Skip to main content

Privacera Platform

How-to

:

Migrate Privacera Manager from one instance to another

Instance migration

The process to migrate Privacera Manager between instances involves compressing the privacera folder, copying the tar file to the new instance, and extracting the contents accordingly.

  1. From the user managing PM, you can run the following to zip the PM installation folder.

    cd ~/privacera
sudo tar -cvf ../privacera-migrate.tar *

  2. Copy privacera-migrate.tar file from Home directory of the current instance to the Home directory of the new instance.

  3. Extract privacera-migrate.tar file.

    mkdir -p ~/privacera
tar -xvf ~/pm-migrate.tar -C ~/privacera/

Change password for Privacera services

Installed services

The steps to change the login password for Portal and Ranger Admin were tested in an environment where the following services were installed using PM CLI:

  • Privacera Core Components

  • Dataserver

  • Discovery on Databricks

Change the login password for Portal and Ranger

  1. To edit the Portal password:

    In the Portal UI, go to Settings > User Management and then click Edit.

  2. To edit the Ranger password:

    In the Ranger Admin UI, go to Admin > Profile and click on Change Password tab.

  3. In a terminal where Privacera is installed:

    a. Create a vars.password.yml file:

    vi ~/privacera/privacera-manager/config/custom-vars/vars.password.yml

    b. The passwords for Portal and Ranger Admin have been changed using the steps above, now set the new passwords in PORTAL_PADMIN_PASSWORD for Portal, and RANGER_ADMIN_PASSWORD for Ranger Admin.

    PORTAL_PADMIN_PASSWORD: "<new portal password>"
RANGER_ADMIN_PASSWORD: "<new ranger password>"
RANGER_USERSYNC_PASSWORD: "<new ranger password>"
USERSYNC_RANGERUSERSYNC_PASSWORD: "<new ranger password>"

    c. Run the update.

    cd ~/privacera/privacera-manager/ ./privacera-manager.sh update

You can log in to Portal and Ranger Admin using the new passwords.

High availability (HA) for Privacera Portal

Configure Portal HA

This topic shows how to configure the Privacera Portal HA mode for AWS. Under a normal working environment, the core Privacera services such as Solr, MariaDB, Dataserver, Zookeeper, and Ranger connect to a Portal service. By configuring a HA mode for Privacera Portal would ensure that the Portal service is always up and running.

Note

Portal HA is supported only in a Kubernetes environment.

A high-availability (HA) Kubernetes cluster is created with multiple pods in a typical master-slave setup, each pod running a Portal service. If one pod goes down, the other pod takes over, thereby ensuring the Portal service continuity.

Zookeeper is given the task of electing which pod/node would be Master. In a 3 pod setup, Zookeeper automatically elects a pod as a master node and the remaining pods as slaves.

Prerequisites

Ensure the following prerequisites are met:

  • Privacera services are installed and running. For more information, refer to Configure and Install Core Services.

  • Assign an IAM role with a policy that gives access to the AWS Controller for Kubernetes (ACK). To attach such an IAM role, see ???

Configuration

  1. SSH to an instance as USER.

  2. Edit the cluster size (replicas) of Zookeeper and Solr.

    cd ~/privacera/privacera-manager
cp config/sample-vars/vars.kubernetes.yml config/custom-vars/
vi config/custom-vars/vars.kubernetes.yml

    Change the value of the properties from 1 to 3.

    ZOOKEEPER_CLUSTER_SIZE:1SOLR_K8S_CLUSTER_SIZE:1

  3. Run the following commands.

    cd ~/privacera/privacera-manager
cp config/sample-vars/vars.portal.kubernetes.ha.yml config/custom-vars/
vi config/custom-vars/vars.portal.kubernetes.ha.yml

  4. Edit the following properties or keep them unchanged.

    PRIVACERA_PORTAL_K8S_HA_ENABLE:"true"PORTAL_K8S_REPLICAS :"3"

    Property

    Description

    Example

    PRIVACERA_PORTAL_K8S_HA_ENABLE

    Activates the HA mode for Portal service.

    true

    PORTAL_K8S_REPLICAS

    Enter an odd number of nodes/pods to be created.

    Zookeeper that manages the nodes/pods requires an odd number to elect a master node successfully.

    Note: A minimum of 3 nodes is required in HA mode. By giving a value of 1 will turn it into a non-HA mode.

    3

  5. Run the following commands. Since, in an HA mode, the Privacera Portal is accessed through a browser, a sticky session is required. For that, AWS load balancer ingress has been implemented.

    cd ~/privacera/privacera-manager
cp config/sample-vars/vars.aws.alb.ingress.yml config/custom-vars/

  6. Run the following commands.

    cd ~/privacera/privacera-manager
./privacera-manager.sh update

    Since 3 nodes are set in the PORTAL_K8S_REPLICAS property, it will create 3 pods/nodes of the Portal service.

At the end of the update, the service URLs are provided as shown below. The external Portal URL is an ingress URL that can be used in a browser to access Privacera Portal.

image47.jpg
Add replicas

After the Portal service is up and running, run the following command to update the Solr replication on the other nodes:

cd ~/privacera/privacera-manager
cd output/solr/
./update_solr_replication.sh --add_replica
Set replicas for other Privacera services

To set the replicas for the services such as Ranger, Dataserver, and Auditserver, add the following in the config/custom-vars/vars.kubernetes.yml file.

  • For Ranger

    RANGER_K8S_REPLICAS:"3"

  • For Dataserver

    DATASERVER_K8S_CLUSTER_SIZE:"3"

  • For AuditServer

    AUDITSERVER_K8S_REPLICAS:"3"

Configure PowerBI Gateway with MSSQL server

This topic shows how to publish your on-premises SQL data source to the Power BI service in Azure via the Power BI gateway, and configure access-control for the following:

  • On-premises SQL data source using the Privacera MSSQL connector

  • Power BI service using Privacera Power BI connector

Configuration

  1. Download and install the following on your Windows system:

    • SQL Server 2019. For more information, refer the Microsoft Azure documentation - click here.

    • Power BI gateway and log in using AAD credentials. For more information, refer the Microsoft Azure documentation -click here.

    • PowerBI Desktop and log in using AAD credentials. For more information, refer the Microsoft Azure documentation -click here.

  2. Configure the UserSync for AAD to pull users/groups into Ranger. For more details, refer Azure Active Directory - Data Access User Synchronization.

  3. Configure PolicySync MSSQL connector with the Microsoft SQL server installed on the Windows system. For more details, refer to the topic MSSQL connectors.Microsoft SQL Server

    Follow the steps in the link, and configure the following properties:

    1. Set the MSSQL_EXTERNAL_USER_AS_INTERNAL to true. On-premises SQL server does not support the authentication of an external AAD user. You need to set this property to convert external AAD users to local database users.

      MSSQL_EXTERNAL_USER_AS_INTERNAL:"true"

    2. Add the external AAD users to be converted to internal database users.

      MSSQL_MANAGE_USER_LIST:"user1,user2,user3"

      Now, you can provide access-control on these users.

Use Case

Let's see how is access-control achieved in the Power BI Desktop application.

  1. In to the Privacera Portal, add a MSSQL connector and create the following policy for the AAD user listed in the MSSQL_MANAGE_USER_LIST property of the MSSQL connector.

    powerbi-sql.jpg

  2. On the Power BI Desktop, connect to the database in the Microsoft SQL server with the AAD login credentials, and load the data. For more information, refer the Microsoft Azure documentation -click here.

    Depending on the permissions granted to the AAD user in the policy, the SQL server will load the data for the AAD user.

  3. Click the Publish icon from the ribbon on the Home tab.

  4. On the Save As dialog, enter File name, and then click Save.

    Workspace will be listed as per the user’s workspace level permissions.

  5. Select the workspace, and then click Publish.

    After you publish, the data gets uploaded to the workspace of the Power BI service. For more information, refer the Microsoft documentation - click here.

    Now, you can apply access-control on the workspace of the Power BI in Azure. For more information, see Power BI PolicySync.Power BI