1 of 6

Install

The guides in this section illustrate how to install and deploy Immuta in your Kubernetes environment. If your distribution is not listed below (such as K3s or RKE2), follow the generic installation instructions.

Managed public cloud: This guide includes instructions for
- Amazon Elastic Kubernetes Service (EKS)
- Google Kubernetes Engine (GKE)
- Microsoft Azure Kubernetes Service (AKS)
Red Hat OpenShift
Generic installation
Immuta in an air-gapped environment

Managed Public Cloud

This is a guide on how to deploy Immuta on Kubernetes in the following managed public cloud providers:

Amazon Web Services (AWS)
Microsoft Azure
Google Cloud Platform (GCP)

Prerequisites

The following cloud-managed services must be provisioned before proceeding:

Validation

PostgreSQL

The PostgreSQL instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The PostgreSQL instance is accepting connections.

Elasticsearch

The Elasticsearch instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The Elasticsearch instance is accepting connections.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a Kubernetes namespace named immuta for Immuta.
```
kubectl create namespace immuta
```

Switch to namespace immuta.

kubectl config set-context --current --namespace=immuta

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

kubectl create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

PostgreSQL

Connecting to the database

There are numerous ways to connect to a PostgreSQL database. This step demonstrates how to connect by creating an ephemeral Kubernetes pod.

Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the kubectl run command outlined below. Wait 5 seconds, and then proceed by entering a password.
```
kubectl run pgclient \
    --stdin \
    --tty \
    --rm \
    --image docker.io/bitnami/postgresql -- \
    psql --host <postgres-fqdn> --username postgres --port 5432 --password
```

Create an immuta role and database.

CREATE ROLE immuta with login encrypted password '<postgres-password>';

GRANT immuta TO CURRENT_USER;

CREATE DATABASE immuta OWNER immuta;

GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;

Revoke privileges from CURRENT_USER as they're no longer required.
```
REVOKE immuta FROM CURRENT_USER;
```
Enable the pgcrypto extension.
```
\c immuta
CREATE EXTENSION pgcrypto;
```
Type \q, and then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.

Create a Helm values file named immuta-values.yaml with the following content:

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  config:
    databaseConnectionString: postgres://immuta:<postgres-password>@<postgres-fqdn>:5432/immuta?schema=audit
    elasticsearchEndpoint: <elasticsearch-endpoint>
    elasticsearchUsername: <elasticsearch-username>
    elasticsearchPassword: <elasticsearch-password>

secure:
  ingress:
    enabled: false
    tls: false
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "true"
    - name: FeatureFlag_detect
      value: "true"
    - name: FeatureFlag_auditLegacyViewHide
      value: "true"

  postgresql:
    host: <postgres-fqdn>
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta oci://ocir.immuta.com/stable/immuta-enterprise \
    --values immuta-values.yaml \
    --version 2024.2.9

Validation

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

kubectl get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
kubectl port-forward service/<name> 8080:http
```

Next steps

Configure Ingress to complete your installation and access your Immuta application.
Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
Learn more about the best practices for Immuta in production.

Configure Ingress to complete your installation and access your Immuta application.
Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
Learn more about the best practices for Immuta in production.

Configure Ingress to complete your installation and access your Immuta application.
Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
Learn more about the best practices for Immuta in production.

Red Hat OpenShift

This is an OpenShift-specific guide on how to deploy Immuta with the following managed services:

Cloud-managed PostgreSQL
Cloud-managed Redis
Cloud-managed Elasticsearch

Prerequisites

Review the following criteria before proceeding with deploying Immuta.

PostgreSQL

The PostgreSQL instance has been provisioned and is actively running.
The PostgreSQL instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The PostgreSQL instance is accepting connections.

Redis

The Redis instance has been provisioned and is actively running.
The Redis instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The Redis instance is accepting connections.

Elasticsearch

The Elasticsearch instance has been provisioned and is actively running.
The Elasticsearch instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The Elasticsearch instance is accepting connections.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a new OpenShift project named immuta for Immuta.
```
oc new-project immuta
```
Get the UID range allocated to the project. Each running container's UID must fall within this range. This value will be referenced later on.
```
oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
```
Get the GID range allocated to the project. Each running container's GID must fall within this range. This value will be referenced later on.
```
oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
```
Switch to project immuta.
```
oc project immuta
```

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

oc create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

Cloud-managed PostgreSQL

Connecting to the database

There are numerous ways to connect to a PostgreSQL database. This step demonstrates how to connect by creating an ephemeral Kubernetes pod.

Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the oc run command outlined below. Wait 5 seconds, and then proceed by entering a password.
```
oc run pgclient \
    --stdin \
    --tty \
    --rm \
    --image docker.io/bitnami/postgresql -- \
    psql --host <postgres-fqdn> --username postgres --port 5432 --password
```

Create an immuta role and database.

CREATE ROLE immuta with login encrypted password '<postgres-password>';

GRANT immuta TO CURRENT_USER;

CREATE DATABASE immuta OWNER immuta;

GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;

Revoke privileges from CURRENT_USER as they're no longer required.
```
REVOKE immuta FROM CURRENT_USER;
```
Enable the pgcrypto extension.
```
\c immuta
CREATE EXTENSION pgcrypto;
```
Type \q, and then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.

Create a Helm values file named immuta-values.yaml with the content below. Because the Ingress resource will be managed by an OpenShift route you will create when configuring Ingress and not the Immuta Enterprise Helm chart, ingress is set to false below. TLS comes pre-configured with OpenShift, so tls is also set to false.

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  config:
    databaseConnectionString: postgres://immuta:<postgres-password>@pg-db-postgresql.immuta.svc.cluster.local:5432/immuta?schema=audit
    elasticsearchEndpoint: http://es-db-elasticsearch.immuta.svc.cluster.local:9200
    elasticsearchUsername: <elasticsearch-username>
    elasticsearchPassword: <elasticsearch-password>

  deployment:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault
      
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

discover:
  deployment:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault
      
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

secure:
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "true"
    - name: FeatureFlag_detect
      value: "true"
    - name: FeatureFlag_auditLegacyViewHide
      value: "true"

  ingress:
    enabled: false
    tls: false

  postgresql:
    host: <postgres-fqdn>
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: false

  web:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault
      
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

  backgroundWorker:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault
      
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta oci://ocir.immuta.com/stable/immuta-enterprise \
    --values immuta-values.yaml \
    --version 2024.2.9

Validation

Wait for all pods in the namespace to become ready.
```
oc wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

oc get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
oc port-forward service/<name> 8080:http
```

Next steps

Configure Ingress to complete your installation and access your Immuta application.
Learn more about best practices for Immuta in Production.

Generic Installation

This is a generic guide that demonstrates how to deploy Immuta into any Kubernetes cluster without dependencies on any particular cloud provider.

Considerations

For the purposes of this guide, the following state stores are deployed in Kubernetes using third-party Helm charts maintained by :

Running production-grade stateful workloads (e.g., databases) in Kubernetes is difficult and heavily discouraged due to the following reasons.

Operational overhead: Managing PostgreSQL and Elasticsearch on Kubernetes requires expertise in deploying, maintaining, and scaling these databases and search engines effectively. This involves tasks like setting up monitoring, configuring backups, managing updates, and ensuring high availability. Cloud-managed services abstract much of this operational burden away, allowing teams to focus on application development rather than infrastructure management.
Resource allocation and scaling: Kubernetes requires careful resource allocation and scaling decisions to ensure that PostgreSQL and Elasticsearch have sufficient CPU, memory, and storage. Properly sizing these resources can be challenging and may require continuous adjustments as workload patterns change. Managed services typically handle this scaling transparently and can automatically adjust based on demand.
Data integrity and high availability: PostgreSQL and Elasticsearch deployments need robust strategies for data integrity and high availability. Kubernetes can facilitate high availability through pod replicas and distributed deployments, but ensuring data consistency and durability across database instances and search indexes requires careful consideration and often additional tooling.
Performance: Kubernetes networking and storage configurations can introduce performance overhead compared to native cloud services. For latency-sensitive applications or high-throughput workloads, these factors become critical in maintaining optimal performance.
Observability: Troubleshooting issues in a Kubernetes environment, especially related to database and search engine performance, can be complex. Managed services typically come with built-in monitoring, logging, and alerting capabilities tailored to the specific service, making it easier to identify and resolve issues.
Security and compliance: Kubernetes environments require careful attention to security best practices, including network policies, access controls, and encryption. Managed services often come pre-configured with security features and compliance certifications, reducing the burden on teams to implement and maintain these measures.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

Setup

Create a Kubernetes namespace named immuta for Immuta and its third-party dependencies.
Switch to namespace immuta.
Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

Elasticsearch

Create a Helm values file named es-values.yaml with the following content:
Deploy Elasticsearch.

PostgreSQL

Create a Helm values file named pg-values.yaml with the following content:
Deploy PostgreSQL.
Wait for all pods in the namespace to become ready.
Determine the name of the PostgreSQL database pod. This will be referenced in a subsequent step.
Exec into the PostgreSQL database pod using the psql command and immuta user to configure the PostgreSQL user used by Immuta.
Alter the search_path for the immuta user.
Enable the pgcrypto extension.
Type \q then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite local services are configured.

Create a Helm values file named immuta-values.yaml with the following content:
Deploy Immuta.

Validation

Wait for all pods in the namespace to become ready.
Determine the name of the Secure service.
Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
Navigate to http://localhost:8080 in a web browser.

Next steps

Immuta in an Air-Gapped Environment

This page provides one possible way to download and package Immuta artifacts for consumption on a separate network with no Internet access.

Install Skopeo

The commands on this page copy the Immuta images from the registry to the local host and export to tarball using skopeo. Install skopeo by following the instructions in the Skopeo GitHub repository.

Authenticate Skopeo to the Immuta registry

Copy the snippet below and replace the placeholder text with the credentials provided by your Immuta representative:

skopeo login https://ocir.immuta.com -u <username> -p <password>

Copy images from the Immuta registry

The IMMUTA_LEGACY_IMAGES noted below are only required if the deployment still requires the Immuta query engine or fingerprint service. If not, those legacy images can be omitted.

export IMMUTA_VERSION=2024.2.9
export IMMUTA_IMAGES="audit-service audit-export-cronjob cache classify-service immuta-service"
export IMMUTA_LEGACY_IMAGES="immuta-db immuta-fingerprint"
for image in ${IMMUTA_IMAGES} ${IMMUTA_LEGACY_IMAGES}; do
  skopeo copy docker://ocir.immuta.com/stable/${image}:${IMMUTA_VERSION} docker-archive://${PWD}/${image}-${IMMUTA_VERSION}.tar;
done

Pull the Immuta Enterprise Helm chart (IEHC)

Copy the snippet below and replace the placeholder text with the credentials provided by your Immuta representative:
```
echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com
```

Download the IEHC for the current Immuta release:

helm pull oci://ocir.immuta.com/stable/immuta-enterprise --version 2024.2.9

Push images to the private registry

After transferring the Immuta container images and IEHC to your air-gapped network, load them into the container registry there after authenticating.

export PRIVATE_REGISTRY=your.private-registry.com
export IMMUTA_VERSION=2024.2.9
export IMMUTA_IMAGES="audit-service audit-export-cronjob cache classify-service immuta-service"
export IMMUTA_LEGACY_IMAGES="immuta-db immuta-fingerprint"
for image in ${IMMUTA_IMAGES} ${IMMUTA_LEGACY_IMAGES}; do
  skopeo copy docker-archive://${PWD}/${image}-${IMMUTA_VERSION}.tar docker://${PRIVATE_REGISTRY}/immuta/${image}:${IMMUTA_VERSION};
done

Install from IEHC tarball

Override the image registry in the Helm chart values overrides:

immuta-values.yaml

---
global:
  imageRegistry: your.private-registry.com
  imageRepositoryMap:
    immuta/immuta-service: immuta/immuta-service
    immuta/immuta-db: immuta/immuta-db
    immuta/immuta-fingerprint: immuta/immuta-fingerprint
    immuta/audit-service: immuta/audit-service
    immuta/audit-export-cronjob: immuta/audit-export-cronjob
    immuta/classify-service: immuta/classify-service
    immuta/cache: immuta/cache

The IEHC can be referenced via filename if there is no Helm chart repository on the destination network:

helm upgrade --install immuta ./immuta-enterprise-2024.2.9.tgz -f immuta-values.yaml

Deploy Immuta without Elasticsearch

Feature availability

If you deploy Immuta without Elasticsearch, several core services and features will be unavailable. See the Deployment requirements page for details.

The guides below outline how to deploy Immuta without Elasticsearch.

This is a guide on how to deploy Immuta on Kubernetes in the following managed public cloud providers:

Amazon Web Services (AWS)
Microsoft Azure
Google Cloud Platform (GCP)

Prerequisites

The following cloud-managed services must be provisioned before proceeding:

Amazon Web Services (AWS): Amazon RDS for PostgreSQL
Microsoft Azure: Azure Database for PostgreSQL
Google Cloud Platform (GCP): Google Cloud SQL for PostgreSQL

Validation

The PostgreSQL instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The PostgreSQL instance is accepting connections.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a Kubernetes namespace named immuta for Immuta.
```
kubectl create namespace immuta
```

Switch to namespace immuta.

kubectl config set-context --current --namespace=immuta

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

kubectl create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

PostgreSQL

Connecting to the database

There are numerous ways to connect to a PostgreSQL database. This step demonstrates how to connect by creating an ephemeral Kubernetes pod.

Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the kubectl run command outlined below. Wait 5 seconds, and then proceed by entering a password.
```
kubectl run pgclient \
    --stdin \
    --tty \
    --rm \
    --image docker.io/bitnami/postgresql -- \
    psql --host <postgres-fqdn> --username postgres --port 5432 --password
```

Create an immuta role and database.

CREATE ROLE immuta with login encrypted password '<postgres-password>';

GRANT immuta TO CURRENT_USER;

CREATE DATABASE immuta OWNER immuta;

GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;

Revoke privileges from CURRENT_USER as they're no longer required.
```
REVOKE immuta FROM CURRENT_USER;
```
Enable the pgcrypto extension.
```
\c immuta
CREATE EXTENSION pgcrypto;
```
Type \q, and then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.

Create a Helm values file named immuta-values.yaml with the following content:

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  enabled: false

secure:
  ingress:
    enabled: false
    tls: false
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "false"
    - name: FeatureFlag_detect
      value: "false"
    - name: FeatureFlag_auditLegacyViewHide
      value: "false"

  postgresql:
    host: <postgres-fqdn>
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta immuta/immuta-enterprise \
    --values immuta-values.yaml

Validation

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

kubectl get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
kubectl port-forward service/<name> 8080:http
```

Next steps

Amazon Web Services (AWS)
- Configure Ingress to complete your installation and access your Immuta application.
- Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
- Learn more about the best practices for Immuta in production.
Microsoft Azure
- Configure Ingress to complete your installation and access your Immuta application.
- Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
- Learn more about the best practices for Immuta in production.
Google Cloud Platform (GCP)
- Configure Ingress to complete your installation and access your Immuta application.
- Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
- Learn more about the best practices for Immuta in production.

This is an OpenShift-specific guide on how to deploy Immuta with the following managed services:

Cloud-managed PostgreSQL
Cloud-managed Redis

Prerequisites

Review the following criteria before proceeding with deploying Immuta.

PostgreSQL

The PostgreSQL instance has been provisioned and is actively running.
The PostgreSQL instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The PostgreSQL instance is accepting connections.

Redis

The Redis instance has been provisioned and is actively running.
The Redis instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The Redis instance is accepting connections.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a new OpenShift project named immuta for Immuta.
```
oc new-project immuta
```
Get the UID range allocated to the project. Each running container's UID must fall within this range. This value will be referenced later on.
```
oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
```
Get the GID range allocated to the project. Each running container's GID must fall within this range. This value will be referenced later on.
```
oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
```
Switch to project immuta.
```
oc project immuta
```

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

oc create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

Cloud-managed PostgreSQL

Connecting to the database

There are numerous ways to connect to a PostgreSQL database. This step demonstrates how to connect by creating an ephemeral Kubernetes pod.

Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the oc run command outlined below. Wait 5 seconds, and then proceed by entering a password.
```
oc run pgclient \
    --stdin \
    --tty \
    --rm \
    --image docker.io/bitnami/postgresql -- \
    psql --host <postgres-fqdn> --username postgres --port 5432 --password
```

Create an immuta role and database.

CREATE ROLE immuta with login encrypted password '<postgres-password>';

GRANT immuta TO CURRENT_USER;

CREATE DATABASE immuta OWNER immuta;

GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;

Revoke privileges from CURRENT_USER as they're no longer required.
```
REVOKE immuta FROM CURRENT_USER;
```
Enable the pgcrypto extension.
```
\c immuta
CREATE EXTENSION pgcrypto;
```
Type \q, and then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  enabled: false

  deployment:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

discover:
  deployment:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

secure:
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "false"
    - name: FeatureFlag_detect
      value: "false"
    - name: FeatureFlag_auditLegacyViewHide
      value: "false"

  ingress:
    enabled: false
    tls: false

  postgresql:
    host: <postgres-fqdn>
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

  web:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

  backgroundWorker:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta immuta/immuta-enterprise \
    --values immuta-values.yaml

Validation

Wait for all pods in the namespace to become ready.
```
oc wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

oc get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
oc port-forward service/<name> 8080:http
```

Next steps

Configure Ingress to complete your installation and access your Immuta application.
Learn more about best practices for Immuta in Production.

This is a generic guide that demonstrates how to deploy Immuta into any Kubernetes cluster without dependencies on any particular cloud provider.

Considerations

For the purposes of this guide, the PostgreSQL state stores are deployed in Kubernetes using third-party Helm charts maintained by Bitnami.

Running production-grade stateful workloads (e.g, databases) in Kubernetes is difficult and heavily discouraged due to the following reasons.

Operational overhead: Managing PostgreSQL on Kubernetes requires expertise in deploying, maintaining, and scaling these databases and search engines effectively. This involves tasks like setting up monitoring, configuring backups, managing updates, and ensuring high availability. Cloud-managed services abstract much of this operational burden away, allowing teams to focus on application development rather than infrastructure management.
Resource allocation and scaling: Kubernetes requires careful resource allocation and scaling decisions to ensure that PostgreSQL has sufficient CPU, memory, and storage. Properly sizing these resources can be challenging and may require continuous adjustments as workload patterns change. Managed services typically handle this scaling transparently and can automatically adjust based on demand.
Data integrity and high availability: PostgreSQL deployments need robust strategies for data integrity and high availability. Kubernetes can facilitate high availability through pod replicas and distributed deployments, but ensuring data consistency and durability across database instances and search indexes requires careful consideration and often additional tooling.
Performance: Kubernetes networking and storage configurations can introduce performance overhead compared to native cloud services. For latency-sensitive applications or high-throughput workloads, these factors become critical in maintaining optimal performance.
Observability: Troubleshooting issues in a Kubernetes environment, especially related to database and search engine performance, can be complex. Managed services typically come with built-in monitoring, logging, and alerting capabilities tailored to the specific service, making it easier to identify and resolve issues.
Security and compliance: Kubernetes environments require careful attention to security best practices, including network policies, access controls, and encryption. Managed services often come pre-configured with security features and compliance certifications, reducing the burden on teams to implement and maintain these measures.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a Kubernetes namespace named immuta for Immuta and its third-party dependencies.
```
kubectl create namespace immuta
```

Switch to namespace immuta.

kubectl config set-context --current --namespace=immuta

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

oc create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

PostgreSQL

Create a Helm values file named pg-values.yaml with the following content:

auth:
    database: immuta
    username: immuta
    password: <postgres-password>

Update all placeholder values in the pg-values.yaml file.

Deploy PostgreSQL.

helm install pg-db oci://registry-1.docker.io/bitnamicharts/postgresql \
    --values pg-values.yaml

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the PostgreSQL database pod. This will be referenced in a subsequent step.

kubectl get pod --selector "app.kubernetes.io/name=postgresql" --output template='{{ .metadata.name }}'

Exec into the PostgreSQL database pod using the psql command and immuta user to configure the PostgreSQL user used by Immuta.
```
kubectl exec --stdin --tty pod/<database-pod-name> -- psql -U immuta
```

Alter the search_path for the immuta user.

ALTER ROLE immuta SET search_path TO bometadata,public;

Enable the pgcrypto extension.
```
CREATE EXTENSION pgcrypto;
```
Type \q then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite local services are configured.

Create a Helm values file named immuta-values.yaml with the following content:

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  enabled: false

secure:
  ingress:
    enabled: false
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "false"
    - name: FeatureFlag_detect
      value: "false"
    - name: FeatureFlag_auditLegacyViewHide
      value: "false"

  postgresql:
    # Each Kubernetes Service has a DNS record associated with it. See: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
    # The anatomy of a domain name is as follows:
    #   <service>.<namespace>.svc.<cluster-domain>
    #
    # Where the default cluster domain is: cluster.local
    host: pg-db-postgresql.immuta.svc.cluster.local
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta immuta/immuta-enterprise \
    --values immuta-values.yaml

Validation

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

kubectl get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
kubectl port-forward service/<name> 8080:http
```
Navigate to http://localhost:8080 in a web browser.

Next steps

Configure Ingress to complete your installation and access your Immuta application.
Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
Learn more about best practices for Immuta in Production.

Deploy Immuta without Elasticsearch

Feature availability

If you deploy Immuta without Elasticsearch, several core services and features will be unavailable. See the Deployment requirements page for details.

The guides below outline how to deploy Immuta without Elasticsearch.

This is a guide on how to deploy Immuta on Kubernetes in the following managed public cloud providers:

Amazon Web Services (AWS)
Microsoft Azure
Google Cloud Platform (GCP)

Prerequisites

The following cloud-managed services must be provisioned before proceeding:

Amazon Web Services (AWS): Amazon RDS for PostgreSQL
Microsoft Azure: Azure Database for PostgreSQL
Google Cloud Platform (GCP): Google Cloud SQL for PostgreSQL

Validation

The PostgreSQL instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The PostgreSQL instance is accepting connections.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a Kubernetes namespace named immuta for Immuta.
```
kubectl create namespace immuta
```

Switch to namespace immuta.

kubectl config set-context --current --namespace=immuta

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

kubectl create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

PostgreSQL

Connecting to the database

There are numerous ways to connect to a PostgreSQL database. This step demonstrates how to connect by creating an ephemeral Kubernetes pod.

Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the kubectl run command outlined below. Wait 5 seconds, and then proceed by entering a password.
```
kubectl run pgclient \
    --stdin \
    --tty \
    --rm \
    --image docker.io/bitnami/postgresql -- \
    psql --host <postgres-fqdn> --username postgres --port 5432 --password
```

Create an immuta role and database.

CREATE ROLE immuta with login encrypted password '<postgres-password>';

GRANT immuta TO CURRENT_USER;

CREATE DATABASE immuta OWNER immuta;

GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;

Revoke privileges from CURRENT_USER as they're no longer required.
```
REVOKE immuta FROM CURRENT_USER;
```
Enable the pgcrypto extension.
```
\c immuta
CREATE EXTENSION pgcrypto;
```
Type \q, and then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.

Create a Helm values file named immuta-values.yaml with the following content:

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  enabled: false

secure:
  ingress:
    enabled: false
    tls: false
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "false"
    - name: FeatureFlag_detect
      value: "false"
    - name: FeatureFlag_auditLegacyViewHide
      value: "false"

  postgresql:
    host: <postgres-fqdn>
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta immuta/immuta-enterprise \
    --values immuta-values.yaml

Validation

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

kubectl get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
kubectl port-forward service/<name> 8080:http
```

Next steps

Amazon Web Services (AWS)
- Configure Ingress to complete your installation and access your Immuta application.
- Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
- Learn more about the best practices for Immuta in production.
Microsoft Azure
- Configure Ingress to complete your installation and access your Immuta application.
- Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
- Learn more about the best practices for Immuta in production.
Google Cloud Platform (GCP)
- Configure Ingress to complete your installation and access your Immuta application.
- Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
- Learn more about the best practices for Immuta in production.

This is an OpenShift-specific guide on how to deploy Immuta with the following managed services:

Cloud-managed PostgreSQL
Cloud-managed Redis

Prerequisites

Review the following criteria before proceeding with deploying Immuta.

PostgreSQL

The PostgreSQL instance has been provisioned and is actively running.
The PostgreSQL instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The PostgreSQL instance is accepting connections.

Redis

The Redis instance has been provisioned and is actively running.
The Redis instance's hostname/FQDN is resolvable from within the Kubernetes cluster.
The Redis instance is accepting connections.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a new OpenShift project named immuta for Immuta.
```
oc new-project immuta
```
Get the UID range allocated to the project. Each running container's UID must fall within this range. This value will be referenced later on.
```
oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
```
Get the GID range allocated to the project. Each running container's GID must fall within this range. This value will be referenced later on.
```
oc get project immuta --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
```
Switch to project immuta.
```
oc project immuta
```

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

oc create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

Cloud-managed PostgreSQL

Connecting to the database

There are numerous ways to connect to a PostgreSQL database. This step demonstrates how to connect by creating an ephemeral Kubernetes pod.

Connect to the database as superuser (postgres) by creating an ephemeral container inside the Kubernetes cluster. A shell prompt will not be displayed after executing the oc run command outlined below. Wait 5 seconds, and then proceed by entering a password.
```
oc run pgclient \
    --stdin \
    --tty \
    --rm \
    --image docker.io/bitnami/postgresql -- \
    psql --host <postgres-fqdn> --username postgres --port 5432 --password
```

Create an immuta role and database.

CREATE ROLE immuta with login encrypted password '<postgres-password>';

GRANT immuta TO CURRENT_USER;

CREATE DATABASE immuta OWNER immuta;

GRANT all ON DATABASE immuta TO immuta;
ALTER ROLE immuta SET search_path TO bometadata,public;

Revoke privileges from CURRENT_USER as they're no longer required.
```
REVOKE immuta FROM CURRENT_USER;
```
Enable the pgcrypto extension.
```
\c immuta
CREATE EXTENSION pgcrypto;
```
Type \q, and then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite cloud-managed services are configured.

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  enabled: false

  deployment:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

discover:
  deployment:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

secure:
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "false"
    - name: FeatureFlag_detect
      value: "false"
    - name: FeatureFlag_auditLegacyViewHide
      value: "false"

  ingress:
    enabled: false
    tls: false

  postgresql:
    host: <postgres-fqdn>
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

  web:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

  backgroundWorker:
    podSecurityContext:
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.uid-range"}}{{"\n"}}'
      runAsUser: <user-id>
      # A number that is within the project range:
      #   oc get project <project-name> --output template='{{index .metadata.annotations "openshift.io/sa.scc.supplemental-groups"}}{{"\n"}}'
      runAsGroup: <group-id>
      seccompProfile:
        type: RuntimeDefault

    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta immuta/immuta-enterprise \
    --values immuta-values.yaml

Validation

Wait for all pods in the namespace to become ready.
```
oc wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

oc get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
oc port-forward service/<name> 8080:http
```

Next steps

Configure Ingress to complete your installation and access your Immuta application.
Learn more about best practices for Immuta in Production.

This is a generic guide that demonstrates how to deploy Immuta into any Kubernetes cluster without dependencies on any particular cloud provider.

Considerations

For the purposes of this guide, the PostgreSQL state stores are deployed in Kubernetes using third-party Helm charts maintained by Bitnami.

Running production-grade stateful workloads (e.g, databases) in Kubernetes is difficult and heavily discouraged due to the following reasons.

Operational overhead: Managing PostgreSQL on Kubernetes requires expertise in deploying, maintaining, and scaling these databases and search engines effectively. This involves tasks like setting up monitoring, configuring backups, managing updates, and ensuring high availability. Cloud-managed services abstract much of this operational burden away, allowing teams to focus on application development rather than infrastructure management.
Resource allocation and scaling: Kubernetes requires careful resource allocation and scaling decisions to ensure that PostgreSQL has sufficient CPU, memory, and storage. Properly sizing these resources can be challenging and may require continuous adjustments as workload patterns change. Managed services typically handle this scaling transparently and can automatically adjust based on demand.
Data integrity and high availability: PostgreSQL deployments need robust strategies for data integrity and high availability. Kubernetes can facilitate high availability through pod replicas and distributed deployments, but ensuring data consistency and durability across database instances and search indexes requires careful consideration and often additional tooling.
Performance: Kubernetes networking and storage configurations can introduce performance overhead compared to native cloud services. For latency-sensitive applications or high-throughput workloads, these factors become critical in maintaining optimal performance.
Observability: Troubleshooting issues in a Kubernetes environment, especially related to database and search engine performance, can be complex. Managed services typically come with built-in monitoring, logging, and alerting capabilities tailored to the specific service, making it easier to identify and resolve issues.
Security and compliance: Kubernetes environments require careful attention to security best practices, including network policies, access controls, and encryption. Managed services often come pre-configured with security features and compliance certifications, reducing the burden on teams to implement and maintain these measures.

Authenticate with OCI registry

Helm chart availability

The deprecated Immuta Helm chart (IHC) is not available from ocir.immuta.com.

Copy the snippet below and replace the placeholder text with the credentials provided to you by your customer success manager:

echo <token> | helm registry login --password-stdin --username <username> ocir.immuta.com

Setup

Create a Kubernetes namespace named immuta for Immuta and its third-party dependencies.
```
kubectl create namespace immuta
```

Switch to namespace immuta.

kubectl config set-context --current --namespace=immuta

Create a container registry pull secret. Contact your Immuta representative to obtain credentials to authenticate with ocir.immuta.com.

oc create secret docker-registry immuta-oci-registry \
    --docker-server=https://ocir.immuta.com \
    --docker-username="<username>" \
    --docker-password="<token>" \
    --docker-email=support@immuta.com

PostgreSQL

Create a Helm values file named pg-values.yaml with the following content:

auth:
    database: immuta
    username: immuta
    password: <postgres-password>

Update all placeholder values in the pg-values.yaml file.

Deploy PostgreSQL.

helm install pg-db oci://registry-1.docker.io/bitnamicharts/postgresql \
    --values pg-values.yaml

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the PostgreSQL database pod. This will be referenced in a subsequent step.

kubectl get pod --selector "app.kubernetes.io/name=postgresql" --output template='{{ .metadata.name }}'

Exec into the PostgreSQL database pod using the psql command and immuta user to configure the PostgreSQL user used by Immuta.
```
kubectl exec --stdin --tty pod/<database-pod-name> -- psql -U immuta
```

Alter the search_path for the immuta user.

ALTER ROLE immuta SET search_path TO bometadata,public;

Enable the pgcrypto extension.
```
CREATE EXTENSION pgcrypto;
```
Type \q then press Enter to exit.

Install Immuta

This section demonstrates how to deploy Immuta using the Immuta Enterprise Helm chart once the prerequisite local services are configured.

Create a Helm values file named immuta-values.yaml with the following content:

global:
  imageRegistry: ocir.immuta.com
  imagePullSecrets:
    - name: immuta-oci-registry
  imageRepositoryMap:
    immuta/immuta-service: stable/immuta-service
    immuta/immuta-db: stable/immuta-db
    immuta/immuta-fingerprint: stable/immuta-fingerprint
    immuta/audit-service: stable/audit-service
    immuta/audit-export-cronjob: stable/audit-export-cronjob
    immuta/classify-service: stable/classify-service
    immuta/cache: stable/cache

audit:
  enabled: false

secure:
  ingress:
    enabled: false
  extraEnvVars:
    - name: FeatureFlag_AuditService
      value: "false"
    - name: FeatureFlag_detect
      value: "false"
    - name: FeatureFlag_auditLegacyViewHide
      value: "false"

  postgresql:
    # Each Kubernetes Service has a DNS record associated with it. See: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
    # The anatomy of a domain name is as follows:
    #   <service>.<namespace>.svc.<cluster-domain>
    #
    # Where the default cluster domain is: cluster.local
    host: pg-db-postgresql.immuta.svc.cluster.local
    port: 5432
    database: immuta
    username: immuta
    password: <postgres-password>
    ssl: true

Update all placeholder values in the immuta-values.yaml file.

Deploy Immuta.

helm install immuta immuta/immuta-enterprise \
    --values immuta-values.yaml

Validation

Wait for all pods in the namespace to become ready.
```
kubectl wait --for=condition=Ready pods --all
```

Determine the name of the Secure service.

kubectl get service --selector "app.kubernetes.io/component=secure" --output template='{{ .metadata.name }}'

Listen on local port 8080, forwarding TCP traffic to the Secure service's port named http.
```
kubectl port-forward service/<name> 8080:http
```
Navigate to http://localhost:8080 in a web browser.

Next steps

Configure Ingress to complete your installation and access your Immuta application.
Configure TLS to secure your Ingress by specifying a Secret that contains a TLS private key and certificate.
Learn more about best practices for Immuta in Production.