# Provision infrastructure

Provision one isolated Kubernetes environment per MPC shard, then install the same `crypto-vault`
Helm chart on each cluster. Sodot provides complete example Terraform for AWS and GCP. Terraform is
optional and never installs the chart.

## Choose a cloud

| | AWS | GCP |
|---|---|---|
| Cluster | EKS | Regional GKE |
| Key Store compute | EC2 nodes with AWS Nitro Enclaves | GKE Confidential node pool |
| Database | RDS for PostgreSQL | Cloud SQL for PostgreSQL |
| Storage encryption | AWS KMS with IRSA | Cloud KMS with Workload Identity |
| Cross-cluster services | AWS PrivateLink | Private Service Connect |
| Front door | NLB, ACM, and Route53 or your DNS | GKE Ingress, Google-managed certificate, and Cloud DNS or your DNS |
| Guided setup | [Provision on AWS with Terraform](/deploy/provision-aws) | [Provision on GCP with Terraform](/deploy/provision-gcp) |

:::warning\[Different confidential-compute guarantees]
On AWS, the Key Store runs inside a measured Nitro Enclave and KMS access can be restricted by enclave
attestation. On GCP, the Key Store runs as a pod on a GKE Confidential Node. Confidential Nodes protect
the node VM's memory from the host and hypervisor, but Cloud KMS access is controlled by Workload
Identity rather than per-workload attestation. Choose the model that satisfies your security
requirements.
:::

## What must exist

Whichever provisioning method you use, provide:

1. Three Kubernetes clusters, with one shard per isolated AWS account or GCP project.
2. Confidential compute for every Key Store workload: Nitro Enclaves on AWS or a GKE Confidential
   node pool on GCP.
3. One managed PostgreSQL instance per cluster. The hub also hosts the Orchestrator database.
4. One KMS key and workload identity per shard for storage encryption.
5. Private network paths between the hub and both spokes for Key Store, Policy Server, NATS, and relay
   traffic. See [Architecture and topology](/deploy/architecture#required-network-paths).
6. TLS and DNS for the hub UI and, if exposed separately, the Orchestrator API.
7. Kubernetes image-pull credentials in all three namespaces.

The example Terraform for each cloud provisions these resources and writes the per-cluster values files
and kubeconfigs to `./out/`. If you use your own infrastructure code, produce equivalent values files
using the [Helm values reference](/deploy/helm/values-reference).

## Handoff to Helm

Both examples use the same file names and shard mapping:

| File | Cluster |
|---|---|
| `out/cluster-0.values.yaml` and `.kubeconfig` | Spoke, shard 0 |
| `out/cluster-1.values.yaml` and `.kubeconfig` | Hub, shard 1 |
| `out/cluster-2.values.yaml` and `.kubeconfig` | Spoke, shard 2 |
| `out/extra.values.yaml` | Optional non-HA overlay |

After all three clusters are reachable, continue to [Install with Helm](/deploy/helm/install).