> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/2024.2/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/2024.2/self-managed-deployment/deployment-requirements.md).

# Deployment Requirements

Immuta comprises three core services (Secure, Discover, and Detect) that rely on PostgreSQL and Elasticsearch to store their states. The illustration below shows the relationships among these services.

```mermaid
%%{ init: { 'flowchart': { 'curve': 'stepBefore' } } }%%
flowchart
    secureWeb --> pg[(PostgreSQL)]
    secureWorker --> pg

    secureWeb --> cacheDecision
    secureWorker --> cacheDecision

    detectApi --> es[(Elasticsearch)]
    detectApi --> pg

    cacheDecision --> |Built-in?| builtinCache
    cacheDecision -.-> |External?| externalCache
    externalCache[(Redis/Memcached)]

    subgraph ideploy[Immuta Enterprise Helm chart]
      subgraph secure[Secure]
        secureWeb[Secure Web/API]
        secureWorker[Secure Worker]
      end

      subgraph detect[Detect]
        detectApi[Detect API]
      end

      subgraph discover[Discover]
        discoverApi[Discover API]
      end

      cacheDecision{Cache}
      builtinCache[(Memcached)]
    end

    %% Add links
    click pg "#metadata-database-postgresql" "PostgreSQL Prerequistes";
    click externalCache "#cache-redismemcached" "Redis/Memcached Prerequistes";
    click es "#elasticsearch" "Elasticsearch Prerequistes";
```

The Immuta Enterprise Helm chart (IEHC) (represented by the yellow box above) does not deploy PostgreSQL or Elasticsearch, so you must deploy and manage them separately.

Although Immuta recommends using Elasticsearch because it supports several new Immuta features and services, you can deploy Immuta without Elasticsearch. The table below outlines the Immuta features supported with and without Elasticsearch and the dependencies you must deploy and manage yourself.

|                                          | Immuta with Elasticsearch                                                                                                                             | Immuta without Elasticsearch                             |
| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
| Dependencies                             | <ul><li><a href="#metadata-database-postgresql">Externalized PostgreSQL</a></li><li><a href="#elasticsearch">Elasticsearch / OpenSearch</a></li></ul> | [Externalized PostgreSQL](#metadata-database-postgresql) |
| Immuta Detect                            | :white\_check\_mark:                                                                                                                                  | :x:                                                      |
| Audit of Immuta and data platform events | :white\_check\_mark:                                                                                                                                  | :x:                                                      |
| Legacy audit                             | :white\_check\_mark: ([Disabled by default, but can be enabled](#legacy-features-and-services))                                                       | :white\_check\_mark: (Until October 2024)                |
| Immuta Monitors                          | :white\_check\_mark:                                                                                                                                  | :x:                                                      |
| Sensitive data discovery                 | :white\_check\_mark:                                                                                                                                  | :white\_check\_mark:                                     |

For guidance on how to configure the IEHC to deploy Immuta with or without Elasticsearch, see one of the guides below:

* [Deploy Immuta with Elasticsearch](/2024.2/self-managed-deployment/getting-started.md)
* [Deploy Immuta without Elasticsearch](/2024.2/self-managed-deployment/install/no-es-os.md)

For more information about legacy features and services no longer enabled in the recommended deployment of Immuta, see the [Legacy features and services section](#legacy-features-and-services).

## Version requirements

### Kubernetes versions

* Kubernetes 1.29 to 1.32

### Metadata database (PostgreSQL)

{% hint style="danger" %}
**PostgreSQL incompatibilities**

Immuta is not compatible with PostgreSQL abstraction layers, such as Amazon Aurora.
{% endhint %}

* PostgreSQL 15.0 or newer
* The `pgcrypto` extension must be enabled

### Elasticsearch

* Elasticsearch v7 API or newer
* AWS OpenSearch Service compatible with Elasticsearch v7 API or newer
  * AWS OpenSearch Serverless is not supported

#### OpenSearch user

The user provided during the install must have the following [permissions](https://opensearch.org/docs/latest/security/access-control/permissions/):

* cluster:monitor/health
* indices:data/write/bulk\*
* indices:data/write/bulk
* indices:data/read/search
* indices:admin/exists
* indices:admin/create
* indices:admin/delete
* indices:admin/settings/update
* indices:admin/get
* indices:data/write/delete/byquery
* indices:data/write/index
* indices:admin/mapping/put
* indices:data/write/bulk
* indices:data/write/bulk\*

Follow OpenSearch documentation to [create the user](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains) and add permissions.

### Cache (Redis/Memcached)

{% hint style="info" %}
**Built-in cache**

The IEHC manages its own Memcached deployment inside the cluster. The key-value cache can optionally be externalized post installation.
{% endhint %}

* Redis 7.0 or newer
* Memcached 1.6 or newer

## Infrastructure recommendations

<table><thead><tr><th>Kubernetes distribution</th><th>Ingress</th><th>External metadata database</th><th>External Elasticsearch</th><th data-hidden>External cache</th></tr></thead><tbody><tr><td>Amazon Elastic Kubernetes Service (EKS)</td><td>AWS Load Balancer Controller</td><td><a href="https://docs.aws.amazon.com/rds/">Amazon RDS for PostgreSQL</a></td><td><a href="https://docs.aws.amazon.com/opensearch-service/">Amazon OpenSearch</a></td><td><a href="https://docs.aws.amazon.com/elasticache/">Amazon ElastiCache for Redis</a></td></tr><tr><td>Azure Kubernetes Service (AKS)</td><td>Azure Application Gateway Ingress Controller</td><td><a href="https://learn.microsoft.com/en-us/azure/postgresql/">Azure Database for PostgreSQL</a></td><td><a href="https://www.elastic.co/partners/microsoft-azure">Elastic Cloud on Azure</a></td><td><a href="https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/">Azure Cache for Redis</a></td></tr><tr><td>Google Kubernetes Engine (GKE)</td><td>GKE Ingress Controller</td><td><a href="https://cloud.google.com/sql/docs/postgres">Google Cloud SQL for PostgreSQL</a></td><td><a href="https://www.elastic.co/partners/google-cloud">Elastic Cloud on Google Cloud</a></td><td><a href="https://cloud.google.com/memorystore/docs/redis">Memorystore for Redis</a></td></tr><tr><td>Red Hat OpenShift</td><td>OpenShift Ingress Operator</td><td><a data-footnote-ref href="#user-content-fn-1">Cloud-managed PostgreSQL</a></td><td><a data-footnote-ref href="#user-content-fn-2">Cloud-managed Elasticsearch</a></td><td><a data-footnote-ref href="#user-content-fn-3">Cloud-managed Redis</a></td></tr><tr><td>SUSE Rancher Government (RKE2)</td><td>Ingress NGINX Controller</td><td><a data-footnote-ref href="#user-content-fn-1">Cloud-managed PostgreSQL</a></td><td><a data-footnote-ref href="#user-content-fn-2">Cloud-managed Elasticsearch</a></td><td><a data-footnote-ref href="#user-content-fn-3">Cloud-managed Redis</a></td></tr><tr><td>SUSE K3s - <em>For evaluation purposes only</em></td><td>Traefik</td><td><a data-footnote-ref href="#user-content-fn-1">Cloud-managed PostgreSQL</a></td><td><a data-footnote-ref href="#user-content-fn-2">Cloud-managed Elasticsearch</a></td><td><a data-footnote-ref href="#user-content-fn-3">Cloud-managed Redis</a></td></tr></tbody></table>

## Legacy features and services

Some legacy services and features are no longer enabled in the recommended configuration of the IEHC. The table below lists these features and provides links to documentation that outlines how to enable them in Immuta.

| Feature                                                                                                                                                                                                                                  | Immuta Enterprise Helm chart configuration                                                                                                                                                                                                                                                   |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Legacy audit                                                                                                                                                                                                                             | <p>Set each of the following <code>secure.extraEnvVars</code> in your <code>immuta-values.yaml</code> file to <code>false</code>:</p><ul><li><code>FeatureFlag\_AuditService</code></li><li><code>FeatureFlag\_detect</code></li><li><code>FeatureFlag\_auditLegacyViewHide</code></li></ul> |
| Legacy sensitive data discovery                                                                                                                                                                                                          | [Enable the query engine and fingerprint services](/2024.2/self-managed-deployment/configure/enabling-legacy-query-engine-and-fingerprint.md)                                                                                                                                                |
| <p>Data platforms</p><ul><li>Amazon Redshift</li><li>Azure Synapse Analytics</li><li>Google BigQuery</li><li><a href="/pages/2voOpOcii65xZ66ZX6Hw#legacy-databases">Legacy databases</a></li></ul>                                       | [Enable the query engine](/2024.2/self-managed-deployment/configure/enabling-legacy-query-engine-and-fingerprint.md)                                                                                                                                                                         |
| <p>Policies</p><ul><li>Masking with format preserving masking (unless using the Snowflake integration)</li><li>Masking with k-anonymization</li><li>Masking using randomized response (unless using the Snowflake integration)</li></ul> | [Enable the query engine and fingerprint services](/2024.2/self-managed-deployment/configure/enabling-legacy-query-engine-and-fingerprint.md)                                                                                                                                                |

## Next step

Follow the [Getting started guide](/2024.2/self-managed-deployment/getting-started.md) to install Immuta.

[^1]: Cloud-managed PostgreSQL, such as Amazon RDS, Azure Database for PostgreSQL, or Google Cloud SQL for PostgreSQL, is recommended when running Kubernetes in cloud environments.

[^2]: Cloud-managed Elasticsearch, such as Amazon OpenSearch, or Elastic Cloud, is recommended when running Kubernetes in cloud environments.

[^3]: Cloud-managed Redis/Memcached, such as Amazon ElastiCache, Azure Cache, or Google Cloud Memorystore, is recommended when running Kubernetes in cloud environments.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://documentation.immuta.com/2024.2/self-managed-deployment/deployment-requirements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.