Azure configuration
Reference for the Azure resources and configuration values used in an In-VPC e6data deployment on AKS.
This reference summarizes the Azure resources and configuration an In-VPC (CloudPrem) deployment on AKS uses. For the step-by-step build, see Configure registry, Kubernetes, and networking.
Common variables
WORKSPACE_NAME
The e6data workspace name
TENANT_NAME
Your e6data tenant identifier (from onboarding)
CLUSTER_NAME
The AKS cluster name
RESOURCE_GROUP
Resource group containing the cluster
LOCATION
Azure region
SUBSCRIPTION_ID
Azure subscription ID
AZURE_STORAGE_ACCOUNT_NAME
ADLS Gen2 account for workspace metadata
Requirements and resources
AKS cluster
OIDC issuer and Workload Identity enabled (--enable-oidc-issuer --enable-workload-identity)
Identity
A User-Assigned Managed Identity, federated with the workspace service accounts
Storage
ADLS Gen2 account with Storage Blob Data Contributor assigned to the identity
Networking
An Azure Load Balancer fronting the workspace endpoint - public by default (protected by JWT auth), or internal/private with the azure-load-balancer-internal annotation. The cluster identity needs Network Contributor on the VNet
Registry
ACR pull access (a pull token, or AcrPull on the kubelet identity)
Outbound access on port 443 is required to app.e6.run, e6labs.azurecr.io, mcr.microsoft.com, quay.io, and the monitoring endpoint (if enabled). The public endpoint is the only inbound path; make it internal if you need all traffic to stay within the VNet.
See also
Last updated
Was this helpful?