Guided Worker Node Installation Overview

You will need at least the following to support worker node creation with OneTrust Data Discovery. The platform-specific installation articles in Data Discovery Knowledge Base will provide additional detail around what support is needed for the given deployment.

• Environment with nodes to support at least 8 vCPU(s), 32 GB RAM

• A subscription which can run the required cluster

• An owner/contributor user of the given subscription which will be used to access, create, and manage the cluster

• A local (laptop) or remote (Jump box/bastion) machine which will be used to access the cluster master. Minimum: 4 CPU, 8GB RAM, 250 GB HDD, Ubuntu 16+

  Note:

  Not applicable for Onebox Microkubernetes Service deployments.

• Virtual Network and subnet in which the given cluster is getting deployed should have access to data sources

• Virtual Network and subnet in which the given cluster is getting deployed should have access to Internet to reach Docker Hub

• Docker >=19.x ce + pre-installed (OneTrust can also install this)

• Latest version of kubectl to ensure full compatibility of services

1. On the Data Discovery menu, select Setup > Worker Nodes. The Worker Nodes screen appears.

2. Click the Add Worker Node button. The Create Worker Node modal appears.

3. Enter a unique name for this new worker node. The name you enter here will be populated as the namespace in the follow screen. It will default to lowercase with no spacing in order to meet the namespace formatting requirements.

4. Select the Guided Install option.

   • The Managing Organization field will default to the parent org level.

   • The Worker Node Owner field will default to the current user.

   • The Label field can be used to provide a description of this node uses or purpose(s).

   Optional: With the guided installation option, you can also choose to create the new node by copying an existing guided worker node template configuration.

   Note:

   For more information on worker node owners and email alerts, see Managing Email Notifications for Worker Nodes.

   
   
   

5. Click the Next button. The Platform Provider and Credential Store screen appears. Proceed to Configuring the worker node.

   If using the worker node template option, the Enter PIN modal appears. See step #7 for more.

6. In order to use an existing worker node configuration, please enter the PIN created as part of the templated worker node creation. For more information on how to create and obtain a PIN, see Worker Node PIN.

   Note:

   OneTrust 202403.1.0 supports storing worker node PINs in the given namespace as a Kubernetes secret to maintain PIN access and easily retrieve the PIN if forgotten or lost.

   
   
   

7. Click the Next button. The Platform Provider and Credential Store screen appears.

By selecting the Guided Install option, you can then proceed with configuring the worker node by following the wizard steps. In this example, we're creating a worker node to use with the Azure platform. The majority of these fields will be generally available to any platform provider.

See Data Discovery Deployment Options for more information on available systems.

1. In the Platform Provider and Credential Store screen, select your platform provider. The interface will auto-populate fields applicable to the chosen system. Here, we have selected AWS.

2. In the Platform Provider block, select your desired provider from the field and then complete the fields for given configuration.

   See the provider information tables below for more information.

   
   
   

3. In the Credential Store block, select your desired credential store from the field and then complete the fields with your applicable vault details.

   
   
   
   Note:

   For more information on support and configuration of credential vaults, see Credential Vault Options for Data Sources.

   Field

   Description

   Credential Store

   Select from the available Credential Store choices. The selection will populate unique fields for each store option.

   Deploy with Native Authentication (specific to AWS Secrets Manager)

   Enable this setting to delegate permissions using IAM role(s) to make certain API calls for fetching credentials.

   Store Options

   AWS Secrets Manager

   Azure Key Vault

   CyberArk - Conjur

   Google Secrets Manager

   HashiCorp Vault - Open Source (Internal)

   HashiCorp Vault - Open Source (External)

   HashiCorp Vault - Enterprise

   Note:

   See Data Discovery Deployment Options for additional information on current deployment options for OneTrust Data Discovery.

4. Click the Next button. The Advanced Options screen appears.

This PIN is used for encryption as part of extra security for your worker node installation.

1. In the Set Up a Pin screen, create a pin by following the requirements and recommended prompts.

   
   
   

2. Click the Save button. If successful, the worker node will be created and the Worker Details screen appears.

3. To retrieve a worker node pin, log in to the kubernetes cluster:

   CODECopy

   az account set --subscription <subscription_name> az aks get-credentials --resource-group <resource_group_name> --name <cluster_name>

   az account set --subscription <subscription_name>
   az aks get-credentials --resource-group <resource_group_name> --name <cluster_name>

4. Run the following command to extract the PIN:

   CODECopy

   kubectl get secret wn-pin-secret -n <namespace> -o jsonpath='{.data.PIN}' | base64 --decode

   kubectl get secret wn-pin-secret -n <namespace> -o jsonpath='{.data.PIN}' | base64 --decode

Now that you've created a worker node, it's ready to use for your worker node installation.

1. From the Settings tab, click the Launch Install button.

   
   
   

2. The Launch Install modal appears with a command to copy so you can get started with your worker node installation.

   
   
   
   Note:

   Log in to the local or remote machine that will be used to access the cluster master. This is the location where the installer scrip will need to be extracted.

3. Run the curl command in the command prompt.

4. Run the deployment script and follow the on-screen instructions.

   CODECopy

   /installer.sh

   /installer.sh

For the manual overview, you will need to use the installer script command found above in Settings screen. For more information on the available update methods, please see Updating Worker Nodes.

A proxy server can be configured to ensure communications with OneTrust are functional and secured. The input requires the Proxy Server Address to be updated for the following variable in the .envs file:

#Optional proxy server, used when connecting to OneTrust
export HTTP_PROXY=""

For additional information on configuring proxy variables during installation, see Using Proxy Variables During Worker Node Installation.

In the event that any variable is not currently configurable via the OneTrust UI, you can still manage the given variable directly through the .guided-envs file. This also helps avoid potential configuration mismatches during deployment.

1. Navigate to the directory: datadis.../k8s.../inventory

2. Open the .guided-envs file.

3. Locate the required variable that needs to be updated.

4. Use the relevant keywords to search for the variable in the .guided-envs file. For example, if you're updating the region configuration, search for "region" to quickly locate the related variable.

5. Modify the variable as necessary. For example:

   • Replace: export AWS_VAULT_REGION="<incorrect_value>"

   • With: export AWS_VAULT_REGION="<correct_value>"

6. To redeploy the configuration, move up one directory using command: cd...

7. Execute the deployment script with: ./deploy.sh install