> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GKE cluster and resources (existing cluster)

> Requirements for node pools, labels, storage, GCS buckets, and GCP IAM when installing Arize AX on an existing GKE cluster.

## Overview

Use this page when you already have a GKE cluster and will create or align supporting resources (buckets, service accounts, node pools) to match Arize AI's expectations.

## Storage buckets

Create two Google Cloud Storage buckets: one for gazette data and one for ArizeDB data.

## Node pools

Use at least two node pools:

* **Base pool** — general workloads and ingestion. Label nodes with `arize=true` and `arize-base=true`.
* **ArizeDB pool** — ArizeDB historical workloads. Label nodes with `arize=true` and `druid-historical=true`.

If you cannot use separate pools, you can deploy on a shared pool by setting `historicalNodePoolEnabled: false` in `values.yaml` (see [Prerequisites](/docs/ax/selfhosting/getting-started/prerequisites) for sizing context).

## Storage classes

Prefer `premium-rwo` and `standard-rwo` where available; these are used by default in the GCP distribution.

## Service account and permissions

Attach a GCP service account with permissions that allow Arize AX to use GCS, BigQuery jobs, Artifact Registry pulls, and Vertex AI predictions as required by your deployment. Typical permission families include:

* `bigquery.jobs.create`
* `storage.objects.create`, `storage.objects.delete`, `storage.objects.get`, `storage.objects.list`
* `artifactregistry.repositories.downloadArtifacts`
* `aiplatform.endpoints.predict`

Exact bindings should follow your organization’s least-privilege standards.

### Workload Identity (recommended)

If you use [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity), grant the Kubernetes service accounts the ability to impersonate the GCP service account (`roles/iam.workloadIdentityUser`) for:

* `arize/arize`
* `arize-operator/arize-operator`
* `arize-spark/spark`

### JSON key (no Workload Identity)

If you do not use Workload Identity, provide the service account JSON key via Helm values (base64-encoded) as documented in the [detailed walkthrough (GCP)](/docs/ax/selfhosting/installation/gcp/install-arize-detailed).

## Namespaces

The Helm chart can create or use existing namespaces: `arize`, `arize-operator`, and `arize-spark`.

## Optional image registry

A GCR or Artifact Registry is optional when pulling from Arize AI's central registry. If you use a private registry, set `pushRegistry` and `pullRegistry` in `values.yaml`.

## Next steps

* [Install Arize AX (quick start)](/docs/ax/selfhosting/installation/gcp/install-arize-quickstart) or [detailed walkthrough (GCP)](/docs/ax/selfhosting/installation/gcp/install-arize-detailed)
* [Terraform-based provisioning](/docs/ax/selfhosting/installation/gcp/cluster-terraform) if you prefer to create infrastructure from the distribution modules