Installing Protegrity Synthetic Data

Steps to install Protegrity Synthetic Data

Note: This guide uses version 2.1.0 throughout. Replace 2.1.0 with the version you are installing, including in the Python SDK Installation section.

This section describes how to deploy Protegrity Synthetic Data on Amazon EKS as part of Protegrity AI Team Edition.
It uses OpenTofu to provision cloud infrastructure, such as S3, IAM, and Karpenter. It also generates the syntheticdata-values.yaml file that Helm uses to deploy Kubernetes workloads.

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

The OpenTofu module creates the S3 bucket, IAM role, EKS Pod Identity association, and Karpenter NodePool. It also writes syntheticdata-values.yaml with cloud-specific Helm overrides.

Option A - You already have a root module

Add the following module block to your existing root module:

module "synthetic_data" {
  source = "oci://registry.protegrity.com/synthetic-data/synthetic-data-server/opentofu/synthetic-data?tag=aws-2.1.0"

  cluster_name  = "<CLUSTER_NAME>"
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = "production"
  chart_version = "2.1.0"
}

Then run the following commands:

tofu init
tofu plan
tofu apply
Option B - You do not have a root module

Create a new directory with a single main.tf:

terraform {
  required_version = "~> 1.10"

  required_providers {
    aws = {
      source  = "registry.opentofu.org/hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "registry.opentofu.org/hashicorp/kubernetes"
      version = "~> 2.35"
    }
  }
}

variable "cluster_name" {
  type        = string
  description = "EKS cluster name."
}

variable "environment" {
  type    = string
  default = "production"
}

data "aws_eks_cluster" "this" {
  name = var.cluster_name
}

data "aws_eks_cluster_auth" "this" {
  name = var.cluster_name
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.this.token
}

module "synthetic_data" {
  source = "oci://registry.protegrity.com/synthetic-data/synthetic-data-server/opentofu/synthetic-data?tag=aws-2.1.0"

  cluster_name  = var.cluster_name
  bucket_name   = "<globally-unique-s3-bucket-name>"
  oci_host      = "registry.protegrity.com"
  environment   = var.environment
  chart_version = "2.1.0"
}

output "helm_install" {
  value = module.synthetic_data.helm_install
}

Then run the following commands:

tofu init
tofu plan -var="cluster_name=<CLUSTER_NAME>"
tofu apply -var="cluster_name=<CLUSTER_NAME>"

Note: tofu output -raw helm_install prints a ready-to-run Helm command with the correct version and namespace.

2. Deploy with Helm

The OpenTofu module writes a syntheticdata-values.yaml file in your working directory. Passwords are required only for the first installation. They are preserved automatically for later upgrades.

export MLOPS_PASSWORD=<MLOPS_PASSWORD>
export JOBSTATE_PASSWORD=<JOBSTATE_PASSWORD>

helm upgrade --install synthetic-data \
  oci://registry.protegrity.com/synthetic-data/helm/synthetic-data \
  --version 2.1.0 \
  --namespace synthetic-data-ns --create-namespace \
  --values syntheticdata-values.yaml \
  --set database.auth.mlopsPassword=$MLOPS_PASSWORD \
  --set database.auth.jobstatePassword=$JOBSTATE_PASSWORD

Note: Ensure that the “<JOBSTATE_PASSWORD>” contains only alphanumeric characters.

For upgrades, omit the --set flags because the passwords are already stored in the cluster secret:

helm upgrade synthetic-data \
  oci://registry.protegrity.com/synthetic-data/helm/synthetic-data \
  --version 2.1.0 \
  --namespace synthetic-data-ns \
  --values syntheticdata-values.yaml

3. Monitor

  1. Monitor the deployment process using the following command.

    kubectl get pods -n synthetic-data-ns

    Verify that all pods are in the Running state. The following is a sample output.

    NAME                                       READY   STATUS    RESTARTS   AGE
synthetic-data-<hash>-<hash>               1/1     Running   0          3m20s
synthetic-data-db-0                        1/1     Running   0          3m20s

  2. Verify that the Synthetic Data service is deployed.

    kubectl get svc -n synthetic-data-ns

    The following is the sample output.

    NAME                  TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
synthetic-data-svc    ClusterIP   172.20.xxx.xxx   <none>        8000/TCP   61s

    For more information about the Python SDK, refer to Python SDK Reference.


Last modified : July 30, 2026