Preparing the Environment

• 1: Initializing the Jump Box
• 2: Extracting the Installation Package
• 3: Creating Certificates
• 4: Uploading the Images to the Container Repository
• 5: Creating the AWS Environment
• 5.1: Creating the AWS Setup for Static Mode
• 5.1.1: Creating a Data Encryption Key (DEK)
• 5.1.2: Creating an AWS S3 Bucket
• 5.1.3: Creating an AWS EFS
• 5.2: Creating a Kubernetes Cluster
• 6: Creating the OpenShift Environment
• 7: Creating the Azure Environment
• 7.1: Creating the Azure Setup for Static Mode
• 7.1.1: Creating an Azure Key
• 7.1.2: Creating an Azure Storage container
• 7.2: Creating a Kubernetes Cluster

1 - Initializing the Jump Box

The Linux instance should be connected to the Kubernetes cluster. The following is the minimum system requirements to be configured for a Linux instance.

2 - Extracting the Installation Package

This section describes the steps to download and extract the installation package for the Application Protector Java Container.

To download the installation package:

1. Download the ApplicationProtector_RHUBI-9-64_x86-64_Generic.K8S.JRE-<JRE_Version>_<Version>.tgz file on the Linux instance.

2. Run the following command to extract the files from the ApplicationProtector_RHUBI-9-64_x86-64_Generic.K8S.JRE-<JRE_Version>_<Version>.tgz file.

   tar -xvf ApplicationProtector_RHUBI-9-64_x86-64_Generic.K8S.JRE-<JRE_Version>_<Version>.tgz

   The signatures directory and the ApplicationProtector_RHUBI-9-64_x86-64_Generic.K8S.JRE-<JRE_Version>_<Version>.tgzfileare extracted.

3. Run the following command to extract the files from the ApplicationProtector_RHUBI-9-64_x86-64_Generic.K8S.JRE-<JRE_Version>_<Version>.tgz file.

   tar -xvf ApplicationProtector_RHUBI-9-64_x86-64_Generic.K8S.JRE-<JRE_Version>_<Version>.tgz

   The following directories and files are extracted:

   • devops - Helm charts, Dockerfiles, and container images to deploy the Application Protector Java Container using the Static policy.
   • protector - Dockerfiles and container images to create the Application Protector Java Container.
   • dynamic - Helm charts, Dockerfiles, and container images to deploy the Application Protector Java Container using the Dynamic method.
   • common - Helm charts, Dockerfiles, and container images to deploy the Log Forwarder.
   • certs - Create certificates required for secure communication.
   • HOW-TO-BUILD-DOCKER-IMAGES - Text file specifying how to build the Docker images.
   • manifest.json - Metadata file specifying the product version and component names.

The following shows a list of the Helm charts and container images.

3 - Creating Certificates

This section describes the steps to create certificates required for secure communication. These certificates are for secure communication between:

• ESA and the RPP.
• RPP and the protector.
• KMSProxy and the protector.

To download the installation package:

1. Navigate to the directory where you have extracted the installation package.

2. Navigate to the certs directory. The following files are available:

   • CertificatesSetup_Linux_x64_<Version>tgz - Download the certificates from the ESA. You can use them as the common certificates in the dynamic deployment between the RPProxy and the ESA, and between the RPProxy and the protector. You can also use these certificates separately as the upstream certificate between the ESA and RPProxy in the dynamic deployment.
   • CreateCertificate_Linux_x64_<Version>.tgz - Generate self-signed client and server certificates. In the Dynamic method, these certificates are used for communication between RPProxy and the protector. In the Static policy method, these certificates are used for communication between KMSProxy and the protector. Customers can choose to use their own certificates.

3. Extract both the packages using the following command.

   tar -xvf CertificatesSetup_Linux_x64_<Version>.tgz
   tar -xvf CreateCertificate_Linux_x64_<Version>.tgz
   

   The following files are extracted:

   • CertificatesSetup_Linux_x64_<Version>.sh
   • CreateCertificate_Linux_x64_<Version>.sh

Certificates for communication between the ESA and the RPP

1. Run the following command to create ESA certificates for establishing a secure communication between the ESA and the RPP.

./CertificatesSetup_Linux_x64_<Version>.sh (-u <username> -p <password>) [-h <hostname>] [--port <port>] [-d <directory>]

Options:
  -u      User with the Export Certificates role
  -p      Password for user with the Export Certificates role
  -h      Host or IP address of the ESA
  --port  Port number of the ESA
  -d      local directory where certificates are stored

For more information about the command, use the –help parameter as shown in the following command.

./CertificatesSetup_Linux_x64_<Version>.sh --help

The output displays all the options that can be used with the command. It also provides usage examples.

Certificates for client and server communication between RPP and Protector, and KMS-Proxy and Protector

5. Run the following command to create server-side certificates.

./CreateCertificate_Linux_x64_<Version>.sh (client | server ) --name <common name> [--dir <directory> ] [--dns <dnsname>] [--ip <ip address>] 

Options:
  client        Generate client certificate
  server        Generate server certificate
  --name        Certificate common name.
  --dns         Specify domain names. To specify multiple DNS names, repeat the --dns flag.
  --ip          Specify IP addresses. To specify multiple IP address, repeat the --ip flag.
  --noenc       The certificate key file is not encrypted. No secret.txt file created.
  --dir         Output base directory for certificates.
  --print       Prints OpenSSL configuration files used to generate certificates.
  --help        Print help message.

This command is used to create the certificates for both the Dynamic and Static-based deployments.

For more information about the command, use the –help parameter as shown in the following command.

./CreateCertificate_Linux_x64_<Version>.sh --help

The output displays all the options that can be used with the command. It also provides usage examples.

4 - Uploading the Images to the Container Repository

Before you begin, ensure that you have set up your Container Registry.

To upload the images to the Container Repository:

1. Install Docker on the Linux instance.

   For more information about installing Docker on a Linux machine, refer to the Docker documentation.

2. Run the following command to authenticate your Docker client to the Container registry.

In case of AWS ECR, run the following command.

aws ecr get-login-password --region <Name of ECR region where you want to upload the container image> | docker login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<Name of ECR region where you want to upload the container image>.amazonaws.com

For more information about authenticating your Docker client to Amazon ECR, refer to the AWS CLI Command Reference documentation.

In case of Azure, run the following command:

docker login <Container Registry Name>.azurecr.io

3. Extract the installation package.

   The RPProxy, Policy Loader, and KMSProxy container images are extracted.

   For more information about extracting the installation package, refer to the section Extracting the Installation Package.

4. Perform the following steps to upload the AP Java container image to the Container registry.

   a. Build a custom image for the AP Java container.

   For more information about creating custom images, refer to the section Using Dockerfiles to Build Custom Images.

   Note: This step is not required for the RPProxy, Policy Loader, and KMSProxy containers as the container images are available in the installation package.

   b. Run the following command to load the AP Java container image into Docker.

   docker load -i APJAVA_RHUBI-9-64_x86-64_K8S_<Version>.tar.gz

   c. Run the following command to list the AP Java container image.

   docker images

   d. Tag the image to the Container registry by running the following command.

   docker tag <Container image>:<Tag> <Container registry path>/<Container image>:<Tag>

   For example for AWS ECR:

   docker tag apjava:AWS <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/apjava:AWS

   For more information regarding tagging an image, refer to the section Pushing an image in the AWS documentation.

   For example for Azure:

   docker tag apjava:AZURE <Container Registry Name>.azurecr.io/apjava:AZURE

   e. Push the tagged image to the Container registry by running the following command.

   docker push <Container registry path>/<Container image>:<Tag>

   For example for AWS:

   docker push <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/apjava:AWS

   For example for Azure:

   docker push <Container Registry Name>.azurecr.io/ap-rest:AZURE

5. Navigate to the directory where you have extracted the Helm charts packages for the AP Java containers.

6. In the values.yaml file, update the appropriate path for the springappImage setting, along with the tag.

7. Repeat steps 1 to 6 for uploading the respective images for RPProxy, Policy Loader, and KMSProxy.

5 - Creating the AWS Environment

This section describes how to create the AWS runtime environment.

Prerequisites

Before creating the runtime environment on AWS, ensure that you have a valid AWS account and the following information:

• Login URL for the AWS account
• Authentication credentials for the AWS account

Audience

It is recommended that you have working knowledge of AWS and knowledge of the following concepts:

• Introduction to AWS S3
• Introduction to AWS Cloud Security
• Introduction to AWS EKS

5.1 - Creating the AWS Setup for Static Mode

This section describes how to create the following AWS resources for static mode:

• Data Encryption Key
• AWS S3 bucket
• AWS EFS

5.1.1 - Creating a Data Encryption Key (DEK)

To create a Data Encryption Key:

1. Log in to the AWS environment.

2. Navigate to Services.

   A list of AWS services appears.

3. In Security, Identity, & Compliance, click Key Management Service.

   The AWS Key Management Service (KMS) console opens. By default, the Customer managed keys screen appears.

4. Click Create key.

   The Configure key screen appears.

5. In the Key type section, select the Asymmetric option to create a single customer master key that will be used to perform the encrypt and decrypt operations.

6. In the Key usage section, select the Encrypt and decrypt option.

7. In the Key spec section, select one option.

   For example, select RSA_4096.

8. In the Advanced options section, select the Single-Region Key option.

9. Click Next.

   The Add labels screen appears.

10. In the Alias field, specify the display name for the key, and then click Next.

    The Review and edit key policy screen appears.

11. Click Finish.

    The Customer managed keys screen appears, displaying the newly created customer master key.

12. Click the key alias.

    A screen specifying the configuration for the selected key appears.

13. In the General Configuration section, copy the value specified in the ARN field, and save it on your local machine.

    You need to attach the key to the KMSDecryptAccess policy. You also need to specify this ARN value in the command for creating a Kubernetes secret for the key.

14. Navigate to Services > IAM.

15. Click Policies.

    The Policies screen appears.

16. Select the KMSDecryptAccess policy.

    The Permissions tab appears.

17. Click Edit policy to edit the policy in JSON format.

18. Modify the policy to add the ARN of the key that you have copied in step 13 to the Resource parameter.

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": "kms:Decrypt",
                "Resource": [
                    "<ARN of the AWS Customer Master Key>"
                ]
            }
        ]
    }
    

19. Click Review policy, and then click Save changes to save the changes to the policy.

5.1.2 - Creating an AWS S3 Bucket

Important: This procedure is optional and is required only if you want to use AWS S3 for storing the policy snapshot during static deployment, instead of the persistent volume.

To create an AWS S3 bucket:

1. Login to the AWS environment.

2. Navigate to Services.

   A list of AWS services appears.

3. In Storage, click S3.

   The S3 buckets screen appears.

4. Click Create bucket.

   The Create bucket screen appears.

5. In the General configuration screen, specify the following details.

   1. In the Bucket name field, enter a unique name for the bucket.

   2. In the AWS Region field, choose the same region in which you want to create your EC2 instance.

   If you want to configure your bucket or set any specific permissions, then you can specify the required values in the remaining sections of the screen. Otherwise, you can go directly to the next step to create a bucket.

6. Click Create bucket.

   The bucket is created.

5.1.3 - Creating an AWS EFS

Important: This procedure is optional and is required only if you want to use AWS EFS for storing the policy package during static deployment, instead of AWS S3.

To create an AWS EFS:

1. Login to the AWS environment.

2. Navigate to Services.

   A list of AWS services appears.

3. In Storage, click EFS.

   The File Systems screen appears.

4. Click Create file system.

   The Configure network access screen appears.

5. In the VPC list, select the VPC where you will be creating the Kubernetes cluster.

6. Click Next Step.

   The Configure file system settings screen appears.

7. Click Next Step.

   The Configure client access screen appears.

8. Click Next Step.

   The Review and create screen appears.

9. Click Create File System.

   The file system is created.

   Note the value in the File System ID column. You need to specify this value as the value of the volumeHandle parameter in the pv.yaml file in step 10c.

10. Perform the following steps if you want to use a persistent volume for storing the policy package instead of the AWS S3 bucket.

    a. Create a file named storage_class.yaml for creating an AWS EFS storage class.

    The following snippet shows the contents of the storage_class.yaml file.

      kind: StorageClass
      apiVersion: storage.k8s.io/v1
      metadata:
        name: efs-sc
      provisioner: efs.csi.aws.com
    

    Important: If you want to copy the contents of the storage_class.yaml file, then ensure that you indent the file as per YAML requirements.

    b. Run the following command to provision the AWS EFS using the storage_class.yaml file.

    kubectl apply -f storage_class.yaml

    An AWS EFS storage class is provisioned.

    c. Create a file named pv.yaml for creating a persistent volume resource.

    The following snippet shows the contents of the pv.yaml file.

      apiVersion: v1
      kind: PersistentVolume
      metadata:
        name: efs-pv1
        labels:
          purpose: policy-store
      spec:
        capacity:
          storage: 1Gi
        volumeMode: Filesystem
        accessModes:
          - ReadWriteMany
        persistentVolumeReclaimPolicy: Retain
        storageClassName: **efs-sc**
        csi:
          driver: efs.csi.aws.com
          volumeHandle: **fs-618248e2:**/
    

    Important: If you want to copy the contents of the pv.yaml file, then ensure that you indent the file as per YAML requirements.

    This persistent volume resource is associated with the AWS EFS storage class that you have created in step 10b.

    In the storageClassName parameter, ensure that you specify the same name for the storage class that you specified in the storage_class.yaml file in step 10a.

    For example, specify efs-sc as the value of the storageClassName parameter.

    d. Run the following command to create the persistent volume resource.

    kubectl apply -f pv.yaml

    A persistent volume resource is created.

    e. Create a file named pvc.yaml for creating a claim on the persistent volume that you have created in step 10d.

    The following snippet shows the contents of the pvc.yaml file.

      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: efs-claim1
      spec:
        selector:
          matchLabels:
            purpose: "policy-store"
        accessModes:
          - ReadWriteMany
        storageClassName: **efs-sc**
        resources:
          requests:
            storage: 1Gi
    

    Important: If you want to copy the contents of the pvc.yaml file, then ensure that you indent the file as per YAML requirements.

    This persistent volume claim is associated with the AWS EFS storage class that you have created in step 10b. The value of the storage parameter in the pvc.yaml defines the storage that is available for saving the policy dump.

    In the storageClassName parameter, ensure that you specify the same name for the storage class that you specified in the storage_class.yaml file in step 10a.

    For example, specify efs-sc as the value of the storageClassName parameter.

    f. Run the following command to create the persistent volume claim.

    kubectl apply -f pvc.yaml -n <Namespace>

    For example:

    kubectl apply -f pvc.yaml -n iap-java

    A persistent volume claim is created. In this example, iap-java is the namespace where the Application Protector Java Container will be deployed.

    g. On the Linux instance, create a mount point for the AWS EFS by running the following command.

    mkdir /efs

    This command creates a mount point efs on the file system.

    h. Install the Amazon EFS client using the following command.

    sudo yum install -y amazon-efs-utils

    For more information about installing the EFS client, refer to the section Manually installing the Amazon EFS client in the Amazon Elastic File System User Guide.

    i. Run the following mount command to mount the AWS EFS on the directory created in step 10g.

    sudo mount -t nfs -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport <file-system-id>.efs.<aws-region>.amazonaws.com:/ /efs

    For example:

    sudo mount -t nfs -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-618248e2.efs.<aws-region>.amazonaws.com:/ /efs

    Ensure that you set the value of the <file-system-id> parameter to the value of the volumeHandle parameter, as specified in the pv.yaml file in step 10c.

    For more information about the permissions required for mounting an AWS EFS, refer to the section Working with Users, Groups, and Permissions at the Network File System (NFS) Level in the AWS documentation.

5.2 - Creating a Kubernetes Cluster

Note: The steps listed in this section for creating a Kubernetes cluster are for reference use. If you have a Kubernetes cluster or want to create a cluster based on custom requirements, then navigate to step 4 to connect your cluster and the Linux instance. However, you must ensure that your ingress port is enabled on the Network Security group of your VPC.

Important: Ensure that the Kubernetes Metrics Server and Cluster Autoscaler are already deployed.

To create a Kubernetes cluster:

1. Create a key pair for the EC2 instances that will be launched as part of your Kubernetes cluster.

   For more information on creating the key pair, refer to the section Create a key pair for your Amazon EC2 instance in the Amazon EC2 documentation.

   After the key pair is created, you need to specify the key pair name in the publicKeyName field of the createCluster.yaml file, for creating a Kubernetes cluster.

2. Log in to the Linux instance and create a file named createCluster.yaml to specify the configurations for creating the Kubernetes cluster.

   The following snippet displays the contents of the createCluster.yaml file.

   apiVersion: eksctl.io/v1alpha5
   kind: ClusterConfig
   metadata:
     name: <Name of your Kubernetes cluster>
     region: <Region where you want to deploy your Kubernetes cluster>
     version: "<Kubernetes version>"
   vpc:
     id: "<ID of the VPC where you want to deploy the Kubernetes cluster>"
     subnets: #In this section specify the subnet region and subnet id accordingly
       private:
         <Availability zone for the region where you want to deploy your Kubernetes cluster>:
             id: "<Subnet ID>"
         <Availability zone for the region where you want to deploy your Kubernetes cluster>
             id: "<Subnet ID>"
   nodeGroups:
     - name: <Name of your Node Group>
       instanceType: m5.large
       minSize: 1
       maxSize: 3
       tags:
         k8s.io/cluster-autoscaler/enabled: "true"
         k8s.io/cluster-autoscaler/<Name of your Kubernetes cluster>: "owned"
       privateNetworking: true
       securityGroups:
         withShared: true
         withLocal: true
         attachIDs: ['<Security group linked to your VPC>']
       ssh:
         publicKeyName: '<EC2 keypair>'
       iam:
         attachPolicyARNs:
           - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
         withAddonPolicies:
           autoScaler: true
   

   Important: If you want to copy the contents of the createCluster.yaml file, then ensure that you indent the file as per YAML requirements.

   For more information about the sample configuration file used to create a Kubernetes cluster, refer to the section Create cluster using config file in the eksctl documentation.

   In the ssh/publicKeyName parameter, you must specify the value of the key pair that you have created in step 1.

   In the iam/attachPolicyARNs parameter, you must specify the following policy ARNs:

   • ARN of the AmazonEKS_CNI_Policy policy - This is a default AWS policy that enables the Amazon VPC CNI Plugin to modify the IP address configuration on your EKS nodes.

     For more information about this policy, refer to the AWS documentation.

     You need to sign in to your AWS account to access the AWS documentation for this policy.

   The content snippet displays the reference configuration required to create a Kubernetes cluster using a private VPC. If you want to use a different configuration for creating your Kubernetes cluster, then you need to refer to the section Creating and managing clusters in the eksctl documentation.

   For more information about creating a configuration file to create a Kubernetes cluster, refer to the section Creating and managing clusters in the eksctl documentation.

3. Run the following command to create a Kubernetes cluster.

   eksctl create cluster -f ./createCluster.yaml

   Important: IAM User 1, who creates the Kubernetes cluster, is automatically assigned the cluster-admin role in Kubernetes.

4. Run the following command to connect your Linux instance to the Kubernetes cluster.

   aws eks update-kubeconfig --name <Name of Kubernetes cluster>

5. Validate whether the cluster is up by running the following command.

   kubectl get nodes

   The command lists the Kubernetes nodes available in your cluster.

6. Deploy the Cluster Autoscaler component to enable the autoscaling of nodes in the EKS cluster.

   This step is required only if the Cluster Autoscaler component is not installed.

   For more information about deploying the Cluster Autoscaler, refer to the section Deploy the Cluster Autoscaler in the Amazon EKS documentation.

7. Install the Metrics Server to enable the horizontal autoscaling of pods in the Kubernetes cluster.

   This step is required only if the Metric Server is not installed.

   For more information about installing the Metrics Server, refer to the section Horizontal Pod Autoscaler in the Amazon EKS documentation.

   After you have created the Kubernetes cluster, you can deploy the Application Protector Java Container using dynamic or static mode of deployment.

8. Run following commands to tag the cluster subnets to ensure that the Elastic load balancer can discover them.

   • aws ec2 create-tags --tags Key=kubernetes.io/cluster/<Cluster Name>,Value=shared --resources <Subnet ID>
   • aws ec2 create-tags --tags Key=kubernetes.io/role/internal-elb,Value=1 --resources <Subnet ID>
   • aws ec2 create-tags --tags Key=kubernetes.io/role/elb,Value=1 --resources <Subnet ID>

   
   Repeat this step for all the cluster subnets.

6 - Creating the OpenShift Environment

This section describes how to create the OpenShift runtime environment.

Prerequisites

Before creating the runtime environment on OpenShift, ensure that you have a valid OpenShift account and the following information:

• Login URL for the OpenShift account
• Authentication credentials for the OpenShift account

Audience

It is recommended that you have working knowledge of OpenShift.

Logging in to the OpenShift environment

This section describes how you can login to the OpenShift environment.

To log in to the OpenShift environment:

1. Access OpenShift at the following URL: https://<OpenShift Console URL>/dashboards

2. Click Sign In to the Console. The Sign in screen appears.

3. Enter the following details:

   • User name
   • Password

4. Click Log In. After successful authentication, the Dashboard screen appears.

Creating secrets

This section describes how to create the Kubernetes secretes required for the OpenShift deployment.

1. On the Linux instance, navigate to the location where you have extracted the Helm charts.

2. Run the following command to create a Kubernetes secret for accessing the image registry using existing Docker credentials.

oc create secret generic regcred --from-file=.dockerconfigjson=<PATH_TO_DOCKER_CONF
IG>/config.json --type=kubernetes.io/dockerconfigjson --namespace <NAMESPACE>

For example:

oc create secret generic regcred --from-file=.dockerconfigjson=<PATH_TO_DOCKER_CONF
IG>/config.json --type=kubernetes.io/dockerconfigjson --namespace iap-rest

3. Create a credentials file using the following format and ensure that you specify the required values for accessing the AWS.

[default]

aws_access_key_id = <AWS_ACCESS_KEY_ID>

aws_secret_access_key = <AWS_SECRET_ACCESS_KEY>

aws_session_token = <AWS_SESSION_TOKEN>

region = us-east-1

4. Create the Kubernetes secret for accessing the AWS KMS using the credentials file created in step 3.

oc -n <NAMESPACE> create secret generic pty-aws-credentials --from-file=credentials=./credentials

7 - Creating the Azure Environment

This section describes how to create the Azure runtime environment.

Prerequisites

Before creating the runtime environment on Azure, ensure that you have a valid Azure account and the following information:

• Login URL for the Azure account.
• Authentication credentials for the Azure account.

Audience

It is recommended that you have working knowledge of Azure and knowledge of the following concepts:

• Introduction to Azure Storage Container and Azure Storage Blob
• Introduction to Azure Cloud Security
• Introduction to Azure AKS
• Introduction to Azure Key Vault

7.1 - Creating the Azure Setup for Static Mode

This section describes how to create the following Azure resources for static mode:

• Data Encryption Key
• Azure Storage Container

7.1.1 - Creating an Azure Key

Create an Azure Key using the Azure Portal

This section describes how to create an Azure Key using the Azure portal.

To create an Azure Key:

1. Login to the Azure environment.

2. Click the Portal menu icon.

   The Portal menu appears.

3. Navigate to All services.

   The All services screen appears.

4. Select Key vaults under the SECURITY section.

   The Key vaults screen appears.

5. Click Add.

   The Create key vault screen appears.

6. On the Basics tab, enter the following details:

   Field	Description
   Subscription	By default, Azure Cloud Platform is selected.
   Resource group	Select the required resource group.
   Key vault name	Enter a name for your key vault.
   Region	Select a region where the key vault will be created.
   Pricing tier	Select a pricing tier. For example, Standard or Premium.

7. Click Next to navigate to the Access policy tab.

   The Access policy tab appears.

8. Click Next to navigate to the Virtual network tab.

9. Click Next to navigate to the Tags tab.

10. Add tags to the key vault, if required.

    Tags are name-value pairs for categorizing the key vault resource.

11. Click Review + create to validate the key vault configuration.

    Azure validates the information that you have entered.

12. Click Create to create the required key vault.

    The key vault is created and the following screen appears.

13. Click Go to resource.

    The Overview screen appears displaying information about the key vault that you have created.

14. On the left pane, under the Settings section, click Keys.

    The Keys screen appears.

15. Click Generate/Import to create a key.

    The Create a key screen appears.

16. Enter the following details for the key.

    Field	Description
    Options	Select Generate to generate the key.
    Name	Enter the name for your Azure key.
    Key Type	Specify the key type. Select RSA.
    RSA Key Size	Specify the key size for RSA. Select the value as 3072.
    Enabled	Select Yes to enable the key.

17. Click Create.

    The key is created.

18. Click the key name.

    The Versions screen for the key appears. It lists all the versions for the key.

19. Click the specific key version.

    The Key Version screen appears. This screen displays the properties and settings for the specific key version.

20. Click the icon next to the Key Identifier field to copy the field value to the clipboard.

    A message appears informing that the identifier has been copied.

    The following is an example of an Azure key identifier:

    https://<Key_Vault_Name>.vault.azure.net/keys/<Key_Name>/0a5e4ea190a24707983ffd0efcc03c8a

You need to paste this identifier as the value of the public key label for encrypting the policy.

For more information about using the public key for encrypting the policy, refer to the section [Retrieving the Policy from the ESA](/docs/rest_container/iap_rest_installation/iap_rest_aws_azure_installation/iap_rest_using_devops/iap_rest_retrieving_package_from_esa/).

21. In the Permitted operations section, select the Decrypt check box and clear all the remaining check boxes.

This ensures that only the **Decrypt** operation is permitted for the Azure key.

22. Click Save to save the changes.

Creating an Azure Key using the CLI

This section describes how to create an Azure Key using the CLI.

1. Run the following command to create the Azure Key Vault.

az keyvault create -g $RG -n $VAULT -l $LOC --enable-rbac-authorization true

In this command:

• RG: Environment variable for the Azure Resource Group.
• VAULT: Environment variable for the Azure Key Vault.
• LOC: Environment variable for the account default region.

2. Run the following command to create the Azure key to be used for encrypting the policy package.

az keyvault key create --vault-name $VAULT --name $KEY --kty RSA --size 2048 --ops decrypt encrypt

3. Run the following command to generate the public key.

az keyvault key download \
--vault-name pty-kv-dev-01 \
--name pty-kek \
--file pub.pem

awk 'BEGIN{ORS="\\n"}1' pub.pem

The output displays the Key ID of the public key and the value of the public key in JSON format.

For more information about using the public key for encrypting the policy, refer to the section Retrieving the Policy from the ESA.

7.1.2 - Creating an Azure Storage container

Important: This procedure is optional and is required only if you want to use Azure Storage Container for storing the policy snapshot during static deployment.

To create an Azure Storage Container:

1. Login to the Azure environment.

2. Click the Portal menu icon.

   The Portal menu appears.

3. Click Storage accounts.

   The Storage accounts screen appears.

4. Click Create.

   The Create storage account screen appears. By default, the Basics tab appears.

5. In the Basics tab, enter the following mandatory details.

Note: Retain the default values for all the remaining tabs on the Create storage account screen.

6. Click Review + create to validate the entered information.

   Azure validates the information that you have entered.

7. Click Create to create the storage account.

   The storage account is created and the following screen appears.

8. Click Go to resource.

   The Overview screen appears, displaying the details of your storage account.

9. Perform the following steps to create a storage container.

   1. On the left pane, click Data storage > Containers.

      The Containers screen appears.

   2. Click Container.

      The New Container screen appears.

   3. Specify a name for the container in the Name field.

   4. Retain the default value for the Anonymous access level list.

      The default value is set to Private (no anonymous access).

   5. Click OK to create the container.

7.2 - Creating a Kubernetes Cluster

This section describes how to create a Kubernetes Cluster on Azure.

Note: The steps listed in this procedure for creating a Kubernetes cluster are for reference use. If you have an existing Kubernetes cluster or want to create a Kubernetes cluster based on your requirements, then you can directly navigate to step 9 to connect your Kubernetes cluster and the Linux instance. However, you must ensure that your ingress port is enabled on the Network Security group of your VPC.

To create a Kubernetes cluster:

1. Login to the Azure environment.

2. Click the Portal menu icon

   The Portal menu appears.

3. Navigate to All Services > Containers > Kubernetes services.

   The Kubernetes services screen appears.

4. Click Add.

   The Create Kubernetes cluster screen appears.

5. In the Resource group field, select the required resource group.

6. In the Kubernetes cluster name field, specify a name for your Kubernetes cluster.

   Retain the default values for the remaining settings.

7. Click Review + create to validate the configuration.

8. Click Create to create the Kubernetes cluster.

   The Kubernetes cluster is created.

9. Login to the Linux instance, and run the following command to connect your Linux instance to the Kubernetes cluster.

`az aks get-credentials --resource-group <Name of Resource Group> --name <Name of Kubernetes Cluster>`

The Linux instance is now connected with the Kubernetes cluster. You can now run commands using the Kubernetes command line interface \(kubectl\) to control the nodes on the Kubernetes cluster.

10. Validate whether the cluster is up by running the following command.

    kubectl get nodes

    The command lists the Kubernetes nodes available in your cluster.

11. Run the export command to export the following environment variables.

export RG=<Resource Group Name>
export AKS=<AKS cluster Name>
export NS=<Namespace where protector is deployed>
export LOC=eastus (account default region)
export VAULT=<Azure Key Vault name>
export KEY=<Azure Key Name>

12. Run the following commands to enable the OpenID Connect (OIDC) and workload identity on the AKS cluster.

az aks update -g $RG -n $AKS --enable-oidc-issuer --enable-workload-identity
export OIDC=$(az aks show -g $RG -n $AKS --query oidcIssuerProfile.issuerUrl -o tsv)