Upgrading Policy Workbench in AWS

Before you begin

• Back up the existing Policy Workbench data.

  For more information, refer to Backing up the Policy Workbench for AWS.

Configuring Credentials for the Policy Workbench

Perform the following steps to configure the credentials to access the Policy Workbench from the OCI registry.

1. Run the following command to create the configuration directory.

   mkdir -p ~/.config/containers
   

2. Obtain the username and access token from the My.Protegrity portal. For more information about obtaining the credentials from the My.Protegrity portal, refer to the section Configuring Authentication for Protegrity AI Team Edition.

3. Generate base64 encoded string with padding for username:accesstoken obtained from the My.Protegrity portal.

   Ensure that you specify the username and access token within single quotes when generating the base64 encoded value. For example, 'username:accesstoken'.

4. Create a file named ~/.config/containers/auth.json with the following content.

    {
        "auths": {
                "registry.protegrity.com:9443": {
                        "auth": "<base64 generated string from step-3>"
                }
        }
}

Upgrade the Policy Workbench Deployment

Depending on the Policy Workbench installation type, follow the relevant steps:

Root module was not available during installation

1. Navigate to the deployment directory.

2. Copy the main.tf contents from step 2 of Installing Policy Workbench when root module is not available.

   Note: The new main.tf includes a kubernetes provider and additional module arguments (oci_host, fips, ami_id) that were not present in earlier versions.

3. Replace the contents of the existing main.tf with the copied content.

4. In main.tf, set the following parameter values.

   Parameter	Description	Value
   <Container_Registry_Path>	Location of the Protegrity Container Registry or the local registry where the policy-workbench OpenTofu module is published.	registry.protegrity.com:9443 if Protegrity Container Registry is used. local registry endpoint if a local registry is used.
   <Container_Registry_Hostname>	OCI registry hostname used for oci_host.	registry.protegrity.com
   <version>	Tag version of the Protegrity Policy Manager, as listed in the Policy Manager README.	1.12.0
   <PPC-cluster-name>	Name of the PPC cluster specified during deployment.	The value used for the cluster name when deploying PPC.
   fips	Use FIPS Bottlerocket AMI for Karpenter nodes.	The default value is true. Set the value to false for non-FIPS.
   ami_id	Explicit Amazon Machine Image (AMI) ID for Karpenter nodes. When this value is set, it overrides the FIPS-based AMI selection.	<ami-id>

   For more information about the <PPC-cluster-name>, refer to Deploying PPC.

5. Ensure that the credentials to install the Policy Workbench from the Protegrity Container Registry have been configured.

   For more information about configuring the credentials, refer to the section Configuring Credentials for the Policy Workbench.

Root module was available during installation

1. Navigate to the root module directory.

2. Locate the policy_workbench module block in the .tf files.

3. Update the module block with the following:

   Note: The oci_host, fips, and ami_id arguments are new in this version. If the existing module block does not include them, add them along with the updated source value.

   module "policy_workbench" {
     source       = "oci://<Container_Registry_Path>/policy-workbench/opentofu/modules/policy-workbench/aws?tag=<version>"
     cluster_name = var.cluster_name
     oci_host     = "<Container_Registry_Hostname>"
     fips         = var.fips
     ami_id       = var.ami_id
   }
   

4. In the policy_workbench module block, set the parameter values as specified in the parameter table.

5. If the root module does not include the following provider versions, add them to the terraform {} block:

   • hashicorp/aws version ~> 6.0
   • hashicorp/kubernetes version ~> 2.35

   required_providers {
     aws = {
       source  = "registry.opentofu.org/hashicorp/aws"
       version = "~> 6.0"
     }
     kubernetes = {
       source  = "registry.opentofu.org/hashicorp/kubernetes"
       version = "~> 2.35"
     }
   }
   

6. Configure the kubernetes provider to connect to the target EKS cluster by adding the following to the root module:

   data "aws_eks_cluster" "this" {
     name = "<PPC-cluster-name>"
   }
   
   data "aws_eks_cluster_auth" "this" {
     name = "<PPC-cluster-name>"
   }
   
   provider "kubernetes" {
     host                   = data.aws_eks_cluster.this.endpoint
     cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
     token                  = data.aws_eks_cluster_auth.this.token
   }
   

7. Ensure that the credentials to update the Policy Workbench from the Protegrity Container Registry have been configured.

   For more information about configuring the credentials, refer to the section Configuring Credentials for the Policy Workbench.

Apply the Configuration

From the configured directory, complete the following steps:

1. Run the following command to initialize the OpenTofu providers.

   tofu init -upgrade
   

2. Run the following commands to import existing resources into the OpenTofu state.

   MANAGED_BY=$(kubectl get nodepool policy-workbench -o jsonpath='{.metadata.labels.app\.kubernetes\.io/managed-by}')
   
   if [ "$MANAGED_BY" = "Helm" ]; then
     tofu import -var="cluster_name=<PPC-cluster-name>" \
       'module.policy_workbench.kubernetes_manifest.node_pool[0]' \
       'apiVersion=karpenter.sh/v1,kind=NodePool,name=policy-workbench'
   
     tofu import -var="cluster_name=<PPC-cluster-name>" \
       'module.policy_workbench.kubernetes_manifest.ec2_node_class[0]' \
       'apiVersion=karpenter.k8s.aws/v1,kind=EC2NodeClass,name=policy-workbench'
   fi
   

3. Run the following commands to preview and apply the OpenTofu changes.

   tofu plan -var="cluster_name=<PPC-cluster-name>"
   tofu apply -var="cluster_name=<PPC-cluster-name>"
   

   OpenTofu displays the plan and prompts for confirmation before applying. Enter yes to proceed, or add the -auto-approve flag to the tofu apply command to skip the prompt.

Deploy the Upgrade with Helm

Run the following command to upgrade Policy Workbench.

helm upgrade --install policy-workbench \
  oci://<Container_Registry_Path>/policy-workbench/helm/policy-workbench \
  --version <version> \
  --namespace policy-workbench \
  --values policy-workbench-values.yaml

Set the values of <Container_Registry_Path> and <version> as specified in the parameter table.

Note: The policy-workbench-values.yaml file is generated by the OpenTofu module in the working directory during the previous step. If the file is missing, re-run tofu apply before proceeding.

If the upgrade is successful, then Helm displays the following output.

NOTES:
Protegrity policy-workbench 1.12.0 installed

The version number reflects the upgraded version.

Verify the Upgrade

Confirm that the Helm release and pods are running correctly.

1. Run the following command to verify the Helm release status.

   helm list -n policy-workbench
   

   The output appears as follows.

   NAME              NAMESPACE         REVISION  STATUS    CHART                    APP VERSION
   policy-workbench  policy-workbench  2         deployed  policy-workbench-1.12.0  1.12.0
   

   The REVISION number increments with each upgrade.

2. Run the following command to verify the Policy Workbench pods are running.

   kubectl get pods -n policy-workbench
   

   The output appears as follows.

   NAME                        READY   STATUS    RESTARTS   AGE
   bootstrap-bffb4b5d9-v6ww4   1/1     Running   0          13m
   cert-7b88dcd84-zx7cv        1/1     Running   0          13m
   devops-75755d87d4-qw9n6     1/1     Running   0          13m
   hubcontroller-0             1/1     Running   0          13m
   kmgw-0                      1/1     Running   0          13m
   mbs-6b7dc765dd-brrfk        1/1     Running   0          13m
   repository-0                1/1     Running   0          13m
   rpproxy-79fc498d8-qp4fz     1/1     Running   0          13m
   rpproxy-79fc498d8-s9k5p     1/1     Running   0          13m
   rpproxy-79fc498d8-tbdtb     1/1     Running   0          13m
   rps-8d79b7d98-svhdw         1/1     Running   0          13m
   

   All pods must show 1/1 under READY and Running under STATUS. Pod names and ages may differ across environments.

Validate the Deployment

Confirm that the Policy Workbench API is accessible after the upgrade.

1. Run the following command to retrieve the gateway address.

   export GW_HOST="$(kubectl get gateway pty-main -n api-gateway -o jsonpath='{.status.addresses[0].value}')"
   

2. Run the following command to obtain an authentication token for the workbench user.

   export TOKEN=$(curl -k -s https://$GW_HOST/pty/v1/auth/login/token \
     -X POST \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'loginname=workbench' \
     -d 'password=<workbench-password>' \
     -D - -o /dev/null 2>&1 | grep -i 'pty_access_jwt_token:' | sed 's/pty_access_jwt_token: //' | tr -d '\r')
   

   Set <workbench-password> to the workbench user password specified during deployment.

3. Run the following command to verify access to the Policy Workbench datastores API.

   curl -k -v https://$GW_HOST/pty/v2/pim/datastores -H "Authorization: Bearer $TOKEN"
   

An empty array [] or a list of datastore objects returned by the command confirms that the upgrade is complete.