Azure - Hilt Documentation

Hilt runs as a single-tenant platform inside your own Azure subscription. A managed AKS cluster hosts the platform workloads, ClickHouse runs on a dedicated Azure VM (or external ClickHouse Cloud), collectors on your hosts stream telemetry through a private Azure Private Link ingest endpoint into Event Hubs, and all traffic stays inside your subscription with no public internet exposure.

Services

Service	Role
AKS	Managed Kubernetes for platform services
Azure VM	Dedicated VM for ClickHouse analytics database (or external ClickHouse Cloud)
Event Hubs	Event streaming (Kafka-compatible)
Private Link	Private ingest endpoint
Blob Storage	Terraform remote state
Azure Database for PostgreSQL	Dashboard database
ingress-nginx + Kubernetes TLS secrets	TLS termination with private DNS A records

Network topology

Collectors connect via an Azure Private Link endpoint
Platform runs in a private VNet with no public ingress
Uses Managed Identity for Azure service authentication
Outbound internet access only where needed for image pulls (configurable to use private registries)

Provisioning

Hilt provisions your Azure deployment using Terraform. The typical process:

You provide a target Azure subscription with the agreed Azure RBAC / subscription permissions
Hilt applies the Terraform configuration to create all infrastructure (AKS, Azure VM, Event Hubs, Azure Database for PostgreSQL, Private Link, and networking)
Private Link connectivity is established between your workload VNets and the platform VNet
Collectors are deployed to your hosts using the Linux and macOS collector guides