Installing Policy

This section describes the steps to install and verify Policy. Ensure that all the prerequisites for installation have been met.
For more information about the prerequisites, refer to Prerequisites.

Create the Namespace

Create the Policy namespace:

kubectl create namespace pty-policy

Continue to Provision the Registry Pull Secret.

Provision the Registry Pull Secret

Policy workload images are downloaded from the PPC workload-image registry. This can differ from the chart registry you logged in to with helm registry login. This login enables Helm to download the chart. It does not let the cluster nodes pull images. If the Secret is needed and missing, then the pods fail with ErrImagePull or ImagePullBackOff.

Perform the following steps to provision the registry pull secret:

1. Read the Secret name configured by PPC:

export REGISTRY_SECRET_NAME="$(kubectl --namespace default get configmap nfa-config \
  -o jsonpath='{.data.REGISTRY_SECRET_NAME}')"
echo "REGISTRY_SECRET_NAME=${REGISTRY_SECRET_NAME:-<empty>}"

If the value is empty, the nodes authenticate to the registry themselves. Skip to Database Credentials.
For more information refer to Database Credentials.

2. If the value is set, copy the Secret into the Policy namespace. Replace default if your PPC platform namespace differs.

kubectl --namespace default get secret "$REGISTRY_SECRET_NAME" -o json \
  | jq -c '{apiVersion, kind, type, data, metadata: {name: .metadata.name, namespace: "pty-policy"}}' \
  | kubectl create -f -

If the command reports AlreadyExists, do not overwrite the Secret. Verify it in the next step.

3. Verify the Secret:

kubectl --namespace pty-policy get secret "$REGISTRY_SECRET_NAME"

The TYPE must be kubernetes.io/dockerconfigjson. Resolve any error before continuing.

The chart references only the Secret’s name and never reads or copies its data through Helm. The copy is not synchronized. When the platform Secret is renewed or replaced, update the copy in pty-policy.

Database Credentials

Create the three database Secrets from the files prepared in prerequisites:

(
  set -e
  for role in maintenance runtime backup; do
    kubectl --namespace pty-policy create secret generic "policy-db-${role}" \
      --from-file="postgres_user=$HOME/.config/protegrity/policy/credentials/${role}-username" \
      --from-file="postgres_password=$HOME/.config/protegrity/policy/credentials/${role}-password"
  done
)

The commands create policy-db-maintenance, policy-db-runtime, and policy-db-backup. They read passwords from the protected files without printing them. For managed credential delivery instead, see credential handling.

PPC Service Credentials

Create the integration Secrets from the prepared PPC user credentials:

(
  set -e
  for service in pim traverse; do
    kubectl --namespace pty-policy create secret generic "${service}-credentials" \
      --from-file="username=$HOME/.config/protegrity/policy/credentials/${service}-username" \
      --from-file="password=$HOME/.config/protegrity/policy/credentials/${service}-password"
  done
)

The commands create pim-credentials and traverse-credentials. Policy uses these users to obtain and refresh dependency access tokens.

Install the Chart

Run the following command:

helm install policy "oci://${POLICY_REGISTRY_HOST}/policy/helm/policy" \
  --version 1.1.0 \
  --namespace pty-policy \
  --wait --wait-for-jobs --timeout 15m

The standard installation does not require a separate values file. For nondefault settings, append --values customer-values.yaml with your configuration file. See configuration for supported overrides.

The chart automatically:

• Deploys the Policy API, Panel, and in-stack PostgreSQL.
• Creates the database logins from the supplied credentials.
• Configures pmx_app membership and database permissions.
• Initializes the application schema through the bootstrap Job.
• Registers the built-in Policy roles and gateway authorization resources.
• Creates storage claims using PPC’s configured storage classes.
• Configures startup, readiness, and liveness probes.

Database provisioning automatically creates pmx_app, a PostgreSQL NOLOGIN permission role, and grants it to runtime. The wait options keep Helm running until workloads and bootstrap Jobs are ready. You do not need to inspect database grants, repeat health probes, or recheck chart-created roles.

If Helm fails, use installation troubleshooting. Keep the credential files until installation completes and you store the credentials through your normal secret-management process.

After Helm completes, follow Creating Policy users to create or assign the named PPC account that will sign in. The chart registers the built-in roles. You assign them to people separately.

Verifying the Installation

Helm waits for workloads and database bootstrap through the command’s wait options. No separate installer checks of database grants, built-in roles, or health probes are required. Complete these steps with your assigned PPC account:

1. Get the Policy web address from PPC:

   kubectl --namespace default get configmap nfa-config \
     -o jsonpath='https://{.data.FQDN}/pty/policy/v1.0/ui/{"\n"}'
   

   The command uses the PPC cluster’s fully qualified domain name (FQDN). Use your configured path if your installation overrides the default.

2. Open that address in your browser and sign in with your named PPC account.

3. Open the Policy Library.

   The Library displays the policies you can access. An empty list is normal before anyone creates a policy.

If you cannot open Policy or sign in, use installation and access troubleshooting.

If you configured Traverse directory connections before installing Policy, the connection owner may need to save those details again. See the identity provider (IdP) backfill issue.