Architecture
How a Serverless e6data deployment on Azure works - managed compute in e6data's subscription, your ADLS Gen2 data read keylessly via Workload Identity.
In a Serverless deployment on Azure, e6data runs and manages the compute. You grant e6data read-only, keyless access to your data; everything else is handled by the platform.
Where things run
Compute runs in the e6data-managed Azure subscription (AKS across three availability zones). A public load balancer fronts ingress (HTTPS / gRPC, with SSO and JWT), and engine egress leaves through a NAT gateway. Your ADLS Gen2 storage is reached read-only via Workload Identity / OIDC federation - no keys are stored. The platform syncs releases and status with the Control Plane at app.e6.run.
Where your data lives
Your data stays in your Azure account. e6data does not copy or move it - the engine reads directly from your ADLS Gen2 storage using a federated identity you grant, with only the Storage Blob Data Reader role. You can revoke access at any time by removing the role assignment.
The two planes
Control Plane
The shared e6data Console where you manage your organization, workspaces, account, and billing.
Compute Plane
The per-workspace environment (opened with Open) where you manage catalogs and clusters and run queries. The compute is managed by e6data.
See also
Last updated
Was this helpful?