# Prerequisites (/docs/enterprise/helm/installation/prerequisites)



<Callout type="info">
  Installation Journey
  **Prerequisites** (you are here) → [Quickstart](/enterprise/helm/installation/quickstart/) or [Standard Install](/enterprise/helm/installation/standard-install/) → [Configure](/enterprise/helm/configuration/helm-values/)
</Callout>

Before installing NetBox Enterprise with the netbox-enterprise Helm chart, verify your environment meets these requirements.

## Kubernetes Version [#kubernetes-version]

The nbe-operator chart requires **Kubernetes 1.33 to 1.35** (Helm enforces `>=1.33.0 <1.36.0`).

```bash
kubectl version
```

## OpenShift [#openshift]

<Callout type="warn">
  NetBox Enterprise does not currently support installation on OpenShift.

  * NetBox Enterprise runs its pods with a fixed UID/GID of `1000`, which OpenShift's `restricted-v2` SCC rejects in favor of per-namespace UID ranges.
  * Some init containers do not request non-root execution, which restricted SCCs also reject.
  * These security context values are set by the NetBox Enterprise operator and cannot be overridden through Helm values.
  * Granting the `anyuid` SCC is not a supported workaround.
</Callout>

## Required Tools [#required-tools]

| Tool                                               | Minimum Version          | Purpose                           |
| -------------------------------------------------- | ------------------------ | --------------------------------- |
| [Helm](https://helm.sh/docs/intro/install/)        | 3.x                      | Chart installation and management |
| [kubectl](https://kubernetes.io/docs/tasks/tools/) | Matching cluster version | Cluster interaction and debugging |

## Resource Requirements [#resource-requirements]

### Cluster Sizing [#cluster-sizing]

| Environment                  | vCPU   | Memory (RAM) | Disk Space |
| ---------------------------- | ------ | ------------ | ---------- |
| **Production** (recommended) | 8 vCPU | 24 GB        | 100 GB SSD |
| **Non-production** (minimum) | 4 vCPU | 16 GB        | 50 GB SSD  |

These recommendations account for the full stack: operator, NetBox application, workers, PostgreSQL, Redis, and Diode components. SSD or NVMe storage is recommended for database performance.

### Per-Component Defaults [#per-component-defaults]

The chart ships with the following resource defaults. These are starting points; production deployments should allocate resources based on the cluster sizing above.

| Component                   | CPU Request | Memory Request | CPU Limit | Memory Limit |
| --------------------------- | ----------- | -------------- | --------- | ------------ |
| Operator                    | 100m        | 128Mi          | 500m      | 512Mi        |
| NetBox app (per replica)    | 200m        | 750Mi          | 1000m     | 1500Mi       |
| NetBox worker (per replica) | 100m        | 128Mi          | 1000m     | 1500Mi       |
| PostgreSQL (PGO-managed)    | N/A         | N/A            | N/A       | N/A          |
| Redis                       | 250m        | 256Mi          | N/A       | N/A          |

For Diode components (if enabled):

| Component  | CPU Request | Memory Request | CPU Limit | Memory Limit |
| ---------- | ----------- | -------------- | --------- | ------------ |
| Reconciler | 100m        | 256Mi          | 500m      | 512Mi        |
| Ingester   | 100m        | 256Mi          | 500m      | 512Mi        |
| Auth       | 50m         | 128Mi          | 200m      | 256Mi        |
| Hydra      | 100m        | 256Mi          | 500m      | 512Mi        |

<Callout type="warn">
  The per-component defaults are conservative requests to allow scheduling. For production workloads, ensure your nodes have sufficient headroom above these minimums; the cluster sizing recommendations above should be used as the target.
</Callout>

## Registry Access [#registry-access]

NetBox Enterprise is distributed through NetBox Labs' Replicated registries: the Helm charts are pulled from `registry.enterprise.netboxlabs.com` and the container images from `proxy.enterprise.netboxlabs.com`. Authenticate to the chart registry with your license credentials (your email as the username and your license ID as the password) before installing - the [Quickstart](/enterprise/helm/installation/quickstart/) and [Standard Installation](/enterprise/helm/installation/standard-install/) both begin with a `helm registry login` step.

You do not need to create an image-pull secret by hand. The bundled Replicated SDK provisions the `netbox-enterprise-helm-registry` pull secret at install time, so every component - including Redis - can pull its image from the proxy registry.

To pull images from your own private registry instead, see [Private Registry](/enterprise/helm/guides/private-registry/).

## Chart Dependencies [#chart-dependencies]

The netbox-enterprise chart automatically installs these dependencies (can be disabled individually):

| Dependency                                                                                         | Version | Purpose                                                               | Toggle                   |
| -------------------------------------------------------------------------------------------------- | ------- | --------------------------------------------------------------------- | ------------------------ |
| [PGO](https://access.crunchydata.com/documentation/postgres-operator/) (Crunchy Postgres Operator) | 6.0.1   | Manages internal PostgreSQL                                           | `pgo.enabled`            |
| [Redis Operator](https://ot-container-kit.github.io/redis-operator/)                               | 0.24.0  | Manages internal Redis                                                | `redis-operator.enabled` |
| [Replicated SDK](https://docs.replicated.com/)                                                     | 1.18.0  | License management                                                    | `replicated.enabled`     |
| [Traefik](https://doc.traefik.io/traefik/) (subchart alias `gateway`)                              | 40.2.0  | Bundled Gateway API controller, disabled by default for Helm installs | `gateway.enabled`        |

## Gateway API CRDs (Gateway Routing Only) [#gateway-api-crds-gateway-routing-only]

The operator routes external traffic through the Kubernetes Gateway API when gateway routing is enabled in the CR (`spec.gateway`) and the Gateway API CRDs are present, and falls back to Ingress resources otherwise (see [Routing Mode](/enterprise/helm/configuration/ingress-tls/#routing-mode)). If you enable the bundled Traefik controller (`gateway.enabled: true`), install the `netbox-enterprise-crds-gateway` chart **before** the main chart:

```bash
helm install netbox-enterprise-crds-gateway \
  oci://registry.enterprise.netboxlabs.com/netbox-enterprise/stable-v2/netbox-enterprise-crds-gateway \
  --namespace netbox --create-namespace
```

The chart vendors the Gateway API v1.5.1 standard CRDs. Skip it if you bring your own Gateway API controller (your cluster already has the CRDs) or stay on the Ingress path. Embedded Cluster installs it automatically.

The upload-size cap (`spec.gateway.maxRequestBodyBytes`) is enforced through a Traefik `Middleware`, which needs the `traefik.io` CRDs. Embedded Cluster ships them automatically via the `netbox-enterprise-crds-traefik` chart. On Helm with the bundled Traefik controller, install that chart too if you want the cap enforced -- without it the operator skips the Middleware (no cap) and logs a warning. Bring-your-own gateways manage their own `traefik.io` CRDs.

<Callout type="info">
  When using an **external PostgreSQL** database, you can disable PGO with `pgo.enabled: false`. Similarly, set `redis-operator.enabled: false` when using external Redis. See the [Configuration](/enterprise/helm/configuration/postgresql) section for details.
</Callout>

## RBAC Requirements [#rbac-requirements]

The operator requires cluster-level or namespace-level RBAC permissions depending on the `rbac.scope` setting:

* **`cluster`** (default): Creates `ClusterRole` and `ClusterRoleBinding`. The operator watches for `NetBoxEnterprise` resources across all namespaces.
* **`namespace`**: Creates `Role` and `RoleBinding` in the release namespace only. The operator watches only the namespace where it is installed.

The operator service account needs permissions to manage Deployments, Services, ConfigMaps, Secrets, PVCs, Jobs, CronJobs, Ingresses, Gateway API resources (Gateways, HTTPRoutes, GRPCRoutes, ReferenceGrants), and the CRDs for PostgreSQL and Redis operators.

## Persistent Storage [#persistent-storage]

The cluster must have a default `StorageClass` or you must specify one explicitly. Storage is used for:

* PostgreSQL data (default: 4Gi)
* NetBox media files (default: 10Gi)
* NetBox scripts (default: 1Gi)
* Redis persistence (if enabled)

<Callout type="info" title="External Storage">
  For production deployments, consider using external managed services (e.g., AWS RDS for PostgreSQL, ElastiCache for Redis) instead of in-cluster storage. See [PostgreSQL Configuration](/enterprise/helm/configuration/postgresql) and [Redis Configuration](/enterprise/helm/configuration/redis) for external database setup.
</Callout>

## Next Steps [#next-steps]

* [Quickstart](/enterprise/helm/installation/quickstart/): Get running in 5 minutes with minimal configuration
* [Standard Installation](/enterprise/helm/installation/standard-install/): Full installation with custom values