Automated script-based installation

Complete the steps provided in this section to deploy PPC in AWS EKS.

Before you begin

  • Before running the bootstrap as the root user on RHEL, ensure that /usr/local/bin, and the AWS CLI binary path, if applicable, is included in the $PATH. Alternatively, run the script using a non-root user, such as ec2-user, where /usr/local/bin is already part of the default PATH.

The repository provides a bootstrap script that automatically installs or updates the following software on the jump box:

  • AWS CLI - Required to communicate with the AWS account.
  • OpenTofu - Required to manage infrastructure as code.
  • kubectl - Required to communicate with the Kubernetes cluster.
  • Helm - Required to manage Kubernetes packages.
  • skopeo - Required to copy and inspect container images across registries without requiring a daemon.
  • jq - Required to parse JSON.

The bootstrap script also checks if you have the required permissions on AWS. It then sets up the EKS cluster and installs the microservices required for deploying the PPC.

Using Standard Bottlerocket AMI Deployment

Verify whether the secure Bottlerocket AMI is available before deciding to use the standard Bottlerocket AMI. Run the following AWS CLI command against the target region, replacing <region>, <eks-version>, and <arch> (x86_64 or arm64) with your values:

aws ssm get-parameter \
--region <region> \
--name "/aws/service/bottlerocket/aws-k8s-<eks-version>-fips/<arch>/latest/image_id"

If the command returns ParameterNotFound, then the secure Bottlerocket AMI is not published in that region, and you must complete the additional requirements. For the additional requirements, refer to Configuring for a Standard Deployment.

Architecture Selection

The step [1b] Select Node Architecture in the bootstrap script prompts to select the node architecture interactively during deployment.

  • amd64 (x86-64-based environments such as standard Intel or AMD servers)

  • arm64 (ARM-based environments such as AWS Graviton)

Deploying the PPC

The bootstrap script prompts for variables to be set to complete your deployment. Follow the instructions on the screen:

./bootstrap.sh --cloud aws

The script prompts for the following variables.

  1. Enter Cluster Name

    The following characters are allowed:

    • Lowercase letters: a-z
    • Numbers: 0-9
    • Hyphens: -

    The following characters are not allowed:

    • Uppercase letters: A-Z
    • Underscores: _
    • Spaces
    • Any special characters such as: / ? * + % ! @ # $ ^ & ( ) = [ ] { } : ; , .
    • Leading or trailing hyphens
    • Names longer than 31 characters (the cluster name must be 31 characters or fewer)

    Note: Ensure that the cluster name does not exceed 31 characters. Cluster names longer than this limit can cause the bootstrap script to fail in subsequent installation steps. If the installation fails, specify a cluster name that is 31 characters or fewer and re-run the script. The script automatically applies the updated value and continues the bootstrap process.

    After the cluster name is accepted, the script prompts you to select the node architecture.

    [1b] Select Node Architecture

    [1b] Select Node Architecture
  1) amd64 (x86_64) — e.g. t3, m5, c5 instances
  2) arm64 (Graviton) — e.g. t4g, m7g, c7g instances

    Enter 1 to select amd64 or 2 to select arm64.

    Note: Select amd64 for standard Intel/AMD 64-bit environments. Select arm64 for ARM-based environments such as AWS Graviton instances.

  2. Enter a VPC ID from the table

    The script automatically retrieves the available VPCs. Enter the VPC ID where the cluster must be created.

  3. Querying for subnets in VPC…

    The script queries for the available VPC subnets and prompts to enter two private subnet IDs. Specify two private subnet IDs from different availability zones.
    The script automatically updates the VPC CIDR block based on the VPC details.

  4. Enter FQDN

    This is the Fully Qualified Domain Name (FQDN) for the ingress.

    Warning: Ensure that the FQDN does not exceed 50 characters and only the following characters are used:

    • Lowercase letters: a-z
    • Numbers: 0-9
    • Special characters: - .

  5. Select S3 Backup Bucket Option

    The script prompts to choose how to provide the AWS S3 bucket encrypted with SSE‑KMS used for storing cluster backups for disaster recovery.

    Do you want to use an existing S3 bucket, or provision a new one (with KMS key)?
  1) Use existing
  2) Provision new via Tofu (00_backup_bucket)

  6. Enter S3 bucket name

    • Option 1 – Use existing: Enter the name of an existing S3 bucket in your AWS account. The bucket must already be encrypted with SSE‑KMS.
    • Option 2 – Provision new via Tofu: The script uses OpenTofu (00_backup_bucket) to create the S3 bucket and the corresponding KMS key on your behalf. Provide a globally unique bucket name when prompted:
      • Lowercase letters, digits, and hyphens only
      • Between 3 and 63 characters
      • Must not already exist

    Note: Use a dedicated S3 bucket per cluster for backup and restore operations to ensure data and encryption isolation. Sharing a bucket across clusters increases the risk of cross-cluster data access or decryption due to IAM misconfiguration. Dedicated buckets with unique IAM policies eliminate this risk.

    Note: During disaster management, OpenSearch restores only those snapshots that are created using the daily-insight-snapshots policy. For more information, refer to Backing up and restoring indexes.

  7. Enter Image Registry Endpoint

    Enter <Container_Registry_Path>, the container registry endpoint from where the container images are retrieved.

    Note: If deploying from the Protegrity Container Registry, use registry.protegrity.com:9443. Specify the local registry endpoint if a local registry is used.

    Expected format: <hostname>[:port].
    Do not include ‘https://’

    Note: The container registry endpoint must be a Fully Qualified Domain Name (FQDN). Sub-paths like, <Container_Registry_Path>/v2/path, are not supported by the Open Container Initiative (OCI) distribution specification.

  8. Enter Registry Username

    Enter the username for the registry mentioned in the previous step. Leave this entry blank if the registry does not require authentication.

  9. Enter Registry Password or Access Token

    Enter Password or Access Token for the registry. Input is masked with * characters. Press Enter to keep the current value. Leave this entry blank if the registry does not require authentication.

  10. Enter Owner Email (for cluster tagging)

    Enter email address in the format name@domain.tld. This email is used for the cluster ‘Owner’ tag and the platform owner contact.

Note: The cluster creation process can take 10-15 minutes.

If the session is terminated during installation due to network issues, power outage, and so on, then the installation stops. To restart the installation, run the script again:

# Navigate to setup directory 
./bootstrap.sh --cloud aws

Important Information

  • Do not install or manage multiple clusters from the same working directory. Each cluster deployment maintains its own Terraform/OpenTofu state, and reusing a directory can overwrite state files, causing loss of cluster tracking and unintended cleanup behavior.

  • Use a dedicated directory, and jump box, where possible, per cluster, and always verify the active kubectl context before running cleanup commands such as ./bootstrap.sh --cloud aws destroy.
    To check the active kubectl context, run the following command:
    kubectl config current-context

  • Do not delete the original cluster deployment directory, as it contains the Terraform state files required for managing the deployment.

Configuring for a Standard Deployment

Note: The following instructions are optional and only required for configuring a standard PPC deployment on AWS. Skip these steps if you have already installed the secure Bottlerocket AMIs.

By default, the PCT is configured to deploy a cluster using secure Bottlerocket AMIs. To deploy a standard cluster, the Terraform configuration files must be modified to use the standard Bottlerocket AMI types and SSM parameter paths before running the bootstrap script or the component-based installation.

For a standard PPC deployment on AWS EKS, perform the following steps:

  1. Ensure that you have downloaded and extracted the PCT. For more information, refer to Preparing for PPC deployment.

  2. Update the node group AMI type map in the /03_node_group/variables.tf file.

The node_group_ami_type_map variable defines the fallback EKS AMI type used per node architecture when node_group_ami_type is not explicitly set. The secure Bottlerocket AMI defaults must be replaced with the corresponding standard Bottlerocket AMI types.

a. Navigate to /03_node_group directory.

cd iac/aws/cluster/modules/03_node_group/

b. Edit the variables.tf file to make the following changes.

Change from (secure defaults):

variable "node_group_ami_type_map" {
  description = "Fallback EKS AMI type per architecture, used when node_group_ami_type is empty."
  type        = map(string)
  default = {
    amd64 = "BOTTLEROCKET_x86_64_FIPS"
    arm64 = "BOTTLEROCKET_ARM_64_FIPS"
  }
}

Change to (standard values):

variable "node_group_ami_type_map" {
  description = "Fallback EKS AMI type per architecture, used when node_group_ami_type is empty."
  type        = map(string)
  default = {
    amd64 = "BOTTLEROCKET_x86_64"
    arm64 = "BOTTLEROCKET_ARM_64"
  }
}
  1. Update the Karpenter AMI SSM parameter path in the /05_helm_releases/main.tf file.

The karpenter_fips_ami_ssm_parameter value specifies the AWS Systems Manager (SSM) parameter path that Karpenter uses to resolve the correct Bottlerocket AMI for worker nodes. The default path targets the secure Bottlerocket AMI. For a standard cluster, remove the -fips segment from the EKS version portion of the path.

a. Navigate to /05_helm_releases directory.

cd iac/aws/cluster/modules/05_helm_releases/

b. Edit the main.tf file to make the following changes.

Change from (secure SSM path):

karpenter_fips_ami_ssm_parameter = "/aws/service/bottlerocket/aws-k8s-${data.aws_eks_cluster.this.version}-fips/${local.karpenter_ami_arch}/latest/image_id"

Change to (standard SSM path):

karpenter_fips_ami_ssm_parameter = "/aws/service/bottlerocket/aws-k8s-${data.aws_eks_cluster.this.version}/${local.karpenter_ami_arch}/latest/image_id"
  1. After completing all these configuration changes, proceed to deploy the cluster.

Note: The additional requirements update the Terraform configuration files for the bootstrap script. Do not modify the 03_node_group/variables.tf or 05_helm_releases/main.tf files in the preceding installation steps. Reverting those changes will result in a secure cluster being deployed instead of a standard cluster.

Last modified : November 03, 2026