Deploy workspace and e6data

Create the workspace namespace and NodePool, deploy the e6data workspace components with Helm, wait for reconciliation, and configure DNS.

With the infrastructure and platform components in place, deploy the e6data workspace. This creates the workspace namespace, a dedicated Karpenter NodePool, and the workspace components (the NamespaceConfig, QueryRouter, and supporting resources).

Step 1: Create the workspace namespace

export WORKSPACE_NAME="my-workspace"  # Replace with your workspace name
export NAMESPACE="${WORKSPACE_NAME}"

kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -

Step 2: Create the workspace NodePool and EC2NodeClass

cat << EOF | kubectl apply -f -
apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: ${WORKSPACE_NAME}-nodeclass
spec:
  amiSelectorTerms:
    - alias: al2023@latest
  instanceProfile: ${CLUSTER_NAME}-karpenter
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: ${CLUSTER_NAME}-eks
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: ${CLUSTER_NAME}-eks
  blockDeviceMappings:
    - deviceName: /dev/xvda
      ebs:
        volumeSize: 100Gi
        volumeType: gp3
        deleteOnTermination: true
  tags:
    Name: ${CLUSTER_NAME}-${WORKSPACE_NAME}
    workspace: ${WORKSPACE_NAME}
EOF

cat << EOF | kubectl apply -f -
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: ${WORKSPACE_NAME}-nodepool
spec:
  template:
    spec:
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: ${WORKSPACE_NAME}-nodeclass
      requirements:
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["spot", "on-demand"]
        - key: kubernetes.io/arch
          operator: In
          values: ["arm64"]
        - key: karpenter.k8s.aws/instance-family
          operator: In
          values: [r6g, r6gd, r7g, r7gd, m7g, c7g]
        - key: topology.kubernetes.io/zone
          operator: In
          values: ["${AZ1}", "${AZ2}"]
      taints:
        - key: workspace-name
          value: ${WORKSPACE_NAME}
          effect: NoSchedule
  limits:
    cpu: 1000
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized
    consolidateAfter: 1h
    budgets:
      - nodes: "10%"
EOF

kubectl get nodepools.karpenter.sh ${WORKSPACE_NAME}-nodepool
kubectl get ec2nodeclasses.karpenter.k8s.aws ${WORKSPACE_NAME}-nodeclass

Step 3: Configure the TLS certificate

Query traffic reaches the workspace over HTTPS, so you need a valid TLS certificate for your workspace hostname. Choose one of the options below. Options B and C create a Kubernetes secret named envoy-tls; Option A is referenced later by its ACM ARN.

Option A: AWS ACM certificate (recommended on AWS)

AWS Certificate Manager provisions and renews the certificate, and it integrates with the Network Load Balancer:

export DOMAIN_NAME="${WORKSPACE_NAME}.yourdomain.com"

ACM_CERTIFICATE_ARN=$(aws acm request-certificate \
  --domain-name "${DOMAIN_NAME}" \
  --validation-method DNS \
  --query 'CertificateArn' --output text --region $REGION)

echo "Certificate ARN: $ACM_CERTIFICATE_ARN"

# Add the DNS validation CNAME shown by this command, then wait for validation:
aws acm describe-certificate --certificate-arn $ACM_CERTIFICATE_ARN --region $REGION \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord'

aws acm wait certificate-validated --certificate-arn $ACM_CERTIFICATE_ARN --region $REGION

You set ACM_CERTIFICATE_ARN in the workspace values in the next step.

Option B: Let's Encrypt via cert-manager

Use cert-manager (installed earlier) to obtain and auto-renew a certificate from Let's Encrypt:

cat << EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]  # Replace with your email
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            class: alb
EOF

cat << EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: envoy-tls
  namespace: ${NAMESPACE}
spec:
  secretName: envoy-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - ${WORKSPACE_NAME}.yourdomain.com  # Replace with your domain
EOF

kubectl wait --for=condition=Ready certificate/envoy-tls -n ${NAMESPACE} --timeout=300s

Option C: Customer-procured certificate

If you have a certificate from a third-party CA (DigiCert, Namecheap, Sectigo, and so on), create the envoy-tls secret from your certificate files. Make sure certificate.crt includes the full chain (your certificate plus intermediates):

kubectl create secret tls envoy-tls \
  --cert=certificate.crt \
  --key=private.key \
  --namespace ${NAMESPACE}

kubectl get secret envoy-tls -n ${NAMESPACE}

Step 4: Deploy the workspace components

e6data provides the e6-workspace Helm chart. It creates the NamespaceConfig, QueryRouter, and all workspace resources. Set the variables from your onboarding details, build the values file, and apply:

# Set variables (values provided by e6data)
export TENANT_NAME="<YOUR_TENANT_NAME>"
export E6_WORKSPACE_CHART="./e6-workspace-chart"
export IMAGE_REPOSITORY="<ECR_REPO_PROVIDED_BY_E6DATA>"
export CONSOLE_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"
export COMPACTION_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"
export ENVOY_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"
export XDS_IMAGE_TAG="<VERSION_PROVIDED_BY_E6DATA>"

# Monitoring configuration (provided by e6data)
export GREPTIME_ENDPOINT="<ENDPOINT_PROVIDED_BY_E6DATA>"
export GREPTIME_DATABASE="<DATABASE_PROVIDED_BY_E6DATA>"
export GREPTIME_USERNAME="<USERNAME_PROVIDED_BY_E6DATA>"
export GREPTIME_PASSWORD="<PASSWORD_PROVIDED_BY_E6DATA>"

# Auth configuration (provided by e6data)
export JWT_ISSUER="https://app.e6.run"
export JWT_JWKS_URI="https://app.e6.run/.well-known/jwks.json"
export JWT_AUDIENCE="e6-controlplane"

# Console configuration - the control plane the console polls for cluster commands
export AGENT_API_BASE_URL="https://app.e6.run"

# Your configuration
# GREPTIME_ENDPOINT must be the GreptimeDB ingest host (e.g. https://olly.e6azure.com),
# NOT the Grafana dashboard URL - pointing at Grafana returns a 302 redirect and
# silently drops every batch of logs and metrics.
export AUTHZ_SUPER_ADMINS="[email protected]"  # Comma-separated list of super-admin emails
export HTTP_HOSTNAME="${WORKSPACE_NAME}.yourdomain.com"
export S3_STORAGE_BACKEND="s3a://e6-${WORKSPACE_NAME}-metadata"

# TLS (from Step 3): set ACM_CERTIFICATE_ARN if you used Option A; leave empty for Option B or C
export ACM_CERTIFICATE_ARN=""

cat > workspace-values.yaml << EOF
workspaceName: "${WORKSPACE_NAME}"
tenant: "${TENANT_NAME}"
cloud: "AWS"
workspaceType: "cloud_prem"
region: "${REGION}"
clusterName: "${CLUSTER_NAME}-eks"
storageBackend: "${S3_STORAGE_BACKEND}"
imageRepository: "${IMAGE_REPOSITORY}"

rbac:
  metriq: { enabled: true }
  laminar: { enabled: true }
  copilot: { enabled: true }

namespaceConfig:
  enabled: true
  suspended: false
  karpenterNodePool: "${WORKSPACE_NAME}-nodepool"
  tolerations:
    - key: "workspace-name"
      operator: "Equal"
      value: "${WORKSPACE_NAME}"
      effect: "NoSchedule"
  console:
    enabled: true
    replicas: 2
    image: { tag: "${CONSOLE_IMAGE_TAG}" }
    resources:
      requests: { cpu: "8", memory: "8Gi" }
      limits: { cpu: "8", memory: "10Gi" }
    environmentVariables:
      AWS_REGION: "${REGION}"
      AGENT_API_BASE_URL: "${AGENT_API_BASE_URL}"  # Control plane URL (provided by e6data)
      AGENT_POLL_INTERVAL: "5m"
      AUTHZ_DEFAULT_ROLE: "viewer"
      AUTHZ_SUPER_ADMINS: "${AUTHZ_SUPER_ADMINS}"  # Comma-separated list of admin emails
  compaction:
    enabled: true
    schedule: "0 * * * *"
    hoursAgo: 2
    image: { tag: "${COMPACTION_IMAGE_TAG}" }

queryRouter:
  enabled: true
  trafficDefaults:
    blueWeight: 100
    greenWeight: 0
  httpQuery: { enabled: true, timeout: "5m" }
  pgQuery: { enabled: true, timeout: "1h" }
  xds:
    replicas: 1
    image: { tag: "${XDS_IMAGE_TAG}" }
    pollInterval: 5
    resources: { cpu: "200m", memory: "256Mi" }
  envoy:
    replicas: 1
    maxReplicas: 10
    image: { tag: "${ENVOY_IMAGE_TAG}" }
    hpa: { enabled: true, targetCPUUtilization: 70, targetMemoryUtilization: 80 }
    resources: { cpu: "500m", memory: "512Mi" }
    service: { type: LoadBalancer }
  auth:
    domain: "${HTTP_HOSTNAME}"
    tls: { secretName: "envoy-tls" }
    jwt:
      issuer: "${JWT_ISSUER}"
      jwksUri: "${JWT_JWKS_URI}"
      audience: "${JWT_AUDIENCE}"
    mode: merged-single-port
    mergedService:
      type: LoadBalancer
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
        # If you used an ACM certificate (Step 3, Option A), uncomment the next line:
        # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "${ACM_CERTIFICATE_ARN}"

monitoringServices:
  enabled: true
  greptimeRef:
    endpoint: "${GREPTIME_ENDPOINT}"
    database: "${GREPTIME_DATABASE}"
    username: "${GREPTIME_USERNAME}"
    password: "${GREPTIME_PASSWORD}"
  metricsBridge:
    enabled: true
    resources: { cpu: "100m", memory: "128Mi" }
    metricPushInterval: "10s"
    healthPort: 8081
EOF

# Verify the e6-operator is ready before applying the workspace CRs
kubectl wait --for=condition=Available deployment/e6operator -n e6operator --timeout=60s

# Deploy the workspace
helm template "${WORKSPACE_NAME}-ws" "${E6_WORKSPACE_CHART}" \
  --namespace "${NAMESPACE}" --values workspace-values.yaml \
  | kubectl apply --server-side --force-conflicts -f -

sleep 30
kubectl get sa "${WORKSPACE_NAME}-engine" -n "${NAMESPACE}"
kubectl get namespaceconfig "${WORKSPACE_NAME}-nsc" -n "${NAMESPACE}"
kubectl get queryrouter "${WORKSPACE_NAME}-qr" -n "${NAMESPACE}"

Step 5: Wait for reconciliation

kubectl wait --for=jsonpath='{.status.phase}'=Ready \
  namespaceconfig/${WORKSPACE_NAME}-nsc -n ${NAMESPACE} --timeout=300s

kubectl wait --for=jsonpath='{.status.phase}'=Ready \
  queryrouter/${WORKSPACE_NAME}-qr -n ${NAMESPACE} --timeout=300s

kubectl get monitoringservices -n ${NAMESPACE}

Step 6: Configure DNS

After the LoadBalancer is provisioned, get the NLB DNS name and create a DNS record:

for i in {1..60}; do
  NLB_DNS=$(kubectl get svc ${WORKSPACE_NAME}-qr-envoy-external -n ${NAMESPACE} \
    -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' 2>/dev/null)
  if [[ -n "$NLB_DNS" ]]; then break; fi
  echo "  Waiting... ($i/60)"
  sleep 5
done

echo "LoadBalancer DNS: $NLB_DNS"

# Create a Route 53 CNAME record (replace HOSTED_ZONE_ID with your zone ID)
if [[ -n "$HOSTED_ZONE_ID" && -n "$NLB_DNS" ]]; then
  aws route53 change-resource-record-sets \
    --hosted-zone-id "$HOSTED_ZONE_ID" \
    --change-batch '{
      "Changes": [{
        "Action": "UPSERT",
        "ResourceRecordSet": {
          "Name": "'${HTTP_HOSTNAME}'",
          "Type": "CNAME",
          "TTL": 60,
          "ResourceRecords": [{"Value": "'${NLB_DNS}'"}]
        }
      }]
    }'
else
  echo "Manual DNS setup required: create a CNAME record ${HTTP_HOSTNAME} -> ${NLB_DNS}"
fi

Next

• Register a catalog - connect your data lake.
• Run your first query - verify the install.