Helm Chart Deployment Guide

Acting as an application package manager running atop Kubernetes, Helm charts simplify the deployment of containerized applications. In Helm, these packages are called charts, which is a package of pre-configured Kubernetes resources. A release is a specific instance of a chart which has been deployed to the cluster using Helm. For more information on this Kubernetes-based deployment, please see official documentation from Helm.

Prerequisites

  • Obtain the on-premisess installer folder and nfs-provisioner package provided by Onetrust. This will be copied into the terminal.

  • Kubernetes environment, with the following:

    • Minimum: 5 x 2 CPU, 4GB RAM nodes

    • Recommended: 3 x 4 CPU, 16GB RAM nodes

  • Deploy box machine which will be used to access the Kubernetes Cluster

    • Minimum: 4 CPU, 8GB RAM, 250 GB HDD, Ubuntu 18.04 

    • Should have access to Internet to pull the OneTrust Docker Images from docker hub

    • Docker >=19.x ce + pre-installed (OneTrust can also install this)

  • Storage class available in the cluster that should support dynamically provision the PVC (recommended). For more information, see Kubernetes Storage Classes

  • Update the kube configuration to access the cluster.

    • Azure Example:

      CODE 
      az aks get-credentials --resource-group <rg_name> --name <cluster_name> --subscription <subscription_name>

    • AWS Example:

      CODE 
      aws eks --region <regionname> update-kubeconfig --name <cluster_name>

  • Latest version of kubectl, with a minimum version of 1.22

Upgrading from Zookeeper to KRaft

Note:

OneTrust recommends switching to KRaft only for new installations.

Switching from Zookeeper to KRaft (Kafka Raft) simplifies your architecture by eliminating the need for an external Zookeeper cluster. With KRaft, you benefit from faster setup and easier maintenance. Additionally, Zookeeper may be deprecated soon, making KRaft a better choice.

To switch to KRaft, update the following properties in your values.yaml:

  • "IS_KRAFT_MODE_ENABLED": "true"

  • "KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP": "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT"

For detailed information on the migration, see Migrating Worker Nodes from Zookeeper to KRaft.

Creating the Worker Node

  1. On the Data Discovery menu, select Worker Nodes. The Worker Nodes screen appears.

  2. Click the Add Worker Node button. The Create On-Premises Worker modal appears.

  3. Provide the necessary details, then select the Manual Install option.



  4. Click the Save button. The worker node is now created and available in the Worker Nodes screen. Use the search bar to quickly locate the new worker node.

  5. Use the Summary, Logs, and Settings tab to edit, review, or further configure the worker node.

  6. The Worker Node ID can be copied in the Settings tab. You will need to reference this ID during installation.



To create client credentials

  1. Click the gear icon button in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Credentials. The Credentials screen appears.

  3. Click the Add button. The Client Credentials section of the Add Client Credential screen appears.


  4. In the Name field, enter a name for the client credential.
    Note:

    The name cannot be modified once the client credential is created.

  5. Optional: In the Description field, enter a description for the client credential.
  6. Optional: In the Access Token Lifetime field, select the amount of time that should pass before the access token expires. The following options are available:

    • 1 Hour

    • 1 Day

    • 1 Week

    • 1 Month

    • 1 Year

  7. Optional: Turn on the Restrict IP Addresses setting to restrict incoming communication to specific IP addresses. If this setting is enabled, enter an IP address in the Restrict IP Addresses field that appears. You can enter multiple IP addresses by clicking the Add icon button and entering an additional IP address in the field that appears.
  8. Click the Next button. The Scope section appears.

  9. Navigate to Data Discovery and enable the DATA_DISCOVERY scope.


  10. Click the Create button. The Client ID and Secret section appears.


  11. Click the Download button. A .txt file containing the Client ID and Client Secret details will download to your local system.
    Attention:

    The Client ID and Client Secret details should be saved to a secure, external location. The Client Secret cannot be retrieved or access again once you've left this screen.

  12. You can also click the Copy buttons to manually copy the Client ID and Client Secret.
  13. Click the Close button.

Manually Deploying with Helm

  1. Download the on-premises installer file package by clicking the Download Installer button in the Worker Details screen. See prerequisites above required for VM and Cluster setup.



  2. The Download Installer Package modal will present download options for Kubernetes or Onebox.



  3. Copy the .zip file (package) to the Ubuntu server by executing the following commands:

    CODE 
    scp -i <identity-file> <path-to-zip-file> 
<username>@<hostname>:/home/azureuser

  4. Unzip the file. You can use the following to assist:

    CODE 
    sudo apt install unzipa.  
unzip <zip-file>

  5. Download the nfs-provisioner package provided by OneTrust.

  6. Copy the folder to the Ubuntu Server by executing the following command:

    CODE 
    scp -i <identity-file> <path-to-zip-file> <username>@<hostname>:/ home/azureuser

  7. Connect to VM using the below command:

    CODE 
    sudo ssh -I <pem file path> azureuser@IP

  8. Navigate to data-discovery/k8s-deployment/dd-helm-chart

  9. Edit the values.yaml file:

    • Enter the namespace value in OT_NAMESPACE_DD

    • Enter storage class name in STORAGE_CLASS_NAME

      CODE 
      For azure 'managed-premium'
For aws 'gp2'
For aws + fargate 'aws-efs-onetrust-dd'
For gcp : 'standard' (or 'gcp-onetrust-dd' for NFS based)
For external nfs storage: 'nfs-onetrust-dd' (make sure you have provided the nfs configuration),
For ocp : 'oci' (or 'ocp-onetrust-dd' for NFS based)
For minikube : 'standard

    • Enter EXTLIB_SHARED_STORAGE_NAME in STORAGE_CLASS_NAME

      CODE 
      For azure 'azurefile-onetrust-dd'
For aws(aws + fargate) 'aws-efs-onetrust-dd'(make sure you have provided the efs configurations below)
For gcp : 'gcp-onetrust-dd'
For external nfs storage 'nfs-onetrust-dd' (make sure you have provided the nfs configuration), 
For ocp: 'ocp-onetrust-dd'
For nfs server as pod 'nfs-pod-onetrust-dd', set it as 'none' if extlib is not needed
For minikube : 'standard'

    • Enter Platform Provider in PLATFORM_PROVIDER

      CODE 
      For azure 'AZURE'
For aws 'AWS',
For aws + fargate 'AWS_FARGATE'
For gcp 'GCP'
For Openshift 'OPENSHIFT'
For onprem-k8s  'ONPREM'
For Oracle Cloud Platform 'ORACLE'
For Minikube 'MINIKUBE'

    • Enter docker registry values in:

      CODE 
      “OT_DOCKER_REGISTRY": "docker.onetrust.io",
"DOCKER_USER": "datadiscovery-readonly",
"DOCKER_PASSWORD": "89r9thK1DBy/E3x1inSdtkLubMUrWkc0t5YeT1EGy4+ACRCQG8Hn"

    • Under worker node settings, enter the value for:

      PYTHON 
      "OT_SERVICE_BASE_URL": "" (This would be your tenant URL. For eg: https://beta.onetrust.com, https://app.onetrust.com)
"OT_WORKER_NODE_ID": "" (You would get this value from OneTrust tenant under worker node section)

    • Under worker node settings, enter the value for:

      CODE 
      "OT_SERVICE_CLIENT_ID": ""
"OT_SERVICE_CLIENT_SECRET": ""(For generating client id and secret, you would need to go to OneTrust tenant -> Settings -> Client Credentials. Select Data Discovery and generate)

  10. By default, worker node is configured to deploy an internal hashicorp vault in your namespace. If you are planning to use an external vault to store data source credentials, such as Azure Key Vault, AWS Secret Manager, Google Secret Manager, or CyberArk Vault, please change the value for:

    • "CREDENTIAL_PROVIDER": "",

      System

      Value

      Azure Key Vault

      "AZURE_VAULT"

      AWS Secret Manager

      "AWS_SECRET_MANAGER"

      CyberArk Vault

      "CYBER_ARK_VAULT"

      External Hashicorp

      "EXTERNAL_VAULT"

      Google Secret Manager

      "GOOGLE_SECRET_MANAGER"

    • If you choose any of the above external vaults for CREDENTIAL_PROVIDER, empty the value for OT_VAULT_URI in your values.yaml i.e. "OT_VAULT_URI": "",

    • Depending on the type of vault you end up configuring, there are additional values that need to be entered. For example, if you choose AZURE_VAULT as your credential provider, then the following values will need to be filled out.

      CODE 
      "AZURE_VAULT_BASE_URI": "",
"AZURE_VAULT_CLIENT_ID": "",
"AZURE_VAULT_CLIENT_SECRET": "",
"AZURE_VAULT_TENANT_ID": "",
”SCANNER_CREDENTIAL_REFERENCE_TYPE”: "AZURE",
”OT_CREDENTIAL_STORE_TYPES”: “AZURE”,
      Note:

      For more configuration options for different types of vaults, see Credential Vault Options for Data Sources.

  11. Navigate to nfs-server-provisioner folder.

  12. Edit the values-templates.yaml file:

    • Enter the Platform Provider name

    • Make the below value changes:

      Note:

      Reach to your OneTrust representative for docker credentials. If you do not want to use OT docker credentials, you may use your own.

      CODE 
      imagePullSecret:
    registryURL: "docker.onetrust.io"
    username: ""
    password: ""
    image:  
    repository: docker.onetrust.io/nfs-server-provisioner

    • Enter the storage class name. This should be same as the one entered in values.yaml.

  13. Make sure you have the kubectl command installed. If not, run the below commands after coming out from nfs-provisioner folder:

    CODE 
    curl -LO https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl

sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

kubectl version –client

  14. Run the below commands to connect to the cluster:

    CODE 
    sudo apt install azure-cli

az login

az account set --subscription <subscription id>

az aks get-credentials --resource-group <resourcegroup name> --name <clustername>

  15. Install helm on your VM using the below commands:

    CODE 
    curl -fsSL -o get_helm.sh 
#See https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3

chmod 700 get_helm.sh

./get_helm.sh

  16. Navigate to data-discovery>k8s>inventory_template and create a text file and add below details:

    CODE 
    CLOUD_AZURE_SUBSCRIPTION="YOUR_CLOUD_SUBSCRIPTION_GUID"
CLOUD_AZURE_RG="YOUR_RESOURCE_GROUP"
CLOUD_AZURE_AKS_CLUSTER="YOUR_AKS_CLUSTER"

  17. Remain in the nfs-server-provisioner folder and execute the below command, then check the status of the pod:

    CODE 
    helm upgrade --install nfs-provisioner --namespace nfs-provisioner --create-namespace . -f values-template.yaml

  18. Create a namespace whose value should be the same to that entered in values.yaml in dd-helm-chart

  19. Navigate to data-discovery>k8s>dd-helmchart and execute the following commands:

    JSON 
    echo '{"keys":[]}' | jq -c ".keys |= .+ [ {\"version\":\"$(date +%s)\",\"keyActual\":\"$(od -An -t x2 -N 16 < /dev/random | tr -d " ")\"} ]" > encryption-key.json

kubectl --namespace <namespace> create secret generic encryption-key --from-file=encryption-key.json

helm upgrade --install <namespace> --namespace <namespace> ./ -f ./default-resources.yaml -f ./image_versions.yaml -f ./custom-labels-annotations.json -f ./values.yaml

  20. When we configure credentials using Azure-key vault, navigate to values.yaml file dd-helm-chart and add the values in below field as follow:

    CODE 
    "CREDENTIAL_PROVIDER": "AZURE_VAULT",
"OT_VAULT_AUTHENTICATION": "",
"OT_CREDENTIAL_STORE_TYPES": "AZURE",
"SCANNER_CREDENTIAL_REFERENCE_TYPE": "AZURE",

Manually Install Istio NS for Helm Only

This section describes how to manually install Istio 1.11.4. The Helm chart is downloaded with the zip package of Onetrust’s deployment.

Deploy Istio (Not In OpenShift)

  1. Create an Istio namespace:

    CODE 
    kubectl create ns istio-system

  2. Create Istio CRDs for upgrade:

    CODE 
    kubectl apply -f  $PWD/vendor-helm-charts/istio-1.11.4/base/crds

  3. If the docker image must be pulled from the s repository, you will need to create a new docker secret titled, regcred:

    CODE 
    kubectl create secret docker-registry regcred
--docker-server="<docker_registry_url>" 
--docker-username="<docker_user>" 
--docker-password="<docker_password>" 
--namespace istio-system --save-config 
--dry-run=client -o yaml | kubectl apply -f -

  4. Install istio-base chart and istio-discovery chart:

    CODE 
    #Istio-Base Chart 

helm upgrade --install  istio-base  ~/vendor-helm-charts/istio-${istio_version}/base
-n istio-system 
--set global.imagePullSecrets[0]="regcred"  --skip-crds
    CODE 
    #istio-Discovery Chart

helm upgrade --install istiod ~/vendor-helm-charts/istio-${istio_version}/istio-control/istio-discovery
-n istio-system --set global.hub="<docker_registry_url>"
--set global.tag="1.11.4.1" --set global.imagePullSecrets[0]="regcred"

Deploy Istio (In OpenShift)

  1. Create an Istio namespace:

    CODE 
    kubectl create ns istio-system

  2. Create Istio CRDs for upgrade:

    CODE 
    kubectl apply -f  $PWD/vendor-helm-charts/istio-1.11.4/base/crds

  3. If the docker image must be pulled from the s repository, you will need to create a new docker secret titled, regcred:

    CODE 
    kubectl create secret docker-registry regcred
--docker-server="<docker_registry_url>" 
--docker-username="<docker_user>" 
--docker-password="<docker_password>" 
--namespace istio-system --save-config 
--dry-run=client -o yaml | kubectl apply -f -

  4. Create a regcred secret inside a kube-system namespace:

    CODE 
    kubectl create secret docker-registry regcred 
    --docker-server="${docker_registry_url}" 
    --docker-username="${docker_user}"
    --docker-password="${docker_password}"
    --namespace kube-system --save-config
    --dry-run=client -o yaml | kubectl apply -f -

  5. Create an Istio system policy:

    CODE 
    oc adm policy add-scc-to-group anyuid system:serviceaccounts:istio-system

  6. Install istio-base chart:

    CODE 
    helm upgrade --install  istio-base  ~/vendor-helm-charts/istio-${istio_version}/base -n istio-system
--set global.imagePullSecrets[0]="regcred"  --skip-crds

  7. Install istio-cni:

    CODE 
    helm upgrade --install istio-cni -n kube-system "$(base_path)/vendor-helm-charts/istio-1.11.4/istio-cni" \
--set cni.cniBinDir="/var/lib/cni/bin"
--set cni.cniConfDir="/etc/cni/multus/net.d"
--set cni.chained=false
--set cni.cniConfFileName="istio-cni.conf"
--set cni.excludeNamespaces[0]="istio-system"
--set cni.excludeNamespaces[1]="kube-system"
--set cni.repair.enabled=false 
--set cni.logLevel=info 
--set global.imagePullSecrets[0]="regcred"
--set global.tag="1.11.4.1"
--set global.hub="<docker_registry_url>"

  8. Install istio-discovery:

    CODE 
    helm upgrade --install -n istio-system istiod ~/vendor-helm-charts/istio-1.11.4/istio-control/istio-discovery
--set global.imagePullSecrets[0]="regcred"
--set istio_cni.enabled=true
--set global.jwtPolicy=first-party-jwt # or third-party-jwt
--set sidecarInjectorWebhook.injectedAnnotations."k8s.v1.cni.cncf.io/networks"="istio-cni"
--set global.tag="1.11.4.1"
--set global.hub="<docker_registry_url>"

Updating with Helm

Note:

You can also leverage the auto-update button in the worker node details. See Updating Worker Nodes on how to configure this preference in Data Discovery settings.



  1. Download the latest installer file package provided by OneTrust.

  2. Retrieve latest set of docker images.

  3. Update the values.yml file which can be found here: data-discovery > k8s-deployment > dd-helm-chart

    Note:

    The variables can be copied from the current file.

  4. Run the following command:

    CODE 
    helm upgrade --install "${OT_NAMESPACE_DD}" --namespace "${OT_NAMESPACE_DD}" ./dd-helm-chart -f ./dd-helm-chart/default-resources.yaml -f ./dd-helm-chart/image_versions.yaml -f ./dd-helm-chart/custom-labels-annotations.json -f ./dd-helm-chart/values.yaml