> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prerequisites

> Tools, access, and onboarding items required before an In-VPC e6data deployment on AWS.

## Tools

Before starting, make sure you have:

* **AWS CLI v2**, configured with appropriate permissions.
* **`kubectl`** v1.28+, installed and configured.
* **`helm`** v3.14+.
* **`jq`** and **`envsubst`** utilities.
* **`eksctl`**, for OIDC provider setup.

## What e6data provides during onboarding

Your e6data onboarding engineer shares the following before you begin:

| Item | Description |
| - | - |
| `TENANT_NAME` | Your e6data tenant identifier. |
| e6-operator CRDs | Custom Resource Definitions, provided as an archive (`e6-operator-crds.zip`). |
| e6-operator Helm chart | Operator controller chart (`e6-operator-<version>.tgz`). |
| e6-workspace Helm chart | Workspace components chart (`e6-workspace-<version>.tgz`). |
| Image versions | Component image tags for your release (operator, console, xds, envoy, and so on). |
| ECR access | Cross-account ECR pull permissions to e6data's image registry. |
| Monitoring credentials | GreptimeDB endpoint, database, username, and password. |
| JWT configuration | Issuer, JWKS URI, and audience for authentication. |

## Outbound network requirements

The cluster needs outbound HTTPS (443) access to:

| Destination | Purpose |
| - | - |
| ECR (e6data registry) | e6data container images. |
| `public.ecr.aws` | Karpenter chart and images. |
| `quay.io` | cert-manager chart and images. |
| `app.e6.run` | e6data control plane (agent polling, JWT key verification). |
| GreptimeDB endpoint (from onboarding) | Monitoring, if enabled. |
| `acme-v02.api.letsencrypt.org` | Only if you use the optional Let's Encrypt TLS path. |

If egress is restricted, allow-list these destinations before deploying - a blocked egress path is a common cause of stalled installs.

## Using an existing EKS cluster

If you already have an EKS cluster, you can **skip the VPC and cluster-creation steps** (Part 1, Steps 1–5 of [Configure registry, VPC, EKS, and networking](/platform/deploy/aws-cloudprem/configure-registry-vpc-eks-networking)) and continue from the S3 metadata bucket step - but verify the cluster meets the requirements below first.

<Info>
  The skipped steps also create resources and variables that later steps rely on:

  * **Part 1, Step 2** creates the Karpenter, ALB Controller, and EBS CSI driver IAM roles used in Part 2. Create them if your cluster doesn't already have equivalents.
  * Export these variables for your existing cluster before continuing:

  ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
  export CLUSTER_NAME="<cluster-name-prefix>"   # commands use ${CLUSTER_NAME}-eks as the EKS cluster name
  export REGION="<region>"
  export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
  export VPC_ID="<vpc-id>"
  export PRIVATE_SUBNET_1="<private-subnet-id-1>"
  export PRIVATE_SUBNET_2="<private-subnet-id-2>"
  export AZ1="<az-of-subnet-1>"
  export AZ2="<az-of-subnet-2>"
  ```
</Info>

Check the cluster's current settings:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
aws eks describe-cluster --name <cluster> \
  --query "{k8s:version, oidc:identity.oidc.issuer, auth:accessConfig.authenticationMode}" -o yaml
```

| Requirement | Expected | If not met |
| - | - | - |
| OIDC issuer | URL present | `eksctl utils associate-iam-oidc-provider --cluster <cluster> --approve` |
| Pod Identity Agent | Add-on installed | `aws eks create-addon --cluster-name <cluster> --addon-name eks-pod-identity-agent` |
| Kubernetes version | 1.29+ (1.31 ideal) | Upgrade the cluster. |
| Outbound egress | Reaches ECR, `public.ecr.aws`, `quay.io`, `app.e6.run` | Allow-list these (security groups / NACLs). |
| Deployer permissions | IAM admin or equivalent | Grant it - required for the role assignments. |

<Info>
  The OIDC issuer and Pod Identity Agent are the ones that silently break everything if they're off - check them first.
</Info>

## Next

Continue to [Configure registry, VPC, EKS, and networking](/platform/deploy/aws-cloudprem/configure-registry-vpc-eks-networking).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.