Issue
Standard MCP RAG SDK deployments on Azure exceed a $500 monthly budget due to:
- Premium Azure Kubernetes Service (AKS) nodes with multi-zone redundancy.
- Managed database services like Azure Cache Premium and CosmosDB.
- Enterprise-grade monitoring tools such as App Insights Premium.
- High-availability configurations with auto-scaling.
Users require full RAG functionality but need to operate within a strict $100/month budget for development and production environments.
Culprit
Architectural Over-Provisioning
Default reference architectures used over-provisioned resources:
- Compute: Premium AKS nodes instead of cost-effective alternatives.
- Databases: Managed Redis and CosmosDB instead of self-hosted solutions.
- Networking: NAT Gateway instead of Load Balancer.
- Monitoring: Premium App Insights instead of FREE-tier alternatives.
Missing Cost Controls
No documented strategies existed for:
- Utilizing spot instances (70-90% cost savings).
- Leveraging FREE-tier Azure services (Key Vault, Log Analytics).
- Self-hosting databases (Redis, ChromaDB) within AKS.
- Gradual upgrade paths from budget-conscious to premium architectures.
Solution
Three-Layer Cost-Optimized Architecture
-
Foundation Layer ($20/month)
- Azure Virtual Network and Network Security Groups (FREE).
- Azure Key Vault (Standard, FREE tier).
- Log Analytics (5GB FREE tier).
-
Application Layer ($65/month)
- AKS with spot instances (B2s size, ~$15/month).
- Azure Container Registry (Standard SKU, $20/month).
- Self-hosted Redis and ChromaDB (FREE).
- Azure OpenAI (pay-per-token).
-
Observability Layer ($15/month)
- Application Insights (FREE tier).
- Grafana Cloud (FREE tier, 10k metrics).
Key Implementations
-
Compute Optimization
- Replaced premium AKS nodes with a single spot instance, reducing costs by 70-90%.
-
Database Self-Hosting
- Deployed Redis and ChromaDB as Kubernetes StatefulSets to avoid managed service costs.
-
FREE Tier Utilization
- Leveraged Azure FREE-tier services for Key Vault, Log Analytics, and Application Insights.
-
Security on a Budget
- Implemented Azure AD OAuth 2.1 with JWT validation.
- Used Network Security Groups for VNet isolation.
- Deployed rule Gatekeeper for container security.
- Utilized Azure Container Registry vulnerability scanning (included with Standard SKU).
-
Upgrade Paths
- Defined a staged progression from budget-constrained to premium architectures using configurable Terraform variables.
Deployment Automation
- Added cost validation before deployment to ensure adherence to the $100/month budget.
- Implemented single-command deployment workflows with pre-apply cost checks.
Observability on Budget
- Utilized Grafana Cloud FREE tier for metrics and Log Analytics FREE tier for logs.
- Implemented custom Prometheus rules to monitor spot node evictions.
This architecture achieves full RAG functionality while maintaining security and reliability within the $100/month constraint.