Prerequisites

List of Prerequisites for Anonymization.

Ensure that all PPC prerequisites for AWS and PPC prerequisites for Azure are met.

Required Tools

Tool	Version	Notes
OpenTofu	>= 1.10.0	Used to provision cloud resources
Helm	>= 3.12	Used to deploy the chart
kubectl	any	Required for validation; must be configured for the target cluster

AWS additionally requires:

Tool	Notes
AWS CLI	Must be configured with credentials that have EKS, IAM, and S3 permissions, and a default region set.

If there are any Permission denied errors when executing cloud CLI commands, refer to Appendix for required permissions per cloud.

Azure additionally requires:

Tool	Notes
Azure CLI	Must be logged in (`az login`) with permissions to create Managed Identities and Storage Accounts.

If there are any Permission denied errors when executing cloud CLI commands, refer to Appendix for required permissions per cloud.

Required cluster prerequisites

Prerequisite	Details
Kubernetes >= 1.27	EKS
StorageClass	`ebs-sc` (AWS) - verify: `kubectl get storageclass`
AWS — `eks-pod-identity-agent` addon	DaemonSet running on each node
AWS — Karpenter >= 1.0	Installed in `karpenter` namespace (if using node isolation)

StorageClass note: If your cluster uses different StorageClass names, override using --set database.persistence.storageClass=<name> during Helm install.

Prerequisite	Details
Kubernetes >= 1.27	AKS
StorageClass	`managed-csi-premium` (Azure) - verify: `kubectl get storageclass`

StorageClass note: If your cluster uses different StorageClass names, override using --set database.persistence.storageClass=<name> during Helm install.

Configuration reference

Key values.yaml parameters

Key	Default	Description
`cloudProvider`	`""`	`aws`
`database.auth.mlopsPassword`	`""`	Required on first install
`database.auth.jobstatePassword`	`""`	Required on first install
`database.auth.hostAuthMethod`	`trust`	`POSTGRES_HOST_AUTH_METHOD` for PostgreSQL init
`database.persistence.storageClass`	`""`	Set per cloud: `ebs-sc`
`database.persistence.size`	`20Gi`	PVC size
`database.persistence.retentionPolicy.whenDeleted`	`Retain`	Keep PVC on uninstall
`karpenter.enabled`	`true`	Inject node affinity/tolerations for Karpenter nodes
`anonapp.affinity`	`{}`	Injected by OpenTofu when `karpenter.enabled=true`
`anonapp.tolerations`	`[]`	Injected by OpenTofu when `karpenter.enabled=true`
`database.affinity`	`{}`	Injected by OpenTofu when `karpenter.enabled=true`
`database.tolerations`	`[]`	Injected by OpenTofu when `karpenter.enabled=true`
`dask.affinity`	`{}`	Injected by OpenTofu when `karpenter.enabled=true`
`dask.tolerations`	`[]`	Injected by OpenTofu when `karpenter.enabled=true`
`serviceaccount.name`	`anon-service-account`	Must match Pod Identity association

Key	Default	Description
`cloudProvider`	`""`	`azure`
`database.auth.mlopsPassword`	`""`	Required on first install
`database.auth.jobstatePassword`	`""`	Required on first install
`database.auth.hostAuthMethod`	`trust`	`POSTGRES_HOST_AUTH_METHOD` for PostgreSQL init
`database.persistence.storageClass`	`""`	Set per cloud: `managed-csi-premium`
`database.persistence.size`	`20Gi`	PVC size
`database.persistence.retentionPolicy.whenDeleted`	`Retain`	Keep PVC on uninstall
`karpenter.enabled`	`true`	Inject node affinity/tolerations for Karpenter nodes
`anonapp.affinity`	`{}`	Injected by OpenTofu when `karpenter.enabled=true`
`anonapp.tolerations`	`[]`	Injected by OpenTofu when `karpenter.enabled=true`
`database.affinity`	`{}`	Injected by OpenTofu when `karpenter.enabled=true`
`database.tolerations`	`[]`	Injected by OpenTofu when `karpenter.enabled=true`
`dask.affinity`	`{}`	Injected by OpenTofu when `karpenter.enabled=true`
`dask.tolerations`	`[]`	Injected by OpenTofu when `karpenter.enabled=true`
`serviceaccount.name`	`anon-service-account`	Must match Pod Identity association

Appendix: Required cloud permissions

Required AWS permissions

If you encounter an AccessDenied error during installation, request the following permissions for your IAM user or role.

IAM

Permission	Purpose
`iam:CreatePolicy` / `iam:DeletePolicy` / `iam:GetPolicy`	Create and manage the S3 access policy
`iam:CreateRole` / `iam:DeleteRole` / `iam:GetRole`	Create and manage the Pod Identity IAM role
`iam:AttachRolePolicy` / `iam:DetachRolePolicy`	Attach the S3 policy to the role

EKS

Permission	Purpose
`eks:DescribeCluster`	Read cluster details
`eks:DescribeAddon`	Verify `eks-pod-identity-agent` is installed
`eks:CreatePodIdentityAssociation` / `eks:DeletePodIdentityAssociation` / `eks:DescribePodIdentityAssociation`	Associate the IAM role with the ServiceAccount

S3

Permission	Purpose
`s3:CreateBucket` / `s3:DeleteBucket`	Create and manage the models bucket
`s3:PutBucketPolicy` / `s3:GetBucketPolicy`	Apply bucket policy
`s3:PutObject` / `s3:GetObject` / `s3:DeleteObject`	Read/write model files

Required Azure permissions

If you encounter an AuthorizationFailed error during installation, request the following permissions.

Permission	Purpose
`Microsoft.ManagedIdentity/userAssignedIdentities/write`	Create the Managed Identity
`Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write`	Create the Federated Identity Credential for Workload Identity
`Microsoft.Storage/storageAccounts/write`	Create the Storage Account
`Microsoft.Storage/storageAccounts/blobServices/containers/write`	Create the blob container for models
`Microsoft.Authorization/roleAssignments/write`	Assign Storage Blob Data Contributor role

Last modified : October 29, 2026

Feedback

Was this page helpful?