This is an OpenShift-specific guide on how to deploy Immuta with the following managed services:
Cloud-managed PostgreSQL
Cloud-managed Redis
Cloud-managed Elasticsearch
Review the following criteria before proceeding with deploying Immuta.
The PostgreSQL instance has been provisioned and is actively running.
The PostgreSQL instance's hostname/FQDN is .
The PostgreSQL instance is .
The Helm chart only supports username/password authentication for PostgreSQL. At this time, other authentication mechanisms are not supported.
The Redis instance has been provisioned and is actively running.
The Redis instance's hostname/FQDN is .
The Redis instance is .
The Elasticsearch instance has been provisioned and is actively running.
The Elasticsearch instance's hostname/FQDN is .
The Elasticsearch instance is .
The user must have the .
Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:
Create a new OpenShift project named immuta for Immuta.
Get the UID range allocated to the project. Each running container's UID must fall within this range. This value will be referenced later on.
Get the GID range allocated to the project. Each running container's GID must fall within this range. This value will be referenced later on.
Switch to project
Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the oc run command outlined below. Wait 5 seconds, and then proceed by entering a password.
Create an immuta role and database.
Revoke privileges from CURRENT_USER as they're no longer required.
This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.
Create a Helm values file named immuta-values.yaml with the content below. Because the Ingress resource will be managed by an OpenShift route you will create when and not the Immuta Enterprise Helm chart, ingress is set to false below. TLS comes pre-configured with OpenShift, so tls is also set to false.
Update all in the immuta-values.yaml file.
Deploy Immuta.
Wait for all pods in the namespace to become ready.
Determine the name of the Secure service.
Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
to complete your installation and access your Immuta application.
.
The Helm chart only supports username/password authentication for Elasticsearch. At this time, other authentication mechanisms are not supported.
immutaCreate a container registry pull secret. Your credentials to authenticate with ocir.immuta.com can be viewed in your user profile at support.immuta.com.
oc create secret docker-registry immuta-oci-registry \
--docker-server=https://ocir.immuta.com \
--docker-username="<username>" \
--docker-password="<token>" \
--docker-email=support@immuta.comEnable the pgcrypto extension.
\c immuta
CREATE EXTENSION pgcrypto;Type \q, and then press Enter to exit.
echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.comoc new-project immutaoc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'oc run pgclient \
--stdin \
--tty \
--rm \
--image docker.io/bitnami/postgresql -- \
psql --host <postgres-fqdn> --username <postgres-admin> --dbname postgres --port 5432 --passwordCREATE ROLE immuta with login encrypted password '<postgres-password>';
GRANT immuta TO CURRENT_USER;
CREATE DATABASE immuta OWNER immuta;
GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;REVOKE immuta FROM CURRENT_USER;global:
imageRegistry: ocir.immuta.com
imagePullSecrets:
- name: immuta-oci-registry
imageRepositoryMap:
immuta/immuta-service: stable/immuta-service
immuta/immuta-db: stable/immuta-db
immuta/immuta-fingerprint: stable/immuta-fingerprint
immuta/audit-service: stable/audit-service
immuta/audit-export-cronjob: stable/audit-export-cronjob
immuta/classify-service: stable/classify-service
immuta/cache: stable/cache
audit:
config:
databaseConnectionString: postgres://immuta:<postgres-password>@pg-db-postgresql.immuta.svc.cluster.local:5432/immuta?schema=audit
elasticsearchEndpoint: http://es-db-elasticsearch.immuta.svc.cluster.local:9200
elasticsearchUsername: <elasticsearch-username>
elasticsearchPassword: <elasticsearch-password>
deployment:
podSecurityContext:
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
runAsUser: <user-id>
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
runAsGroup: <group-id>
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
discover:
deployment:
podSecurityContext:
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
runAsUser: <user-id>
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
runAsGroup: <group-id>
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
secure:
extraEnvVars:
- name: FeatureFlag_AuditService
value: "true"
- name: FeatureFlag_detect
value: "true"
- name: FeatureFlag_auditLegacyViewHide
value: "true"
ingress:
enabled: false
tls: false
postgresql:
host: <postgres-fqdn>
port: 5432
database: immuta
username: immuta
password: <postgres-password>
ssl: false
web:
podSecurityContext:
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
runAsUser: <user-id>
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
runAsGroup: <group-id>
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
backgroundWorker:
podSecurityContext:
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
runAsUser: <user-id>
# A number that is within the project range:
# oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
runAsGroup: <group-id>
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALLhelm install immuta oci://ocir.immuta.com/stable/immuta-enterprise \
--values immuta-values.yaml \
--version 2024.2.20oc wait --for=condition=Ready pods --alloc get service --selector "app.kubernetes.io/component=secure" --output nameoc port-forward service/<name> 8080:httpHelm chart availability
The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.
Audit records
Preserving legacy audit records
Immuta does not migrate legacy audit records to the universal audit model (UAM), so when you upgrade Immuta those audit records will be lost unless you enable the following setting in your immuta-values.yaml file:
secure:
extraEnvVars:
- name: FeatureFlag_auditLegacyViewHide
value: "false"Audit record retention
Immuta defaults to keeping audit records for 7 days. To change this duration, set the following values in the immuta-values.yaml file. The example below configures audit records to be kept for 90 days:
Avoid these special characters in generated passwords
whitespace, $, &, :, \, /, '
oc project immutaaudit:
deployment:
extraEnvVars:
- name: AUDIT_RETENTION_POLICY_IN_DAYS
value: "90"