Protegrity Synthetic Data on

Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Ensure the following prerequisites are met:

Tools

Install and configure the following tools on the jumpbox:

opentofu 1.10 or later. Refer to OpenTofu Installation.
helm 3.12+, kubectl 1.27+, and aws CLI v2 with access to the Protegrity Provisioned Cluster (PPC).

AWS Setup

Ensure that the following AWS requirements are met:

A Protegrity Provisioned Cluster (PPC) is available. For more information, refer to Protegrity Provisioned Cluster.
AWS CLI credentials are configured by using aws configure.

Installing Protegrity Synthetic Data

Mon, 01 Jan 0001 00:00:00 +0000

Note: This guide uses version 2.1.0 throughout. Replace 2.1.0 with the version you are installing, including in the Python SDK Installation section.

This section describes how to deploy Protegrity Synthetic Data on Amazon EKS as part of Protegrity AI Team Edition.
It uses OpenTofu to provision cloud infrastructure, such as S3, IAM, and Karpenter. It also generates the syntheticdata-values.yaml file that Helm uses to deploy Kubernetes workloads.

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

The OpenTofu module creates the S3 bucket, IAM role, EKS Pod Identity association, and Karpenter NodePool. It also writes syntheticdata-values.yaml with cloud-specific Helm overrides.

Configuring Protegrity Synthetic Data

Mon, 01 Jan 0001 00:00:00 +0000

Warning: Use the -k flag only in development or trusted internal environments. Do not use it in production, where valid certificates must be configured.

Role Update and User Creation

After deployment, update the default syntheticdata_administrator role to include can_create_token permission. Then create a user with this role.

1. Update `syntheticdata_administrator` role permission

export GATEWAY_URL="https://$(kubectl get configmap/nfa-config -n default -o jsonpath='{.data.FQDN}')"

# 1. Obtain an Authentication Token
TOKEN=$(curl -sk -X POST "${GATEWAY_URL}/api/v1/auth/login/token" \
 -H 'Content-Type: application/x-www-form-urlencoded' \
 -d 'loginname=admin&password=Admin123!' \
 -D - -o /dev/null | grep -i 'pty_access_jwt_token' | awk '{print $2}' | tr -d '\r\n')

curl -sk -X PUT \
 "${GATEWAY_URL}/pty/v1/auth/roles" \
 -H 'accept: application/json' \
 -H "Authorization: Bearer ${TOKEN}" \
 -H 'Content-Type: application/json' \
 -d '{
 "name": "syntheticdata_administrator",
 "description": "Administrator role",
 "permissions": [
 "can_create_token",
 "syntheticdata_operations_admin"
 ]
 }'

2. Create a user with the `syntheticdata_administrator` role attached

Use the following request payload when creating the user:

Uninstallation and Cleanup Protegrity Synthetic Data

Mon, 01 Jan 0001 00:00:00 +0000

To remove the Synthetic Data service and all associated Kubernetes and AWS resources:

1. Uninstall the Helm release

# Removes all chart resources. PVC data is RETAINED by default (retentionPolicy: whenDeleted=Retain).
helm uninstall synthetic-data -n synthetic-data-ns

# To also delete the database PVC:
kubectl delete pvc -n synthetic-data-ns -l app.kubernetes.io/name=synthetic-data

Optionally, delete the namespace after all resources are deleted:

kubectl delete namespace synthetic-data-ns

2. Destroy OpenTofu infrastructure

# Destroys Karpenter nodes, IAM role, Pod Identity association, and S3 bucket.
tofu destroy -var="cluster_name=<CLUSTER_NAME>"

Note: By default, tofu destroy prompts for confirmation before deleting resources. Add -auto-approve to skip the prompt.

Protegrity Synthetic Data on

Prerequisites

Tools

AWS Setup

Installing Protegrity Synthetic Data

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

Configuring Protegrity Synthetic Data

Role Update and User Creation

1. Update syntheticdata_administrator role permission

2. Create a user with the syntheticdata_administrator role attached

Uninstallation and Cleanup Protegrity Synthetic Data

1. Uninstall the Helm release

2. Destroy OpenTofu infrastructure

1. Update `syntheticdata_administrator` role permission

2. Create a user with the `syntheticdata_administrator` role attached