "abcdEFGH1234ijklMNOP5678=="
  }
}

NetworkAndCompute.PaaS.AzureContainerInstanceService

Service for running containers on Azure Container Instances.

No configurable parameters.

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AzureContainerInstanceService",
  "parameters": {}
}

NetworkAndCompute.PaaS.DnsZone

DNS zone for managing DNS records and domain resolution.

Parameter	Description	Example / possible values	Required
isPrivate	Whether the zone is a private DNS zone.	true	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.DnsZone",
  "parameters": {
    "isPrivate": true
  }
}

NetworkAndCompute.PaaS.Kubernetes

Managed Kubernetes cluster in Azure (alias for AKS).

Parameter	Description	Example / possible values	Required
managedClusterSkuTier	Control plane SKU tier.	Free, Standard, Premium	No
azureActiveDirectoryProfile	Azure AD integration settings.	{"managed": true, "enableAzureRBAC": true}	No
outboundIps	Static outbound public IP addresses.	["20.50.1.10"]	No
cidrBlock	Virtual network address space.	10.0.0.0/16	No
vnetSubnetAddressIpRange	Subnet range for cluster nodes.	10.0.1.0/24	No
podIpRange	Address range for pods.	10.244.0.0/16	No
serviceIpRange	Address range for Kubernetes services.	10.0.2.0/24	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.Kubernetes",
  "parameters": {
    "managedClusterSkuTier": "Free",
    "azureActiveDirectoryProfile": {"managed": true, "enableAzureRBAC": true},
    "outboundIps": ["20.50.1.10"],
    "cidrBlock": "10.0.0.0/16",
    "vnetSubnetAddressIpRange": "10.0.1.0/24",
    "podIpRange": "10.244.0.0/16",
    "serviceIpRange": "10.0.2.0/24"
  }
}

NetworkAndCompute.SaaS.Unmanaged

External network/compute service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-compute-secret	No
secretValue	Connection details / credentials for the external service.	https://compute.example.com;token=abc123	Yes

Example (fully parameterized):

{
  "type": "NetworkAndCompute.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-compute-secret",
    "secretValue": "https://compute.example.com;token=abc123"
  }
}

Observability

Observability.CaaS.Elastic

Elastic Stack (Elasticsearch + Kibana) deployed on Kubernetes for logging and analytics.

Parameter	Description	Example / possible values	Required
elasticVersion	Elasticsearch version to deploy.	8.10.0	Yes
elasticInstances	Number of Elasticsearch nodes.	3	Yes
storage	Persistent storage per node.	100Gi	Yes
storageClassName	Kubernetes storage class backing the volumes.	managed-premium	No
memory	Memory (GB) per node.	8	No
cpu	CPU cores per node.	8	No
isApmRequired	Deploy the APM server.	false	No
isKibanaRequired	Deploy Kibana.	true	No
secrets	Secret references injected into the stack.	{"elastic-credentials": "elasticsearch-es-elastic-user"}	No
namespace	Kubernetes namespace the stack is deployed into.	elastic	Yes

Example (fully parameterized):

{
  "type": "Observability.CaaS.Elastic",
  "parameters": {
    "elasticVersion": "8.10.0",
    "elasticInstances": 3,
    "storage": "100Gi",
    "storageClassName": "managed-premium",
    "memory": 8,
    "cpu": 8,
    "isApmRequired": false,
    "isKibanaRequired": true,
    "secrets": {"elastic-credentials": "elasticsearch-es-elastic-user"},
    "namespace": "elastic"
  }
}

Observability.CaaS.Jaeger

Jaeger distributed tracing system deployed on Kubernetes.

Parameter	Description	Example / possible values	Required
storageClassName	Kubernetes storage class backing the trace store.	managed-premium	No
storageSettings	Trace storage backend configuration.	{"type": "elasticsearch", "esServerUrls": "http://elasticsearch:9200"}	No
namespace	Kubernetes namespace the system is deployed into.	jaeger	Yes

Example (fully parameterized):

{
  "type": "Observability.CaaS.Jaeger",
  "parameters": {
    "storageClassName": "managed-premium",
    "storageSettings": {"type": "elasticsearch", "esServerUrls": "http://elasticsearch:9200"},
    "namespace": "jaeger"
  }
}

Observability.CaaS.Prometheus

Prometheus monitoring and alerting system deployed on Kubernetes.

Parameter	Description	Example / possible values	Required
grafanaConfigSecretId	Secret store ID holding the Grafana configuration.	grafana-admin-config	No
namespace	Kubernetes namespace the system is deployed into.	prometheus	Yes

Example (fully parameterized):

{
  "type": "Observability.CaaS.Prometheus",
  "parameters": {
    "grafanaConfigSecretId": "grafana-admin-config",
    "namespace": "prometheus"
  }
}

Observability.SaaS.Elastic

External Elastic Cloud (hosted Elasticsearch) with custom URI configuration.

Parameter	Description	Example / possible values	Required
kibanaUri	URL of the hosted Kibana instance.	https://my-deployment.kb.westeurope.azure.elastic-cloud.com	Yes
version	Elastic Stack version.	8.10.0	Yes
operatorVersion	ECK operator version used to integrate.	2.9.0	Yes

Example (fully parameterized):

{
  "type": "Observability.SaaS.Elastic",
  "parameters": {
    "kibanaUri": "https://my-deployment.kb.westeurope.azure.elastic-cloud.com",
    "version": "8.10.0",
    "operatorVersion": "2.9.0"
  }
}

Observability.SaaS.Jaeger

External Jaeger instance with custom frontend URI.

Parameter	Description	Example / possible values	Required
frontendUri	URL of the Jaeger UI.	https://jaeger.example.com	Yes
version	Jaeger version.	1.57.0	Yes

Example (fully parameterized):

{
  "type": "Observability.SaaS.Jaeger",
  "parameters": {
    "frontendUri": "https://jaeger.example.com",
    "version": "1.57.0"
  }
}

Observability.SaaS.Prometheus

External Prometheus service with API gateway and authentication.

Parameter	Description	Example / possible values	Required
apiGatewayUrl	URL of the Prometheus-compatible API gateway.	https://prometheus.example.com/api	Yes
grafanaConfigSecretId	Secret store ID holding the Grafana configuration.	grafana-admin-config	Yes

Example (fully parameterized):

{
  "type": "Observability.SaaS.Prometheus",
  "parameters": {
    "apiGatewayUrl": "https://prometheus.example.com/api",
    "grafanaConfigSecretId": "grafana-admin-config"
  }
}

Security

Security.CaaS.Ocelot

Ocelot API gateway deployed in Kubernetes for authentication and routing.

Parameter	Description	Example / possible values	Required
host	Public hostname the gateway serves.	api.example.com	Yes
corsOrigins	Allowed CORS origins.	["https://app.example.com"]	No
cookieMaxAgeSec	Auth cookie lifetime in seconds.	900	No
pathPrefix	Route path prefix handled by the gateway.	/*	No
roles	Roles required to access routes.	["admin", "user"]	No
namespace	Kubernetes namespace the gateway is deployed into.	ocelot	Yes

Example (fully parameterized):

{
  "type": "Security.CaaS.Ocelot",
  "parameters": {
    "host": "api.example.com",
    "corsOrigins": ["https://app.example.com"],
    "cookieMaxAgeSec": 900,
    "pathPrefix": "/*",
    "roles": ["admin", "user"],
    "namespace": "ocelot"
  }
}

Security.PaaS.AzureEntraExternalId

Microsoft Entra External ID (Azure AD B2C / CIAM) tenant — the Azure implementation of the Identity Provider component; the counterpart to Amazon Cognito. Provisions a CIAM tenant with configurable MFA and password guardrails. App clients are provisioned per inbound link (see below); a tenant with zero links is valid.

Parameter	Description	Example / possible values	Required
tenantName	Entra External ID tenant name.	contoso	Yes
resourceGroup	Resource group hosting the tenant.	my-identity-rg	Yes
region	Preserved for contract / back-compat — an Entra tenant is not an ARM-located resource, so this value is not consumed. Legacy alias: location.	europe	No
mfaConfiguration	Multi-factor authentication enforcement.	OFF (default), OPTIONAL, ON	No
passwordPolicy	Password guardrail object: { "minLength": <int> }.	{"minLength": 12}	No
sessionDuration	Session duration in seconds.	3600	No
userDirectoryName	Friendly directory name.	customers	No

Example (fully parameterized):

{
  "type": "Security.PaaS.AzureEntraExternalId",
  "parameters": {
    "tenantName": "contoso",
    "resourceGroup": "my-identity-rg",
    "mfaConfiguration": "OPTIONAL",
    "passwordPolicy": { "minLength": 12 },
    "sessionDuration": 3600,
    "userDirectoryName": "customers"
  }
}

App clients (provisioned per link). A Workload or gateway component links to this provider to become an OAuth client; each link provisions one app client shaped by clientType (web, spa, or machine), with redirectUris / logoutUris / scopes taken from the link settings. The guardrails above cap what any client may request. The tenant publishes oidcIssuerUrl, jwksUri, and each created clientId as output fields; the agent injects OIDC_ISSUER_URI, OIDC_CLIENT_ID, OIDC_JWKS_URI, OIDC_SCOPES, and — for confidential (web / machine) clients — OIDC_CLIENT_SECRET_REF into the linked consumer. The raw client secret is stored in Azure Key Vault and never placed in output fields.

Security.SaaS.Unmanaged

External security service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-security-secret	No
secretValue	Connection details / credentials for the external service.	https://vault.example.com;token=abc123	Yes

Example (fully parameterized):

{
  "type": "Security.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-security-secret",
    "secretValue": "https://vault.example.com;token=abc123"
  }
}

Storage

Storage.CaaS.CnpgCluster

CloudNativePG cluster — PostgreSQL deployed natively on Kubernetes.

Parameter	Description	Example / possible values	Required
instances	Number of PostgreSQL instances (primary + replicas).	3	No
postgresqlVersion	PostgreSQL version to run.	17.2	No
storageSize	Persistent storage per instance.	10Gi	No
storageClass	Kubernetes storage class backing the volumes.	managed-premium	No
cpuRequest	CPU requested per instance.	500m	No
cpuLimit	CPU limit per instance.	1	No
memoryRequest	Memory requested per instance.	512Mi	No
memoryLimit	Memory limit per instance.	1Gi	No
database	Name of the default application database.	app	No
databaseOwner	Owner role of the default database.	app	No
enableSuperuserAccess	Enable the PostgreSQL superuser.	false	No
namespace	Kubernetes namespace the cluster is deployed into.	cnpg	Yes

Example (fully parameterized):

{
  "type": "Storage.CaaS.CnpgCluster",
  "parameters": {
    "instances": 3,
    "postgresqlVersion": "17.2",
    "storageSize": "10Gi",
    "storageClass": "managed-premium",
    "cpuRequest": "500m",
    "cpuLimit": "1",
    "memoryRequest": "512Mi",
    "memoryLimit": "1Gi",
    "database": "app",
    "databaseOwner": "app",
    "enableSuperuserAccess": false,
    "namespace": "cnpg"
  }
}

Storage.CaaS.CnpgDatabase

Database in a CloudNativePG cluster.

Parameter	Description	Example / possible values	Required
databaseName	Name of the database.	app	No
databaseOwner	Owner role of the database.	app	No
encoding	Character encoding.	UTF8	No
localeCollate	LC_COLLATE locale.	en_US.UTF-8	No
localeCType	LC_CTYPE locale.	en_US.UTF-8	No
cnpgClusterName	Name of the CloudNativePG cluster hosting the database.	postgres-cluster	Yes
namespace	Kubernetes namespace of the cluster.	cnpg	Yes

Example (fully parameterized):

{
  "type": "Storage.CaaS.CnpgDatabase",
  "parameters": {
    "databaseName": "app",
    "databaseOwner": "app",
    "encoding": "UTF8",
    "localeCollate": "en_US.UTF-8",
    "localeCType": "en_US.UTF-8",
    "cnpgClusterName": "postgres-cluster",
    "namespace": "cnpg"
  }
}

Storage.CaaS.Elastic

Elastic Stack (Elasticsearch + Kibana) deployed on Kubernetes.

Parameter	Description	Example / possible values	Required
elasticVersion	Elasticsearch version to deploy.	8.10.0	Yes
elasticInstances	Number of Elasticsearch nodes.	3	Yes
storage	Persistent storage per node.	100Gi	Yes
storageClassName	Kubernetes storage class backing the volumes.	managed-premium	No
memory	Memory (GB) per node.	8	No
cpu	CPU cores per node.	8	No
isApmRequired	Deploy the APM server.	false	No
isKibanaRequired	Deploy Kibana.	true	No
secrets	Secret references injected into the stack.	{"elastic-credentials": "elasticsearch-es-elastic-user"}	No
namespace	Kubernetes namespace the stack is deployed into.	elastic	Yes

Example (fully parameterized):

{
  "type": "Storage.CaaS.Elastic",
  "parameters": {
    "elasticVersion": "8.10.0",
    "elasticInstances": 3,
    "storage": "100Gi",
    "storageClassName": "managed-premium",
    "memory": 8,
    "cpu": 8,
    "isApmRequired": false,
    "isKibanaRequired": true,
    "secrets": {"elastic-credentials": "elasticsearch-es-elastic-user"},
    "namespace": "elastic"
  }
}

Storage.CaaS.MinioTenant

MinIO S3-compatible object storage cluster deployed on Kubernetes.

Parameter	Description	Example / possible values	Required
minioVersion	MinIO server release tag to deploy.	RELEASE.2025-03-12T18-04-18Z	No
servers	Number of MinIO server pods in the tenant.	4	No
volumesPerServer	Persistent volumes attached to each server.	4	No
volumeSize	Capacity of each persistent volume.	100Gi	No
storageClass	Kubernetes storage class backing the volumes.	managed-premium	No
cpuRequest	CPU requested per server pod.	500m	No
cpuLimit	CPU limit per server pod.	2	No
memoryRequest	Memory requested per server pod.	1Gi	No
memoryLimit	Memory limit per server pod.	4Gi	No
requestAutoCert	Enable MinIO's automatic TLS certificate generation.	true	No
namespace	Kubernetes namespace the tenant is deployed into.	minio	Yes

Example (fully parameterized):

{
  "type": "Storage.CaaS.MinioTenant",
  "parameters": {
    "minioVersion": "RELEASE.2025-03-12T18-04-18Z",
    "servers": 4,
    "volumesPerServer": 4,
    "volumeSize": "100Gi",
    "storageClass": "managed-premium",
    "cpuRequest": "500m",
    "cpuLimit": "2",
    "memoryRequest": "1Gi",
    "memoryLimit": "4Gi",
    "requestAutoCert": true,
    "namespace": "minio"
  }
}

Storage.PaaS.CosmosDbAccount

Azure Cosmos DB account providing multi-model database service.

Parameter	Description	Example / possible values	Required
maxTotalThroughput	Cap on total account throughput (-1 for unlimited).	-1	No
publicNetworkAccess	Public network access state.	Disabled, Enabled	No
backupPolicy	Backup mode and retention configuration.	{"type": "Periodic", "periodicModeProperties": {"backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8}}	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbAccount",
  "parameters": {
    "maxTotalThroughput": -1,
    "publicNetworkAccess": "Disabled",
    "backupPolicy": {"type": "Periodic", "periodicModeProperties": {"backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8}}
  }
}

Storage.PaaS.CosmosDbCassandra

Cassandra API database in Azure Cosmos DB.

Parameter	Description	Example / possible values	Required
cassandraVersion	Cassandra protocol version.	3.11	No
useCassandraAuthentication	Enable Cassandra native authentication.	true	No
isDeallocated	Whether the cluster is deallocated (stopped).	false	No
delegatedManagementSubnetId	Subnet ID delegated to the managed instance.	/subscriptions/.../subnets/cassandra-subnet	No
isCassandraAuditLoggingEnabled	Enable audit logging.	true	No
hoursBetweenBackups	Interval between automatic backups.	24	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbCassandra",
  "parameters": {
    "cassandraVersion": "3.11",
    "useCassandraAuthentication": true,
    "isDeallocated": false,
    "delegatedManagementSubnetId": "/subscriptions/00000000-0000-0000-0000-000000000000/subnets/cassandra-subnet",
    "isCassandraAuditLoggingEnabled": true,
    "hoursBetweenBackups": 24
  }
}

Storage.PaaS.CosmosDbGremlinDatabase

Gremlin graph database in Azure Cosmos DB.

Parameter	Description	Example / possible values	Required
throughput	Provisioned throughput in RU/s (-1 for autoscale).	-1	No
maxThroughput	Maximum autoscale throughput in RU/s.	2000	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbGremlinDatabase",
  "parameters": {
    "throughput": -1,
    "maxThroughput": 2000
  }
}

Storage.PaaS.CosmosDbMongoDatabase

MongoDB API database in Azure Cosmos DB.

Parameter	Description	Example / possible values	Required
throughput	Provisioned throughput in RU/s (-1 for autoscale).	-1	No
maxThroughput	Maximum autoscale throughput in RU/s.	2000	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbMongoDatabase",
  "parameters": {
    "throughput": -1,
    "maxThroughput": 2000
  }
}

Storage.PaaS.CosmosDbPostgreSqlDatabase

PostgreSQL database in Azure Cosmos DB.

Parameter	Description	Example / possible values	Required
azureRegion	Azure region for the database.	westeurope	No
storageAutoGrow	Automatically grow storage as needed.	Enabled, Disabled	No
highAvailabilityMode	High availability mode.	Disabled, ZoneRedundant	No
replicationRole	Server replication role.	Primary, Replica	No
version	PostgreSQL major version.	18	No
isPrivate	Deploy with private networking.	true	No
firewallRules	Allowed firewall IP ranges.	[{"name": "office", "startIpAddress": "203.0.113.0", "endIpAddress": "203.0.113.255"}]	No
rootUser	Administrator username.	fractal	No
skuName	Compute SKU.	Standard_D4ds_v5	No
storageGb	Storage size in GB.	128	No
coordinatorStorageGb	Coordinator node storage in GB.	128	No
workerStorageGb	Worker node storage in GB.	128	No
backupRetentionDays	Backup retention in days.	10	No
coordinatorCores	Coordinator node vCores.	2	No
workersCores	Worker node vCores.	4	No
nodeCount	Number of worker nodes (0 = single node).	0	No
coordinatorServerEdition	Coordinator compute tier.	GeneralPurpose	No
nodeServerEdition	Worker compute tier.	MemoryOptimized	No
subnetAddressCidr	Delegated subnet CIDR.	10.1.1.0/27	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbPostgreSqlDatabase",
  "parameters": {
    "azureRegion": "westeurope",
    "storageAutoGrow": "Enabled",
    "highAvailabilityMode": "Disabled",
    "replicationRole": "Primary",
    "version": "18",
    "isPrivate": true,
    "firewallRules": [{"name": "office", "startIpAddress": "203.0.113.0", "endIpAddress": "203.0.113.255"}],
    "rootUser": "fractal",
    "skuName": "Standard_D4ds_v5",
    "storageGb": 128,
    "coordinatorStorageGb": 128,
    "workerStorageGb": 128,
    "backupRetentionDays": 10,
    "coordinatorCores": 2,
    "workersCores": 4,
    "nodeCount": 0,
    "coordinatorServerEdition": "GeneralPurpose",
    "nodeServerEdition": "MemoryOptimized",
    "subnetAddressCidr": "10.1.1.0/27"
  }
}

Storage.PaaS.CosmosDbPostgresSqlCluster

PostgreSQL cluster in Azure Cosmos DB with distributed compute.

Parameter	Description	Example / possible values	Required
azureRegion	Azure region for the cluster.	westeurope	No
storageAutoGrow	Automatically grow storage as needed.	Enabled, Disabled	No
highAvailabilityMode	High availability mode.	Disabled, ZoneRedundant	No
replicationRole	Server replication role.	Primary, Replica	No
version	PostgreSQL major version.	18	No
isPrivate	Deploy with private networking.	true	No
firewallRules	Allowed firewall IP ranges.	[{"name": "office", "startIpAddress": "203.0.113.0", "endIpAddress": "203.0.113.255"}]	No
rootUser	Administrator username.	fractal	No
skuName	Compute SKU.	Standard_D4ds_v5	No
storageGb	Storage size in GB.	128	No
coordinatorStorageGb	Coordinator node storage in GB.	128	No
workerStorageGb	Worker node storage in GB.	128	No
backupRetentionDays	Backup retention in days.	10	No
coordinatorCores	Coordinator node vCores.	2	No
workersCores	Worker node vCores.	4	No
nodeCount	Number of worker nodes (0 = single node).	0	No
coordinatorServerEdition	Coordinator compute tier.	GeneralPurpose	No
nodeServerEdition	Worker compute tier.	MemoryOptimized	No
subnetAddressCidr	Delegated subnet CIDR.	10.1.1.0/27	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbPostgresSqlCluster",
  "parameters": {
    "azureRegion": "westeurope",
    "storageAutoGrow": "Enabled",
    "highAvailabilityMode": "Disabled",
    "replicationRole": "Primary",
    "version": "18",
    "isPrivate": true,
    "firewallRules": [{"name": "office", "startIpAddress": "203.0.113.0", "endIpAddress": "203.0.113.255"}],
    "rootUser": "fractal",
    "skuName": "Standard_D4ds_v5",
    "storageGb": 128,
    "coordinatorStorageGb": 128,
    "workerStorageGb": 128,
    "backupRetentionDays": 10,
    "coordinatorCores": 2,
    "workersCores": 4,
    "nodeCount": 0,
    "coordinatorServerEdition": "GeneralPurpose",
    "nodeServerEdition": "MemoryOptimized",
    "subnetAddressCidr": "10.1.1.0/27"
  }
}

Storage.PaaS.CosmosDbSqlDatabase

SQL API database in Azure Cosmos DB.

Parameter	Description	Example / possible values	Required
throughput	Provisioned throughput in RU/s (-1 for autoscale).	-1	No
maxThroughput	Maximum autoscale throughput in RU/s.	2000	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbSqlDatabase",
  "parameters": {
    "throughput": -1,
    "maxThroughput": 2000
  }
}

Storage.PaaS.CosmosDbTable

Table API database in Azure Cosmos DB.

Parameter	Description	Example / possible values	Required
throughput	Provisioned throughput in RU/s (-1 for autoscale).	-1	No
maxThroughput	Maximum autoscale throughput in RU/s.	2000	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.CosmosDbTable",
  "parameters": {
    "throughput": -1,
    "maxThroughput": 2000
  }
}

Storage.PaaS.FileShare

File share within Azure Storage Account for SMB/NFS access.

Parameter	Description	Example / possible values	Required
accessTier	Performance tier of the share.	TransactionOptimized, Hot, Cool, Premium	No
enabledProtocols	File-sharing protocol.	SMB, NFS	No
metadata	Custom metadata key/values.	{"env": "prod"}	No
rootSquash	NFS root squash mode.	NoRootSquash, RootSquash, AllSquash	No
shareQuota	Share quota in GB.	5120	No
signedIdentifiers	Stored access policies.	[{"id": "policy1", "accessPolicy": {"permission": "rwd"}}]	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.FileShare",
  "parameters": {
    "accessTier": "TransactionOptimized",
    "enabledProtocols": "SMB",
    "metadata": {"env": "prod"},
    "rootSquash": "NoRootSquash",
    "shareQuota": 5120,
    "signedIdentifiers": [{"id": "policy1", "accessPolicy": {"permission": "rwd"}}]
  }
}

Storage.PaaS.FileStorage

Premium file storage in Azure.

Parameter	Description	Example / possible values	Required
accessTier	Performance tier of the share.	TransactionOptimized, Hot, Cool, Premium	No
enabledProtocols	File-sharing protocol.	SMB, NFS	No
metadata	Custom metadata key/values.	{"env": "prod"}	No
rootSquash	NFS root squash mode.	NoRootSquash, RootSquash, AllSquash	No
shareQuota	Share quota in GB.	5120	No
signedIdentifiers	Stored access policies.	[{"id": "policy1", "accessPolicy": {"permission": "rwd"}}]	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.FileStorage",
  "parameters": {
    "accessTier": "TransactionOptimized",
    "enabledProtocols": "SMB",
    "metadata": {"env": "prod"},
    "rootSquash": "NoRootSquash",
    "shareQuota": 5120,
    "signedIdentifiers": [{"id": "policy1", "accessPolicy": {"permission": "rwd"}}]
  }
}

Storage.PaaS.PostgreSqlDatabase

Database in an Azure PostgreSQL server.

Parameter	Description	Example / possible values	Required
charset	Character set of the database.	UTF8	No
collation	Collation of the database.	en_US.utf8	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.PostgreSqlDatabase",
  "parameters": {
    "charset": "UTF8",
    "collation": "en_US.utf8"
  }
}

Storage.PaaS.PostgreSqlDbms

Azure Database for PostgreSQL server.

Parameter	Description	Example / possible values	Required
azureRegion	Azure region for the server.	westeurope	No
storageAutoGrow	Automatically grow storage as needed.	Enabled, Disabled	No
highAvailabilityMode	High availability mode.	Disabled, ZoneRedundant	No
replicationRole	Server replication role.	Primary, Replica	No
version	PostgreSQL major version.	18	No
isPrivate	Deploy with private networking.	true	No
firewallRules	Allowed firewall IP ranges.	[{"name": "office", "startIpAddress": "203.0.113.0", "endIpAddress": "203.0.113.255"}]	No
rootUser	Administrator username.	fractal	No
skuName	Compute SKU.	Standard_D4ds_v5	No
storageGb	Storage size in GB.	128	No
coordinatorStorageGb	Coordinator node storage in GB.	128	No
workerStorageGb	Worker node storage in GB.	128	No
backupRetentionDays	Backup retention in days.	10	No
coordinatorCores	Coordinator node vCores.	2	No
workersCores	Worker node vCores.	4	No
nodeCount	Number of worker nodes (0 = single node).	0	No
coordinatorServerEdition	Coordinator compute tier.	GeneralPurpose	No
nodeServerEdition	Worker compute tier.	MemoryOptimized	No
subnetAddressCidr	Delegated subnet CIDR.	10.1.1.0/27	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.PostgreSqlDbms",
  "parameters": {
    "azureRegion": "westeurope",
    "storageAutoGrow": "Enabled",
    "highAvailabilityMode": "Disabled",
    "replicationRole": "Primary",
    "version": "18",
    "isPrivate": true,
    "firewallRules": [{"name": "office", "startIpAddress": "203.0.113.0", "endIpAddress": "203.0.113.255"}],
    "rootUser": "fractal",
    "skuName": "Standard_D4ds_v5",
    "storageGb": 128,
    "coordinatorStorageGb": 128,
    "workerStorageGb": 128,
    "backupRetentionDays": 10,
    "coordinatorCores": 2,
    "workersCores": 4,
    "nodeCount": 0,
    "coordinatorServerEdition": "GeneralPurpose",
    "nodeServerEdition": "MemoryOptimized",
    "subnetAddressCidr": "10.1.1.0/27"
  }
}

Storage.PaaS.StorageAccount

Azure Storage Account for blobs, files, queues, and tables.

Parameter	Description	Example / possible values	Required
kind	Storage account kind.	StorageV2, BlobStorage, FileStorage	No
azureRegion	Azure region the account is created in.	westeurope	No
sku	Replication/performance SKU.	Standard_LRS, Standard_GRS, Premium_LRS	No
extendedLocation	Edge zone / extended location placement.	{"name": "losangeles", "type": "EdgeZone"}	No
identity	Managed identity assigned to the account.	{"type": "SystemAssigned"}	No
accessTier	Default blob access tier.	Hot, Cool	No
allowBlobPublicAccess	Allow anonymous public access to blobs.	false	No
allowCrossTenantReplication	Allow object replication across tenants.	false	No
allowSharedKeyAccess	Allow access via storage account keys.	true	No
allowedCopyScope	Restrict copy operations scope.	AAD, PrivateLink	No
azureFilesIdentityBasedAuthentication	Identity-based auth settings for Azure Files.	{"directoryServiceOptions": "AADDS"}	No
customDomain	Custom domain assigned to the account.	{"name": "storage.example.com"}	No
defaultToOAuthAuthentication	Default to Azure AD auth in the portal.	false	No
dnsEndpointType	DNS endpoint type.	Standard, AzureDnsZone	No
encryption	Encryption configuration.	{"keySource": "Microsoft.Storage"}	No
immutableStorageWithVersioning	Account-level immutability with versioning.	{"enabled": true}	No
isHnsEnabled	Enable hierarchical namespace (Data Lake Gen2).	true	No
isLocalUserEnabled	Enable local users for SFTP/NFS.	true	No
isNfsV3Enabled	Enable NFS v3 protocol.	true	No
isSftpEnabled	Enable SFTP access.	true	No
keyPolicy	Account key expiration policy.	{"keyExpirationPeriodInDays": 90}	No
largeFileSharesState	Enable large file shares.	Enabled, Disabled	No
minimumTlsVersion	Minimum TLS version accepted.	TLS1_2	No
networkRuleSet	Network access rules.	{"defaultAction": "Deny"}	No
publicNetworkAccess	Public network access state.	Enabled, Disabled	No
routingPreference	Network routing preference.	{"routingChoice": "MicrosoftRouting"}	No
sasPolicy	SAS token expiration policy.	{"sasExpirationPeriod": "1.00:00:00"}	No
supportsHttpsTrafficOnly	Require HTTPS for all traffic.	true	No
fileService	File service properties.	{"shareDeleteRetentionDays": 7}	No
backup	Backup configuration.	{"enabled": true, "retentionDays": 30}	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.StorageAccount",
  "parameters": {
    "kind": "StorageV2",
    "azureRegion": "westeurope",
    "sku": "Standard_LRS",
    "extendedLocation": {"name": "losangeles", "type": "EdgeZone"},
    "identity": {"type": "SystemAssigned"},
    "accessTier": "Hot",
    "allowBlobPublicAccess": false,
    "allowCrossTenantReplication": false,
    "allowSharedKeyAccess": true,
    "allowedCopyScope": "AAD",
    "azureFilesIdentityBasedAuthentication": {"directoryServiceOptions": "AADDS"},
    "customDomain": {"name": "storage.example.com"},
    "defaultToOAuthAuthentication": false,
    "dnsEndpointType": "Standard",
    "encryption": {"keySource": "Microsoft.Storage"},
    "immutableStorageWithVersioning": {"enabled": true},
    "isHnsEnabled": true,
    "isLocalUserEnabled": true,
    "isNfsV3Enabled": true,
    "isSftpEnabled": true,
    "keyPolicy": {"keyExpirationPeriodInDays": 90},
    "largeFileSharesState": "Enabled",
    "minimumTlsVersion": "TLS1_2",
    "networkRuleSet": {"defaultAction": "Deny"},
    "publicNetworkAccess": "Enabled",
    "routingPreference": {"routingChoice": "MicrosoftRouting"},
    "sasPolicy": {"sasExpirationPeriod": "1.00:00:00"},
    "supportsHttpsTrafficOnly": true,
    "fileService": {"shareDeleteRetentionDays": 7},
    "backup": {"enabled": true, "retentionDays": 30}
  }
}

Storage.PaaS.StorageBlobContainer

Blob container within Azure Storage Account.

Parameter	Description	Example / possible values	Required
defaultEncryptionScope	Default encryption scope for blobs.	$account-encryption-key	No
denyEncryptionScopeOverride	Prevent overriding the default encryption scope.	false	No
enableNfsV3AllSquash	Enable NFS v3 all-squash mapping.	true	No
enableNfsV3RootSquash	Enable NFS v3 root-squash mapping.	true	No
immutableStorageWithVersioning	Container-level immutability with versioning.	{"enabled": true}	No
metadata	Custom metadata key/values.	{"env": "prod"}	No
publicAccess	Anonymous public access level.	None, Blob, Container	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.StorageBlobContainer",
  "parameters": {
    "defaultEncryptionScope": "$account-encryption-key",
    "denyEncryptionScopeOverride": false,
    "enableNfsV3AllSquash": true,
    "enableNfsV3RootSquash": true,
    "immutableStorageWithVersioning": {"enabled": true},
    "metadata": {"env": "prod"},
    "publicAccess": "None"
  }
}

Storage.SaaS.Unmanaged

External storage service with custom configuration supplied via secret.

Parameter	Description	Example / possible values	Required
secretName	Secret store name holding the external service configuration.	external-storage-secret	No
secretValue	Connection details / credentials for the external service.	https://storage.example.com;key=abc123	Yes

Example (fully parameterized):

{
  "type": "Storage.SaaS.Unmanaged",
  "parameters": {
    "secretName": "external-storage-secret",
    "secretValue": "https://storage.example.com;key=abc123"
  }
}