Prerequisites

Tools, Azure permissions, outbound network access, and onboarding items required before an In-VPC e6data deployment on AKS.

Confirm the following before you start. The infrastructure itself - VNet, AKS cluster, identities, and storage - is created in Configure registry, Kubernetes, and networking; if you already have an AKS cluster, that page has an existing-cluster checklist so you can reuse it.

Tools

Run the deployment from any machine with these tools and a loaded kubeconfig (a Linux/macOS workstation, a build agent, or Azure Cloud Shell):

• Azure CLI (az), logged in with permission to create resource groups, AKS clusters, Managed Identities, and role assignments.
• kubectl, installed and configured.
• helm v3+.
• jq and envsubst utilities.

Azure permissions

The account running the deployment needs:

• Owner (or equivalent) on the resource group - to create the VNet, AKS cluster, Managed Identities, and storage.
• User Access Administrator - required for the role assignments (Network Contributor, Storage Blob Data roles, AcrPull).

Outbound network requirements

The cluster needs outbound HTTPS (443) to:

Destination	Purpose
e6labs.azurecr.io	e6data container images.
mcr.microsoft.com	Karpenter chart and images.
quay.io	cert-manager chart and images.
app.e6.run	e6data control plane (agent polling, JWT key verification).
GreptimeDB endpoint (from onboarding)	Monitoring, if enabled.
acme-v02.api.letsencrypt.org	Only if you use the optional Let's Encrypt TLS path.

The workspace query endpoint is public by default (protected by JWT auth), so DNS points at a public load balancer IP. You can instead make it private and keep all traffic inside your VNet - see the QueryRouter step in Deploy workspace and e6data.

What e6data provides during onboarding

Item	Description
TENANT_NAME	Your e6data tenant identifier.
e6-operator CRDs	Custom Resource Definitions, provided as a chart archive (e6-operator-crds.tgz).
e6-operator Helm chart	Operator controller chart (e6-operator-<version>.tgz).
Image versions	Component image tags (operator, console, xds, envoy, and so on).
ACR access	A pull token for e6labs.azurecr.io, or an AcrPull role for your kubelet identity.
JWT configuration	Issuer, JWKS URI, and audience for control-plane auth.
Service-token verifier secret	Shared value for cp-verifier-shared - required for e6_svc_ service tokens.
TLS wildcard certificate	Only if your endpoint uses an e6data domain (for example *.e6.run).
Monitoring credentials	GreptimeDB endpoint, database, username, and password (if monitoring is enabled).

Values to have ready

Value	Where it comes from
WORKSPACE_NAME	A name you pick. Lowercase, alphanumeric, hyphens; 1–18 characters.
TENANT_NAME	Your e6data onboarding engineer.
LOCATION	Azure region (for example, eastus).
SUBSCRIPTION_ID	Your Azure subscription ID.
CONSOLE_HOSTNAME	The hostname your workspace endpoint will use.

Next

Continue to Configure registry, Kubernetes, and networking.