//Module included in the following assemblies:
// hosted_control_planes/hcp-deploy/hcp-deploy-azure.adoc

:_mod-docs-content-type: CONCEPT
[id="hcp-azure-overview_{context}"]
= Overview of {hcp} on {azure-short}

[role="_abstract"]
You can deploy and manage hosted clusters on an OpenShift management cluster that runs in {azure-first}. With a self-managed deployment model, you manage your own OpenShift cluster.

[id="hcp-azure-arch_{context}"]
== Architecture of {hcp} on {azure-short}

At a high level, the architecture of {hcp} on {azure-short} consists of three layers:

Management cluster:: An {azure-short} OpenShift cluster that hosts the HyperShift Operator and the control planes for your hosted clusters.
Control plane:: Kubernetes control-plane components that run as pods on the management cluster.
Data plane:: Compute nodes that run as {azure-short} virtual machines (VMs) in your {azure-short} subscription.

The architecture uses {azure-short} Workload Identity for secure, credential-free authentication between {product-title} components and {azure-short} services. As a result, you do not need to manage long-lived service principal credentials, and you get better security through federated identity credentials.

[id="hcp-azure-deployment-workflow_{context}"]
== Deployment workflow for {hcp} on {azure-short}

Deploying self-managed {hcp} on {azure-short} involves a three-phase process in the following order:

Phase 1: Set up {azure-short} Workload Identity:: This phase establishes secure authentication infrastructure so that {product-title} components can access {azure-short} services. During this phase, the security infrastructure that your hosted clusters require is created:
+
* Managed identities for each {product-title} component, including the image registry, ingress, CSI drivers, cloud provider, network operator, and so on
* OIDC issuer in {azure-short} Blob Storage for service account token validation
* Federated credentials that establish trust relationships between {azure-short} Entra ID and {product-title} service accounts

Phase 2: Set up the management cluster:: In this phase, you prepare your {product-title} management cluster on {azure-short} to host and manage hosted clusters. During this phase, you install the following components:
+
* {azure-short} DNS zones, for private and public-private topologies
* External DNS, for private and public-private topologies
* HyperShift Operator

Phase 3: Create hosted clusters:: In this phase, you create and configure hosted clusters. This phase involves the following steps:
+
.. Setting up infrastructure
.. Creating a hosted cluster
.. Integrating workload identity
.. Configuring private endpoint access (optional)
