Protegrity Anonymization on

Introduction

Mon, 01 Jan 0001 00:00:00 +0000

Organizations today collect vast amounts of personal data, providing valuable insights into individuals’ habits, purchasing trends, health, and preferences. This information helps businesses refine their strategies, develop products, and drive success. However, much of this data is highly sensitive and private. Organizations must implement robust protection measures aligned with compliance requirements and business needs.

To safeguard personal data, pseudonymization replaces direct identifiers with encrypted or tokenized values. This approach allows data processing while minimizing exposure to sensitive attributes. Because pseudonymized data can be re-identified with access to the decryption mechanism, it enables controlled usage while maintaining privacy. However, as more fields, particularly quasi-identifiers, are pseudonymized to prevent re-identification, the overall utility of the data may decrease.

Understanding the Architecture and Components

Mon, 01 Jan 0001 00:00:00 +0000

Protegrity Anonymization processes datasets through generalization to ensure the risk of re-identification stays within tolerable thresholds. The anonymization process affects data utility. However, Protegrity Anonymization optimizes the privacy-utility trade-off to maximize data quality within defined privacy goals.

Protegrity Anonymization uses Kubernetes for data anonymization at scale and provides deployment support for AWS EKS.

Component Diagram

The following diagram shows the deployment architecture and communication between components.

graph TD
 User([User / Client Application]) -->|HTTPS :443| GW[PPC Gateway]
 User --> SDK[Anonymization Python SDK]
 SDK -->|HTTPS :443| GW

 GW -->|:8000 /pty/anonymization/v3| App[anon-app\nREST Server]
 GW -->|:8786 /pty/dask| Sched[anon-scheduler\nDask Scheduler]

 App -->|:5432| DB[(anon-db\nPostgreSQL)]
 App --> Sched
 Sched -->|random ports| W1[anon-worker]
 Sched -->|random ports| W2[anon-worker]
 W1 <-->|read / write| S3[(S3 Bucket\nAnon-Storage)]
 W2 <-->|read / write| S3

 subgraph EKS [EKS Cluster · anon-ns]
 GW
 App
 DB
 Sched
 W1
 W2
 end

 subgraph AWS
 S3
 IAM[IAM Role\nPod Identity]
 end

 App -.->|assumes| IAM
 IAM -.->|grants access| S3

Communication Ports

The following table lists the ports used for communication between the components.

Prerequisites for Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Ensure the following prerequisites are met:

Tools

Install and configure the following tools on the jumpbox:

opentofu 1.10 or later. For more information about installation steps, refer to OpenTofu Installation.
helm 3.12+, kubectl 1.27+, and aws CLI v2 with access to the Protegrity Provisioned Cluster (PPC).

AWS Setup

Ensure that the following AWS requirements are met:

A Protegrity Provisioned Cluster (PPC) is available. For more information about PPC, refer to Protegrity Provisioned Cluster.

Server Installation

Mon, 01 Jan 0001 00:00:00 +0000

Note: This guide uses version 2.0.1 throughout. Replace 2.0.1 with the version you are installing, including in the Python SDK Installation section.

This project deploys the Protegrity Anonymization service on Amazon EKS as part of the Protegrity AI Team Edition.

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

The OpenTofu module creates the S3 bucket, IAM role, EKS Pod Identity association, and Karpenter NodePool. It also writes anonymization-values.yaml with cloud-specific Helm overrides.

Upgrading Protegrity Anonymization

Mon, 01 Jan 0001 00:00:00 +0000

This section describes how to upgrade Protegrity Anonymization to the latest version.

Note: If you are upgrading across major versions, review the release notes for any breaking changes before proceeding.

Run helm upgrade with the new --version value.

Note: Passwords are preserved during upgrades. Omit the --set database.auth.* flags.

helm upgrade anonymization \
 oci://registry.protegrity.com/anonymization/anonymization-server/helm/anonymization \
 --version <NEW_VERSION> \
 --namespace anon-ns \
 --values <VALUES_FILE>

After upgrading, verify that all pods are in the Running state.

User Creation in PPC

Mon, 01 Jan 0001 00:00:00 +0000

Warning: Use the -k flag only in development or trusted internal environments. Do not use it in production, where valid certificates must be configured.

Role Update and User Creation

After deployment, update the default anonymization_administrator role to include the can_create_token permission and then create a user with this role.

1. Update `anonymization_administrator` role permission

export GATEWAY_URL="https://$(kubectl get configmap/nfa-config -n default -o jsonpath='{.data.FQDN}')"

# 1. Obtain an Authentication Token
TOKEN=$(curl -sk -X POST "${GATEWAY_URL}/api/v1/auth/login/token" \
 -H 'Content-Type: application/x-www-form-urlencoded' \
 -d 'loginname=admin&password=Admin123!' \
 -D - -o /dev/null | grep -i 'pty_access_jwt_token' | awk '{print $2}' | tr -d '\r\n')

curl -sk -X PUT \
 "${GATEWAY_URL}/pty/v1/auth/roles" \
 -H 'accept: application/json' \
 -H "Authorization: Bearer ${TOKEN}" \
 -H 'Content-Type: application/json' \
 -d '{
 "name": "anonymization_administrator",
 "description": "Administrator role",
 "permissions": [
 "can_create_token",
 "anonymization_operations_admin"
 ]
 }'

2. Create a user with the `anonymization_administrator` role

Use the following request payload when creating the user:

Uninstallation and Cleanup

Mon, 01 Jan 0001 00:00:00 +0000

To remove the Anonymization service and all associated Kubernetes and AWS resources:

1. Uninstall the Helm release

# Removes all chart resources. PVC data is RETAINED by default (retentionPolicy: whenDeleted=Retain).
helm uninstall anonymization -n anon-ns

# To also delete the database PVC:
kubectl delete pvc -n anon-ns -l app.kubernetes.io/name=anonymization

Optionally, delete the namespace after the Helm release and PVCs are removed using the following command:

kubectl delete namespace anon-ns

2. Destroy OpenTofu infrastructure

Warning: tofu destroy deletes the S3 bucket, including all stored input and output datasets. Back up any data you need before proceeding.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Diagnostic Flowchart

flowchart TD
 Start[Problem?] --> ServerRunning{Server pods Running?}
 ServerRunning -->|No| PodIssue[Check pod logs<br/>kubectl logs -n anon-ns]
 ServerRunning -->|Yes| APIWorks{Does API respond?}
 APIWorks -->|No| NetworkIssue[Check Service and Gateway<br/>kubectl get svc -n anon-ns]
 APIWorks -->|Yes| ValidationFails{Request fails?}
 ValidationFails -->|Yes| ConfigIssue[Review request config<br/>Check privacy model params]
 ValidationFails -->|No| OtherIssue[Check logs or open a support ticket]
 style Start fill:#e1f5ff

Common Issues

Pods not reaching the `Running` state

kubectl describe pod -n anon-ns <POD_NAME>
kubectl logs -n anon-ns <POD_NAME>

Check that the Karpenter NodePool provisioned the required nodes. Ensure that OpenTofu created the S3 bucket and IAM role.

Protegrity Anonymization on

Introduction

Understanding the Architecture and Components

Component Diagram

Communication Ports

Prerequisites for Deployment

Tools

AWS Setup

Server Installation

Deployment Steps

1. Provision Cloud Infrastructure with OpenTofu

Upgrading Protegrity Anonymization

User Creation in PPC

Role Update and User Creation

1. Update anonymization_administrator role permission

2. Create a user with the anonymization_administrator role

Uninstallation and Cleanup

1. Uninstall the Helm release

2. Destroy OpenTofu infrastructure

Troubleshooting

Diagnostic Flowchart

Common Issues

Pods not reaching the Running state

1. Update `anonymization_administrator` role permission

2. Create a user with the `anonymization_administrator` role

Pods not reaching the `Running` state