On-Premises Kubernetes Deployment Guide

This document outlines the steps required to install and deploy an on-premisess worker node to Kubernetes for OneTrust Data Discovery. Currently, this installation is only supported on Mac-OS and Linux systems. Users may have to install a Linux instance on their Windows machine if they lack access to Mac-OS.

Prerequisites

  • Kubernetes Environment, minimum requirements:

    • 5 nodes (each x 8 cores, 128 GB storage and 32 GB RAM)

    • Minimum 200 GB of persistence storage with 500 GB recommended

  • Deploy box machine to access the Kubernetes cluster:

    • Minimum: 4 CPU, 8GB RAM, 250 GB HDD, Ubuntu 18.04

    • Should have access to Internet to pull the OneTrust Docker Images from docker hub

    • Docker >=19.x ce + pre-installed (OneTrust can also install this)

  • Storage class available in the cluster that should support dynamic provisioning of PVC. See Kubernetes documentation on storage classes for more information.

    • Recommended NFS

  • Update the kube configuration to access the cluster.

    • Azure:

      CODE 
      az aks get-credentials --resource-group <rg_name> --name <cluster_name> --subscription <subscription_name>

    • AWS:

      CODE 
      aws eks --region <regionname> update-kubeconfig --name <cluster_name>

  • Latest version of kubectl, with a minimum version of 1.18

Creating the Worker Node

For more information on the supported installation methods, see the following:

  1. On the Data Discovery menu in the OneTrust application, select Worker Nodes. The Worker Nodes screen appears.

  2. Click the Add Worker Node button. The Create On-Premises Worker modal appears.

  3. Select either the Manual or Guided installation method to create/configure your new worker node.

  4. Once you've created a new node, select it from the Worker Nodes screen list. The Worker Details screen appears.

  5. Navigate to the Settings tab.

  6. Click the Copy button to copy the Worker Node ID. You will need this ID for the Scanner installation.



On-Premises Deployment to Kubernetes

  1. Download the on-premisess installer file package provided by OneTrust.

  2. Copy the .zip file (package) to the Ubuntu server by executing the following commands:

    CODE 
    scp -i <identity-file> <path-to-zip-file> <username>@<hostname>:

  3. Use the following to unzip the file:

    CODE 
    sudo apt install unzip
unzip <zip-file>

  4. Change the directory via cd data-discovery/k8s-deployment

  5. Copy the folder inventory_template to:

    CODE 
    cp -r inventory_template/ inventory/

  6. Edit the inventory/.envs with your preferred editor (nano, vi, etc.).

    CODE 
    vi inventory/.envs

  7. Use the following exported variables as templates with configuring your .envs:

    CODE 
    # Namespace configuration
export OT_NAMESPACE_DD="<namespace>" 

# Docker configuration
export OT_DOCKER_REGISTRY="<registry>"
export DOCKER_USER="<username>"
export DOCKER_PASSWORD="<password>" 

# On-prem K8s configuration
export IS_ONPREM_K8S="false" #set to true

# Storage class configuration
export STORAGE_CLASS_NAME="<storage-class-name>" #set to be NAME of storage class you have created.
#This storage class must support dynamic pvc creation.

# OneTrust Data Discovery Scanner Configuration
export OT_SERVICE_BASE_URL="<OT-Platform-URL>"
export OT_WORKER_NODE_ID="<Worker-Node-ID>"
export OT_SERVICE_CLIENT_ID="<Client-ID>"
export OT_SERVICE_CLIENT_SECRET="<Client-Secret>"


export EXTLIB_SHARED_STORAGE_NAME="${STORAGE_CLASS_NAME}"

  8. Run the installation script ./deploy.sh to get the usage of the installer.

  9. Follow the usage manual and run the installer as required (e.g. ./deploy.sh install).

  10. Output will be generated for you to verify all of your configuration. Enter y to continue.

  11. The installer will create all of the necessary namespaces, secrets, services, and deployments in the cluster based on your input values in the .envs file.

  12. The Vault Token and Key will be shown once the deployment is finished. Please wait while the installation completes.