Skip to content

Privacera Setup for AWS

Note

Please ensure you have completed the prerequisites before proceeding with the setup.

This section provides the steps to setup Privacera on AWS. The setup includes the following steps:

  1. Update the configuration file aws_pm_config_env.sh with the required details.
  2. Install Privacera Manager
  3. Deploy Privacera in Kubernetes
  4. Configure AWS ALB for Privacera (Optional)
  5. Post-Install Configuration

Download Scripts

The base installation is done using the Privacera Manager bootstrapping scripts. Download the following scripts and upload them to the EC2 instance where you will install Privacera Manager.

  1. Download aws_pm_config_env.sh configuration file template.
  2. Download aws_install_pm.sh script for installing Privacera Manager.
  3. Download aws_bootstrap_privacera.sh script for default configuration of Privacera.

Note

Copy the downloaded files to the EC2 instance where you will install Privacera Manager.

Update the Privacera bootstrapping configuration file

The configuration file aws_pm_config_env.sh contains the variables required for bootstrapping Privacera Manager and deploying Privacera in Kubernetes. Update them with the values specific to your deployment.

Note

After the initial bootstrapping, this configuration should be stored securely and deleted from the instance.

Configuration Variables Table

Variable Name Description Sample Value
DEPLOYMENT_ENV_NAME Deployment environment name, typically the name of the deployment or project. "privacera-prod" or "privacera-dev"
PRIV_MGR_IMAGE Docker image for Privacera Manager, including the repository URL and image tag. "hub2.privacera.com/privacera-manager:rel_9.0.0.3"
PRIV_MGR_PACKAGE URL for the Privacera Manager package, usually hosted on an S3 bucket or similar repository. "https://privacera-host/path/privacera-manager.tar.gz"
PRIVACERA_HUB_USER Username for accessing Privacera Hub, the central repository for Privacera images. "hub_user"
PRIVACERA_HUB_PASSWORD Password for accessing Privacera Hub. This should be securely stored. "hub_password"
ANSIBLE_VAULT_PASSWORD Password for Ansible Vault, used to encrypt and decrypt sensitive Ansible variables in the EC2 instance. "YourStrongPassword"
GLOBAL_DEFAULT_SECRETS_KEYSTORE_PASSWORD Password for the global secrets keystore. Used to encrypt sensitive information in the Pod. "YourStrongPassword"
AWS_REGION AWS region where the deployment will occur. "us-east-1"
EFS_FSID Elastic File System (EFS) File System ID for shared storage in AWS. "fs-1234567890abcdef"
SSL_DEFAULT_PASSWORD Default password for SSL certificate management. Should be a strong password to secure SSL certificates generated by Privacera Manager. "YourStrongSSLPassword"
DB Database type used. Uncomment the appropriate line for your database: MySQL or PostgreSQL. MYSQL or POSTGRESQL or NATIVE
EXTERNAL_DB_HOST Hostname or IP address of the external database. "database.example.com" or "192.168.1.100"
EXTERNAL_DB_PORT (Optional) Port of the external database if different then default port. "3306"
EXTERNAL_DB_NAME Name of the external database. "privacera_db"
EXTERNAL_DB_USER Username for accessing the external database. "db_admin"
EXTERNAL_DB_PASSWORD Password for the external database user. This should be stored securely. "YourSecureDBPassword"
AWS_ROUTE_53_DOMAIN_NAME Domain name for AWS Route 53. If Privacera will create Route 53 entries, the service name will be prefixed with this domain. "privacera.yourdomain.com"
CERTIFICATE_ARN ARN of the AWS Certificate Manager (ACM) certificate to use with the ALB "arn:aws:acm:us-east-1:1223444:certificate/622eb4db-ea45b48"
SUBNETS Subnets in which the ALB will be deployed. Comma-separated list of subnet IDs. "subnet-1234abcd,subnet-5678efgh"
AWS_ALB_GROUP Group name for the ALB. Used for grouping ALBs within a cluster. "privacera-group"
PRIVACERA_AWS_ZONE_ID AWS Zone ID for the Route 53 hosted zone. "Z3M3LMPEXAMPLE"
AWS_NLB_RANGER_INTERNAL Set to true if the Network Load Balancer (NLB) for the Ranger plugin should be internal. "true" or "false"
SECURITY_GROUPS (Optional) Security groups to associate with the ALB. Comma-separated list of security group IDs. "sg-0123456789abcdef,sg-9876543210fedcba"

Notes

  • Optional Fields: SECURITY_GROUPS is optional and should be included only if needed.
  • Database Configuration: Uncomment the appropriate database type (MYSQL or POSTGRESQL) that applies to your setup. For PoCs, you can set to NATIVE to deploy MariaDB in the same Kubernetes cluster.

Install Privacera Manager

On the EC2 instance, after updating the configuration file, run the aws_pm_install.sh script to install Privacera Manager.

Bash
1
bash aws_install_pm.sh aws_pm_config_env.sh
After the installation is complete, you will see files and directories created in the ~/privacera/privacera-manager/ directory.

Bash
1
ls ~/privacera/privacera-manager/

Configure Privacera for base installation

Run the aws_bootstrap_privacera.sh script to configure Privacera for the base installation.

Bash
1
bash aws_bootstrap_privacera.sh aws_pm_config_env.sh

The script will create the necessary configuration files and directories for Privacera Manager. You can verify the configuration files and directories created in the ~/privacera/privacera-manager/config/custom-vars/ directory.

Just make sure the .yml files are created in the directory.

Bash
1
ls ~/privacera/privacera-manager/config/custom-vars/

Tip

This script sets all the common configurations required for Privacera. If you need to customize the configurations, you can update the .yml files in the ~/privacera/privacera-manager/config/custom-vars/ directory. Please note once you update the configuration files, you shouldn't run the aws_bootstrap_privacera.sh script again, otherwise it will overwrite the changes.

Generate Kubernetes Deployment Files and Helm Charts

Run the following command to generate the Kubernetes deployment files and Helm charts for Privacera.

Note

The setup command will ask you to enter vault password. This is the same that you entered in the configuration file for ANSIBLE_VAULT_PASSWORD variable.

Bash
1
2
cd ~/privacera/privacera-manager
./privacera-manager.sh setup

Apply the Privacera Helm Charts

Run the following command to apply the Privacera Helm charts.

Bash
1
2
cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade

The above command will deploy Privacera in the Kubernetes cluster. You can verify the deployment by checking the pods.

Bash
1
source ~/aws_pm_config_env.sh; kubectl get pods -n $DEPLOYMENT_ENV_NAME

If any of the pods are showing up, then you can go to the next step to configure the AWS ALB for Privacera.

Configure AWS ALB for Privacera (Optional)

Run the following command to get the AWS ALB external URL.

Bash
1
2
3
source ~/aws_pm_config_env.sh; kubectl -n $DEPLOYMENT_ENV_NAME get ingress \
privacera-ingress-resource \
-o jsonpath='{.status.loadBalancer.ingress[0].hostname}'; echo ""; echo "Above is your AWS_ALB_EXTERNAL_URL"
The above command will display the AWS ALB external URL. You can need to update the below file with the AWS ALB external URL.

Tip

You could create another terminal to run the below step or you can save the AWS ALB external URL in a text file and then update the below file

Bash
1
2
cd ~/privacera/privacera-manager
vi config/custom-vars/vars.aws.alb.ingress.yml

Update the AWS_ALB_EXTERNAL_URL variable with the AWS ALB external URL you got from the previous command.

YAML
1
AWS_ALB_EXTERNAL_URL: "<PLEASE_CHANGE>"

Post-Install Configuration

Some of the Post Install tasks are: - Route 53 Entries - Generate the plugin tarball

Bash
1
2
cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

Verify the Privacera Installation

Check the Pod Status

You can run the following command to use k9s to check the pod status

Bash
1
source ~/aws_pm_config_env.sh; kubectl get pods -n $DEPLOYMENT_ENV_NAME

You can also use k9s to check the pod status.

Bash
1
2
cd ~/privacera/privacera-manager
source ~/aws_pm_config_env.sh; ./privacera-manager.sh k9s -n $DEPLOYMENT_ENV_NAME

Tip

To exit k9s, you can press ctrl+c and then q or ':q' to exit.

URLs for Privacera Components

If the installation is successful, you can get the URLs for the Privacera components using the following command.

Bash
1
cat ~/privacera/privacera-manager/output/service-urls.txt

Common URLs for Privacera components are:

Privacera Portal: https://portal-<$DEPLOYMENT_ENV_NAME>.<AWS_ALB_EXTERNAL_URL>

Privacera Diagnostic Tool

You can run the Privacera Diagnostic Tool to check the health of the Privacera components. The URL path for the diagnostic tool can be found from the service-urls.txt file. It will be in the format:

https://diagnostics-server-<$DEPLOYMENT_ENV_NAME>.<AWS_ALB_EXTERNAL_URL>

Privacera Health Monitoring

You can run the Privacera Health Monitoring tool to check the health of the Privacera components. The URL path for the health monitoring tool can be found from the service-urls.txt file. It will be in the format:

https://grafana-<$DEPLOYMENT_ENV_NAME>.<AWS_ALB_EXTERNAL_URL>

Delete the Configuration Files

Once the base installation is complete, you could the configuration files securely. For security reasons, you should delete the configuration files from the EC2 instance.

Bash
1
rm ~/aws_pm_config_env.sh

Comments