Prerequisites

Tools

Before starting, make sure you have:

AWS CLI v2, configured with appropriate permissions.
kubectl v1.28+, installed and configured.
helm v3.14+.
jq and envsubst utilities.
eksctl, for OIDC provider setup.

What e6data provides during onboarding

Your e6data onboarding engineer shares the following before you begin:

Item	Description
`TENANT_NAME`	Your e6data tenant identifier.
e6-operator CRDs	Custom Resource Definitions, provided as an archive (`e6-operator-crds.zip`).
e6-operator Helm chart	Operator controller chart (`e6-operator-<version>.tgz`).
e6-workspace Helm chart	Workspace components chart (`e6-workspace-<version>.tgz`).
Image versions	Component image tags for your release (operator, console, xds, envoy, and so on).
ECR access	Cross-account ECR pull permissions to e6data’s image registry.
Monitoring credentials	GreptimeDB endpoint, database, username, and password.
JWT configuration	Issuer, JWKS URI, and audience for authentication.

Outbound network requirements

The cluster needs outbound HTTPS (443) access to:

Destination	Purpose
ECR (e6data registry)	e6data container images.
`public.ecr.aws`	Karpenter chart and images.
`quay.io`	cert-manager chart and images.
`app.e6.run`	e6data control plane (agent polling, JWT key verification).
GreptimeDB endpoint (from onboarding)	Monitoring, if enabled.
`acme-v02.api.letsencrypt.org`	Only if you use the optional Let’s Encrypt TLS path.

If egress is restricted, allow-list these destinations before deploying - a blocked egress path is a common cause of stalled installs.

Using an existing EKS cluster

If you already have an EKS cluster, you can skip the VPC and cluster-creation steps (Part 1, Steps 1–5 of Configure registry, VPC, EKS, and networking) and continue from the S3 metadata bucket step - but verify the cluster meets the requirements below first.

The skipped steps also create resources and variables that later steps rely on:

Part 1, Step 2 creates the Karpenter, ALB Controller, and EBS CSI driver IAM roles used in Part 2. Create them if your cluster doesn’t already have equivalents.
Export these variables for your existing cluster before continuing:

export CLUSTER_NAME="<cluster-name-prefix>"   # commands use ${CLUSTER_NAME}-eks as the EKS cluster name
export REGION="<region>"
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export VPC_ID="<vpc-id>"
export PRIVATE_SUBNET_1="<private-subnet-id-1>"
export PRIVATE_SUBNET_2="<private-subnet-id-2>"
export AZ1="<az-of-subnet-1>"
export AZ2="<az-of-subnet-2>"

Check the cluster’s current settings:

aws eks describe-cluster --name <cluster> \
  --query "{k8s:version, oidc:identity.oidc.issuer, auth:accessConfig.authenticationMode}" -o yaml

Requirement	Expected	If not met
OIDC issuer	URL present	`eksctl utils associate-iam-oidc-provider --cluster <cluster> --approve`
Pod Identity Agent	Add-on installed	`aws eks create-addon --cluster-name <cluster> --addon-name eks-pod-identity-agent`
Kubernetes version	1.29+ (1.31 ideal)	Upgrade the cluster.
Outbound egress	Reaches ECR, `public.ecr.aws`, `quay.io`, `app.e6.run`	Allow-list these (security groups / NACLs).
Deployer permissions	IAM admin or equivalent	Grant it - required for the role assignments.

The OIDC issuer and Pod Identity Agent are the ones that silently break everything if they’re off - check them first.

Continue to Configure registry, VPC, EKS, and networking.

Platform

Get started

Deploy a workspace

Manage workspaces

Identity and access

Tokens and support access

Operate

Automate

Security and trust

Reference

Tools

What e6data provides during onboarding

Outbound network requirements

Using an existing EKS cluster

Next

​Tools

​What e6data provides during onboarding

​Outbound network requirements

​Using an existing EKS cluster

​Next

Tools

What e6data provides during onboarding

Outbound network requirements

Using an existing EKS cluster

Next