Azure Kubernetes Service (AKS) Deployment Guide

This document outlines the steps required to install and configure the worker node for OneTrust Data Discovery on Azure Kubernetes Service (AKS) environments. This installation is supported on Mac-OS and Linux systems. Users may have to install a Linux instance if using a Windows machine. See Windows Subsystem for Linux documentation for more guidance.

Prerequisites

  • Azure environment, with the following:

    • 5 x Standard_D8s_v3 (8 vCPU(s), 32 GB RAM) nodes - Managed Disks, Premium SSD.

    • AKS subscription which can run the required cluster.

    • An owner/contributor user of the AKS subscription which will be used to create and manage the cluster.

    • Virtual Network and subnet in which the AKS cluster is getting deployed should have access to data sources.

    • Virtual Network and subnet in which the AKS cluster is getting deployed should have access to Internet to reach Docker Hub.

  • A local (laptop) or remote (Jump box/bastion) machine which will be used to access the cluster master. This machine must have installed the latest versions of Azure, the Azure CLI.

    • Minimum: 4 CPU, 8GB RAM, 250 GB HDD, Ubuntu 16+

    • Should have access to Internet to pull the OneTrust Docker Images from docker hub.

    • Docker >=19.x ce + pre-installed (OneTrust can also install this)

    • Node size support: D8s_v3 or higher.

  • Latest version of kubectl, with a minimum version of 1.30

Required Installations (Mac OS)

Installation

Command

Install Homebrew
CODE 
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)&quot"

Install Azure CLI
CODE 
brew update && brew install azure-cli

Install Kubectl
CODE 
brew install kubectl

Install gettext
CODE 
brew install gettext

Creating Resource Groups & Clusters

This process should be completed prior to installation. For additional information, see Deploy Azure Cluster using Azure CLI.

  1. Log in to the Azure Portal.

  2. Add a Resource Group.



  3. Add a Kubernetes Cluster to the Resource Group by providing the following information:



    Field
    Description
    Resource Group

    Titled after the Resource Group created in previous step.

    Kubernetes cluster name

    Resource Group name + '-aks'

    Region

    Match the region from previous step.

    Availability Zones

    For development and testing purposes, a single zone is adequate. For production, select 2 or 3 zones.

    Kubernetes Version

    Defaults to current version.

    Node Size

    Default is adequate but OneTrust recommends increasing up to D4 v3 or higher.

    Node Count

    OneTrust recommends 3+ nodes depending on volume.

  4. Add Azure Kubernetes Cluster Admin permissions to the IAM Role Assignments for the cluster. This is required for Entra ID installs (Installs using AD/RBAC)

    Note:

    Contributor role is recommended for the resource group where the AKS cluster is provisioned. If you are not able to provide this, Azure Kubernetes Service Cluster Admin role is needed.

On-Premises Deployment

  1. Download the On-Premise installer file package ot-onprem-installer-dd-k8s-latest.zip. You will need to unzip and place it in a location on your Linux VM.

    Note:

    Contact your dedicated OneTrust contact or OneTrust support to acquire this file.

  2. Navigate to data-discovery/k8s-deployment

  3. Copy the folder inventory_template to cp -r inventory_template inventory

  4. Change the directory to data-discovery/k8s-deployment/inventory

  5. There should be one existing file:

    • .env

    Note:

    If you do not see this file, hold down the Command, Shift and Period keys: cmd + shift + [.]

    You will have to manually create and edit the .env-azure file, as necessary.

  6. Open the .env file in a text editor and update the following fields.

    CODE 
    OT_NAMESPACE_DD="YOUR_RESOURCE_GROUP_NAME+ns"

OT_SERVICE_BASE_URL="YOUR_APP_ONETRUST_URL"
OT_WORKER_NODE_ID="YOUR_WORKERNODE_GUID"
OT_SERVICE_CLIENT_ID="YOUR_CLIENT_ID"
OT_SERVICE_CLIENT_SECRET="YOUR_CLIENT_SECRET"
    Note:

    Client ID and Client Secret are provided from the previous Client Credential creation step.

    If the Vault needs to be external to the deployment, you will need to be configure the .env file, as necessary.

  7. Save and close the file.

  8. Open the .env-azure file in a text editor and update the following fields.

    CODE 
    CLOUD_AZURE_SUBSCRIPTION="YOUR_CLOUD_SUBSCRIPTION_GUID"
CLOUD_AZURE_RG="YOUR_RESOURCE_GROUP"
CLOUD_AZURE_AKS_CLUSTER="YOUR_AKS_CLUSTER"

  9. Save and close the file.

  10. Open a terminal in data-discovery/k8s-deployment directory.

  11. Run the deployment script:

    CODE 
    ./deploy.sh install
    Note:

    When running the script, you will be asked to log into Azure.

  12. Confirm the configuration by pressing 'Y'.

  13. Document the Vault Token and Secret details in a secure, external location for later reference.