Oracle Container Engine for Kubernetes (OKE) Deployment Guide

This document outlines the steps required to install and configure the OneTrust Data Discovery worker node for Oracle Container Engine for Kubernetes (OKE) environments. Currently, this installation is only supported on Mac-OS and Linux systems. Users may have to install a Linux instance on their Windows machine if they lack access to Mac-OS.

Prerequisites

  • OKE environment, with the following:

    • Minimum: 3 x (8 vCPU(s), 32GB RAM) nodes

      Recommended: 5 x (8 vCPU(s), 32 GB RAM) nodes

    • OKE subscription which can run the required cluster.

    • An owner/contributor user of the instance which will be used to create and manage the cluster.

    • Virtual Network and subnet in which the Kubernetes cluster is getting deployed should have access to data sources.

    • Virtual Network and subnet in which the Kubernetes cluster is getting deployed should have access to Internet to reach Docker Hub.

  • OKE instance which can access by OKE worker nodes.

  • A local (laptop) or remote (Jump box/bastion) machine which will be used to access the cluster master.

    • Minimum: 4 CPU, 8GB RAM, 250 GB HDD, Ubuntu 16+

    • Should have access to Internet to pull the OneTrust Docker Images from docker hub.

    • Docker >=19.x ce + pre-installed (OneTrust can also install this)

  • Latest version of kubectl, with a minimum version of 1.22

Creating Client Credentials

  1. Click the gear icon button in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Credentials. The Credentials screen appears.

  3. Click the Add button. The Client Credentials section of the Add Client Credential screen appears.



  4. In the Name field, enter a name for the client credential.

    Note:

    The name cannot be modified once the client credential is created.

  5. Optional: In the Description field, enter a description for the client credential.

  6. In the Access Token Lifetime field, select the amount of time that should pass before the access token expires. The following options are available:

    • 1 Hour

    • 1 Day

    • 1 Week

    • 1 Month

    • 1 Year

  7. Optional: Turn on the Restrict IP Addresses setting to restrict incoming communication to specific IP addresses. If this setting is enabled, enter an IP address in the Restrict IP Addresses field that appears. You can enter multiple IP addresses by clicking the Add icon button and entering an additional IP address in the field that appears.

  8. Click the Next button. The Scope section appears.

  9. Navigate to Data Discovery and enable the DATA_DISCOVERY scope.



  10. Navigate to Integration and enable the INTEGRATIONS scope.



  11. Click the Create button. The Client ID and Secret section appears.



  12. Click the Download button. A .txt file containing the Client ID and Client Secret details will download to your local system.

    Attention:

    The Client ID and Client Secret details should be saved to a secure, external location. The Client Secret cannot be retrieved or access again once you've left this screen, unless it is reset.

  13. You can also click the Copy buttons to manually copy the Client ID and Client Secret.

  14. Click the Close button.

On-Premises Deployment

Before proceeding with the installation you have to fill the .envs file with the necessary information from Oracle Cloud Platform. Open the file by executing nano .env-ocp, then provide the following:

Oracle Cloud Plaform Details

Description

Oracle User

The OCID from the User details page in Oracle.

Example: ocid1.user.<REALM>.[REGION][.FUTURE USE].<UNIQUE ID>

Fingerprint

The fingerprint shall correspond to the specific private key.

Example: 12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef

Oracle Tenancy

The tenancy OCID from the Tenancy Details page in Oracle.

Example: ocid1.tenancy.<REALM>.[REGION][.FUTURE USE].<UNIQUE ID>

Oracle Region

The region for the Oracle Cloud infrastructure.

Example: us-ashburn-1

Oracle Compartment

The Oracle Cloud infrastructure compartment containing the cluster

OKE Cluster

Container Engine for Kubernetes can be used to create new Kubernetes clusters.

Example: ocid1.cluster.<REALM>.[REGION][.FUTURE USE].<UNIQUE ID>

OKE Cluster Endpoint IP

The IP address of the endpoint for the cluster.

Namespace

The existing namespace used for this deployment.

Key File

API requests will be signed with your private key, and Oracle will use the public key to verify the authenticity of the request. The private key can be acquired from the Oracle Cloud Platform.

Enter the key content in PEM format (not SSH-RSA format):

CODE 
-----BEGIN PRIVATE KEY-----
2MIIBIjANBgkqhkiG9w0BAQE...
3...
4-----END PRIVATE KEY-----

Execute Script

  1. Download the On-Premise installer file package ot-onprem-installer-dd-k8s-latest.zip. You will need to unzip and place it in a location on your Linux VM.

    Note:

    Contact your dedicated OneTrust contact or OneTrust support to acquire this file.

  2. Navigate to data-discovery/k8s-deployment

  3. Copy the folder inventory_template to cp -r inventory_template inventory

  4. Change the directory to data-discovery/k8s-deployment/inventory

  5. There should be one existing file:

    • .envs

    Note:

    If you do not see this file, hold down the Command, Shift and Period keys: cmd + shift + [.]

    You will have to manually create and edit the .env-ocp file, as necessary.

  6. Open the .env file in a text editor and update the following fields.

    CODE 
    OT_NAMESPACE_DD="YOUR_RESOURCE_GROUP_NAME+ns"

OT_SERVICE_BASE_URL="YOUR_APP_ONETRUST_URL"
OT_WORKER_NODE_ID="YOUR_WORKERNODE_GUID"
OT_SERVICE_CLIENT_ID="YOUR_CLIENT_ID"
OT_SERVICE_CLIENT_SECRET="YOUR_CLIENT_SECRET"
    Note:

    Client ID and Client Secret are provided from the previous Client Credential creation step.

    If the Vault needs to be external to the deployment, you will need to be configure the .env file, as necessary.

  7. Update the following fields based on your Oracle account information:

    CODE 
    export ORACLE_USER=<oracle-user> 
export ORACLE_FINGERPRINT=<your-oracle-fingerprint>
export ORACLE_TENANCY=<your-oracle-tenant>
export ORACLE_REGION=<your-oracle-region>
export ORACLE_COMPARTMENT=<your-oracle-compartment>
export ORACLE_CLUSTER=<your-oracle-cluster>
export ORACLE_ENDPOINT_IP=<your-oracle-endpoint>
export ORACLE_PEM_FILE_CONTENT="<private-key-file-content>"

  8. Save and close the file.

  9. Open the .env-opc file in a text editor and update the following fields.

    • For NFS, use ocp-onetrust-dd

    • For Standard, use oci

    CODE 
    export STORAGE_CLASS_NAME="ocp-onetrust-dd" or “oci”
export EXTLIB_SHARED_STORAGE_NAME="ocp-onetrust-dd"

  10. Save and close the file.

  11. Open a terminal in data-discovery/k8s-deployment directory.

  12. Run the deployment script:

    CODE 
    ./deploy.sh install

  13. Confirm the configuration by pressing 'Y'.

  14. Document the Vault Token and Secret details in a secure, external location for later reference.