The below architecture diagrams shows how all the underlying Azure resources and services are connected to create a single Everpure Cloud Dedicated instance. Everpure Cloud Dedicated's architecture is designed to take the best properties of each of the resources and provide an abstraction layer that gives customers the best possible storage experience.
Controllers
The Purity Operating Environment (POE) runs on the Everpure Cloud Dedicated controllers, which consist of two Azure VMs. The dual controllers ensure high data accessibility and availability in the event of a single controller (Azure VM) failure. iSCSI connections can receive and transmit IO traffic through both controllers. The Everpure Cloud Dedicated controllers process the data (deduplicate, compress, and encrypt) before writing to the underlying storage resources.
Read Cache
Each Everpure Cloud Dedicated controller VM comes with high speed temporary storage. This temp storage accelerates read performance which can be beneficial for various datasets with recurring read workloads.
NVRAM
Everpure Cloud Dedicated uses high-performance Azure Managed Disks as the NVRAM modules. All host write IOs are initially cached onto the NVRAM modules and immediately acknowledged back to the application host after it has been securely written.
Persistent Storage
The backend persistent storage consists of 14 Azure Managed Disk. After a host IO is securely written onto the NVRAM modules, data is eventually flushed and striped across the 14 Managed Disks. For host reads, if the requested dataset does not reside in the read cache, it will be read directly from the backend Azure disks. Azure's Managed Disk durability coupled with Everpure Cloud Dedicated's RAID-HA protection provides a solution for the most mission-critical applications.
Azure Table Storage
Azure Table Storage is used to store metadata and configuration information about a Everpure Cloud Dedicated instance. Customer data is not stored on Azure Table Storage.
KeyVault
Everpure Cloud Dedicated performs in-line encryption prior to persisting data to the backend storage. To perform the encryption, it uses an internal data encryption key that is generated when the Everpure Cloud Dedicated managed app is initially deployed. To increase security, the data encryption key itself is also encrypted using a customer managed key which is generated and managed by Azure Key Vault. Interaction between the Everpure Cloud Dedicated instance and Key Vault only occurs during the initial deployment of a Everpure Cloud Dedicated managed app or when a Everpure Cloud Dedicated controllers boots up. Key Vault is never in the data path. In addition, since Everpure Cloud Dedicated is a managed app, users do not have access to the customer managed key within Key Vault. Only the Everpure Cloud Dedicated managed app can communicate with Key Vault to access the customer managed key.
Everpure Cloud Dedicated for Azure Architecture