Skip to content

Integration Platform — Deployment

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P6)

The June-2026 page is archived under catalogs 2026-06.

Runtime model

Concern Choice
Deployment units IntegrationHost (microservice template; modules connections and connectors) and WebhookGatewayService (API gateway template; conditional)
Hosting host on AKS, 2 to 8 replicas; ingress on Azure Container Apps, 1 to 8 replicas, scale-to-zero when no subscriptions exist
Data integration-sql (connections, grants, descriptors, subscriptions, deliveries, inbound records); artifact-blob for payloads and certification evidence; cache for the ingress deduplication window
Messaging MessagingModel outbox and inbox; Orleans profile
Identity workload identity; vendor credentials brokered per use; webhook signing secrets brokered per connector
Ingress GW-03 for Studio reads and administration; GW-06 public for webhooks only
Egress vendors under each connection's endpoint policy; Governance; Control plane; Knowledge; Artifact store

Topology by profile

flowchart LR
    subgraph CS["ConnectSoft cloud, tenant region"]
        IH["IntegrationHost"]
        WH["WebhookGatewayService (GW-06)"]
        SQL["('integration-sql')"]
    end
    Vendors["Vendors"] -- "signed webhooks" --> WH
    WH -- "verified deliveries" --> IH
    IH --> SQL
    IH -- "endpoint policies" --> Vendors
Hold "Alt" / "Option" to enable pan & zoom
Profile Placement
saas-default both in ConnectSoft's cloud in the tenant's region
hybrid host in ConnectSoft's cloud; connections to in-network systems through a private link; ingress public in ConnectSoft's cloud
on-prem host in the customer cluster; no ingress unless the customer exposes one; polling subscriptions instead
hybrid-compute as saas-default

Scaling

Signal Action
resolve latency above target add host replicas; cache grants per request
delivery backlog scale the dispatcher partitions per subscription
ingress rate Container Apps scales on HTTP concurrency; per-ingress rate limits protect downstream

Configuration and secrets

Options sections Integration:Host, Integration:Adapters, Integration:Connections, Integration:Connectors, Integration:Webhooks. Store and transport secrets in Key Vault through workload identity; connection credentials and signing secrets are references resolved by the Secret Broker.

Health and rollout

/integration/health and /webhooks/health; rolling updates drain in-flight deliveries; adapter upgrades re-run certification for affected connectors before activation.

NFR class and recovery

pilot-interactive (D30). integration-sql restores after the control store; deliveries in Dispatched after a restore are reconciled from receipts; the ingress deduplication cache is rebuilt from recent inbound records.