Protegrity Synthetic Data

• 1: Prerequisites
• 2: Installing Protegrity Synthetic Data
• 3: Configuring Protegrity Synthetic Data
• 4: Uninstallation and Cleanup Protegrity Synthetic Data

1 - Prerequisites

Ensure the following prerequisites are met:

Tools

Install and configure the following tools on the jumpbox:

• opentofu 1.10 or later. Refer to OpenTofu Installation.
• helm 3.12+, kubectl 1.27+, and aws CLI v2 with access to the Protegrity Provisioned Cluster (PPC).

AWS Setup

Ensure that the following AWS requirements are met:

• A Protegrity Provisioned Cluster (PPC) is available. For more information, refer to Protegrity Provisioned Cluster.

• AWS CLI credentials are configured by using aws configure.

• The AWS credentials have permission to provision IAM roles, S3 buckets, EKS Pod Identity associations, and Karpenter node resources. If you encounter AccessDenied errors, refer to IAM Permissions for Installation.

• The jumpbox can connect to the required registry. If you are not already authenticated, log in to it.

  • To authenticate to the Protegrity Container Registry (PCR), use the following command with credentials from the My.Protegrity portal during account creation:

  echo "<password>" | helm registry login registry.protegrity.com --username "<username>" --password-stdin
  

  • For a local registry, use your credentials and local registry endpoint as required.

EKS Cluster Requirements

Ensure that the EKS cluster meets the following requirements:

• Kubernetes 1.27 or later is installed.
• The default StorageClass is used unless you override it. Verify the StorageClass with kubectl get storageclass.
• The EKS Pod Identity Agent add-on is enabled on the cluster.
• Karpenter 1.0 or later is installed and configured on the cluster.

IAM Permissions for Installation

The AWS credentials used during installation require the following permissions. You can reduce these permissions after installation is complete.

2 - Installing Protegrity Synthetic Data

Note: This guide uses version 2.1.0 throughout. Replace 2.1.0 with the version you are installing, including in the Python SDK Installation section.

This section describes how to deploy Protegrity Synthetic Data on Amazon EKS as part of Protegrity AI Team Edition.
It uses OpenTofu to provision cloud infrastructure, such as S3, IAM, and Karpenter. It also generates the syntheticdata-values.yaml file that Helm uses to deploy Kubernetes workloads.

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

The OpenTofu module creates the S3 bucket, IAM role, EKS Pod Identity association, and Karpenter NodePool. It also writes syntheticdata-values.yaml with cloud-specific Helm overrides.

Option A - You already have a root module

Add the following module block to your existing root module:

module "synthetic_data" {
  source = "oci://registry.protegrity.com/synthetic-data/synthetic-data-server/opentofu/synthetic-data?tag=aws-2.1.0"

  cluster_name  = "<CLUSTER_NAME>"
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = "production"
  chart_version = "2.1.0"
}

Then run the following commands:

tofu init
tofu plan
tofu apply

Option B - You do not have a root module

Create a new directory with a single main.tf:

terraform {
  required_version = "~> 1.10"

  required_providers {
    aws = {
      source  = "registry.opentofu.org/hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "registry.opentofu.org/hashicorp/kubernetes"
      version = "~> 2.35"
    }
  }
}

variable "cluster_name" {
  type        = string
  description = "EKS cluster name."
}

variable "environment" {
  type    = string
  default = "production"
}

data "aws_eks_cluster" "this" {
  name = var.cluster_name
}

data "aws_eks_cluster_auth" "this" {
  name = var.cluster_name
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.this.token
}

module "synthetic_data" {
  source = "oci://registry.protegrity.com/synthetic-data/synthetic-data-server/opentofu/synthetic-data?tag=aws-2.1.0"

  cluster_name  = var.cluster_name
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = var.environment
  chart_version = "2.1.0"
}

output "helm_install" {
  value = module.synthetic_data.helm_install
}

Then run the following commands:

tofu init
tofu plan -var="cluster_name=<CLUSTER_NAME>"
tofu apply -var="cluster_name=<CLUSTER_NAME>"

Note: tofu output -raw helm_install prints a ready-to-run Helm command with the correct version and namespace.

2. Deploy with Helm

The OpenTofu module writes a syntheticdata-values.yaml file in your working directory. Passwords are required only for the first installation. They are preserved automatically for later upgrades.

export MLOPS_PASSWORD=<MLOPS_PASSWORD>
export JOBSTATE_PASSWORD=<JOBSTATE_PASSWORD>

helm upgrade --install synthetic-data \
  oci://registry.protegrity.com/synthetic-data/helm/synthetic-data \
  --version 2.1.0 \
  --namespace synthetic-data-ns --create-namespace \
  --values syntheticdata-values.yaml \
  --set database.auth.mlopsPassword=$MLOPS_PASSWORD \
  --set database.auth.jobstatePassword=$JOBSTATE_PASSWORD

Note: Ensure that the “<JOBSTATE_PASSWORD>” contains only alphanumeric characters.

For upgrades, omit the --set flags because the passwords are already stored in the cluster secret:

helm upgrade synthetic-data \
  oci://registry.protegrity.com/synthetic-data/helm/synthetic-data \
  --version 2.1.0 \
  --namespace synthetic-data-ns \
  --values syntheticdata-values.yaml

3. Monitor

1. Monitor the deployment process using the following command.

   kubectl get pods -n synthetic-data-ns
   

   Verify that all pods are in the Running state. The following is a sample output.

   NAME                                       READY   STATUS    RESTARTS   AGE
   synthetic-data-<hash>-<hash>               1/1     Running   0          3m20s
   synthetic-data-db-0                        1/1     Running   0          3m20s
   

2. Verify that the Synthetic Data service is deployed.

   kubectl get svc -n synthetic-data-ns
   

   The following is the sample output.

   NAME                  TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   synthetic-data-svc    ClusterIP   172.20.xxx.xxx   <none>        8000/TCP   61s
   

   For more information about the Python SDK, refer to Python SDK Reference.

3 - Configuring Protegrity Synthetic Data

Warning: Use the -k flag only in development or trusted internal environments. Do not use it in production, where valid certificates must be configured.

Role Update and User Creation

After deployment, update the default syntheticdata_administrator role to include can_create_token permission. Then create a user with this role.

1. Update syntheticdata_administrator role permission

export GATEWAY_URL="https://$(kubectl get configmap/nfa-config -n default -o jsonpath='{.data.FQDN}')"

# 1. Obtain an Authentication Token
TOKEN=$(curl -sk -X POST "${GATEWAY_URL}/api/v1/auth/login/token" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'loginname=admin&password=Admin123!' \
  -D - -o /dev/null | grep -i 'pty_access_jwt_token' | awk '{print $2}' | tr -d '\r\n')

curl -sk -X PUT \
  "${GATEWAY_URL}/pty/v1/auth/roles" \
  -H 'accept: application/json' \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "syntheticdata_administrator",
    "description": "Administrator role",
    "permissions": [
      "can_create_token",
      "syntheticdata_operations_admin"
    ]
  }'

2. Create a user with the syntheticdata_administrator role attached

Use the following request payload when creating the user:

{
  "username": "syntheticdata_admin",
  "email": "synthadmin@example.com",
  "firstName": "Synth",
  "lastName": "<USERNAME>",
  "password": "<PASSWORD>",
  "roles": [
    "syntheticdata_administrator"
  ]
}

Note: Replace default credentials and URLs for production environments. For example, for <USERNAME>, enter User and for <PASSWORD>, enter StrongPassword123!.

Create the user with the following API call:

curl -sk -X POST \
  "${GATEWAY_URL}/pty/v1/auth/users" \
  -H 'accept: application/json' \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "syntheticdata_admin",
    "email": "synthadmin@example.com",
    "firstName": "Synth",
    "lastName": "<USERNAME>",
    "password": "<PASSWORD>",
    "roles": [
      "syntheticdata_administrator"
    ]
  }'

4 - Uninstallation and Cleanup Protegrity Synthetic Data

To remove the Synthetic Data service and all associated Kubernetes and AWS resources:

1. Uninstall the Helm release

# Removes all chart resources. PVC data is RETAINED by default (retentionPolicy: whenDeleted=Retain).
helm uninstall synthetic-data -n synthetic-data-ns

# To also delete the database PVC:
kubectl delete pvc -n synthetic-data-ns -l app.kubernetes.io/name=synthetic-data

Optionally, delete the namespace after all resources are deleted:

kubectl delete namespace synthetic-data-ns

2. Destroy OpenTofu infrastructure

# Destroys Karpenter nodes, IAM role, Pod Identity association, and S3 bucket.
tofu destroy -var="cluster_name=<CLUSTER_NAME>"

Note: By default, tofu destroy prompts for confirmation before deleting resources. Add -auto-approve to skip the prompt.