Skip to content

Installation & Operations Overview

VDA can be deployed across on-premise bare-metal servers, private virtual clouds (VMware vSphere / Nutanix), hyperscalers (Azure, AWS, GCP), or sovereign government clouds.

1. Supported Deployment Topologies

graph TD
    Deploy["VDA Deployment Modes"]
    Deploy --> Mode1["1. Standalone / Staging VM<br/>(Docker Compose)"]
    Deploy --> Mode2["2. Enterprise Production<br/>(Kubernetes / Red Hat OpenShift)"]
    Deploy --> Mode3["3. Air-Gapped Bastion<br/>(Disconnected On-Premise Cluster)"]
  1. Docker Compose (Staging & Proof of Concept): All services orchestrated within a unified virtual machine, ideal for testing, development, and air-gapped pilot demonstrations.
  2. Kubernetes & OpenShift (Production Enterprise): Cloud-native orchestrations using declarative manifests, providing auto-healing, rolling zero-downtime updates, ingress routing, and horizontal pod autoscaling.
  3. Air-Gapped Bastion Deployment: Dedicated offline installation procedure where all images and dependencies are imported via tarballs or internal private registries without external connectivity.

2. Infrastructure Prerequisites

Minimum System Specifications (Pilot / Staging)

  • CPU: 8 Cores (x86_64, AVX-512 recommended for GLiNER and vector embeddings)
  • Memory: 32 GB RAM
  • Storage: 250 GB NVMe / SSD disk space
  • Operating System: Ubuntu 22.04/24.04 LTS, Red Hat Enterprise Linux 8/9, or SUSE Linux Enterprise Server 15
  • Compute Worker Nodes: 3 to 5 Nodes (each with 16 vCPUs, 64 GB RAM)
  • Persistence Storage: High-speed CSI storage class (Ceph, Portworx, Azure Managed Disks, or AWS gp3) providing minimum 3,000 IOPS.
  • Network: 10 Gbps inter-node network with MTU 1500 or 9000 (Jumbo frames).
  • Ingress Controller: Nginx Ingress Controller or OpenShift Router with TLS certificate management (Cert-Manager or internal PKI).

3. Unified Port Allocation & Network Exposure Matrix

The table below outlines every platform service, standard port, protocol, resource sizing, and whether the service must be exposed via Ingress or kept strictly internal.

Component Default Port Protocol Exposure Level Sizing (Min) Sizing (Prod) Description
VDA Web UI 8080 (or 80/443) HTTP/HTTPS Public / Ingress 0.5 CPU, 512 MiB 2 CPU, 2 GiB React SPA & Nginx edge proxy
Keycloak SSO 8081 (or 8443) HTTP/HTTPS Public / Ingress 1 CPU, 1 GiB 2 CPU, 2 GiB OpenID Connect / SAML identity provider
VDA GraphQL API 4000 HTTP Internal (/api) 1 CPU, 2 GiB 2 CPU, 4 GiB Core catalog, schema & user management
Metadata Core API 8200 HTTP / SSE Internal (/api/v2) 2 CPU, 4 GiB 4 CPU, 8 GiB FastAPI engine, text-to-SQL & MCP server
Metadata Worker None Worker Private 2 CPU, 4 GiB 4 CPU, 8 GiB Temporal activity runner for GLiNER NER & profiling
PostgreSQL 5432 TCP (PG) Strictly Private 1 CPU, 2 GiB 4 CPU, 8 GiB Relational metadata & user persistence
SurrealDB 8000 HTTP / WS Strictly Private 1 CPU, 2 GiB 2 CPU, 4 GiB Multi-model graph engine for data lineage
Qdrant Vector DB 6333 / 6334 HTTP / gRPC Strictly Private 1 CPU, 2 GiB 2 CPU, 4 GiB HNSW vector store for semantic discovery
Temporal Server 7233 gRPC Strictly Private 1 CPU, 1 GiB 2 CPU, 2 GiB Distributed durable workflow engine
Temporal Web UI 8480 HTTP Admin VPN Only 0.25 CPU, 256 MiB 0.5 CPU, 512 MiB Workflow execution debugger & monitor
Ollama (Local LLM) 11434 HTTP Strictly Private 4 CPU, 8 GiB 8 CPU / 1 GPU, 16 GiB Air-gapped model inference (qwen2.5:7b)

Zero-Trust Network Perimeter

Never expose internal data stores (PostgreSQL, SurrealDB, Qdrant, Temporal gRPC, or Ollama) directly to the internet or outside the secure private subnet. Ingress must terminate exclusively at the VDA Web UI, the Keycloak SSO portal, and authenticated reverse-proxy routes.

4. Choose Your Installation Path

Path Best for Start here
Docker Compose Single-host installs, staging, proofs of concept, and air-gapped pilots Docker Compose Installation
Kubernetes / OpenShift Production multi-node enterprise clusters Kubernetes & OpenShift Installation

Both paths follow the same sequence:

  1. Install & Launch: prerequisites, configuration, and starting the platform.
  2. Verify the Installation: health checks and expected output.
  3. First-Time Setup: Keycloak realm, administrator, and roles.
  4. Connect a Datasource: your first source and ingestion pipeline.
  5. LLM & Model Setup: local air-gapped or cloud model tier.
  6. Air-Gapped Installation: only if the target has no internet access.
  7. Backup, Restore & Upgrades: ongoing operations.