Deploy AI Data Engine as a multi-node deployment with a proxy

10/24/2026 Contributors

Deploy AI Data Engine (AIDE) as a multi-node deployment from NetApp Console when your Kubernetes cluster and the installer host reach the internet only through an outbound proxy. This procedure includes every step of the multi-node deployment, along with the proxy steps. If your cluster and installer host have direct internet access, use Deploy AI Data Engine as a multi-node deployment instead.

For the supported proxy types and the complete parameter reference, see Learn about proxies for AI Data Engine. For the endpoints to allow on your proxy, see Outbound internet access.

Before you begin

Permissions and access

You have Organization admin or greater permissions in NetApp Console.
You have a kubeconfig with cluster-admin access to the target cluster. If kubectl isn't on your PATH, the installer downloads it to the tools directory.

Kubernetes cluster

Your Kubernetes cluster meets the multi-node prerequisites described in AIDE multi-node deployment prerequisites and AIDE requirements.
The aide namespace exists on the cluster before you run the install command.
The nodes that schedule AI Data Engine workloads have the node labels described in Node labels.
A configured StorageClass (default name: aide-sc) is available on the cluster and used for AIDE's stateful backing services.

Storage and NetApp Console

An NFS server with an exported path is available and reachable from the cluster for the AIDE config volume.
A NetApp Console agent is deployed and reachable from the cluster nodes. The Console agent IP is required to run the install command.

Proxy

You have configured your proxy to allow the endpoints in Outbound internet access.
You know the proxy host, port, and scheme (http or https). If the proxy requires authentication, you also know the username and password.
If you use an HTTPS proxy with a privately signed certificate, you have the CA certificate as a PEM file, or a flat directory of .crt and .pem files, on the installer host.

Use the installer only for the first installation of AIDE. Do not use it to upgrade AIDE. After installation, the AIDE operator manages upgrades. For information about upgrades, contact NetApp Support.

How the proxy applies to a multi-node deployment

In a multi-node deployment, you own the Kubernetes cluster. The installer configures the AI Data Engine workloads for the proxy and doesn't change your nodes. You must configure the container runtime and certificate trust on every node before you run the installer.

The installer checks the proxy from the installer host only. It doesn't check your nodes. If a node's container runtime isn't configured, the installation completes and pods on that node later show ImagePullBackOff.

The installer also doesn't install operating system packages on your nodes. Verify that the nodes have the packages that your environment requires, and that your package managers have the appropriate proxy configuration if required in your environment.

Configure the nodes for the proxy

Before you run the installer, configure the container runtime on every node, control plane and worker, to pull images through your proxy. Use the same proxy host, port, and scheme that you give the installer.

The nodes must reach the NetApp container registry host and the image layer bucket listed in Outbound internet access through the proxy.
Keep cluster-internal and node addresses out of the proxy.
If you use an HTTPS proxy with a privately signed certificate, the nodes must also trust the proxy CA certificate.

The steps depend on your Kubernetes distribution. See the documentation for your distribution.

Copy the install command

In NetApp Console, navigate to AI data hub > AI Data Engine.

The AI Data Engine landing page appears.
Select Deploy AI Data Engine.
Select the Multi-node deployment option and select Next.
Select your configuration size:
- Small: recommended for environments with up to approximately 1 billion files.
- Medium (Default): recommended for environments with up to approximately 3 billion files.
- Large: recommended for environments with up to approximately 6 billion files.
  
  These sizes are recommended baselines, not hard limits. An AIDE multi-node deployment requires custom sizing with NetApp for environments beyond 6 billion files; see flexible sizing guidelines for details.
  
  The wizard generates the install command with the configuration size you select. You don't need to edit the command to set the size.
Copy the install command displayed in the wizard to an editor.

The install command downloads the installer from d13jb5dapseb36.cloudfront.net and starts it in one step. That download doesn't use the proxy.

If the installer host can reach d13jb5dapseb36.cloudfront.net directly, skip the next section and continue with Create a proxy password file. Run the install command as copied. The installer prompts you for the proxy settings. To supply them on the command line instead, see Non-interactive installation with command-line flags.
If the installer host reaches the internet only through a proxy, the command stops at the download. Complete the next section first. Only the installer host needs this. Your nodes don't download the installer.

Download the installer through the proxy

Download the installer yourself, and then run the install command from ./install-enterprise.sh onward.

Get the installer onto the installer host. Use any method that your environment allows, and then place the file on the installer host.

To download the installer from the installer host through your proxy:
```
mkdir -p ~/aide && cd ~/aide
curl -fsSL -x http://PROXY_HOST:PROXY_PORT \
  https://d13jb5dapseb36.cloudfront.net/aide/latest/aide-installer.tar.gz -o aide-installer.tar.gz
```
If the proxy requires a username, add --proxy-user USER to the curl command. If you omit the password, curl prompts for it, so it isn't saved in your shell history.
- Use https:// in the -x address if your proxy listens on HTTPS.
- If your proxy uses a privately signed certificate, add --proxy-cacert CA_FILE, or add the CA certificate to the installer host trust store first.
- If you use an HTTPS proxy and a curl version earlier than 8.3, the download can pause for about a minute. Ubuntu 22.04 includes such a version. Wait for it to finish.
  
  Alternatively, download https://d13jb5dapseb36.cloudfront.net/aide/latest/aide-installer.tar.gz from another computer, and then copy it to the installer host with scp or your usual file transfer method.
Extract the installer, and change to the installer folder:
```
tar -xzf aide-installer.tar.gz
cd installer
```
Run every following command from inside this installer folder. The version.txt file in the folder shows the installer build version.
Prepare the install command that you copied from NetApp Console. It downloads the installer and then runs ./install-enterprise.sh with your parameters. Because you already downloaded the installer:
- Delete everything before ./install-enterprise.sh, so the command starts with ./install-enterprise.sh.
- If the command was wrapped in quotes, for example bash -c '…‘, delete the single quote (') at the very end.
- If the command contains --no-proxy, delete it.
  
  The remaining command looks like this:
  ./install-enterprise.sh --flavor <small|medium|large> --kubeconfig <kubeconfig-path> --nfs-server <nfs-server> --nfs-data-share <export-path> --registry <registry> --account-id <account-id> --organization-id <organization-id> --agent-id <agent-id> --cm-host <console-agent-ip>
  Keep every parameter that follows ./install-enterprise.sh exactly as it appears in the command that you copied. The installer prompts you for the proxy settings. See Interactive guided setup.

Create a proxy password file

If your proxy requires authentication and you want to supply the password without being prompted for it, for example in an automated deployment, create a password file before you run the installer. Otherwise, skip this section. The installer prompts for the password with hidden input.

The file contains only the password. Enter the password exactly as it is, without percent-encoding special characters.

Create the file as the same user who runs ./install-enterprise.sh, because the installer reads the file as that user.

umask 077
read -rs -p 'Proxy password: ' P && printf '%s' "$P" > $HOME/.aide-proxy-password; unset P; echo
chmod 600 $HOME/.aide-proxy-password

Delete the file after the installation completes.

Supply the proxy settings

The installer prompts you for the proxy settings. Run the install command as copied from NetApp Console, and answer the prompts. For automated deployments that must run without prompts, see Non-interactive installation with command-line flags.

Use the same proxy host, port, scheme, and CA certificate that you configured on the nodes.

Use the interactive guided setup

When you run the install command in a terminal without --proxy-host or --no-proxy, the installer asks the following questions. If you pass a value as a parameter, the installer doesn't ask for it again.

Prompt What to enter

Prompt	What to enter
`Configure outbound proxy? (y/N)`	Enter `y`.
Proxy host or IP	Enter the proxy host name or IPv4 address, optionally with a port (`host:port`).
Proxy scheme (`https` or `http`)	Enter the protocol that your proxy listens on. The default is `https`.
Proxy port	Enter the proxy port. The default is `443` for HTTPS and `80` for HTTP.
Proxy type	Press Enter to accept the default.
CA certificate for the proxy's own certificate (HTTPS only, optional)	Enter the path to the CA file or directory. Press Enter if a public CA signed the proxy certificate.
Does the proxy require a username and password? (y/N)	If yes, enter the username, and then enter the password twice. The installer doesn't echo the password.

Configure outbound proxy? (y/N)

Enter y.

Proxy host or IP

Enter the proxy host name or IPv4 address, optionally with a port (host:port).

Proxy scheme (https or http)

Enter the protocol that your proxy listens on. The default is https.

Proxy port

Enter the proxy port. The default is 443 for HTTPS and 80 for HTTP.

Proxy type

Press Enter to accept the default.

CA certificate for the proxy's own certificate (HTTPS only, optional)

Enter the path to the CA file or directory. Press Enter if a public CA signed the proxy certificate.

Does the proxy require a username and password? (y/N)

If yes, enter the username, and then enter the password twice. The installer doesn't echo the password.

Without a terminal, the installer never prompts. Pass --proxy-host to use a proxy, and --proxy-password-file if the proxy needs a password.

Use command-line flags for setup

Use command-line flags for automated or other non-interactive deployments that must run without prompts. The flags are optional. The installer prompts you for any proxy information you don't supply.

Add the proxy parameters to the end of the install command, after the last existing parameter.

If you run the install command as copied from NetApp Console, add the parameters inside the quotes, before the closing quote.
If you downloaded the installer and shortened the command, add the parameters to the end of the shortened command.

If the command contains --no-proxy, remove it. Keep every other parameter from the install command. For the description and default of each parameter, see Proxy configuration parameters. The following examples show only the proxy parameters.

HTTP proxy with a username and password

--proxy-host proxy.example.com \
--proxy-port 3128 \
--proxy-scheme http \
--proxy-user svc-aide \
--proxy-password-file $HOME/.aide-proxy-password

HTTPS proxy with a privately signed certificate and no authentication

--proxy-host proxy.example.com \
--proxy-port 8443 \
--proxy-scheme https \
--proxy-ca-cert $HOME/proxy-ca.pem

If your proxy doesn't require authentication, omit --proxy-user and --proxy-password-file.
If you specify --proxy-user without --proxy-password-file, the installer prompts you for the password when you run it from a terminal.

With an HTTP proxy, the proxy username and password are sent in clear text. Use an HTTPS proxy when the proxy requires authentication.

Run the installation

Run the install command from a host that can reach your Kubernetes cluster. If you downloaded the installer, run the command from the installer folder.

Before the installer downloads anything, it checks from the installer host that the proxy responds, that the proxy accepts your credentials, and that the proxy certificate is valid for the scheme you chose. If the check fails, the installer stops and names the cause. The check doesn't test whether the cluster nodes can reach the proxy.

Installation takes about 30 minutes to complete. Timeouts and retries might occur, and this is normal.
If you didn't pass all of the proxy parameters, answer the proxy prompts. See Interactive guided setup.
Answer the installer's confirmation prompts to continue the installation.
- The installer shows the Kubernetes cluster selected by your kubeconfig, including the context, cluster name, and API server. Answer yes only if that is the cluster you intend to use. If it is the wrong cluster, stop the installer, select the correct kubeconfig context, and run the installer again.
- The installer asks you to confirm that the prerequisites for a multi-node deployment are complete. Answer yes to continue.
- The installer detects the IP address of the node that runs the AI Data Engine NGINX ingress and asks you to confirm it. Press Enter to keep the address shown, or type a different address. Use an address that can be reached from outside the cluster. If the detected address is an internal cluster address, type the reachable address instead. Do not enter the Console agent address.
Monitor the progress screen until the success screen appears and confirms that the AIDE installation is complete.

Result

Your AI Data Engine multi-node deployment is deployed and connected to NetApp Console. You can now connect a data source to start scanning.

Check the proxy after installation

The AI Data Engine operator logs the proxy that it uses. The log never includes the password. To check the proxy, run the following command from a host that can reach your cluster. Replace <kubeconfig> with the path to your kubeconfig file:

kubectl --kubeconfig <kubeconfig> -n aide logs deploy/aide-operator -c chart-fetcher | grep -m1 'proxy enabled'

If kubectl isn't on your PATH, the installer downloaded it to the tools directory. Run <tools-dir>/kubectl instead. The default tools directory is /opt/netapp/aide/.aide-installer-tools.

The line shows the proxy endpoint, whether authentication is on, and whether a CA certificate is mounted.