Managed Deployments
Learn how to view and manage the Kubernetes endpoint deployments that FoundationaLLM runs on Azure Kubernetes Service (AKS).
Overview
A managed deployment is a FoundationaLLM resource (FoundationaLLM.Platform/managedEndpointDeployments) that describes a container workload on an AKS cluster: the image, replicas, resources, environment variables, and optional external access through the Kubernetes Gateway API. The platform creates and updates the Kubernetes objects for you and reports the observed status back.
The Managed Deployments page ("View managed endpoint deployments for the FoundationaLLM instance.") also shows the Selected FoundationaLLM instance ID with a copy button.
Open the Managed Deployments Page
- Sign in to the Management Portal.
- In the sidebar, select Platform > Managed Deployments.
To copy the instance ID, select the copy button next to Selected FoundationaLLM instance.
Deployment List
The list loads 20 deployments at a time and loads more as you scroll ("Loading more managed deployments...").
| Column | Description |
|---|---|
| Checkbox | Selects the deployment for bulk actions |
| Name | Deployment name |
| Version | Tag of the container image |
| Status | Icon for Running, Deploying, Pending, or Failed; hover for the status message |
| Type | Kubernetes (regular) or Kubernetes (sandbox), with a filter |
| Namespace | Kubernetes namespace, with a filter |
| Replicas | Available replicas / requested replicas |
| Actions | View JSON definition, Edit (or View for standalone Pods), Clone, Delete |
- Use Search managed deployments to filter by name.
- Select the refresh button to reload the list.
- Edit and Delete require the
FoundationaLLM.Platform/managedEndpointDeployments/writeand/deletepermissions.
Bulk actions
Select one or more deployments to show the bulk actions bar:
- Update Container Version — enter a New version (tag only, for example
1.0.0-beta129). The dialog previews the old and new tag for each deployment. Available only when all selected deployments use the same container registry. - Restart — recreates the pods of each selected deployment without changing its configuration.
- Clear selection.
Standalone Pod deployments and deployments you cannot update cannot be selected.
Create a Managed Deployment
- Select Create Managed Deployment, or select Clone on an existing deployment to start from a copy.
- Complete the tabs described below.
- Select Create. Select Cancel to discard your changes.
General
| Field | Description |
|---|---|
| Display name | Friendly name. On a new deployment, the name is generated from it until you edit the name. |
| Name * | Must be a valid Kubernetes resource name (lowercase letters, digits, and dashes) |
| Description | Optional description |
Container
| Field | Description |
|---|---|
| Container image * | Full image reference, for example ghcr.io/org/service:1.0.0 |
| Replica count * | Number of pods (1 or more; must be 1 for a standalone Pod) |
| Restart strategy | Rolling Update (default) replaces pods gradually. Recreate stops all existing pods before starting new ones. |
| Container port | Port the container listens on. Leave empty or 0 to use port 80. |
| CPU / Memory | Kubernetes quantities (for example 500m, 1, 512Mi, 2Gi). The same value is used for request and limit. Leave blank for none. |
| AKS cluster resource ID * | Resource ID of a Microsoft.ContainerService/managedClusters resource |
| Namespace * | Kubernetes namespace, for example fllm |
| ACR pull secret | Optional Kubernetes docker-registry secret name |
| Managed identity client ID | Optional user-assigned managed identity client ID (GUID) |
| Node pool name | Optional AKS node pool used to schedule the pods |
| Deploy as a standalone Pod (replica count must be 1) | Creates a single Pod instead of a Deployment. Standalone Pods cannot be edited later. |
| Run in a sandboxed pod (Kata VM isolation) | Runs the workload in a Kata VM. These deployments show the type Kubernetes (sandbox). |
| Mount ephemeral /tmp storage | Adds an ephemeral /tmp volume |
| Read-only root filesystem | Makes the container root filesystem read-only |
Environment
Add environment variables with Add environment variable. Values can be static strings, config:// references, or secure-config:// references to App Configuration keys. Variable names must start with a letter, -, ., or _ and every variable needs a value.
External access
Select Require external IP address (via Kubernetes Gateway API) to expose the deployment. Additional options appear:
| Field | Description |
|---|---|
| Require private IP address on the gateway load balancer | Uses a private IP address instead of a public one |
| Gateway name / Gateway namespace | Default to the deployment name and namespace |
| Use managed DNS name | When on, enter a Managed DNS name (Azure DNS label). The gateway resolves to {label}.{region}.cloudapp.azure.com and listens on HTTP only. |
| TLS certificate secret names | When managed DNS is off. One Kubernetes TLS secret per line, optionally as namespace/secret-name. Every secret is attached to the gateway listener, and a ReferenceGrant is created for secrets in another namespace. |
| Hostnames | When managed DNS is off. One hostname per line. |
| Path prefix / Path rewrite prefix | Leave both empty to route all paths unchanged, or set both (each starting with /) to rewrite the path |
Edit a Managed Deployment
- Select the pencil icon for the deployment.
- The General tab shows the Observed status: status, message, available replicas, and cluster and external IP addresses and DNS names.
- Change the settings and select Save.
Use Access Control at the top of the editor to manage role assignments on the deployment.
Standalone Pod deployments open as View Managed Deployment in read-only mode. To change one, delete it and create a new deployment.
Delete a Managed Deployment
- Select the trash icon for the deployment.
- In the Delete Managed Deployment dialog, select Yes.
Troubleshooting
| Issue | Resolution |
|---|---|
| Status stays Pending or shows Failed | Hover over the status icon or open the editor to read the status message. Check the image reference, pull secret, and node pool. |
| Update Container Version is disabled | The selected deployments use different registries. Select deployments from one registry. |
| "AKS cluster resource ID must reference a Microsoft.ContainerService/managedClusters resource." | Paste the full AKS cluster resource ID. |
| "At least one TLS certificate secret name is required when external access is enabled." | Add a TLS secret, or turn on Use managed DNS name. |