Prerequisites

Required tools, cloud permissions, and Kubernetes cluster configuration for deployment.

Required tools, cloud permissions, and Kubernetes cluster configuration for deployment on Amazon EKS or Azure Kubernetes Service (AKS).

Ensure the following prerequisites are met:

Tools

Install and configure the following tools on the host from which you run the installation:

Tool	Version	Notes
`opentofu`	1.10.0 and later	Provisions node isolation resources.
`helm`	3.12 and later	Deploys the umbrella chart.
`kubectl`	any version	Required for validation; must be configured for the target cluster.

Install the CLI for your cloud provider:

Tool	Version	Notes
`aws` CLI	v2	Must be configured with EKS credentials and a default region.

Tool	Version	Notes
`az` CLI	2.x	Must be logged in with `az login` and have access to the target AKS cluster.

Cloud Setup

Ensure that the following requirements are met:

A Protegrity Provisioned Cluster (PPC) is available. For more information about PPC, refer to Protegrity Provisioned Cluster.
The host from which you run the installation can connect to the required registry. If you are not already authenticated, log in to it.

Configure cloud credentials for your provider:

AWS CLI credentials are configured using aws configure, with permissions to describe the target EKS cluster.

Azure CLI is logged in using az login, with access to the resource group that contains the target AKS cluster.

To authenticate to the Protegrity Container Registry, use the following command with credentials from the My.Protegrity portal during account creation:

echo "<password>" | helm registry login <Container_Registry_Path> --username "<username>" --password-stdin

Note: If deploying from the Protegrity Container Registry, use registry.protegrity.com:9443. Specify the local registry endpoint if a local registry is used.

Note: helm registry login authenticates Helm only. The OpenTofu module is pulled from the OCI registry and additionally requires container registry credentials in ~/.config/containers/auth.json. You configure these during the Install procedure before running tofu init.

Cluster Requirements

A standard Protegrity Provisioned Cluster (PPC) already satisfies the following requirements, so no additional setup is needed in that case. Use the checklist below to verify the cluster only if you are not deploying onto a standard PPC cluster.

Verify that the EKS cluster meets the following requirements:

Kubernetes 1.27 or later is installed.
The nfa-config ConfigMap is present in the default namespace. This is standard on PPC clusters.
The EKS Pod Identity Agent add-on is enabled on the cluster.
Karpenter 1.0 or later is installed and configured in the karpenter namespace.

Verify that the AKS cluster meets the following requirements:

Kubernetes 1.27 or later is installed.
The nfa-config ConfigMap is present in the default namespace. This is standard on PPC clusters.
The cluster is reachable using the credentials retrieved by az login for the resource group that contains it.

External Service Prerequisites

The umbrella chart deploys Sensitive Data Guardrails, Vault-Based Tokenization, and Semantic Guardrails as part of the release. The Classification Service must already be available in the cluster:

Service	Namespace	Port	Notes
Classification Service (Data Discovery)	`data-discovery`	8050	Required by Sensitive Data Guardrails and Semantic Guardrails.

Note: AI Gateway does not require cloud object storage, such as an S3 bucket or Azure Storage Account, or dedicated cloud data-access roles. The OpenTofu module provisions only the node isolation resources for workload scheduling.

Cloud Permissions for Installation

The AWS credentials used during installation require the following permissions.

Service	Permissions	Purpose
EKS	`eks:DescribeCluster`, `eks:DescribeAddon`	Verify the cluster and connect the Kubernetes provider.

The Azure credentials used during installation require the following permissions.

Scope	Permissions	Purpose
AKS	`Microsoft.ContainerService/managedClusters/read`, `Microsoft.ContainerService/managedClusters/listClusterUserCredential/action`	Read the cluster and retrieve the kubeconfig to connect the Kubernetes provider.

Last modified : October 29, 2026

Feedback

Was this page helpful?