Deploy workspace and e6data

With the infrastructure and platform components in place, deploy the e6data workspace. This creates the workspace namespace, a dedicated Karpenter NodePool, and the workspace components (the NamespaceConfig, QueryRouter, and supporting resources).

Step 1: Create the workspace namespace

export WORKSPACE_NAME="my-workspace"  # Replace with your workspace name
export NAMESPACE="${WORKSPACE_NAME}"

kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -

Step 2: Create the workspace NodePool and EC2NodeClass

cat << EOF | kubectl apply -f -
apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: ${WORKSPACE_NAME}-nodeclass
spec:
  amiSelectorTerms:
    - alias: al2023@latest
  instanceProfile: ${CLUSTER_NAME}-karpenter
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: ${CLUSTER_NAME}-eks
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: ${CLUSTER_NAME}-eks
  blockDeviceMappings:
    - deviceName: /dev/xvda
      ebs:
        volumeSize: 100Gi
        volumeType: gp3
        deleteOnTermination: true
  tags:
    Name: ${CLUSTER_NAME}-${WORKSPACE_NAME}
    workspace: ${WORKSPACE_NAME}
EOF

cat << EOF | kubectl apply -f -
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: ${WORKSPACE_NAME}-nodepool
spec:
  template:
    spec:
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: ${WORKSPACE_NAME}-nodeclass
      requirements:
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["spot", "on-demand"]
        - key: kubernetes.io/arch
          operator: In
          values: ["arm64"]
        - key: karpenter.k8s.aws/instance-family
          operator: In
          values: [r6g, r6gd, r7g, r7gd, m7g, c7g]
        - key: topology.kubernetes.io/zone
          operator: In
          values: ["${AZ1}", "${AZ2}"]
      taints:
        - key: workspace-name
          value: ${WORKSPACE_NAME}
          effect: NoSchedule
  limits:
    cpu: 1000
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized
    consolidateAfter: 1h
    budgets:
      - nodes: "10%"
EOF

kubectl get nodepools.karpenter.sh ${WORKSPACE_NAME}-nodepool
kubectl get ec2nodeclasses.karpenter.k8s.aws ${WORKSPACE_NAME}-nodeclass

Step 3: Configure the TLS certificate

Query traffic reaches the workspace over HTTPS, so you need a valid TLS certificate for your workspace hostname. Choose one of the options below. Options B and C create a Kubernetes secret named envoy-tls; Option A is referenced later by its ACM ARN.

Option A: AWS ACM certificate (recommended on AWS)

AWS Certificate Manager provisions and renews the certificate, and it integrates with the Network Load Balancer:

export DOMAIN_NAME="${WORKSPACE_NAME}.yourdomain.com"

ACM_CERTIFICATE_ARN=$(aws acm request-certificate \
  --domain-name "${DOMAIN_NAME}" \
  --validation-method DNS \
  --query 'CertificateArn' --output text --region $REGION)

echo "Certificate ARN: $ACM_CERTIFICATE_ARN"

# Add the DNS validation CNAME shown by this command, then wait for validation:
aws acm describe-certificate --certificate-arn $ACM_CERTIFICATE_ARN --region $REGION \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord'

aws acm wait certificate-validated --certificate-arn $ACM_CERTIFICATE_ARN --region $REGION

You set ACM_CERTIFICATE_ARN in the workspace values in the next step.

Option B: Let’s Encrypt via cert-manager

Use cert-manager (installed earlier) to obtain and auto-renew a certificate from Let’s Encrypt:

cat << EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]  # Replace with your email
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            class: alb
EOF

cat << EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: envoy-tls
  namespace: ${NAMESPACE}
spec:
  secretName: envoy-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - ${WORKSPACE_NAME}.yourdomain.com  # Replace with your domain
EOF

kubectl wait --for=condition=Ready certificate/envoy-tls -n ${NAMESPACE} --timeout=300s

Option C: Customer-procured certificate

If you have a certificate from a third-party CA (DigiCert, Namecheap, Sectigo, and so on), create the envoy-tls secret from your certificate files. Make sure certificate.crt includes the full chain (your certificate plus intermediates):

kubectl create secret tls envoy-tls \
  --cert=certificate.crt \
  --key=private.key \
  --namespace ${NAMESPACE}

kubectl get secret envoy-tls -n ${NAMESPACE}

Step 4: Deploy the workspace components

e6data provides the e6-workspace Helm chart. It creates the NamespaceConfig, QueryRouter, and all workspace resources. Set the variables from your onboarding details, build the values file, and apply:

# Set variables (values provided by e6data)
export TENANT_NAME="<YOUR_TENANT_NAME>"
export E6_WORKSPACE_CHART="./e6-workspace-chart"
export IMAGE_REPOSITORY="<ECR_REPO_PROVIDED_BY_E6DATA>"
export CONSOLE_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"
export COMPACTION_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"
export ENVOY_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"
export XDS_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"

# Monitoring configuration (provided by e6data)
export GREPTIME_ENDPOINT="<ENDPOINT_PROVIDED_BY_E6DATA>"
export GREPTIME_DATABASE="<DATABASE_PROVIDED_BY_E6DATA>"
export GREPTIME_USERNAME="<USERNAME_PROVIDED_BY_E6DATA>"
export GREPTIME_PASSWORD="<PASSWORD_PROVIDED_BY_E6DATA>"

# Auth configuration (provided by e6data)
export JWT_ISSUER="https://app.e6.run"
export JWT_JWKS_URI="https://app.e6.run/.well-known/jwks.json"
export JWT_AUDIENCE="e6-controlplane"

# Console configuration - the control plane the console polls for cluster commands
export AGENT_API_BASE_URL="https://app.e6.run"

# Your configuration
# GREPTIME_ENDPOINT must be the GreptimeDB ingest host (e.g. https://olly.e6azure.com),
# NOT the Grafana dashboard URL - pointing at Grafana returns a 302 redirect and
# silently drops every batch of logs and metrics.
export AUTHZ_SUPER_ADMINS="[email protected]"  # Comma-separated list of super-admin emails
export HTTP_HOSTNAME="${WORKSPACE_NAME}.yourdomain.com"
export S3_STORAGE_BACKEND="s3a://e6-${WORKSPACE_NAME}-metadata"

# TLS (from Step 3): set ACM_CERTIFICATE_ARN if you used Option A; leave empty for Option B or C
export ACM_CERTIFICATE_ARN=""

cat > workspace-values.yaml << EOF
workspaceName: "${WORKSPACE_NAME}"
tenant: "${TENANT_NAME}"
cloud: "AWS"
workspaceType: "cloud_prem"
region: "${REGION}"
clusterName: "${CLUSTER_NAME}-eks"
storageBackend: "${S3_STORAGE_BACKEND}"
imageRepository: "${IMAGE_REPOSITORY}"

rbac:
  metriq: { enabled: true }
  laminar: { enabled: true }
  copilot: { enabled: true }

namespaceConfig:
  enabled: true
  suspended: false
  karpenterNodePool: "${WORKSPACE_NAME}-nodepool"
  tolerations:
    - key: "workspace-name"
      operator: "Equal"
      value: "${WORKSPACE_NAME}"
      effect: "NoSchedule"
  console:
    enabled: true
    replicas: 2
    image: { tag: "${CONSOLE_IMAGE_TAG}" }
    resources:
      requests: { cpu: "8", memory: "8Gi" }
      limits: { cpu: "8", memory: "10Gi" }
    environmentVariables:
      AWS_REGION: "${REGION}"
      AGENT_API_BASE_URL: "${AGENT_API_BASE_URL}"  # Control plane URL (provided by e6data)
      AGENT_POLL_INTERVAL: "5m"
      AUTHZ_DEFAULT_ROLE: "viewer"
      AUTHZ_SUPER_ADMINS: "${AUTHZ_SUPER_ADMINS}"  # Comma-separated list of admin emails
  compaction:
    enabled: true
    schedule: "0 * * * *"
    hoursAgo: 2
    image: { tag: "${COMPACTION_IMAGE_TAG}" }

queryRouter:
  enabled: true
  trafficDefaults:
    blueWeight: 100
    greenWeight: 0
  httpQuery: { enabled: true, timeout: "5m" }
  pgQuery: { enabled: true, timeout: "1h" }
  xds:
    replicas: 1
    image: { tag: "${XDS_IMAGE_TAG}" }
    pollInterval: 5
    resources: { cpu: "200m", memory: "256Mi" }
  envoy:
    replicas: 1
    maxReplicas: 10
    image: { tag: "${ENVOY_IMAGE_TAG}" }
    hpa: { enabled: true, targetCPUUtilization: 70, targetMemoryUtilization: 80 }
    resources: { cpu: "500m", memory: "512Mi" }
    service: { type: LoadBalancer }
  auth:
    domain: "${HTTP_HOSTNAME}"
    tls: { secretName: "envoy-tls" }
    jwt:
      issuer: "${JWT_ISSUER}"
      jwksUri: "${JWT_JWKS_URI}"
      audience: "${JWT_AUDIENCE}"
    mode: merged-single-port
    mergedService:
      type: LoadBalancer
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
        # If you used an ACM certificate (Step 3, Option A), uncomment the next line:
        # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "${ACM_CERTIFICATE_ARN}"

monitoringServices:
  enabled: true
  greptimeRef:
    endpoint: "${GREPTIME_ENDPOINT}"
    database: "${GREPTIME_DATABASE}"
    username: "${GREPTIME_USERNAME}"
    password: "${GREPTIME_PASSWORD}"
  metricsBridge:
    enabled: true
    resources: { cpu: "100m", memory: "128Mi" }
    metricPushInterval: "10s"
    healthPort: 8081
EOF

# Verify the e6-operator is ready before applying the workspace CRs
kubectl wait --for=condition=Available deployment/e6operator -n e6operator --timeout=60s

# Deploy the workspace
helm template "${WORKSPACE_NAME}-ws" "${E6_WORKSPACE_CHART}" \
  --namespace "${NAMESPACE}" --values workspace-values.yaml \
  | kubectl apply --server-side --force-conflicts -f -

sleep 30
kubectl get sa "${WORKSPACE_NAME}-engine" -n "${NAMESPACE}"
kubectl get namespaceconfig "${WORKSPACE_NAME}-nsc" -n "${NAMESPACE}"
kubectl get queryrouter "${WORKSPACE_NAME}-qr" -n "${NAMESPACE}"

Step 5: Wait for reconciliation

kubectl wait --for=jsonpath='{.status.phase}'=Ready \
  namespaceconfig/${WORKSPACE_NAME}-nsc -n ${NAMESPACE} --timeout=300s

kubectl wait --for=jsonpath='{.status.phase}'=Ready \
  queryrouter/${WORKSPACE_NAME}-qr -n ${NAMESPACE} --timeout=300s

kubectl get monitoringservices -n ${NAMESPACE}

Step 6: Configure DNS

After the LoadBalancer is provisioned, get the NLB DNS name and create a DNS record:

for i in {1..60}; do
  NLB_DNS=$(kubectl get svc ${WORKSPACE_NAME}-qr-envoy-external -n ${NAMESPACE} \
    -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' 2>/dev/null)
  if [[ -n "$NLB_DNS" ]]; then break; fi
  echo "  Waiting... ($i/60)"
  sleep 5
done

echo "LoadBalancer DNS: $NLB_DNS"

# Create a Route 53 CNAME record (replace HOSTED_ZONE_ID with your zone ID)
if [[ -n "$HOSTED_ZONE_ID" && -n "$NLB_DNS" ]]; then
  aws route53 change-resource-record-sets \
    --hosted-zone-id "$HOSTED_ZONE_ID" \
    --change-batch '{
      "Changes": [{
        "Action": "UPSERT",
        "ResourceRecordSet": {
          "Name": "'${HTTP_HOSTNAME}'",
          "Type": "CNAME",
          "TTL": 60,
          "ResourceRecords": [{"Value": "'${NLB_DNS}'"}]
        }
      }]
    }'
else
  echo "Manual DNS setup required: create a CNAME record ${HTTP_HOSTNAME} -> ${NLB_DNS}"
fi

Register a catalog - connect your data lake.
Run your first query - verify the install.

Platform

Get started

Deploy a workspace

Manage workspaces

Identity and access

Tokens and support access

Operate

Automate

Security and trust

Reference

Deploy workspace and e6data

Step 1: Create the workspace namespace

Step 2: Create the workspace NodePool and EC2NodeClass

Step 3: Configure the TLS certificate

Option A: AWS ACM certificate (recommended on AWS)

Option B: Let’s Encrypt via cert-manager

Option C: Customer-procured certificate

Step 4: Deploy the workspace components

Step 5: Wait for reconciliation

Step 6: Configure DNS

Next

​Step 1: Create the workspace namespace

​Step 2: Create the workspace NodePool and EC2NodeClass

​Step 3: Configure the TLS certificate

​Option A: AWS ACM certificate (recommended on AWS)

​Option B: Let’s Encrypt via cert-manager

​Option C: Customer-procured certificate

​Step 4: Deploy the workspace components

​Step 5: Wait for reconciliation

​Step 6: Configure DNS

​Next

Step 1: Create the workspace namespace

Step 2: Create the workspace NodePool and EC2NodeClass

Step 3: Configure the TLS certificate

Option A: AWS ACM certificate (recommended on AWS)

Option B: Let’s Encrypt via cert-manager

Option C: Customer-procured certificate

Step 4: Deploy the workspace components

Step 5: Wait for reconciliation

Step 6: Configure DNS

Next