The CloudRadial AutomationAI runner installer provisions a self-contained set of Azure resources in a resource group inside your own subscription. This article lists what gets created and explains that you own all of it. It is for the technician performing the install.
- Where the Resources Go
- What Gets Created
- The Supervisor
- You Own All of It
Where the Resources Go
Everything deploys into one resource group in the subscription you choose — crautomationai-rg by default, created if it does not exist. Resource names are prefixed with crrun- so they are easy to identify, and the per-runner resources carry your runner's friendly name so you can match a runner to its Function Apps at a glance in the portal.
What Gets Created
The installer provisions the following:
| Resource | Purpose |
|---|---|
| Virtual network and subnets | Function App VNet integration and private endpoints |
| Storage account | Function App runtime storage, reachable only through a private endpoint |
| Key Vault | Holds the runner secret and the AI-provider settings, in RBAC mode and reachable only through a private endpoint |
| AI Foundry workspace | The workspace is always created, reachable only through a private endpoint and shared by the three script runners. The gpt-5.4 model deployment inside it depends on available quota in the subscription — without it the runner still deploys and polls, and the installer tells you to request quota and re-run |
| Hosting plans | One Flex Consumption plan per Function App by default; or a single shared Premium plan hosting the three language apps when the Premium plan is chosen |
| Three Function Apps | The PowerShell, C#, and Python runners — each polls for its language's work |
| Agent Function App | The fourth flavor, always on its own Flex Consumption plan, hosting the agent loop. Deployed by default |
| Bundled agent Foundry | A separate gpt-5.4 account for the agent runner, reachable only through a private endpoint and authenticated by managed identity |
| Supervisor Function App | One per runner, always on Flex Consumption. Keeps the runner on the version and instance count you have asked for |
| Supervisor storage account | The supervisor's own storage, deliberately separate from the storage the runner applications use |
| Two managed identities | One shared by the runner applications for Key Vault, AI and storage access; one used only by the supervisor for the resource changes it makes |
| Log Analytics and Application Insights | Telemetry for the runner fleet |
The four runner flavors — PowerShell, C#, Python, and Agent — let a workflow node run on the runner that matches its language. The agent runner is on by default; you can skip it at install time if you only need the three script runners.
The Supervisor
From runner version 2.0 the installer also deploys a supervisor: a small application that keeps the runner matching the version and instance count you have set, without you running anything. It is the only part of the runner allowed to change Azure resources, and its permissions are deliberately narrow — scoped to this runner’s own resource group, and limited to the specific resource types it needs. It holds no access to Key Vault, no ability to read account keys, and no network permissions.
The runner applications themselves hold no Azure resource permissions at all. That separation is the point: workflow steps run your own scripts, so the applications that execute them are kept away from anything that could change your environment. For the same reason the supervisor has its own storage account rather than sharing the one the runner applications use.
Important -> Deploy only one runner into a given resource group. The supervisor’s permissions are scoped to the resource group, so a second runner sharing it would be within reach of the first runner’s supervisor. The installer checks for this and stops if it finds another runner’s resources in the target group.
You Own All of It
Every resource the installer creates lives in your subscription and your resource group. AutomationAI's control plane never reaches into your environment — the runner is outbound-only and connects out to the control plane on its own schedule. The control plane stores only the runner's registered identity, the hash of its secret, and the health history the runner reports on each poll. Because you own the resources, you also own their cost and lifecycle: removing the resource group removes the runner. For the trade-off between the Flex Consumption and Premium hosting plans, see the article on runner plans.
Comments
0 comments
Please sign in to leave a comment.