Prerequisites
This page outlines the requirements and prerequisites necessary for deploying AI/Run CodeMie on Microsoft Azure. Please ensure all requirements are met before proceeding with the installation.
Azure Account Requirements
Required Access and Permissions
To deploy AI/Run CodeMie on Azure, you need:
- Active Azure Subscription with sufficient quota for the required resources
- Contributor Role for the deployment user with the following permissions:
- Access to Entra ID App Registration to obtain Application ID and Secret
- Ability to create and manage Azure resources (AKS, networking, storage, etc.)
Complete Resource List
For a detailed list of all Azure resources that will be provisioned, refer to the Infrastructure Deployment section or review the Terraform modules in the deployment repository.
- Entra ID Access on the Azure portal to retrieve application details such as Tenant ID
DNS and Certificate Requirements
DNS and TLS certificate requirements depend on your access model:
- Public Access
- Private Access
If you require public internet access to AI/Run CodeMie:
- Azure DNS Zone must be created and domain delegated there
- Valid wildcard TLS certificate must be available for HTTPS connections
If you only require internal access within your organization:
- AI/Run CodeMie Terraform modules will automatically create a private DNS zone
- No external DNS delegation or public certificates are required
Network Requirements
Network Requirements
Outbound Connectivity
Your AKS cluster's Network Security Group (NSG) or firewall must allow outbound access to the following endpoints:
| Destination | Purpose |
|---|---|
europe-west3-docker.pkg.dev | AI/Run CodeMie container registry (Google Container Registry) |
quay.io | Third-party container images |
docker.io | Docker Hub container images |
registry.developers.crunchydata.com | PostgreSQL operator images |
| Your integration services | GitLab, GitHub, or other services you plan to use with CodeMie |
AI/Run CodeMie container images are hosted on Google Container Registry (GCR). You will need gcloud CLI installed on your deployment machine to authenticate and pull helm charts from GCR.
Inbound Connectivity on Corporate Services
If you plan to integrate AI/Run CodeMie with external corporate services (e.g., GitLab, GitHub, internal APIs):
- Configure the firewall on your external service to allow inbound traffic from the AI/Run CodeMie NAT Gateway public IP address
- This allows AI/Run CodeMie to make outbound API calls to your external services (e.g., GitLab API, GitHub API, internal services)
The AI/Run CodeMie NAT Gateway public IP address will only be available after infrastructure deployment. You will need to configure external service firewalls after the installation is complete.
Access Control Network List
To restrict access to AI/Run CodeMie and prevent unauthorized access from the public internet, prepare a list of allowed networks:
- Corporate network CIDR ranges from which users will access AI/Run CodeMie
- VPN network ranges if remote users connect via VPN
- Office locations and their public IP addresses or CIDR blocks
- Any other trusted networks that require access to the platform
Kubernetes Cluster Requirements
Requirements for AKS cluster deployment.
Administrative Permissions
The deployment user must have:
- AKS Admin permissions with the ability to create and manage namespaces
- Access to configure cluster-level resources (if deploying to an existing cluster)
Admission Control and Resource Requirements
If deploying to an existing AKS cluster, ensure that admission webhooks allow the creation of the following Kubernetes resources:
- NATS Messaging
- Keycloak Operator
- PostgreSQL Operator
- Security Context
Kubernetes API: Service (LoadBalancer type)
Purpose: NATS is a core component of the CodeMie Plugin Engine, providing messaging infrastructure for communication between the codemie-plugins CLI tool with MCP and the AI/Run CodeMie platform.
The LoadBalancer configuration depends on where the CLI tool will be executed:
| CLI Tool Execution Location | LoadBalancer Type | Description |
|---|---|---|
| Same VNet as AKS cluster | Internal LoadBalancer | Secure, private network communication within the VNet |
| External to AKS VNet | Public LoadBalancer | Cross-network communication when CLI is run outside the VNet |
Kubernetes APIs: ClusterRole, ClusterRoleBinding, Role, RoleBinding, Custom Resource Definitions (CRDs), Custom Resources (CRs)
Purpose: Manages Keycloak configuration including realms, clients, and user federation
Requires cluster-wide permissions for identity and access management operations.
Kubernetes APIs: ClusterRole, ClusterRoleBinding, Custom Resource Definitions (CRDs), Custom Resources (CRs)
Purpose: Manages PostgreSQL database instances and their lifecycle
Requires cluster-wide permissions for database provisioning and management.
Kubernetes API: Pod with securityContext
Requirement: All AI/Run CodeMie components require readOnlyRootFilesystem: false in their security context for proper operation
Deployment Machine Requirements
Required Software Tools
The following tools must be pre-installed and properly configured on your deployment machine (laptop, workstation, or VDI instance):
| Tool | Version | Purpose |
|---|---|---|
| Terraform | 1.5.7 | Infrastructure as Code provisioning |
| kubectl | latest | Kubernetes cluster management |
| Helm | 3.16.0+ | Kubernetes package management |
| gcloud CLI | latest | Authentication to AI/Run CodeMie container registry (GCR) |
| Docker | latest | Container operations |
| natscli | latest | NATS messaging CLI |
| nsc | latest | NATS security configuration |
| jq | latest | JSON processing and parsing |
| curl | latest | HTTP requests and file transfers |
htpasswd | linux package | Password hash generation |
Cloud-Specific Tools:
| Tool | Version | Purpose |
|---|---|---|
| Azure CLI | latest | Azure resource management |
| kubelogin | latest | AKS authentication plugin |
Required Repository Access
You will need access to the following repositories to complete the deployment:
- Terraform Modules: codemie-terraform-azure
- Helm Charts: codemie-helm-charts
If your deployment machine operates in an isolated environment without direct internet or repository access, the repositories can be provided as ZIP/TAR archives and transferred through approved channels.
Next Steps
Once all prerequisites are met, proceed to the Architecture Overview to understand the deployment architecture, or continue directly to Infrastructure Deployment to begin the installation process.