> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prerequisites

> Tools, Azure permissions, outbound network access, and onboarding items required before an In-VPC e6data deployment on AKS.

Confirm the following before you start. The infrastructure itself - VNet, AKS cluster, identities, and storage - is created in [Configure registry, Kubernetes, and networking](/platform/deploy/azure-cloudprem/configure-registry-kubernetes-networking); if you already have an AKS cluster, that page has an existing-cluster checklist so you can reuse it.

## Tools

Run the deployment from any machine with these tools and a loaded kubeconfig (a Linux/macOS workstation, a build agent, or Azure Cloud Shell):

* **Azure CLI (`az`)**, logged in with permission to create resource groups, AKS clusters, Managed Identities, and role assignments.
* **`kubectl`**, installed and configured.
* **`helm`** v3+.
* **`jq`** and **`envsubst`** utilities.

## Azure permissions

The account running the deployment needs:

* **Owner** (or equivalent) on the resource group - to create the VNet, AKS cluster, Managed Identities, and storage.
* **User Access Administrator** - required for the role assignments (Network Contributor, Storage Blob Data roles, AcrPull).

## Outbound network requirements

The cluster needs outbound HTTPS (443) to:

| Destination | Purpose |
| - | - |
| `e6labs.azurecr.io` | e6data container images. |
| `mcr.microsoft.com` | Karpenter chart and images. |
| `quay.io` | cert-manager chart and images. |
| `app.e6.run` | e6data control plane (agent polling, JWT key verification). |
| GreptimeDB endpoint (from onboarding) | Monitoring, if enabled. |
| `acme-v02.api.letsencrypt.org` | Only if you use the optional Let's Encrypt TLS path. |

The workspace query endpoint is **public by default** (protected by JWT auth), so DNS points at a public load balancer IP. You can instead make it private and keep all traffic inside your VNet - see the QueryRouter step in [Deploy workspace and e6data](/platform/deploy/azure-cloudprem/deploy-workspace).

## What e6data provides during onboarding

| Item | Description |
| - | - |
| `TENANT_NAME` | Your e6data tenant identifier. |
| e6-operator CRDs | Custom Resource Definitions, provided as a chart archive (`e6-operator-crds.tgz`). |
| e6-operator Helm chart | Operator controller chart (`e6-operator-<version>.tgz`). |
| Image versions | Component image tags (operator, console, xds, envoy, and so on). |
| ACR access | A pull token for `e6labs.azurecr.io`, or an AcrPull role for your kubelet identity. |
| JWT configuration | Issuer, JWKS URI, and audience for control-plane auth. |
| Service-token verifier secret | Shared value for `cp-verifier-shared` - required for `e6_svc_` service tokens. |
| TLS wildcard certificate | Only if your endpoint uses an e6data domain (for example `*.e6.run`). |
| Monitoring credentials | GreptimeDB endpoint, database, username, and password (if monitoring is enabled). |

## Values to have ready

| Value | Where it comes from |
| - | - |
| `WORKSPACE_NAME` | A name you pick. Lowercase, alphanumeric, hyphens; 1–18 characters. |
| `TENANT_NAME` | Your e6data onboarding engineer. |
| `LOCATION` | Azure region (for example, `eastus`). |
| `SUBSCRIPTION_ID` | Your Azure subscription ID. |
| `CONSOLE_HOSTNAME` | The hostname your workspace endpoint will use. |

## Next

Continue to [Configure registry, Kubernetes, and networking](/platform/deploy/azure-cloudprem/configure-registry-kubernetes-networking).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.