Minimal architecture

A development architecture (minimal architecture) provides a validated design for development and testing environments. Minimal architecture uses separate servers for each component, which lets you test realistic configurations while minimizing infrastructure needs.

For production environments, use the high‑availability architecture. The minimal architecture doesn’t provide redundancy.

Before you begin

Understand the minimal architecture

The minimal architecture separates each component onto its own server:

A minimal (development) architecture is an Itential architecture where all components are installed as singletons and cannot gracefully tolerate failures. This architecture is not recommended for production environments and testing environments that require strict uptimes and redundancies. This architecture is suitable for development environments only.

Architecture overview

The Itential Platform application performs many reads and writes against the database and is sensitive to high latencies. All components must be installed in the same data center and have authentication enabled.

The minimum architecture is comprised of four virtual machines (VMs):

  • One Itential Platform server
  • One MongoDB server
  • One Redis server
  • One IAG server
Development architecture
Development architecture

Required user accounts

The validated designs are opinionated installations of Itential and its dependencies. The following user accounts are required by the dependencies.

MongoDB

AccountDescription
adminHas full root access to the mongo database. Can read and write to any logical database. Can be used to issue admin commands like forcing an election and configuring replica sets. This is NOT used by the Itential application but is created for admin purposes.
itentialHas read and write access to the "itential" database only. This is the account used by the Itential Platform application.
localaaaHas read and write access to the "LocalAAA" database. This is used by the Local AAA adapter for local, non-LDAP logins.

Redis

AccountDescription
adminHas full root access to the Redis database, all channels, all keys, all commands. This is NOT used by the Itential application but is created for admin purposes.
itentialHas full access to the Redis database, all channels, all keys, EXCEPT the following commands: asking, cluster, readonly, readwrite, bgrewriteaof, bgsave, failover, flushall, flushdb, psync, replconf, replicaof, save, shutdown, sync. This is the account used by the Itential Platform application.

Network requirements

In an environment where components are installed on more than one host, the following network traffic flows need to be allowed. All ports and networking specs are TCP protocol unless otherwise noted. Not all ports will need to be open for every supported architecture. Secure ports are only required when explicitly configured.

SourceDestinationPortDescription
Desktop DevicesItential Platform3000Web browser connections to Itential Platform over HTTP
Desktop DevicesItential Platform3443Web browser connections to Itential Platform over HTTPS
Desktop DevicesIAG8083Web browser connections to IAG over HTTP
Desktop DevicesIAG8443Web browser connections to IAG over HTTPS
Desktop DevicesHashiCorp Vault8200Web browser connections to HashiCorp Vault
Itential PlatformMongoDB27017Itential Platform connects to MongoDB
Itential PlatformRedis6379Itential Platform connects to Redis
Itential PlatformRedis26379Itential Platform connects to Redis Sentinel (HA installations only)
Itential PlatformIAG8083Itential Platform connects to IAG over HTTP
Itential PlatformIAG8443Itential Platform connects to IAG over HTTPS
Itential PlatformHashiCorp Vault8200Itential Platform connects to HashiCorp Vault
Itential PlatformLDAP389Itential Platform connects to LDAP (when LDAP adapter is used for authentication)
Itential PlatformLDAP636Itential Platform connects to LDAP with TLS (when LDAP adapter is used for authentication)
Itential PlatformRADIUS1812Itential Platform connects to RADIUS (when RADIUS adapter is used for authentication; uses UDP)
MongoDBMongoDB27017Each MongoDB talks to other MongoDBs for replication (HA installations only)
RedisRedis6379Each Redis talks to other Redis sources for replication (HA installations only)
RedisRedis26379Each Redis uses Redis Sentinel to monitor the Redis processes (HA installations only)

Hardware requirements

Processor

Processor specification requirements:

  • Second generation or better Intel Xeon Platinum 8000 series processors
  • Third generation or better AMD EPYC 7000 series processors

Memory

Memory specification requirement:

  • DDR5 DRAM 3200 MHz or higher

Storage

Storage performance requirements in IOPS (16 kiB):

  • 20000+ IOPS
  • Non-spinning media (SSD, NVMe)

Network

Network speed requirement:

  • 10 Gbps or higher

In some instances, adding additional dedicated interfaces that are focused on routing specific traffic to specific external systems can be explored. This routing of traffic would be configured at the OS-level (custom interfaces and routes) and requires the system administrator to manage it. An example would be separating NSO traffic from Redis/MongoDB destined traffic.

Hypervisor/host OS settings

These settings are strongly recommended for high load applications of Itential Platform:

  • CPU affinity settings or similar functionality to prevent CPU starvation
  • Full memory reservation
  • One physical CPU per VM is preferred
  • Huge pages for memory support enabled (except MongoDB)
  • Memory compression disabled
  • Minimal CPU allocation settings for scheduler according to CPU clock

Example: Assuming an Itential Platform VM on a server capable of 2.5GHz nominal speed:

CPU clock reservation = 16vCPU × 2.5GHz

Follow hypervisor recommendations when performing CPU reservations. In most cases the total of all CPU reservations for all VMs on a host cannot be more than 90% of the host capacity as 10% is reserved by the host itself.

MongoDB discourages the utilization of Transparent Huge Pages.

Server specifications

For production environments, all Itential Platform components should be installed on their own individual servers to properly support High Availability (HA). Disk references to pronghorn (seen in older deployments) should be changed to itential.

Itential Platform server

SpecRequirementDevelopment ENV
CPU64-bit x86 CPU cores16
OSRHEL
Rocky
8/9
8/9
RAMDDR5 DRAM 3200 MHz64 GB
Disk (Solid State Media, SSD, NVMe)Total
/var/log/itential
/opt/itential
/
250 GB
100 GB
100 GB
50 GB

MongoDB server

SpecRequirementDevelopment ENV
CPU64-bit x86 CPU cores16
OSRHEL
Rocky
8/9
8/9
RAMDDR5 DRAM 3200 MHz128 GB
Disk (Solid State Media, SSD, NVMe)Total
/var/log/mongodb
/var/lib/mongo
/
500 GB
50 GB
400 GB
50 GB

Redis server

SpecRequirementDevelopment ENV
CPU64-bit x86 CPU cores4
OSRHEL
Rocky
8/9
8/9
RAMDDR5 DRAM 3200 MHz16 GB
Disk (Solid State Media, SSD, NVMe)Total
/var/log/redis
/var/lib/redis
/
100 GB
10 GB
50 GB
40 GB

IAG server

SpecRequirementDevelopment ENV
CPU64-bit x86 CPU cores8
OSRHEL
Rocky
8/9
8/9
RAMDDR5 DRAM 3200 MHz16 GB
Disk (Solid State Media, SSD, NVMe)Total
/var/log/automation-gateway
/var/lib/automation-gateway
/opt/automation-gateway
/
80 GB
10 GB
50 GB
10 GB
10 GB