MPC deployment on Azure

This guide covers deploying customer MPC nodes (Node 2 and Node 3) to Microsoft Azure using the MPC Deployer tool.

The MPC Deployer automates the deployment of customer MPC nodes to Azure Confidential VMs, using AMD SEV-SNP based isolation for node execution and Azure Key Vault for node key material and deployment configuration.

Azure deployments require several resources to exist before you run the deployer:

Subscription and permissions:

• Azure subscription dedicated to Ripple MPC Nodes deployment.
• Permissions allowing the deployer tool to create resources in the Azure subscription.
• Confidential VM quota and supported VM SKUs in the selected Azure region.

Credentials:

Authenticate to Azure using the method approved by your organization. For service-principal based deployments, provide Azure credentials to the container using the environment variables expected by the deployer and the Terraform Azure provider, for example:

export ARM_SUBSCRIPTION_ID="<subscription-id>"
export ARM_TENANT_ID="<tenant-id>"
export ARM_CLIENT_ID="<service-principal-client-id>"
export ARM_CLIENT_SECRET="<service-principal-client-secret>"

• Docker: Docker Desktop or Docker Engine installed and running.
• MPC Deployer Image: Access to Ripple's Docker registry.

Before deployment, Ripple will provide:

The deployment follows a coordinated process between you and Ripple:

Before running the deployer, confirm that the following resources exist:

Create an .env file using the sample provided with your MPC Deployer package. For key generation, include your tenant details, Azure region, and the pre-provisioned Azure resource values.

At minimum, the key-generation configuration includes:

Generate cryptographic keys for your MPC nodes:

docker run --rm -it \
  --env-file .env \
  -e ARM_SUBSCRIPTION_ID \
  -e ARM_TENANT_ID \
  -e ARM_CLIENT_ID \
  -e ARM_CLIENT_SECRET \
  -v $(pwd)/output:/app/output \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --provider azure --keygen --output /app/output --non-interactive

The tool stores the private node keys and KEKs in Azure Key Vault. The output includes the public Peer IDs for Node 2 and Node 3:

Key material successfully generated and stored in Azure Key Vault.
Node 2 Public Key (Peer ID): 12D3KooWBhMevWJT...
Node 3 Public Key (Peer ID): 12D3KooWCdEfGhIj...

Ripple will configure their infrastructure and provide you with:

Add the following values to your .env file before deployment:

After Ripple provides the cluster configuration, deploy Node 2 and Node 3 to Azure.

For production deployments, use environment variables with the --non-interactive flag:

docker run --rm -it \
  --env-file .env \
  -e ARM_SUBSCRIPTION_ID \
  -e ARM_TENANT_ID \
  -e ARM_CLIENT_ID \
  -e ARM_CLIENT_SECRET \
  -v $(pwd)/output:/app/output \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --provider azure --output /app/output --non-interactive

If you prefer to enter configuration interactively:

docker run --rm -it \
  --env-file .env \
  -e ARM_SUBSCRIPTION_ID \
  -e ARM_TENANT_ID \
  -e ARM_CLIENT_ID \
  -e ARM_CLIENT_SECRET \
  -v $(pwd)/output:/app/output \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --provider azure --output /app/output

If you have existing subnets, use the --no-create-vpc flag:

docker run --rm -it \
  --env-file .env \
  -e ARM_SUBSCRIPTION_ID \
  -e ARM_TENANT_ID \
  -e ARM_CLIENT_ID \
  -e ARM_CLIENT_SECRET \
  -v $(pwd)/output:/app/output \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --provider azure --output /app/output --non-interactive --no-create-vpc

Your .env file must include the existing VNet and subnet values required by your deployer package. The two subnets should be in separate availability zones or fault domains when your Azure region and networking design support it.

After deployment completes, verify the Azure infrastructure and node startup.

Verify that both VMs are running:

az vm list \
  --resource-group <RESOURCE_GROUP> \
  --show-details \
  --query "[?contains(name, 'mpc')].{Name:name,PowerState:powerState,Size:hardwareProfile.vmSize}" \
  --output table

Confirm that each VM has the expected user-assigned managed identity:

az vm identity show \
  --resource-group <RESOURCE_GROUP> \
  --name <MPC_VM_NAME>

Retrieve the startup log for each VM:

az vm boot-diagnostics get-boot-log \
  --resource-group <RESOURCE_GROUP> \
  --name <MPC_VM_NAME>

Confirm that deployment secrets exist in the Standard Key Vault:

az keyvault secret list \
  --vault-name <CONFIG_KEY_VAULT_NAME> \
  --query "[?contains(name, '<TENANT_ALIAS>')].name"

All deployer operations are logged to the output directory:

If you encounter issues:

1. Check log files in the output directory.
2. Verify Azure credentials, Key Vault access, and managed identity assignment.
3. Retrieve VM boot diagnostics for Node 2 and Node 3.
4. Contact your Ripple representative with log files and boot diagnostics.

After successful deployment, contact your Ripple representative to:

1. Verify connectivity between your nodes and Ripple nodes.
2. Complete cluster configuration and run health checks.
3. Test key generation using the DKG process.
4. Set up MPC backups for encrypted shard backups with verifiable encryption.