<mxfile host="app.diagrams.net" modified="2026-07-15T23:55:00.000Z" agent="GitHub Copilot" version="24.7.17" type="device">
  <diagram id="tau-azure-resource-blueprint" name="Tau Azure resource blueprint">
    <mxGraphModel dx="1800" dy="1250" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1600" pageHeight="1100" math="0" shadow="0" libs="azure2 kubernetes">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />

        <mxCell id="title" value="Tau-enabled AKS cluster — Azure resources to provision" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=28;fontStyle=1;fontColor=#0F172A;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="980" height="42" as="geometry" />
        </mxCell>
        <mxCell id="subtitle" value="Core: resource group + VNet/subnet + AKS + AKS identities   |   Per workspace: identity + federation + scoped RBAC   |   Data: Storage, then optional Key Vault / ACR" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=13;fontColor=#475569;" vertex="1" parent="1">
          <mxGeometry x="40" y="62" width="980" height="28" as="geometry" />
        </mxCell>

        <mxCell id="legend-tenant" value="Tenant / directory object" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#F3E8FF;strokeColor=#9333EA;fontFamily=Helvetica;fontSize=10;fontColor=#581C87;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="980" y="28" width="130" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-required" value="Azure: required / shared" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#E8F0FE;strokeColor=#0078D4;fontFamily=Helvetica;fontSize=11;fontColor=#0F172A;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="1120" y="28" width="155" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-k8s" value="Kubernetes object" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#FFF7E6;strokeColor=#D97706;fontFamily=Helvetica;fontSize=11;fontColor=#78350F;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="1285" y="28" width="120" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-optional" value="Azure: conditional / optional" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#F8FAFC;strokeColor=#64748B;dashed=1;fontFamily=Helvetica;fontSize=10;fontColor=#334155;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="1415" y="28" width="130" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-tooling" value="Operator / tooling (not a resource)" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#FFFFFF;strokeColor=#64748B;fontFamily=Helvetica;fontSize=10;fontColor=#334155;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="980" y="64" width="165" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-trust" value="Identity / authorization" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#ECFDF5;strokeColor=#059669;fontFamily=Helvetica;fontSize=11;fontColor=#065F46;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="1155" y="64" width="145" height="30" as="geometry" />
        </mxCell>
        <mxCell id="legend-flow" value="→  Data or control flow" style="rounded=1;whiteSpace=wrap;html=1;arcSize=20;fillColor=#FFFFFF;strokeColor=#475569;fontFamily=Helvetica;fontSize=11;fontColor=#334155;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="1310" y="64" width="155" height="30" as="geometry" />
        </mxCell>

        <mxCell id="subscription" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=8;fillColor=#FFFFFF;strokeColor=#0078D4;strokeWidth=2;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="30" y="110" width="1540" height="955" as="geometry" />
        </mxCell>
        <mxCell id="subscription-label" value="Azure tenant / subscription" style="text;html=1;strokeColor=none;fillColor=#FFFFFF;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=13;fontStyle=1;fontColor=#0078D4;spacingRight=6;" vertex="1" parent="1">
          <mxGeometry x="55" y="100" width="210" height="24" as="geometry" />
        </mxCell>

        <mxCell id="identity-zone" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#F8FAFC;strokeColor=#CBD5E1;strokeWidth=2;" vertex="1" parent="1">
          <mxGeometry x="55" y="145" width="350" height="595" as="geometry" />
        </mxCell>
        <mxCell id="identity-title" value="1  Identity &amp; access" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=17;fontStyle=1;fontColor=#0F172A;" vertex="1" parent="1">
          <mxGeometry x="75" y="160" width="260" height="28" as="geometry" />
        </mxCell>
        <mxCell id="identity-note" value="Tenant objects and Azure ARM resources. Platform-created; TauWorkspace only references them." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=top;fontFamily=Helvetica;fontSize=11;fontColor=#64748B;whiteSpace=wrap;" vertex="1" parent="1">
          <mxGeometry x="75" y="190" width="305" height="36" as="geometry" />
        </mxCell>

        <mxCell id="entra" value="&lt;font color=&quot;#7E22CE&quot; style=&quot;font-size:10px&quot;&gt;&lt;b&gt;EXISTING TENANT OBJECT&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Microsoft Entra group&lt;/b&gt;&#xa;Researcher team object ID" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F3E8FF;strokeColor=#9333EA;strokeWidth=2;fontFamily=Helvetica;fontSize=12;fontColor=#581C87;align=left;verticalAlign=middle;spacing=10;spacingLeft=64;" vertex="1" parent="1">
          <mxGeometry x="80" y="235" width="300" height="78" as="geometry" />
        </mxCell>
        <mxCell id="operator" value="&lt;font color=&quot;#475569&quot; style=&quot;font-size:10px&quot;&gt;&lt;b&gt;OWNER / TOOLING — NOT A RESOURCE&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Platform operator + reviewed IaC&lt;/b&gt;&#xa;Creates Azure resources; approves policy" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#FFFFFF;strokeColor=#64748B;strokeWidth=2;fontFamily=Helvetica;fontSize=12;fontColor=#0F172A;align=left;verticalAlign=middle;spacing=10;" vertex="1" parent="1">
          <mxGeometry x="80" y="328" width="300" height="78" as="geometry" />
        </mxCell>
        <mxCell id="workspace-uami" value="&lt;font color=&quot;#047857&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;CONDITIONAL PER WORKSPACE · MANAGEDIDENTITY&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;User-assigned managed identity&lt;/b&gt;&#xa;One least-privilege principal per workspace" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#ECFDF5;strokeColor=#059669;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=12;fontColor=#065F46;align=left;verticalAlign=middle;spacing=10;spacingLeft=64;" vertex="1" parent="1">
          <mxGeometry x="80" y="421" width="300" height="84" as="geometry" />
        </mxCell>
        <mxCell id="fic" value="&lt;font color=&quot;#047857&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;IDENTITY SUBRESOURCE · federatedIdentityCredentials&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Federated identity credential&lt;/b&gt;&#xa;AKS OIDC issuer + workspace ServiceAccount subject" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#ECFDF5;strokeColor=#059669;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#065F46;align=left;verticalAlign=middle;spacing=10;" vertex="1" parent="1">
          <mxGeometry x="80" y="520" width="300" height="82" as="geometry" />
        </mxCell>
        <mxCell id="azure-rbac" value="&lt;font color=&quot;#047857&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;CONDITIONAL · MICROSOFT.AUTHORIZATION&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Scoped Azure role assignments&lt;/b&gt;&#xa;Exact target resource; e.g. Key Vault Secrets User" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#ECFDF5;strokeColor=#059669;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#065F46;align=left;verticalAlign=middle;spacing=10;" vertex="1" parent="1">
          <mxGeometry x="80" y="617" width="300" height="82" as="geometry" />
        </mxCell>

        <mxCell id="foundation-zone" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#F8FAFC;strokeColor=#CBD5E1;strokeWidth=2;" vertex="1" parent="1">
          <mxGeometry x="430" y="145" width="685" height="595" as="geometry" />
        </mxCell>
        <mxCell id="foundation-title" value="2  Required cluster foundation" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=17;fontStyle=1;fontColor=#0F172A;" vertex="1" parent="1">
          <mxGeometry x="450" y="160" width="330" height="28" as="geometry" />
        </mxCell>
        <mxCell id="foundation-note" value="Blue boxes are Azure resources provisioned by ARM / Bicep / Terraform. Orange boxes are installed into AKS later." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=top;fontFamily=Helvetica;fontSize=11;fontColor=#64748B;whiteSpace=wrap;" vertex="1" parent="1">
          <mxGeometry x="450" y="190" width="620" height="32" as="geometry" />
        </mxCell>

        <mxCell id="cluster-rg" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#FFFFFF;strokeColor=#0078D4;strokeWidth=2;" vertex="1" parent="1">
          <mxGeometry x="455" y="230" width="635" height="425" as="geometry" />
        </mxCell>
        <mxCell id="cluster-rg-label" value="REQUIRED AZURE RESOURCE · Resource group (Microsoft.Resources/resourceGroups)" style="text;html=1;strokeColor=none;fillColor=#FFFFFF;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=11;fontStyle=1;fontColor=#0078D4;" vertex="1" parent="1">
          <mxGeometry x="475" y="220" width="440" height="24" as="geometry" />
        </mxCell>

        <mxCell id="vnet" value="&lt;font color=&quot;#0078D4&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;REQUIRED · MICROSOFT.NETWORK&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Virtual network + AKS subnet&lt;/b&gt;&#xa;Node and routable pod networking" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#E8F0FE;strokeColor=#0078D4;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#0F172A;align=left;verticalAlign=middle;spacing=8;spacingLeft=60;" vertex="1" parent="1">
          <mxGeometry x="480" y="260" width="250" height="76" as="geometry" />
        </mxCell>
        <mxCell id="egress-ip" value="&lt;font color=&quot;#475569&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;CONDITIONAL · MICROSOFT.NETWORK (2 RESOURCES)&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;NAT Gateway + static Public IP&lt;/b&gt;&#xa;Attach NAT Gateway to the AKS subnet" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=58;" vertex="1" parent="1">
          <mxGeometry x="760" y="260" width="300" height="76" as="geometry" />
        </mxCell>

        <mxCell id="aks" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#F1F7FF;strokeColor=#0078D4;strokeWidth=3;" vertex="1" parent="1">
          <mxGeometry x="480" y="360" width="580" height="265" as="geometry" />
        </mxCell>
        <mxCell id="aks-title" value="&lt;font color=&quot;#0078D4&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;REQUIRED · MICROSOFT.CONTAINERSERVICE/managedClusters&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Azure Kubernetes Service (AKS)&lt;/b&gt;&#xa;&lt;font color=&quot;#475569&quot; style=&quot;font-size:10px&quot;&gt;OIDC + Workload Identity · MC_* node RG: VMSS, NICs, disks, LBs&lt;/font&gt;" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=14;fontColor=#0F172A;" vertex="1" parent="1">
          <mxGeometry x="555" y="368" width="350" height="64" as="geometry" />
        </mxCell>
        <mxCell id="control-plane-mi" value="&lt;b&gt;AKS control-plane identity&lt;/b&gt;&#xa;&lt;font style=&quot;font-size:9px&quot;&gt;AKS identity&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#ECFDF5;strokeColor=#059669;fontFamily=Helvetica;fontSize=10;fontColor=#065F46;align=left;verticalAlign=middle;spacing=6;spacingLeft=42;" vertex="1" parent="1">
          <mxGeometry x="905" y="375" width="135" height="48" as="geometry" />
        </mxCell>
        <mxCell id="system-pool" value="&lt;font color=&quot;#0078D4&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;AKS agentPool&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;System node pool&lt;/b&gt;&#xa;Platform services" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#E8F0FE;strokeColor=#0078D4;fontFamily=Helvetica;fontSize=11;fontColor=#0F172A;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="505" y="445" width="160" height="72" as="geometry" />
        </mxCell>
        <mxCell id="gpu-pool" value="&lt;font color=&quot;#0078D4&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;AKS agentPool&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;GPU node pool(s)&lt;/b&gt;&#xa;H100 / H200 / A100" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#E8F0FE;strokeColor=#0078D4;fontFamily=Helvetica;fontSize=11;fontColor=#0F172A;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="680" y="445" width="170" height="72" as="geometry" />
        </mxCell>
        <mxCell id="kubelet-mi" value="&lt;font style=&quot;font-size:9px&quot;&gt;&lt;b&gt;AKS-CREATED IDENTITY&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Kubelet identity&lt;/b&gt;&#xa;AcrPull for private ACR" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#ECFDF5;strokeColor=#059669;fontFamily=Helvetica;fontSize=10;fontColor=#065F46;align=left;verticalAlign=middle;spacing=6;spacingLeft=44;" vertex="1" parent="1">
          <mxGeometry x="865" y="445" width="170" height="72" as="geometry" />
        </mxCell>
        <mxCell id="tau-controller" value="TauWorkspace&#xa;controller" style="rounded=1;whiteSpace=wrap;html=1;arcSize=18;fillColor=#FFF7E6;strokeColor=#D97706;fontFamily=Helvetica;fontSize=11;fontColor=#78350F;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="505" y="545" width="130" height="55" as="geometry" />
        </mxCell>
        <mxCell id="kueue" value="Kueue +&#xa;ClusterQueue" style="rounded=1;whiteSpace=wrap;html=1;arcSize=18;fillColor=#FFF7E6;strokeColor=#D97706;fontFamily=Helvetica;fontSize=11;fontColor=#78350F;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="645" y="545" width="120" height="55" as="geometry" />
        </mxCell>
        <mxCell id="kuberay" value="KubeRay&#xa;operator" style="rounded=1;whiteSpace=wrap;html=1;arcSize=18;fillColor=#FFF7E6;strokeColor=#D97706;fontFamily=Helvetica;fontSize=11;fontColor=#78350F;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="775" y="545" width="110" height="55" as="geometry" />
        </mxCell>
        <mxCell id="workspace-ns" value="Workspace namespace&#xa;Group RBAC + LocalQueue&#xa;PVC + workload SA" style="rounded=1;whiteSpace=wrap;html=1;arcSize=18;fillColor=#FFF7E6;strokeColor=#D97706;fontFamily=Helvetica;fontSize=11;fontColor=#78350F;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="895" y="545" width="140" height="55" as="geometry" />
        </mxCell>

        <mxCell id="data-zone" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#F8FAFC;strokeColor=#CBD5E1;strokeWidth=2;" vertex="1" parent="1">
          <mxGeometry x="1140" y="145" width="400" height="595" as="geometry" />
        </mxCell>
        <mxCell id="data-title" value="3  Workspace data plane" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=17;fontStyle=1;fontColor=#0F172A;" vertex="1" parent="1">
          <mxGeometry x="1160" y="160" width="300" height="28" as="geometry" />
        </mxCell>
        <mxCell id="data-note" value="Azure services consumed by workspace pods. Storage backs /data; add other services only when needed." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=top;fontFamily=Helvetica;fontSize=11;fontColor=#64748B;whiteSpace=wrap;" vertex="1" parent="1">
          <mxGeometry x="1160" y="190" width="350" height="36" as="geometry" />
        </mxCell>

        <mxCell id="storage-account" value="&lt;font color=&quot;#0078D4&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;BLOB-BACKED /data · MICROSOFT.STORAGE/storageAccounts&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Azure Storage account&lt;/b&gt;&#xa;Blob: datasets, checkpoints, registry, artifacts" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#E8F0FE;strokeColor=#0078D4;strokeWidth=2;fontFamily=Helvetica;fontSize=12;fontColor=#0F172A;align=left;verticalAlign=middle;spacing=10;spacingLeft=68;" vertex="1" parent="1">
          <mxGeometry x="1165" y="240" width="350" height="90" as="geometry" />
        </mxCell>
        <mxCell id="key-vault" value="&lt;font color=&quot;#475569&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;OPTIONAL · MICROSOFT.KEYVAULT&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Azure Key Vault&lt;/b&gt;&#xa;Runtime secrets via CSI + workload identity" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=12;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=68;" vertex="1" parent="1">
          <mxGeometry x="1165" y="350" width="350" height="82" as="geometry" />
        </mxCell>
        <mxCell id="container-registry" value="&lt;font color=&quot;#475569&quot; style=&quot;font-size:9px&quot;&gt;&lt;b&gt;CONDITIONAL · MICROSOFT.CONTAINERREGISTRY&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Private Azure Container Registry&lt;/b&gt;&#xa;Use MCR when available; otherwise grant AcrPull" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=68;" vertex="1" parent="1">
          <mxGeometry x="1165" y="452" width="350" height="86" as="geometry" />
        </mxCell>
        <mxCell id="storageclass" value="Azure CSI StorageClass  →  blob-training PVC  →  /data" style="rounded=1;whiteSpace=wrap;html=1;arcSize=18;fillColor=#FFF7E6;strokeColor=#D97706;fontFamily=Helvetica;fontSize=11;fontColor=#78350F;align=center;verticalAlign=middle;spacing=6;" vertex="1" parent="1">
          <mxGeometry x="1165" y="560" width="350" height="48" as="geometry" />
        </mxCell>
        <mxCell id="data-guidance" value="&lt;b&gt;Provisioning boundary:&lt;/b&gt; TauWorkspace never creates Azure resources. It records the client ID and reconciles Kubernetes objects that consume platform-owned identity, storage, vault, and RBAC." style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#FFFFFF;strokeColor=#CBD5E1;fontFamily=Helvetica;fontSize=11;fontColor=#475569;align=left;verticalAlign=middle;spacing=10;" vertex="1" parent="1">
          <mxGeometry x="1165" y="625" width="350" height="82" as="geometry" />
        </mxCell>

        <mxCell id="optional-zone" value="" style="rounded=1;whiteSpace=wrap;html=1;arcSize=10;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="55" y="780" width="1485" height="245" as="geometry" />
        </mxCell>
        <mxCell id="optional-title" value="4  Optional production integrations" style="text;html=1;strokeColor=none;fillColor=#F8FAFC;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=17;fontStyle=1;fontColor=#334155;" vertex="1" parent="1">
          <mxGeometry x="75" y="768" width="360" height="28" as="geometry" />
        </mxCell>
        <mxCell id="optional-note" value="Add for fleet scale, compliance, private service discovery, or high-throughput training — not to make a basic Tau cluster function." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;fontFamily=Helvetica;fontSize=11;fontColor=#64748B;" vertex="1" parent="1">
          <mxGeometry x="455" y="792" width="900" height="24" as="geometry" />
        </mxCell>

        <mxCell id="eventhub" value="&lt;font style=&quot;font-size:9px&quot;&gt;&lt;b&gt;OPTIONAL · MICROSOFT.EVENTHUB&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Event Hubs&lt;/b&gt;&#xa;AKS audit stream" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=62;" vertex="1" parent="1">
          <mxGeometry x="85" y="825" width="230" height="90" as="geometry" />
        </mxCell>
        <mxCell id="adx" value="&lt;font style=&quot;font-size:9px&quot;&gt;&lt;b&gt;OPTIONAL · MICROSOFT.KUSTO&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Azure Data Explorer&lt;/b&gt;&#xa;Metrics · logs · audit · Stellar" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=10;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=62;" vertex="1" parent="1">
          <mxGeometry x="345" y="825" width="230" height="90" as="geometry" />
        </mxCell>
        <mxCell id="private-dns" value="&lt;font style=&quot;font-size:9px&quot;&gt;&lt;b&gt;OPTIONAL · MICROSOFT.NETWORK · PRIVATE DNS&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Private DNS zone&lt;/b&gt;&#xa;Ray dashboard records" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=10;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=62;" vertex="1" parent="1">
          <mxGeometry x="605" y="825" width="230" height="90" as="geometry" />
        </mxCell>
        <mxCell id="lustre" value="&lt;font style=&quot;font-size:9px&quot;&gt;&lt;b&gt;OPTIONAL · MICROSOFT.STORAGECACHE · AMLFS&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;Azure Managed Lustre&lt;/b&gt;&#xa;Hot RWX training tier" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=10;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=62;" vertex="1" parent="1">
          <mxGeometry x="865" y="825" width="230" height="90" as="geometry" />
        </mxCell>
        <mxCell id="multikueue" value="&lt;font style=&quot;font-size:9px&quot;&gt;&lt;b&gt;OPTIONAL · MICROSOFT.CONTAINERSERVICE&lt;/b&gt;&lt;/font&gt;&#xa;&lt;b&gt;MultiKueue manager AKS&lt;/b&gt;&#xa;Second CPU-only cluster dispatches to workers" style="rounded=1;whiteSpace=wrap;html=1;arcSize=12;fillColor=#F8FAFC;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#334155;align=left;verticalAlign=middle;spacing=8;spacingLeft=68;" vertex="1" parent="1">
          <mxGeometry x="1125" y="825" width="380" height="90" as="geometry" />
        </mxCell>
        <mxCell id="optional-footer" value="Production rule: treat every optional Azure service as an independently owned resource with explicit identity, network, retention, cost, and rollback decisions." style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;fontFamily=Helvetica;fontSize=11;fontColor=#64748B;fontStyle=2;" vertex="1" parent="1">
          <mxGeometry x="120" y="947" width="1360" height="34" as="geometry" />
        </mxCell>

        <!-- Compact service badges make Azure resource types scannable at wiki scale. -->
        <mxCell id="icon-entra" value="ID" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#9333EA;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="95" y="252" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-workspace-uami" value="MI" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#059669;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="95" y="442" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-vnet" value="VNet" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#0078D4;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="495" y="278" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-nat" value="NAT" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=10;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="775" y="278" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-aks" value="AKS" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#0078D4;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=10;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="500" y="378" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-control-plane-mi" value="MI" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#059669;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="914" y="384" width="28" height="28" as="geometry" />
        </mxCell>
        <mxCell id="icon-kubelet-mi" value="MI" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#059669;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="875" y="465" width="30" height="30" as="geometry" />
        </mxCell>
        <mxCell id="icon-storage" value="STG" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#0078D4;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=10;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="1180" y="262" width="46" height="46" as="geometry" />
        </mxCell>
        <mxCell id="icon-key-vault" value="KV" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=10;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="1180" y="369" width="44" height="44" as="geometry" />
        </mxCell>
        <mxCell id="icon-acr" value="ACR" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="1180" y="473" width="44" height="44" as="geometry" />
        </mxCell>
        <mxCell id="icon-eventhub" value="EH" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=10;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="100" y="848" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-adx" value="ADX" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="360" y="848" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-private-dns" value="DNS" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="620" y="848" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-lustre" value="AML" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="880" y="848" width="42" height="42" as="geometry" />
        </mxCell>
        <mxCell id="icon-multikueue-aks" value="AKS" style="rounded=1;arcSize=18;whiteSpace=wrap;html=1;pointerEvents=0;fillColor=#64748B;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=9;align=center;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="1145" y="848" width="42" height="42" as="geometry" />
        </mxCell>

        <mxCell id="edge-operator-core" value="provisions via IaC" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#0078D4;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#475569;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="operator" target="cluster-rg">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-operator-uami" value="creates" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#059669;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#065F46;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="operator" target="workspace-uami">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-fic-uami" value="contains OIDC trust" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#059669;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#065F46;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="workspace-uami" target="fic">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-uami-rbac" value="identity receives roles" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#059669;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#065F46;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="fic" target="azure-rbac">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-vnet-aks" value="node + pod network" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#0078D4;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#475569;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="vnet" target="aks">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-vnet-egress" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#475569;strokeWidth=2;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="vnet" target="egress-ip">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-kubelet-acr" value="AcrPull / image pull" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#475569;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#475569;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="kubelet-mi" target="container-registry">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-storageclass-storage" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#475569;strokeWidth=2;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="storageclass" target="storage-account">
          <mxGeometry relative="1" as="geometry">
            <Array as="points">
              <mxPoint x="1540" y="584" />
              <mxPoint x="1540" y="285" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="edge-workspace-storageclass" value="/data" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#475569;strokeWidth=2;fontFamily=Helvetica;fontSize=11;fontColor=#475569;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="workspace-ns" target="storageclass">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-eventhub-adx" value="audit ingestion" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;endArrow=block;endFill=1;strokeColor=#64748B;strokeWidth=2;dashed=1;fontFamily=Helvetica;fontSize=11;fontColor=#475569;labelBackgroundColor=#FFFFFF;" edge="1" parent="1" source="eventhub" target="adx">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
