Deploying REST Container Using Static Method

Describes how to deploy the REST container using the Static deployment method.

The following steps describe how to deploy the REST Container.

Run the following command to generate the client certificate to authenticate with the KMS-Proxy service.

CreateCertificate_Linux_x64_<Version>.sh client --name <Directory> --dns <Release_Name>.<namespace>.svc

For example:

CreateCertificate_Linux_x64_<Version>.sh client --name kms-client --dns kms-proxy.<namespace>.svc

For more information about generating the client certificates, refer to the section Creating Certificates.

The following client certificates files are created in the kms-client folder:

cert.pem
cert.key
CA.pem
secret.txt

This certificate is used by the protector as a client certificate to authenticate the protector with the KMS-Proxy service.

Ensure that the namespace and release name that you specify in this command are the same names that you specify in step 5 while deploying the KMS-Proxy Helm chart.

2. Run the following command to generate the secret for the KMS-Proxy client certificate created in step 1.

kubectl -n <KMS-Proxy_Namespace> create secret generic service-certs --from-file=CA.pem=<path-to-CA.pem> --from-file=cert.key=<path-to-cert.key> --from-file=cert.pem=<path-to-cert.pem> --from-file=secret.txt=<path-to-secret.txt>

For more information about generating the client certificates, refer to the section Creating Certificates.

Specify this secret as the value of the kms/certificates parameter in the values.yaml file.

Run the following command to generate the TLS certificate for the server that hosts the REST Container endpoint.

CreateCertificate_Linux_x64_<Version>.sh server --name <Directory> --dns <DNS_Name> --noenc

CreateCertificate_Linux_x64_<Version>.sh server --name rest-server --dns test-sampleapp-10-v1.example.com --noenc

The following server certificates files are created in the rest-server folder:

cert.pem
cert.key
CA.pem

For more information about generating the certificates, refer to the section Creating Certificates

4. Run the following command to generate a secret using the server certificate for the REST Container endpoint.

kubectl -n <Namespace> create secret generic pty-rest-server-secret --from-file=CA.pem=<path-to-CA.pem> --from-file=cert.key=<path-to-cert.key> --from-file=cert.pem=<path-to-cert.pem>

For more information about generating the server certificates, refer to the section Creating Certificates.

Specify this secret as the value of the service/certificates parameter in the values.yaml file.

Run the following command to generate the client secret for accessing the REST Container endpoint.

CreateCertificate_Linux_x64_<Version>.sh client --name <Directory> --dns <Namespace_name> --noenc

CreateCertificate_Linux_x64_<Version>.sh client --name rest-client --dns test-sampleapp-10-v1.example.com --noenc

The following client certificates files are created in the rest-client folder:

cert.pem
cert.key
CA.pem

These certificates are used in the curl command for invoking the REST APIs.

For more information about generating the certificates, refer to the section Creating Certificates

On the Linux instance, navigate to the location where you have extracted the Helm charts to deploy the REST Container.
The devops > values.yaml file contains the default configuration values for deploying the RPP container on the Kubernetes cluster.


## -- create image pull secrets and specify the name here.
## remove the [] after 'imagePullSecrets:' once you specify the secrets
imagePullSecrets: []
# - name: regcred

nameOverride: ""
fullnameOverride: ""

# REST protector image configuration
iaprestImage:
  # -- rest protector image registry address
  repository:
  # -- rest protector image tag name
  tag:
  # -- The pullPolicy for a container and the tag of the image affect 
  # when the kubelet attempts to pull (download) the specified image.
  pullPolicy: IfNotPresent

# policy loader sidecar image configuration
policyLoaderImage: 
  # -- policy loader sidecar container image registry address
  repository:
  # -- policy loader sidecar container image tag name
  tag:
  # -- The pullPolicy for a container and the tag of the image affect 
  # when the kubelet attempts to pull (download) the specified image.
  pullPolicy: IfNotPresent

# Docker Hub Image (Root User): docker.io/nginx:stable 
# To use nginx image that runs with non-root permissions
# Ref. https://hub.docker.com/r/nginxinc/nginx-unprivileged
nginxImage:
  # -- nginx image registry address
  repository:
  # -- nginx image tag name
  tag:
  # -- The pullPolicy for a container and the tag of the image affect 
  # when the kubelet attempts to pull (download) the specified image.
  pullPolicy: IfNotPresent

# specify CPU and memory requirement of REST protector container
iaprestResources:
  limits:
    cpu: 1000m 
    memory: 3000Mi
  requests:
    cpu: 500m
    memory: 800Mi

# specify CPU and memory requirement of policy loader container
policyLoaderResources:
  limits:
    cpu: 200m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 200Mi

# specify CPU and memory requirement of nginx proxy container
nginxResources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 200m
    memory: 200Mi

...
   
# -- pod service account to be used.
# A k8s service account can be linked to cloud identity to allow pod to access
# cloud services like Object storage solutions.
serviceAccount: 
  # The name of the service account to use.
  name:

# Specify any additional annotation to be associated with pod
podAnnotations:
  checksum/nginx-config: '{{ include (print $.Template.BasePath "/nginx-configmap.yaml") . | sha256sum }}'
  checksum/rest-config: '{{ include (print $.Template.BasePath "/rest-configmap.yaml") . | sha256sum }}'

# set the Pod's security context object.
podSecurityContext:
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000

# set the iapRest Container's security context object
iaprestContainerSecurityContext:
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  privileged : false
  seccompProfile:
    type: RuntimeDefault

# -- set the policy loader sidecar Container's security context object
# leave the field empty if not applicable
policyLoaderContainerSecurityContext:
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  privileged : false
  seccompProfile:
    type: RuntimeDefault

# -- set the nginx Container's security context object.
# leave the field empty if not applicable
nginxContainerSecurityContext:
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  privileged : false
  seccompProfile:
    type: RuntimeDefault

# protector configuration
protector:
  # Policy information for the protector initialization
  # Note: Policy update is control by policy puller sidecar, Below configuration
  # are for protector to refresh policy once it is updated by policy puller sidecar.
  policy:
    # -- Cadence determines how often the protector connects local filesystem 
    # to fetch the policy updates in background. Default is 60 seconds. 
    # So by default, every 60 seconds protector tries to fetch the policy updates.
    # If the cadence is set to "0", then the protector will get the policy only 
    # once, which is not recommended.
    cadence: 60

  # KMS proxy service configuration
  kms:
    # -- kms proxy service hostname.
    # kms proxy service helps protector to decrypt resilient policy package.
    host:

    # -- certificates to authenticate with kms proxy service.
    # Specify certificate secret name.
    # kubectl -n $NAMESPACE create secret generic pty-kms-proxy-tls \
    #   --from-file=cert.pem=./certs/cert.pem \
    #   --from-file=cert.key=./certs/cert.key \
    #   --from-file=CA.pem=./ca/CA.pem \
    #   --from-file=secret.txt=./certs/secret.txt
    certificates:

  # Logforwarder configuration
  logs:
    # -- specify log levels.
    # In case that connection to fluent-bit is lost, set how audits/logs are handled
    # 
    # drop  : Protector throws logs away if connection to the fluentbit is lost
    # error : (default) Protector returns error without protecting/unprotecting 
    #         data if connection to the fluentbit is lost
    mode: error

    # -- Host/IP of Logforwarder service where audits/logs are forwarded by the 
    # REST protector
    host:

# nginx configuration
nginx:
  # control audit records generate by nginx proxy.
  # the generated records are sent to stdout.
  # error logs are enabled by default.
  logs:
    # -- configure http client request access logs, by default the records
    # are sent to stdout
    request_logs: false
    # -- configure kubelet health check probe access logs, by default the records
    # are sent to stdout.
    probe_logs: false

# policy puller sidecar configuration
policyPuller:
  policy:
    # -- Control how often the sidecar application will read the configuration 
    # file for policy update information.
    # Interval is reset when previous pull operation is completed.
    # IMPORTANT: do not set interval to 0. 
    interval: 30

    # -- If using VolumeMount as storage destination for policy package
    # specify the persistent volume claim name to be used to mount the volume.
    pvcName:

    # -- Path to KMS encrypted Resilient policy package. Specify an URL encoded
    # path to package file. Here are few examples,
    # If stored in S3 then, s3://[s3 bucket name]/[to]/<[policy]>/<[package]>
    # If stored in Azure Blob storage then, https://[storage account].blob.core.windows.net/[to]/<[policy]>/<[package]> 
    # If stored in GCS then, gs://[bucket name]/[to]/<[policy]>/<[package]>
    # If stored in local filesystem (VolumeMount) then, [to]/<[policy]>/<[package]>
    # Important: updating it will not trigger pod restart.
    path:
  
  logs:
    # -- control policy puller log level
    # logs are forwarded to stdout
    # Supported Values
    # INFO - default
    # DEBUG
    level: INFO


# -- specify the initial no. of rest Pod replicas
replicaCount: 1

# HPA configuration
autoScaling:
  # -- lower limit on the number of replicas to which the autoscaler
  # can scale down to.
  minReplicas: 1
  # -- upper limit on the number of replicas to which 
  # the autoscaler can scale up. It cannot be less that minReplicas.
  maxReplicas: 10
  # -- CPU utilization threshold which triggers the autoscaler
  targetCPU: 70

# specify service type for rest container.
service:
  # -- Configure service type: LoadBalancer or ClusterIP for rest protector
  # endpoint
  type: ClusterIP
  port: 443

  # -- secret name containing server TLS certificates to host 
  # rest protector endpoint.
  # kubectl -n $NAMESPACE create secret generic pty-rest-tls \
  #   --from-file=cert.pem=./certs/cert.pem \
  #   --from-file=cert.key=./certs/cert.key \
  #   --from-file=CA.pem=./ca/CA.pem
  certificates:

  # -- Specify k8s service related annotations
  # annotation can configure internal load balancer
  # AWS internal load balancer
  #service.beta.kubernetes.io/aws-load-balancer-internal: "true"
  # AZURE internal load balancer
  #service.beta.kubernetes.io/azure-load-balancer-internal: "true"
  # GCP internal load balancer
  #networking.gke.io/load-balancer-type: "Internal" 
  annotations:
    #service.beta.kubernetes.io/aws-load-balancer-internal: "true"
    #service.beta.kubernetes.io/azure-load-balancer-internal: "true"
    #networking.gke.io/load-balancer-type: "Internal"

Modify the default values in the values.yaml file as required.

Field	Description
iaprestImage	Specify the repository and tag details for the REST Container image.
policyLoaderImage	Specify the repository and tag details for the Policy Loader image.
nginxImage	Specify the repository and tag details for the NGINX image.
iaprestResources	Specify the CPU and memory requirements for the REST Container.
policyLoaderResources	Specify the CPU and memory requirements for the Policy Loader container.
nginxResources	Specify the CPU and memory requirements for the NGINIX container.
serviceAccount/name	Specify the name of the service account that enables you to access the Object storage solutions of the Cloud service.
podSecurityContext	Specify the privilege and access control settings for the pod. The default values are set as follows: runAsUser - 1000 runAsGroup - 1000 fsGroup - 1000
Container Security Context: iaprestContainerSecurityContext policyLoaderSecurityContext nginxContainerSecurityContext	Specify the privilege and access control settings for the REST Container, Policy Loader container, and the NGINX containers respectively.
protector/policy/cadence	Specify the time interval in seconds after which the protector retrieves the policy that has been updated by the Policy Loader container. By default, the value is set to 60. Ensure that the value is not set to 0. Else, the protector will retrieve the policy only once.
protector/kms/host	Specify the host name of the KMS Proxy service that is used to decrypt the policy package.
protector/kms/certificates	Specify the name of the secret for the certificate that is used to authenticate with the KMS Proxy service, which you have created in step 2.
protector/logs/mode	Specify one of the following options in case the connection to the Log Forwarder is lost: drop - The protector deletes the logs. error - The protector returns an error without protecting or unprotecting the data. By default, the value is set to error.
protector/logs/host	Specify the service hostname of the Log Forwarder, where the logs are forwarded. The default value is <Helm_Installation_Name>-<Helm_Chart_Name>..svc. For example, iaplog-logforwarder.iaprest.svc.
nginx/logs/request_logs	Specify whether to enable or disable the HTTP client request access logs. By default, the value is set to False.
nginx/logs/probe_logs	Specify whether to enable or disable the Kubelet health check probe access logs. By default, the value is set to False.
policyPuller/policy/interval	Specify the time interval in seconds after which the Policy Loader sidecar container will retrieve the policy package from the specified path. By default, the value is set to 30. Ensure that the interval is not set to 0. Else, the Policy Loader container will not retrieve the updated policy package.
policyPuller/path	Specify the path where the encrypted policy package has been uploaded. For example, if the package is stored in an AWS S3 bucket, then you need to specify the following path: `s3://[s3 bucket name]/[to]/<[policy]>/<[package]`. If the package is stored in local filesystem VolumeMount, then you need to specify the following path: `[to]/<[policy]>/<[package]>`.
policyPuller/logs/level	Specify the log level of the Policy Loader container. By default, the value is set to INFO.
replicaCount	Specify the initial number of the REST pod replicas.
autoScaling	Specify the configurations required for the Horizontal Pod Autoscaling.
service/type	Specify the service type for the REST Container. By default, this value is set to ClusterIP. Change this value to LoadBalancer to send an HTTPS request to the REST Container pod from outside the cluster.
service/port	Specify the service port number for the REST container. By default, the value is set to 443.
service/certificates	Specify the name of the secret that contains the server TLS certificates to the host the REST protector endpoint, which you have created in step 4.
service/annotations	Specify the annotations for the respective Cloud platforms if you want to use the internal load balancer instead of the NGINX ingress. By default, this value is left blank.

Run the following command to deploy the REST Container on the Kubernetes cluster.

helm install <Release_Name> --namespace <Namespace where you want to deploy the REST container> <Location of the directory that contains the Helm charts>

For example:

helm install iap-rest-devops --namespace iap-rest devops/

Run the following command to check the status of the pods.

kubectl get pods -n <Namespace>

For example:

kubectl get pods -n iap-rest

NAME                                         READY   STATUS    RESTARTS        AGE

kms-10-v1-kms-proxy-7b97d5dff7-grqph         2/2     Running   0               11h

log1-logforwarder-f6gvj                      1/1     Running   0               11h

log1-logforwarder-ls4hn                      1/1     Running   0               11h

log1-logforwarder-phk4t                      1/1     Running   0               11h

log1-logforwarder-z2mz7                      1/1     Running   0               11h

iap-rest-iap-rest-devops-5fd7d859b6-p9544    1/1     Running   0               11h

Alternatively, if you do not want to modify the values.yaml file, you can use set arguments to update the values during runtime.
For more information about deploying containers using set arguments, refer to the section Appendix - Deploying the Helm Charts by Using the Set Argument.

The test user can run the REST version API to verify the version of the REST protector.

Feedback

Was this page helpful?

Last modified : January 17, 2026