1. Prerequisites & access

Owner: Cloud Ops · Time: ~30 min
You’ll finish with: tools installed, release artifacts in hand, and cloud access confirmed.
Before you start: ask IT to begin their Entra steps — you need two of its values by Step 3.

Tools

Install on your workstation:

• Terraform 1.6+
• kubectl
• Helm 3.16+ (with OCI registry support)
• jq, openssl, curl, and a DNS lookup tool such as dig
• Git

Then the CLI and Kubernetes authentication plugin for your cloud:

Provider	CLI	Kubernetes authentication
AWS	AWS CLI v2	AWS CLI EKS credential plugin
Google Cloud	gcloud	gke-gcloud-auth-plugin
Azure	Azure CLI 2.60+	kubelogin (az aks install-cli)

From the Arbium team

Ask Arbium for:

• The target release version — X.Y.Z in Helm commands, chaindb-vX.Y.Z in the Terraform repository.
• A GHCR credential with read:packages for the private chart and images.
• Your license key.
• The approved LLM-provider credential, if LLM-backed jobs are enabled.

The chart is published at:

oci://ghcr.io/try-caret/charts/chaindb

Keep the chart version, image version, and Terraform release tag aligned — they are released together. Terraform for all three clouds ships in the release-tagged try-caret/arbium-terraform repository. Never deploy from an unpinned main.

From your own organization

Collect before Step 3:

• A DNS name you control for the Arbium endpoint, and permission to create records under it.
• Your Entra tenant ID and Arbium Agent client ID, from the walkthrough’s Entra steps.
• If the fleet console is enabled: the Arbium Admin client ID and secret, the admin-group object ID, and the SCIM group IDs.

Cloud account access

You need permission to create networking, managed Kubernetes, managed PostgreSQL, identities, secret storage, load balancing, and certificates. Use a dedicated environment or resource boundary, and remote Terraform state that your organization manages.

Confirm you are in the right account before applying anything:

# AWS
aws sts get-caller-identity --profile <profile>

# Google Cloud
gcloud auth list
gcloud config get-value project

# Azure
az account show --query '{subscription:id, tenant:tenantId, user:user.name}'

Next

Continue to 2. Provision your cloud.