---
title: "On-Prem Prerequisites"
description: "Everything you need before deploying Middleware on premises: cluster sizing, AWS EKS and Azure AKS prerequisites, credentials and a checklist."
section: "OnPrem"
breadcrumb: "OnPrem > Prerequisites"
canonical: "https://docs.middleware.io/features/on-prem/setup"
---
# On-Prem Prerequisites

Below is everything needed before deploying Middleware on premise. The installation guide is shared by the Middleware team during onboarding.

**At a glance, you will need:**

- **From Middleware team** — registry username + token, installation guide
- **Kubernetes cluster** — v1.25+, sized as per the table below, kubeconfig with cluster-admin access
- **CLI tools** — `helm` (v3.8+), `kubectl`, `openssl` on the machine running the install
- **Storage class** — a default storage class with dynamic provisioning (~260 GB of volumes are created)
- **Object storage** — S3 bucket / Blob container with access credentials
- **Domain** — one domain for Middleware, used by UI and agents (example: `mw.your-company.com`)
- **SSL** — certificate and key files for that domain
- **Network egress** — Middleware registry, public container registries, your object storage, `app.middleware.io` (emails)
- **Credentials** — owner email + password, decided before install (datastore passwords are generated by the install kit)

---

## Cluster Sizing

| Tier | Daily ingest | AWS (EKS) | Azure (AKS) | Total capacity |
| --- | --- | --- | --- | --- |
| Evaluation | up to 25 GB/day | 3 × `m6i.xlarge` | 3 × `D4s_v5` | 12 vCPU / 48 GB |
| Standard | up to 500 GB/day | 4 × `m6i.2xlarge` | 4 × `D8s_v5` | 32 vCPU / 128 GB |
| High volume | ~1 TB/day | 6 × `m6i.2xlarge` | 6 × `D8s_v5` | 48 vCPU / 192 GB |

- Add one 8-core node per additional 100 GB/day beyond the table.
- No burstable instances (`t2`/`t3`/`B-series`) in production.
- Node root disk: 100 GB per node (50 GB is enough for the evaluation tier).
- Optional: a dedicated database node pool — 1 node, 8 core / 32 GB, taint `dedicated=database:NoSchedule` (ClickHouse tolerates it; set `clickhouse.clusters.db1.nodeSelector` in the values file to pin ClickHouse there).
- A load balancer is assigned automatically to Middleware's ingress on deploy.

---

## Cloud-Specific Prerequisites

### AWS (EKS)

- Make sure the **EBS storage driver addon** is installed.
- **Storage class**: verify there is one storage class when you create the cluster and ensure it's marked as default.
- Keep all default settings which AWS suggests while creating the cluster for permissions and roles.
- To get kubeconfig, run this in cloudshell:

  ```bash
  aws eks update-kubeconfig --region {{region_in_which_cluster_deployed}} --name {{your_cluster_name}}
  cat /home/cloudshell-user/.kube/config
  ```
- Add users in cluster IAM access entries (Click on cluster > Access tab).
- **S3 bucket** to store telemetry data, and an IAM user (access key ID + secret) that can access only this bucket. Attach this policy to that user:

  ```json
  {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads"],
      "Resource": ["arn:aws:s3:::YOUR_BUCKET", "arn:aws:s3:::YOUR_BUCKET/*"]
    }]
  }
  ```

### Azure (AKS)

- A **storage account**, its key and secret.
- A Blob container to store telemetry data.
- Get kubeconfig from cloudshell of Azure.

---

## Credentials

> ⚠️ **Passwords are fixed at the first install.** Changing them later needs a manual rotation procedure.

- **Owner email + password** — first UI login. The account is activated during install, so no activation email is sent.
- **Datastore passwords** (Postgres, Redis, ClickHouse) — generated automatically by the install kit and stored in your values file; keep that file for every upgrade.
- **Password rules** — minimum 8 characters, letters and digits (not only numbers), always in quotes in YAML.

---

## Checklist

- [ ] Registry credentials and installation guide received
- [ ] Cluster created as per sizing table, kubeconfig working with cluster-admin
- [ ] `helm`, `kubectl`, `openssl` installed
- [ ] Default storage class present
- [ ] Bucket/container created with access credentials
- [ ] Domain and SSL certificate ready
- [ ] Outbound access approved
- [ ] Owner email and password decided

---

Need assistance or want to learn more about Middleware? Get in touch with us via our Contact Us page or join our Slack channel.