Prerequisites

Complete these steps before installing Policy on a Protegrity Provisioned Cluster (PPC). Use a PPC user with administrator permissions to create users and assign roles. This guide calls that user a PPC administrator.

Required Products

Ensure that PPC, Policy Workbench, and Traverse are installed. Ensure that Policy Integration Manager (PIM) is initialized through the Workbench setup. Use the Workbench installation instructions for Amazon Web Services (AWS) or Microsoft Azure.

• Traverse is installed
• Traverse is not installed

If you configured directory connections before installing Policy, save those connection details again after Policy installation. See the IdP backfill issue for the identity provider (IdP) connection steps.

Connect to PPC

Use the Kubernetes connection established during PPC installation. Run the Bash examples in a terminal with Helm, kubectl, jq, and OpenSSL available. All installation commands use the active Kubernetes context:

kubectl config current-context

The output should identify your PPC cluster. For connection instructions, refer to your PPC installation documentation.

PPC Storage and Release Defaults

Policy uses the shared pty-main gateway in api-gateway and the nfa-config ConfigMap in default. These are PPC platform resources, not values you need to supply for a standard installation.

The chart uses PPC’s STORAGE_CLASS and BACKUP_STORAGE_CLASS settings. It creates separate persistent volume claims for the database and logical backups, each requesting 10Gi. It also configures the database accounts and permissions. You do not need to create storage classes, volumes, or database grants manually.

The installation command selects chart version 1.1.0. The chart supplies its application and database image versions and reads the workload registry from PPC. You only need the Open Container Initiative (OCI) chart-registry host from your release distribution. The installation procedure checks whether PPC requires an image-pull Secret and, if so, copies it into the Policy namespace.
For more information about provisioning registry pull secret, refer to Provision the Registry Pull Secret.

Create PPC Service Users

Helm creates database users, but it does not create PPC integration users. Create the two service users once during preparation:

1. Log in to the PPC command-line interface (CLI) as a PPC administrator. Follow Accessing the PPC CLI to connect and sign in to the CLI Manager.

2. Create the token-login role if it does not already exist:

   admin create roles --name policy_service_login --permissions "can_create_token"
   

3. Create the PIM service user:

   admin create users --username pmx.pim.service --roles "workbench_administrator,policy_service_login" --password "<pim-service-password>"
   

4. Create the Traverse service user:

   admin create users --username pmx.traverse.poller --roles "discoverx-automation-client,discoverx-admin,policy_service_login" --password "<traverse-service-password>"
   

   Replace the password placeholders with separate passwords that satisfy PPC’s password policy. Run credential-setting commands in a protected CLI Manager session without command recording. If PPC prompts for a first-login password change, use the final password in the files below.

5. List PPC users:

   admin list users
   

   The output includes the usernames and identifiers of the users you created. Roles are assigned during creation, so no separate user-identifier lookup or role-update command is required.

These users authenticate Policy’s background connections to PIM and Traverse. Policy obtains and refreshes their tokens using the credentials you provide. They are separate from the named PPC accounts people use to sign in. See accounts and permissions for the permission reference.

Prepare Credential Files

Return to the Bash terminal you will use for Helm installation. This guide stores local credential files under the following directory:

$HOME/.config/protegrity/policy/credentials

These are files you create, not preinstalled PPC files. The installation commands below use this location directly. Keep the directory private and outside source control.

Database Credentials

Run this block once to create three database usernames and generate their passwords:

(
  set -e
  set +x
  set -o noclobber
  umask 077
  mkdir -p "$HOME/.config/protegrity/policy/credentials"
  chmod 700 "$HOME/.config/protegrity/policy/credentials"
  for role in maintenance runtime backup; do
    printf '%s' "policy_${role}" > "$HOME/.config/protegrity/policy/credentials/${role}-username"
    password=$(openssl rand -base64 32)
    printf '%s' "$password" > "$HOME/.config/protegrity/policy/credentials/${role}-password"
  done
)

The block creates six files and refuses to overwrite existing files. Helm uses these credentials to create the database logins and their grants. Database provisioning automatically creates pmx_app, a PostgreSQL NOLOGIN permission role, and grants it to runtime. You do not create or validate these database accounts yourself.

PPC Service Credentials

Save the passwords you assigned to the PPC service users:

(
  set -e
  set +x
  set -o noclobber
  umask 077
  printf '%s' 'pmx.pim.service' > "$HOME/.config/protegrity/policy/credentials/pim-username"
  printf '%s' 'pmx.traverse.poller' > "$HOME/.config/protegrity/policy/credentials/traverse-username"
  for service in pim traverse; do
    read -r -s -p "Password for the ${service} service user: " password
    printf '\n'
    if [ -z "$password" ]; then
      printf 'A service-user password is required.\n' >&2
      exit 1
    fi
    printf '%s' "$password" > "$HOME/.config/protegrity/policy/credentials/${service}-password"
  done
)

The prompts hide each password. Use the existing PPC passwords. Do not generate replacements for these users.

Additional Prerequisites

Use the same Bash terminal and active Kubernetes context as the prerequisite steps. These instructions install a new Policy deployment. Set the Open Container Initiative (OCI) chart-registry host supplied with your release:

export POLICY_REGISTRY_HOST='<oci-registry-host>'

Replace the placeholder with the host, including a port if required. The following command installs chart version 1.1.0. Its other settings use PPC defaults. If the chart registry requires authentication, log in:

helm registry login "$POLICY_REGISTRY_HOST"

Helm prompts for registry credentials. The chart registry can differ from PPC’s workload-image registry.
This login authenticates Helm only. It does not authorize cluster nodes to pull workload images. For more information, refer to Provision the Registry Pull Secret.

Continue to Installation

Continue to install the Policy Helm chart.
For more information about installing Policy, refer to section Installing Policy. The procedure creates Kubernetes Secrets from these files and installs Policy with the standard PPC defaults.