Installing PPC on Microsoft Azure on

Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Microsoft Azure Resource Providers

The following Microsoft Azure resource providers are registered.

Microsoft.ContainerService
Microsoft.Network
Microsoft.Compute
Microsoft.Storage
Microsoft.KeyVault
Microsoft.ManagedIdentity

Permissions to deploy AKS

Update the following custom role permissions.

Before you begin

Identify the resource group where the AKS cluster will be created.
Ensure that a custom role is already created in the subscription or resource group.
Complete this configuration before starting the AKS installation process.

To update the permission for the custom role, perform the following steps:

Preparing for PPC deployment

Mon, 01 Jan 0001 00:00:00 +0000

The Protegrity Cluster Template (PCT) is a pre-packaged deployment archive that contains the infrastructure-as-code scripts, Helm charts, and bootstrap tooling required to provision a PPC on your target cloud platform. It automates the creation of the Kubernetes cluster, networking, identity configuration, and installation of Protegrity microservices. Download and extract the PCT on your jump box before starting the deployment process.

Note: If there is an existing cluster from a previous install, clean up your local repository on the jump box and any existing clusters by running ./bootstrap.sh --cloud azure destroy from /deployment before proceeding.

Installing Features and Protectors

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Ensure that PPC is successfully installed before installing the features or protectors.

Installing Features

The following table lists the available features.

Feature	Description
Data Discovery	Installing Data Discovery
Semantic Guardrails	Installing Semantic Guardrails
Protegrity Agent	Installing Protegrity Agent
Anonymization	Installing Anonymization
Synthetic Data	Installing Synthetic Data

Installing Protectors

The following table lists the available protectors.

Protector	Description
Application Protector	Installing Application Protector
Repository Protector	Installing Repository Protector
Application Protector Java Container	Installing Application Protector Java Container
Rest Container	Installing Rest Container
Cloud Protector	Installing Cloud Protector

Deleting PPC

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Authentication

The deletion process uses OpenTofu to destroy Azure resources, such as AKS clusters, managed identities, storage accounts, and Key Vaults. The Azure CLI must be authenticated to perform these operations.

Note: While using temporary credentials, such as service principal tokens or managed identity tokens, ensure that the credentials have not expired before proceeding.

To authenticate and set the correct subscription, run the following commands.

az login
az account set --subscription <subscription-id>

To verify that the credentials are valid and the correct Azure subscription is being used, run the following command.

Backing up the PPC

Mon, 01 Jan 0001 00:00:00 +0000

Protegrity Provisioned Cluster (PPC) supports backup of Insight indexes and cluster configurations. Use the procedures below to update the scheduled backups of your PPC deployment.

Backing up Velero backup schedule

To take a backup at an interval of 10 minutes, the cron job must be executed before the schedule. This ensures that the latest configurations are included and are available in the Storage Account.
By default, the cron job is executed after every 3 hours and schedule is executed after every 3.5 hours.

Restoring the PPC

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Before starting a restore, ensure the following conditions are met:

An existing backup is available. Backups are taken automatically as part of the default installation using scheduled backup mechanisms. These backups are stored in a Storage Account configured during the original installation.
Access to the original backup Storage Account. During restore, the same Storage Account that was used during the original installation must be specified.
Permissions to read from the Storage Account. The user performing the restore must have sufficient permissions to access the backup data stored in the account.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Accessing the PPC CLI

Permission denied for publickey: Ensure the correct private key ~/.ssh/<cluster_name>_user_svc is used and matches the authorized_keys in the pod.
Connection refused: Verify the load balancer IP and hosts file configuration.
Key format issues: Ensure the private key is in the correct format . For example, OpenSSH format for Linux or macOS, .ppk for PuTTY.

Component installation issues

Helm chart not found: Run helm repo update to refresh the repository cache.

Restoring the SSH keys and PCT from backed up Terraform state file

Mon, 01 Jan 0001 00:00:00 +0000

This section describes the procedure to rebuild a usable PPC v1.1.0 deployment workspace on a jump box from an existing cluster and a backed up Terraform state file.

Before you Begin

Ensure the following requirements are met.

The state file from all the following modules must be available on the Storage Account.