Prerequisites for Deployment

Ensure the following prerequisites are met:

Tools

Install and configure the following tools on the jumpbox:

• opentofu 1.10 or later. For more information about installation steps, refer to OpenTofu Installation.
• helm 3.12+, kubectl 1.27+, and aws CLI v2 with access to the Protegrity Provisioned Cluster (PPC).

AWS Setup

Ensure that the following AWS requirements are met:

• A Protegrity Provisioned Cluster (PPC) is available. For more information about PPC, refer to Protegrity Provisioned Cluster.

• AWS CLI credentials are configured using aws configure.

• The AWS credentials have permission to provision IAM roles, S3 buckets, EKS Pod Identity associations, and Karpenter node resources. If you encounter AccessDenied errors, refer to IAM Permissions for Installation.

• The jumpbox can connect to the required registry. If you are not already authenticated, log in to it.

  • To authenticate to the Protegrity Container Registry (PCR), use the following command with credentials from the My.Protegrity portal during account creation:

  echo "<password>" | helm registry login registry.protegrity.com --username "<username>" --password-stdin
  

  • For a local registry, use your credentials and local registry endpoint as required.

EKS Cluster Requirements

Ensure that the EKS cluster meets the following requirements:

• Kubernetes 1.27 or later is installed.
• The default StorageClass is used unless you override it. Verify the StorageClass with kubectl get storageclass.
• The EKS Pod Identity Agent add-on is enabled on the cluster.
• Karpenter 1.0 or later is installed and configured on the cluster.

IAM Permissions for Installation

The AWS credentials used during installation require the following permissions. These permissions are required only during installation and can be reduced afterward.