> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/deployment/aws-in-vpc/prerequisites.md).

# Prerequisites

Tools, access, and onboarding items required before an In-VPC e6data deployment on AWS.

## Tools

Before starting, make sure you have:

* **AWS CLI v2**, configured with appropriate permissions.
* **`kubectl`** v1.28+, installed and configured.
* **`helm`** v3.14+.
* **`jq`** and **`envsubst`** utilities.
* **`eksctl`**, for OIDC provider setup.

## What e6data provides during onboarding

Your e6data onboarding engineer shares the following before you begin:

| Item                    | Description                                                                       |
| ----------------------- | --------------------------------------------------------------------------------- |
| `TENANT_NAME`           | Your e6data tenant identifier.                                                    |
| e6-operator CRDs        | Custom Resource Definitions, provided as an archive (`e6-operator-crds.zip`).     |
| e6-operator Helm chart  | Operator controller chart (`e6-operator-<version>.tgz`).                          |
| e6-workspace Helm chart | Workspace components chart (`e6-workspace-<version>.tgz`).                        |
| Image versions          | Component image tags for your release (operator, console, xds, envoy, and so on). |
| ECR access              | Cross-account ECR pull permissions to e6data's image registry.                    |
| Monitoring credentials  | GreptimeDB endpoint, database, username, and password.                            |
| JWT configuration       | Issuer, JWKS URI, and audience for authentication.                                |

## Outbound network requirements

The cluster needs outbound HTTPS (443) access to:

| Destination                           | Purpose                                                     |
| ------------------------------------- | ----------------------------------------------------------- |
| ECR (e6data registry)                 | e6data container images.                                    |
| `public.ecr.aws`                      | Karpenter chart and images.                                 |
| `quay.io`                             | cert-manager chart and images.                              |
| `app.e6.run`                          | e6data control plane (agent polling, JWT key verification). |
| GreptimeDB endpoint (from onboarding) | Monitoring, if enabled.                                     |
| `acme-v02.api.letsencrypt.org`        | Only if you use the optional Let's Encrypt TLS path.        |

If egress is restricted, allow-list these destinations before deploying - a blocked egress path is a common cause of stalled installs.

## Using an existing EKS cluster

If you already have an EKS cluster, you can **skip the VPC and cluster-creation steps** (Part 1, Steps 1–5 of [Configure registry, VPC, EKS, and networking](/query-engine/guides/deployment/aws-in-vpc/configure-registry-vpc-eks-networking.md)) and continue from the S3 metadata bucket step - but verify the cluster meets the requirements below first.

Check the cluster's current settings:

```bash
aws eks describe-cluster --name <cluster> \
  --query "{k8s:version, oidc:identity.oidc.issuer, auth:accessConfig.authenticationMode}" -o yaml
```

| Requirement          | Expected                                               | If not met                                                                          |
| -------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------- |
| OIDC issuer          | URL present                                            | `eksctl utils associate-iam-oidc-provider --cluster <cluster> --approve`            |
| Pod Identity Agent   | Add-on installed                                       | `aws eks create-addon --cluster-name <cluster> --addon-name eks-pod-identity-agent` |
| Kubernetes version   | 1.29+ (1.31 ideal)                                     | Upgrade the cluster.                                                                |
| Outbound egress      | Reaches ECR, `public.ecr.aws`, `quay.io`, `app.e6.run` | Allow-list these (security groups / NACLs).                                         |
| Deployer permissions | IAM admin or equivalent                                | Grant it - required for the role assignments.                                       |

{% hint style="info" %}
The OIDC issuer and Pod Identity Agent are the ones that silently break everything if they're off - check them first.
{% endhint %}

## Next

Continue to [Configure registry, VPC, EKS, and networking](/query-engine/guides/deployment/aws-in-vpc/configure-registry-vpc-eks-networking.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/deployment/aws-in-vpc/prerequisites.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.