Azure Deployment Specifications
High-level Azure Deployment Networking Diagram
This diagram shows the overall wallet network topology of the Institutional Vault deployment:
Azure Region
VNet 10.1.0.0/16
DB Subnet 10.1.0.0/24
AKS Subnet 10.1.8.0/21
AKS Cluster 10.2.0.0/16
Internet
Azure DNS Zone
AKS Ingress / Load Balancer
Wallet Pods
PostgreSQL Flexible Server
Network and Firewall Ports
The table below summarizes the minimum network and firewall rules required for the Institutional Vault AKS deployment.
| Source | Destination | Protocol / Port(s) | Purpose / Notes |
|---|---|---|---|
| External users / administrators (External Network) | ingress-nginx public IP (AKS Load Balancer) |
TCP 443 (HTTP 80 opt.) | Wallet UI / API, approval flows, and webhook endpoints. HTTP 80 is used only for HTTPS redirect. |
| Wallet pods, MPA policy-node pods (AKS subnet) | PostgreSQL Flexible Server (DB Subnet 10.1.0.0/24) |
TCP 5432 | Application database traffic from wallet services and MPA policy nodes to Azure PostgreSQL Flexible Server. |
| Wallet pods, MPA policy-node pods (internal) | NATS pods / services inside AKS | TCP 4222, 8222, 8443 | Internal message bus (NATS) used by wallet services and MPA policy nodes for orchestration messaging. |
| Wallet pods, MPA policy-node pods | Cluster DNS (kube-dns in kube-system namespace) |
UDP/TCP 53 | Pod DNS resolution inside the AKS cluster. |
| Wallet pods, MPA policy-node pods | Azure DNS / Azure public services (e.g. Key Vault, AAD/OIDC, ACR) | TCP 443 | Outbound HTTPS for identity, secrets, image pulls, and Azure control-plane APIs. MPA policy nodes use this for OIDC key discovery and optionally Azure Key Vault. |
| Wallet pods (application namespace) | External / internal blockchain node RPC endpoints | TCP 443, 8555–8556, 8546 | Node RPC connectivity for on-chain operations over HTTPS and WebSocket. |
| Wallet pods (application namespace) | Blockdaemon API (https://svc.blockdaemon.com) |
TCP 443 | Blockchain data, staking, token, pricing, balance and transaction queries via Blockdaemon. |
| Wallet pods (application namespace) | WalletConnect relay (wss://relay.walletconnect.com) |
TCP 443 (WSS) | WalletConnect v2 relay for dApp-to-wallet session and signing communication. |
| Wallet pods (application namespace) | WalletConnect Verify API (https://verify.walletconnect.org) |
TCP 443 | Domain verification and anti-phishing checks for WalletConnect dApp sessions. |
| Wallet pods (application namespace) | ApproverApp Expo push service (https://expo.host) |
TCP 443 | Outbound push notifications to mobile devices via Expo push notification service. |
| Wallet pods (application namespace) | Customer SMTP relay (configured host:port) (optional) |
TCP 587, 465, or as configured | Email notifications to approvers when SMTP relay is enabled. Required only when email notifications are configured. |
| Wallet pods (application namespace) | Chainalysis KYT API (https://api.chainalysis.com) (optional) |
TCP 443 | KYT compliance screening for withdrawal and deposit transactions. Required only when Chainalysis integration is enabled. |
| Wallet pods (application namespace) | Canton validator, scan API and DA Utilities (https://api.utilities.digitalasset.com) (optional) |
TCP 443, gRPC 443 | Canton ledger, validator and scan API access, plus Digital Asset utility services. Required only when Canton/Daml blockchain support is enabled. |
These ports should be reflected in any perimeter firewall, Azure NSG rules, and on-prem network controls used in the deployment.
Recommended Service and Infrastructure Sizing
The following tables summarize the recommended sizing derived from the Azure Terraform and Helm configuration.
Kubernetes Workload Sizing (per pod)
| Service Name | Resource Type | CPU (cores) | Memory (GB) |
|---|---|---|---|
| Wallet UI / API (includes approval and WalletConnect) | microservice container | 1 | 1 |
| MPA Policy-node | microservice container | 1 | 1 |
| EVM tracker (per chain) | microservice container | 0.5 | 0.5 |
| NATS message broker | microservice container | 0.5 | 1 |
Azure Infrastructure Sizing
| Component | Resource Type | CPU Cores | Memory (GB) | Azure Specification |
|---|---|---|---|---|
| AKS system node pool | Kubernetes worker node | 2 | 8 | Standard_D2s_v5, node_count = 1 (default). |
| AKS application node pool | Kubernetes worker node | 2 | 8 | Standard_D2s_v5, autoscaling 1–3 nodes. |
| AKS confidential node pool | Kubernetes worker node (CVM) | 4 | 16 | Standard_DC4s_v3, autoscaling 1–3 nodes. |
| Relational Database (per replica) | Database PaaS | 4 | 16 | Azure PostgreSQL Flexible Server, SKU GP_Standard_D4s_v3. |
| Key Vault | Secrets management | N/A | N/A | Azure Key Vault, SKU Standard. |
| Container Registry | Container registry | N/A | N/A | Azure Container Registry, SKU Standard. |
| Log Analytics Workspace + Storage | Monitoring and log retention | N/A | N/A | PerGB2018 workspace with export to a Standard LRS storage account. |