Prerequisites

Tools, access, and onboarding items required before an In-VPC e6data deployment on AWS.

Tools

Before starting, make sure you have:

• AWS CLI v2, configured with appropriate permissions.
• kubectl v1.28+, installed and configured.
• helm v3.14+.
• jq and envsubst utilities.
• eksctl, for OIDC provider setup.

What e6data provides during onboarding

Your e6data onboarding engineer shares the following before you begin:

Item	Description
TENANT_NAME	Your e6data tenant identifier.
e6-operator CRDs	Custom Resource Definitions, provided as an archive (e6-operator-crds.zip).
e6-operator Helm chart	Operator controller chart (e6-operator-<version>.tgz).
e6-workspace Helm chart	Workspace components chart (e6-workspace-<version>.tgz).
Image versions	Component image tags for your release (operator, console, xds, envoy, and so on).
ECR access	Cross-account ECR pull permissions to e6data's image registry.
Monitoring credentials	GreptimeDB endpoint, database, username, and password.
JWT configuration	Issuer, JWKS URI, and audience for authentication.

Outbound network requirements

The cluster needs outbound HTTPS (443) access to:

Destination	Purpose
ECR (e6data registry)	e6data container images.
public.ecr.aws	Karpenter chart and images.
quay.io	cert-manager chart and images.
app.e6.run	e6data control plane (agent polling, JWT key verification).
GreptimeDB endpoint (from onboarding)	Monitoring, if enabled.
acme-v02.api.letsencrypt.org	Only if you use the optional Let's Encrypt TLS path.

If egress is restricted, allow-list these destinations before deploying - a blocked egress path is a common cause of stalled installs.

Using an existing EKS cluster

If you already have an EKS cluster, you can skip the VPC and cluster-creation steps (Part 1, Steps 1–5 of Configure registry, VPC, EKS, and networking) and continue from the S3 metadata bucket step - but verify the cluster meets the requirements below first.

Check the cluster's current settings:

aws eks describe-cluster --name <cluster> \
  --query "{k8s:version, oidc:identity.oidc.issuer, auth:accessConfig.authenticationMode}" -o yaml

Requirement	Expected	If not met
OIDC issuer	URL present	eksctl utils associate-iam-oidc-provider --cluster <cluster> --approve
Pod Identity Agent	Add-on installed	aws eks create-addon --cluster-name <cluster> --addon-name eks-pod-identity-agent
Kubernetes version	1.29+ (1.31 ideal)	Upgrade the cluster.
Outbound egress	Reaches ECR, public.ecr.aws, quay.io, app.e6.run	Allow-list these (security groups / NACLs).
Deployer permissions	IAM admin or equivalent	Grant it - required for the role assignments.

The OIDC issuer and Pod Identity Agent are the ones that silently break everything if they're off - check them first.

Next

Continue to Configure registry, VPC, EKS, and networking.