Prerequisites
The following prerequisites apply to both resource-management paths. Both paths require access to the OCI registry to install the Helm chart.
Ensure that the target AKS cluster is accessible and has a supported PPC installation.
For more information, refer to PPC installation.
Ensure that the jumpbox can connect to the required registries. If not already authenticated, then log in to the required registry.
For connecting and deploying from the Protegrity Container Registry (PCR), use the following command and the credentials obtained from the My.Protegrity portal during account creation:
helm registry login registry.protegrity.com:9443
- For connecting and deploying to the local registry, use your local credentials and local registry endpoint as required.
Required Tools
| Tool | Version | Description |
|---|---|---|
| Azure CLI | Any version | Required for Azure resource configuration. Must be logged in with az login. |
| kubectl | Any version | Required for validating the deployment. Must be configured for the target AKS cluster. |
| Helm | >= 3.8.0 | Required to install or upgrade the Policy Workbench Helm chart for both resource-management paths. |
| OpenTofu | 1.10.0 or later | Required only for module-managed Workbench resources. |
Permissions
The identity used to provision Workbench resources needs the following Azure permissions, irrespective of whether provisioning uses OpenTofu or the existing infrastructure process.
| Permission | Purpose |
|---|---|
Microsoft.ManagedIdentity/userAssignedIdentities/write | Create the managed identity. |
Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write | Create the federated identity credential. |
Microsoft.KeyVault/vaults/read | Read the key vault properties. |
Microsoft.Authorization/roleAssignments/write | Assign the Key Vault Crypto Officer role on the key vault. |
Microsoft.KeyVault/managedHSMs/read | Read the managed HSM properties. |
HSM local RBAC: Microsoft.KeyVault/managedHsm/roleAssignments/write | Assign the Crypto User role on the HSM. |
Helm deployment: The installer needs OCI registry access and Kubernetes RBAC to install or upgrade the chart. Helm access does not grant Azure or keystore access.
KMGW runtime: The KMGW pod uses the workbench-kms workload identity to access the configured keystore. Grant this identity only the keystore permissions required by the configured backend. These permissions are separate from those required by the OpenTofu or Helm operator.
Feedback
Was this page helpful?