> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/deployment/azure-in-vpc/prerequisites.md).

# Prerequisites

Tools, Azure permissions, outbound network access, and onboarding items required before an In-VPC e6data deployment on AKS.

Confirm the following before you start. The infrastructure itself - VNet, AKS cluster, identities, and storage - is created in [Configure registry, Kubernetes, and networking](/query-engine/guides/deployment/azure-in-vpc/configure-registry-kubernetes-networking.md); if you already have an AKS cluster, that page has an existing-cluster checklist so you can reuse it.

## Tools

Run the deployment from any machine with these tools and a loaded kubeconfig (a Linux/macOS workstation, a build agent, or Azure Cloud Shell):

* **Azure CLI (`az`)**, logged in with permission to create resource groups, AKS clusters, Managed Identities, and role assignments.
* **`kubectl`**, installed and configured.
* **`helm`** v3+.
* **`jq`** and **`envsubst`** utilities.

## Azure permissions

The account running the deployment needs:

* **Owner** (or equivalent) on the resource group - to create the VNet, AKS cluster, Managed Identities, and storage.
* **User Access Administrator** - required for the role assignments (Network Contributor, Storage Blob Data roles, AcrPull).

## Outbound network requirements

The cluster needs outbound HTTPS (443) to:

| Destination                           | Purpose                                                     |
| ------------------------------------- | ----------------------------------------------------------- |
| `e6labs.azurecr.io`                   | e6data container images.                                    |
| `mcr.microsoft.com`                   | Karpenter chart and images.                                 |
| `quay.io`                             | cert-manager chart and images.                              |
| `app.e6.run`                          | e6data control plane (agent polling, JWT key verification). |
| GreptimeDB endpoint (from onboarding) | Monitoring, if enabled.                                     |
| `acme-v02.api.letsencrypt.org`        | Only if you use the optional Let's Encrypt TLS path.        |

The workspace query endpoint is **public by default** (protected by JWT auth), so DNS points at a public load balancer IP. You can instead make it private and keep all traffic inside your VNet - see the QueryRouter step in [Deploy workspace and e6data](/query-engine/guides/deployment/azure-in-vpc/deploy-workspace-and-e6data.md).

## What e6data provides during onboarding

| Item                          | Description                                                                         |
| ----------------------------- | ----------------------------------------------------------------------------------- |
| `TENANT_NAME`                 | Your e6data tenant identifier.                                                      |
| e6-operator CRDs              | Custom Resource Definitions, provided as a chart archive (`e6-operator-crds.tgz`).  |
| e6-operator Helm chart        | Operator controller chart (`e6-operator-<version>.tgz`).                            |
| Image versions                | Component image tags (operator, console, xds, envoy, and so on).                    |
| ACR access                    | A pull token for `e6labs.azurecr.io`, or an AcrPull role for your kubelet identity. |
| JWT configuration             | Issuer, JWKS URI, and audience for control-plane auth.                              |
| Service-token verifier secret | Shared value for `cp-verifier-shared` - required for `e6_svc_` service tokens.      |
| TLS wildcard certificate      | Only if your endpoint uses an e6data domain (for example `*.e6.run`).               |
| Monitoring credentials        | GreptimeDB endpoint, database, username, and password (if monitoring is enabled).   |

## Values to have ready

| Value              | Where it comes from                                                 |
| ------------------ | ------------------------------------------------------------------- |
| `WORKSPACE_NAME`   | A name you pick. Lowercase, alphanumeric, hyphens; 1–18 characters. |
| `TENANT_NAME`      | Your e6data onboarding engineer.                                    |
| `LOCATION`         | Azure region (for example, `eastus`).                               |
| `SUBSCRIPTION_ID`  | Your Azure subscription ID.                                         |
| `CONSOLE_HOSTNAME` | The hostname your workspace endpoint will use.                      |

## Next

Continue to [Configure registry, Kubernetes, and networking](/query-engine/guides/deployment/azure-in-vpc/configure-registry-kubernetes-networking.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/deployment/azure-in-vpc/prerequisites.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.