Manual Worker Node Installation Overview

Overview

When creating the On-Premises worker node for OneTrust Data Discovery, you can opt to manually install the worker node for more direct configuration of the package.

Things to Know

  • Manual worker node installation should only be used for Helm-based installs.

  • OneTrust recommends the guided installation as the preferred deployment option. For more information, see Guided Worker Node Installation Overview.

Dedicated Deployment Guides

To create a worker node

Note:

Ensure you are running the latest version of kubectl, with a minimum version of 1.18.

  1. On the Data Discovery menu, select Worker Nodes. The Worker Nodes screen appears.

  2. Click the Add Worker Node button. The Create On-Premises Worker modal appears.

  3. Complete the fields, then select the Manual Install option.


  4. Click the Save Only or the Save & Download button. The worker node is now created and available in the Worker Nodes screen. Use the search bar to quickly locate the new worker node.
    Note:

    If using the Save & Download option, a .zip file will be downloaded. Unzip the file and follow the instructions in the README file to install the worker node..

To create client credentials

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Credentials. The Credentials screen appears.

  3. Click the Add button. The Client Credentials section of the Add Client Credential screen appears.


  4. In the Name field, enter a name for the client credential.
    Note:

    The name cannot be modified once the client credential is created.

  5. Optional: In the Description field, enter a description for the client credential.
  6. Optional: In the Access Token Lifetime field, select the amount of time that should pass before the access token expires. The following options are available:

    • 1 Hour

    • 1 Day

    • 1 Week

    • 1 Month

    • 1 Year

  7. Optional: Turn on the Restrict IP Addresses setting to restrict incoming communication to specific IP addresses. If this setting is enabled, enter an IP address in the Restrict IP Addresses field that appears. You can enter multiple IP addresses by clicking the Add icon button and entering an additional IP address in the field that appears.
  8. Click the Next button. The Scope section appears.

  9. Navigate to Data Discovery and enable the DATA_DISCOVERY scope.


  10. Click the Create button. The Client ID and Secret section appears.


  11. Click the Download button. A .txt file containing the Client ID and Client Secret details will download to your local system.
    Attention:

    The Client ID and Client Secret details should be saved to a secure, external location. The Client Secret cannot be retrieved or access again once you've left this screen.

  12. You can also click the Copy buttons to manually copy the Client ID and Client Secret.
  13. Click the Close button.

To generally deploy

  1. Download the on-premises installer file package provided by OneTrust.
  2. Copy the .zip file (package) to the Ubuntu server by executing the following commands:
    CODE 
    scp -i <identity-file> <path-to-zip-file> <username>@<hostname>:
  3. Unzip the file. You can use the following to assist:
    CODE 
    sudo apt install unzip
unzip <zip-file>
  4. Change the directory via cd data-discovery/onebox-deployment
  5. Copy the folder inventory_template to:
    CODE 
    cp -r inventory_template/ inventory/

  7. Edit inventory/.envs with your preferred editor (nano, vi, etc.). For example:
    CODE 
    vi inventory/.envs
  8. Use the following exported variables as templates when configuring your .envs:
    Note:

    The following sections in the .envs are required at minimum in addition to any custom configurations.

    • Namespace

    • Docker

    • Platform

    • Storage Class

    • Scanner

    • Credential

    • Shared Storage

    CODE 
    # Namespace configuration
export OT_NAMESPACE_DD="<namespace>" 

# Storage class configuration
export STORAGE_CLASS_NAME="<storage-class-name>" 

# Docker configuration
export OT_DOCKER_REGISTRY="<registry>"
export DOCKER_USER="<username>"
export DOCKER_PASSWORD="<password>" 

# OneTrust Data Discovery Scanner Configuration
export OT_SERVICE_BASE_URL="<OT-Platform-URL>"
export OT_WORKER_NODE_ID="<Worker-Node-ID>"
export OT_SERVICE_CLIENT_ID="<Client-ID>"
export OT_SERVICE_CLIENT_SECRET="<Client-Secret>"
  9. Run the installation script ./deploy.sh to get the usage of the installer.
  10. Follow the usage manual and run the installer as required (e.g. ./deploy.sh install)
  11. Output will be generated for you to verify all of your configuration. Enter y to continue.
  12. The installer will create all of the necessary namespaces, secrets, services, and deployments in the cluster based on your input values in .envs file.

Updating Worker Nodes

For the manual overview, you will need to acquire the latest installation package from OneTrust. For more information on the available update methods, please see Updating Worker Nodes.

Auto-Scaling Pods

You can automatically scale down the number of pods not in use to help manage resourcing, CPU utilization, and other custom defined system metrics.

During Installation - Recommended

  1. Within the the utils folder, copy the auto-scaling variable and paste it into the .envs or .guided envs.

  2. You will need to update the following variable to true. It will remain false by default.

    The default grace period for scaling is 60 minutes, after which the pods will be scaled down. This can be adjusted to a custom idle time.

    JSON 
    export ENABLE_AUTO_SCALING="${ENABLE_AUTO_SCALING:-false}"
export OT_AUTO_SCALE_IDLE_TIME="${OT_AUTO_SCALE_IDLE_TIME:-60m}"

  3. Once added, continue with the deployment process.

Post Installation

  1. Auto-scaling can also be performed post installation with the following commands:

    CODE 
    kubectl set env deployment/datadiscovery-onprem-agent OT_AUTO_SCALE_ENABLED=true -n <namespace_name>

kubectl set env deployment/datadiscovery-onprem-agent OT_AUTO_SCALE_IDLE_TIME=30m - <namespace_name>

Adding Proxy Support

A proxy server can be configured to ensure communications with OneTrust are functional and secured. The input requires the Proxy Server Address to be updated for the following variable in the .envs file:

CODE 
#Optional proxy server, used when connecting to OneTrust
export HTTP_PROXY=""

For additional information on configuring proxy variables during installation, see Using Proxy Variables During Worker Node Installation.