Troubleshooting

Diagnostic Flowchart

flowchart TD
    Start[Problem?] --> ServerRunning{Server pods Running?}
    ServerRunning -->|No| PodIssue[Check pod logs<br/>kubectl logs -n anon-ns]
    ServerRunning -->|Yes| APIWorks{Does API respond?}
    APIWorks -->|No| NetworkIssue[Check Service and Gateway<br/>kubectl get svc -n anon-ns]
    APIWorks -->|Yes| ValidationFails{Request fails?}
    ValidationFails -->|Yes| ConfigIssue[Review request config<br/>Check privacy model params]
    ValidationFails -->|No| OtherIssue[Check logs or open a support ticket]
    style Start fill:#e1f5ff

Common Issues

Pods not reaching the Running state

kubectl describe pod -n anon-ns <POD_NAME>
kubectl logs -n anon-ns <POD_NAME>

Check that the Karpenter NodePool provisioned the required nodes. Ensure that OpenTofu created the S3 bucket and IAM role.

API returns 401 Unauthorized

Ensure that the login token is valid and has not expired. Re-authenticate using the login endpoint and update the Authorization header.

API returns 403 Forbidden

Verify that the user’s role includes the can_create_token permission. Follow the User Creation in PPC steps to confirm role configuration.

OpenTofu errors on tofu apply

• AccessDenied: The AWS credentials do not have the required IAM permissions. For more information about permissions, refer to IAM Permissions for Installation section.
• BucketAlreadyExists: An S3 bucket with the same name already exists. Choose a unique bucket name or import the existing bucket into the OpenTofu state.

Helm upgrade fails with an immutable field error

Delete the existing release, then reinstall:

helm uninstall anonymization -n anon-ns
# Re-run the install command

For more troubleshooting guidance, refer to Protegrity Support.