Installing Protegrity Anonymization

Steps to install Protegrity Anonymization

Note: This guide uses version 2.0.1 throughout. Replace 2.0.1 with the version you are installing, including in the Python SDK Installation section.

This project deploys the Protegrity Anonymization service on Amazon EKS as part of the Protegrity AI Team Edition.

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

The OpenTofu module creates the S3 bucket, IAM role, EKS Pod Identity association, and Karpenter NodePool. It also writes anonymization-values.yaml with cloud-specific Helm overrides.

Option A - You already have a root module

Add the following module block to your existing root module:

module "anonymization" {
  source = "oci://registry.protegrity.com/anonymization/anonymization-server/opentofu/anonymization?tag=aws-2.0.1"

  cluster_name  = "<CLUSTER_NAME>"
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = "production"
  chart_version = "2.0.1"
  bucket_name  = "<BUCKET_NAME>"
  #fips="false" #Uses FIPS Bottlerocket AMI when set to true, non-FIPS when set to false.
  #ami_family = "Bottlerocket"
  #ami_id = "<>"  #Explicit AMI ID for Karpenter nodes; when set, this overrides fips-based AMI selection
}

Note: This module requires the hashicorp/aws (~> 5.0) and hashicorp/kubernetes (~> 2.35) providers.

If your root module does not already declare them, add the following to your terraform {} block:

required_providers {
  aws = {
    source  = "registry.opentofu.org/hashicorp/aws"
    version = "~> 5.0"
  }
  kubernetes = {
    source  = "registry.opentofu.org/hashicorp/kubernetes"
    version = "~> 2.35"
  }
}

Configure the kubernetes provider to connect to the target EKS cluster:

data "aws_eks_cluster" "this" {
  name = "<your-cluster-name>"
}

data "aws_eks_cluster_auth" "this" {
  name = "<your-cluster-name>"
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.this.token
}

Then run the following commands:

tofu init
tofu plan
tofu apply

Note: Running tofu plan is optional. It lets you review the planned changes before they are applied.

Option B - You do not have a root module

Create a new directory with a single main.tf:

terraform {
  required_version = "~> 1.10"

  required_providers {
    aws = {
      source  = "registry.opentofu.org/hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "registry.opentofu.org/hashicorp/kubernetes"
      version = "~> 2.35"
    }
  }
}

variable "cluster_name" {
  type        = string
  description = "EKS cluster name."
}

variable "environment" {
  type    = string
  default = "production"
}

variable "bucket_name" {
  type        = string
  description = "Storage bucket name."
}

data "aws_eks_cluster" "this" {
  name = var.cluster_name
}

data "aws_eks_cluster_auth" "this" {
  name = var.cluster_name
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.this.token
}

module "anonymization" {
  source = "oci://registry.protegrity.com/anonymization/anonymization-server/opentofu/anonymization?tag=aws-2.0.1"

  cluster_name  = var.cluster_name
  oci_host      = "registry.protegrity.com"
  environment   = var.environment
  chart_version = "2.0.1"
  bucket_name  = var.bucket_name
  #fips="false" #Uses FIPS Bottlerocket AMI when set to true, non-FIPS when set to false. 
  #ami_family = "Bottlerocket"
  #ami_id = "<>"  #Explicit AMI ID for Karpenter nodes; when set, this overrides fips-based AMI selection
}

output "helm_install" {
  value = module.anonymization.helm_install
}

Then run the following commands:

tofu init
tofu plan -var="cluster_name=<cluster-name>" -var="bucket_name=<globally-unique-bucket>"
tofu apply -var="cluster_name=<cluster-name>" -var="bucket_name=<globally-unique-bucket>"

Note:
Running tofu plan is optional. It lets you review the planned changes before they are applied.
tofu output -raw helm_install prints a ready-to-run Helm command with the correct version and namespace.
bucket_name is a new S3 bucket name and it is created as part of this deployment.

2. Deploy with Helm

The OpenTofu module writes an anonymization-values.yaml file in your working directory. Passwords are required only for the first installation. They are preserved automatically for later upgrades.

export MLOPS_PASSWORD=<MLOPS_PASSWORD>
export JOBSTATE_PASSWORD=<JOBSTATE_PASSWORD>

helm install anonymization \
  oci://registry.protegrity.com/anonymization/anonymization-server/helm/anonymization \
  --version 2.0.1 \
  --namespace anon-ns --create-namespace \
  --values anonymization-values.yaml \
  --set database.auth.mlopsPassword=$MLOPS_PASSWORD \
  --set database.auth.jobstatePassword=$JOBSTATE_PASSWORD

Note: Ensure that “<JOBSTATE_PASSWORD>” contains only alphanumeric characters.

3. Monitor

Monitor the deployment process using the following command.

kubectl get pods -n anon-ns

Verify that all pods are in the Running state. The following is a sample output.

NAME                                  READY   STATUS    RESTARTS   AGE
anon-app-depl-f5c4d4cd6-42wgn         1/1     Running   0          3m20s
anon-db-depl-0                        1/1     Running   0          3m20s
anon-scheduler-depl-7b87fcb74-l5q6v   1/1     Running   0          3m20s
anon-worker-depl-7c4d95496f-djw7f     1/1     Running   0          3m20s
anon-worker-depl-7c4d95496f-gnnvp     1/1     Running   0          3m20s

Verify that the Anonymization service is deployed.

kubectl get svc -n anon-ns

The following is the sample output.

NAME            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
anon-app-svc    ClusterIP   172.20.151.139   <none>        8000/TCP   61s
anon-dask-svc   ClusterIP   172.20.224.133   <none>        8786/TCP   61s

Next Steps

For more information about the Python SDK, refer to Python SDK Reference.

If you encounter any error during or after installation, refer to Troubleshooting.

Feedback

Was this page helpful?

Last modified : August 04, 2026