Installing Protegrity Anonymization

Steps to install Protegrity Anonymization

Note: This guide uses version 2.0.1 throughout. Replace 2.0.1 with the version you are installing, including in the Python SDK Installation section.

This project deploys the Protegrity Anonymization service on Amazon EKS as part of the Protegrity AI Team Edition.

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

The OpenTofu module creates the S3 bucket, IAM role, EKS Pod Identity association, and Karpenter NodePool. It also writes anonymization-values.yaml with cloud-specific Helm overrides.

Option A - You already have a root module

Add the following module block to your existing root module:

module "anonymization" {
  source = "oci://registry.protegrity.com/anonymization/anonymization-server/opentofu/anonymization?tag=aws-2.0.1"

  cluster_name  = "<CLUSTER_NAME>"
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = "production"
  chart_version = "2.0.1"
}

Note: This module requires the hashicorp/aws (~> 5.0) and hashicorp/kubernetes (~> 2.35) providers.

If your root module does not already declare them, add the following to your terraform {} block:

required_providers {
  aws = {
    source  = "registry.opentofu.org/hashicorp/aws"
    version = "~> 5.0"
  }
  kubernetes = {
    source  = "registry.opentofu.org/hashicorp/kubernetes"
    version = "~> 2.35"
  }
}

Configure the kubernetes provider to connect to the target EKS cluster:

data "aws_eks_cluster" "this" {
  name = "<your-cluster-name>"
}

data "aws_eks_cluster_auth" "this" {
  name = "<your-cluster-name>"
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.this.token
}

Then run the following commands:

tofu init
tofu plan
tofu apply
Option B - You do not have a root module

Create a new directory with a single main.tf:

terraform {
  required_version = "~> 1.10"

  required_providers {
    aws = {
      source  = "registry.opentofu.org/hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "registry.opentofu.org/hashicorp/kubernetes"
      version = "~> 2.35"
    }
  }
}

variable "cluster_name" {
  type        = string
  description = "EKS cluster name."
}

variable "environment" {
  type    = string
  default = "production"
}

data "aws_eks_cluster" "this" {
  name = var.cluster_name
}

data "aws_eks_cluster_auth" "this" {
  name = var.cluster_name
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.this.token
}

module "anonymization" {
  source = "oci://registry.protegrity.com/anonymization/anonymization-server/opentofu/anonymization?tag=aws-2.0.1"

  cluster_name  = var.cluster_name
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = var.environment
  chart_version = "2.0.1"
}

output "helm_install" {
  value = module.anonymization.helm_install
}

Then run the following commands:

tofu init
tofu plan -var="cluster_name=<cluster-name>" -var="bucket_name=<globally-unique-bucket>"
tofu apply -var="cluster_name=<cluster-name>" -var="bucket_name=<globally-unique-bucket>"

Note: tofu output -raw helm_install prints a ready-to-run Helm command with the correct version and namespace.

2. Deploy with Helm

The OpenTofu module writes an anonymization-values.yaml file in your working directory. Passwords are required only for the first installation. They are preserved automatically for later upgrades.

export MLOPS_PASSWORD=<MLOPS_PASSWORD>
export JOBSTATE_PASSWORD=<JOBSTATE_PASSWORD>

helm upgrade --install anonymization \
  oci://registry.protegrity.com/anonymization/anonymization-server/helm/anonymization \
  --version 2.0.1 \
  --namespace anon-ns --create-namespace \
  --values anonymization-values.yaml \
  --set database.auth.mlopsPassword=$MLOPS_PASSWORD \
  --set database.auth.jobstatePassword=$JOBSTATE_PASSWORD

Note: Ensure that “<JOBSTATE_PASSWORD>” contains only alphanumeric characters.

For upgrades, omit the --set flags because the passwords are already stored in the cluster secret:

helm upgrade anonymization \
  oci://registry.protegrity.com/anonymization/anonymization-server/helm/anonymization \
  --version 2.0.1 \
  --namespace anon-ns \
  --values anonymization-values.yaml

3. Monitor

  1. Monitor the deployment process using the following command.

    kubectl get pods -n anon-ns

    Verify that all pods are in the Running state. The following is a sample output.

    NAME                                  READY   STATUS    RESTARTS   AGE
anon-app-depl-f5c4d4cd6-42wgn         1/1     Running   0          3m20s
anon-db-depl-0                        1/1     Running   0          3m20s
anon-scheduler-depl-7b87fcb74-l5q6v   1/1     Running   0          3m20s
anon-worker-depl-7c4d95496f-djw7f     1/1     Running   0          3m20s
anon-worker-depl-7c4d95496f-gnnvp     1/1     Running   0          3m20s

  2. Verify that the Anonymization service is deployed.

    kubectl get svc -n anon-ns

    The following is the sample output.

    NAME            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
anon-app-svc    ClusterIP   172.20.151.139   <none>        8000/TCP   61s
anon-dask-svc   ClusterIP   172.20.224.133   <none>        8786/TCP   61s

    For more information about the Python SDK, refer to Python SDK Reference.


Last modified : July 30, 2026