1. Prerequisites & access

Owner: Cloud Ops

Complete the common checklist, then confirm the requirements for the cloud you will use.

Common tools

Install these on the operator workstation:

• Terraform 1.6 or later
• kubectl
• Helm 3.16 or later with OCI registry support
• jq, openssl, curl, and a DNS lookup tool such as dig
• Git, for checking out the Terraform release

Install the CLI and Kubernetes authentication plugin for your cloud:

Provider	CLI	Kubernetes authentication
AWS	AWS CLI v2	AWS CLI EKS credential plugin
Google Cloud	gcloud	gke-gcloud-auth-plugin
Azure	Azure CLI 2.60+	kubelogin (az aks install-cli)

Arbium release artifacts

Ask the Arbium team for:

• The target release version, written as X.Y.Z in Helm commands and chaindb-vX.Y.Z in the Terraform repository.
• A per-customer GHCR credential with read:packages for the private chart and runtime images.
• The Arbium license key for this deployment.
• The approved LLM-provider credential, if LLM-backed jobs are enabled.

The chart is published at:

oci://ghcr.io/try-caret/charts/chaindb

The chart references version-matched images under ghcr.io/try-caret/. Keep the chart version, image version, and Terraform release tag aligned.

AWS, Google Cloud, and Azure Terraform are distributed through the release-tagged try-caret/arbium-terraform mirror. Never deploy from an unpinned main branch.

Customer inputs

Collect these before Step 3:

• A customer-controlled DNS name for the Arbium endpoint.
• Permission to create the required DNS validation and application records.
• The customer Entra tenant ID and Arbium Agent client ID from IT Step 1.
• If the fleet console is enabled: the Arbium Admin client ID and secret, the admin-group object ID, and the SCIM provisioning group IDs.

Cloud account permissions

The deployer must be able to create the resources in the selected provider guide, including networking, managed Kubernetes, managed PostgreSQL, identities, secret storage, load balancing, and certificates. Use a dedicated environment or resource boundary and customer-managed remote Terraform state.

Before applying Terraform, verify the active identity and account:

# AWS
aws sts get-caller-identity --profile <profile>

# Google Cloud
gcloud auth list
gcloud config get-value project

# Azure
az account show --query '{subscription:id, tenant:tenantId, user:user.name}'

Choose a provider

Continue to 2. Provision your cloud.