--- title: "Prerequisites" slug: "fortanix-armor-on-premises-prerequisites" updated: 2026-08-19T13:15:18Z published: 2026-08-19T13:15:18Z canonical: "support.fortanix.com/fortanix-armor-on-premises-prerequisites" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Prerequisites ## 1.0 Introduction This article describes the prerequisites for installing and deploying Fortanix Armor in a customer-managed Azure Kubernetes environment (cloud-hosted). ## 2.0 Prerequisites The following prerequisites must be completed before deploying Fortanix Armor. > [!NOTE] > NOTE > > These components are **not installed as part of the Fortanix Armor on-premises deployment** and must be provisioned by the customer. ### 2.1 Kubernetes Cluster Requirements - Ensure that a Kubernetes cluster (for example, Azure Kubernetes Service (AKS)) is provisioned and accessible. - A Kubernetes cluster should be configured with separate node pools: - **System node pool**: Used for core Kubernetes components and general workloads. This pool can use non-SGX VM instances and should have a minimum of three nodes for high availability. - **User node pool** (SGX-enabled): Used for running Fortanix Armor workloads that require SGX. This pool must use SGX-capable VM instances. The minimum supported VM size is Standard_DC8_v3 (DC8_v3), or a later supported SGX-enabled VM size. SGX must be enabled according to the cloud provider configuration (for example, by enabling the SGX add-on in AKS). - The node pools should be running Linux. Fortanix has validated this deployment on Ubuntu 24.x version. - Kubernetes version: 1.34.8 or later (or supported non-end-of-life version). | **INITIAL AKS VERSION** | **SUPPORTED UPGRADE VERSIONS** | | --- | --- | | **1.34.8** | 1.35.0 | | **1.35.0** | 1.34.x (minor updates), 1.36.0 | | **1.36.0** | This is latest AKS version | - The cluster must have a minimum of three nodes for user pool. - Ensure that the `KUBECONFIG` environment variable is set in the environment used to run Helm commands for installing the Fortanix Armor Kubernetes Operator. For example, ```bash export KUBECONFIG= ``` Where, `<path-to-kubeconfig>` is the file path to your Kubernetes configuration file. For example: `$HOME/.kube/config`. ### 2.2 Node Requirements - **Configure SGX Support on the Kubernetes cluster**: ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-20260430-062933.png) **Figure 1: SGX plugin running** - The Kubernetes cluster must include node pools with SGX-capable VM instances to run Fortanix Armor workloads. - Intel SGX must be enabled and functional on these nodes. - The Intel SGX Device Plugin must be installed in the cluster and expose the following resources: > [!NOTE] > NOTE > > For Azure AKS, SGX support requires enabling the SGX add-on when creating the cluster. *For detailed steps, refer to* [*Microsoft official documentation*](https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-solutions-sgx). - `sgx.intel.com/enclave` - `sgx.intel.com/provision` - The Kubernetes cluster **must not** have K8ssandra installed. - The Kubernetes cluster **must** have an Ingress Controller installed. *For steps to install the Ingress Controller, refer to the* [*Installation Guide - On-premises*](/v1/docs/fortanix-armor-installation-guide-on-prem#60-certmanager). - The Kubernetes cluster **must** have cert-manager installed. *For steps to install cert-manager, refer to the* [*Installation Guide - On-premises*](/v1/docs/fortanix-armor-installation-guide-on-prem#60-certmanager). - You **must** have Helm installed and access configured to deploy resources to the cluster. - Certificates - External or Internal Certificate Authority (CA) to sign Fortanix Armor UI and API certificates. - Customer-managed Cassandra deployments are not supported. #### 2.2.1 Configure User Node Pool (SGX-Enabled) Labelling in AKS Fortanix Armor SGX workloads, such as `node-agent` and `sgx-quote-helper` should run only on SGX-enabled nodes. In AKS clusters with multiple workload types, Kubernetes might schedule these workloads on nodes that do not support SGX if SGX-specific scheduling constraints are not configured. To ensure correct scheduling behavior, install Kubernetes Node Feature Discovery (NFD): 1. Run the following commands to install NFD: ```bash helm repo add nfd https://kubernetes-sigs.github.io/node-feature-discovery/charts helm install nfd nfd/node-feature-discovery \    --namespace node-feature-discovery \    --create-namespace ``` > [!NOTE] > NOTE > > The `node-feature-discovery` version must be 0.15.0 or later. 2. After installing NFD, verify that SGX-enabled nodes have the following label: ```bash feature.node.kubernetes.io/cpu-security.sgx.enabled=true ``` ### 2.3 Image Registry Access - Fortanix Armor container images are hosted in a Fortanix-managed container registry. Customers must have access credentials to pull the required images during deployment. - **The customer must create a Support Ticket with Fortanix to access the Fortanix OCI registry.** *For more information on the Fortanix registry configuration, refer to* [*Deploy Fortanix Armor Kubernetes Operator*](/v1/docs/fortanix-armor-installation-guide-on-prem#70-deploy-fortanix-armor-kubernetes-operator). - An image pull secret must be created in each namespace used by Fortanix Armor to allow access to the registry. - The customer is responsible for maintaining and periodically refreshing the image pull secrets to ensure continued access to the registry. ### 2.4 Networking and Load Balancing Requirements Fortanix Armor requires minimal external network exposure and standard Kubernetes-based load balancing. *For detailed traffic flow, refer to the* [*Fortanix Armor Architecture Diagram (on-premises)*](/v1/docs/armor-on-premises-architecture). | **Protocol** | **Inbound/ Outbound** | **Port Number** | **Load Balancer Use (Yes/No)** | **Purpose** | | --- | --- | --- | --- | --- | | TCP | Inbound | 443 | | HTTPS- Used for static content. | | TCP | Inbound | 443 | | HTTPS- Used for Web UI and API access. | | TCP | Outbound | 443 | | Internet – Azure Attestation service. | | TCP | Outbound | 443 | | Internet - [https://github.com/cert-manager](https://github.com/cert-manager) to install cert-manager. | | TCP | Outbound | 443 | | Internet – Fortanix OCI registry (oci://cr.download.fortanix.com/) to pull the Fortanix Armor Kubernetes Operator | | TCP | Outbound | 443 | | Azure’s Provisioning Certificate Caching Service (PCCS) endpoint [https://global.acccache.azure.net](https://global.acccache.azure.net) | | TCP | Outbound | 443 | | Internet – Pull nginx ingress oci://ghcr.io/nginx/ | | TCP | Outbound | 443 | | Azure blob storage for Armor platform backup | | TCP | Outbound (Optional) | 514 | | If external Syslog is configured for audit logging | ### 2.5 Operator Scope and Namespace Recommendation - Only one instance of the Fortanix Armor Kubernetes Operator can be deployed per Kubernetes cluster. - The operator is installed in a specific namespace (for example, `armor`), but operates with cluster-wide scope, allowing it to potentially manage Fortanix CCM and Fortanix Key Insight resources across multiple namespaces. - As part of the deployment, a supporting K8ssandra operator (used to manage Cassandra) is also deployed with cluster-wide scope. ## 3.0 Where to go from here For steps to deploy Fortanix Armor in a customer-managed Kubernetes environment (on-premises or cloud-hosted), click [*here*](/v1/docs/fortanix-armor-installation-guide-on-prem).