Deployment Requirements

Immuta comprises three core services: Secure, Discover, and Detect. These services rely on PostgreSQL and ElasticSearch to store their states, a caching layer, and Temporal for job execution. The illustration below shows the relationships among these services.

The Immuta Enterprise Helm chart (IEHC) does not include the deployment of PostgreSQL or ElasticSearch, so you must deploy them separately.

Although Immuta recommends using ElasticSearch because it supports several new Immuta features and services, you can deploy Immuta without ElasticSearch. The table below outlines the Immuta features supported with and without ElasticSearch and the dependencies you must deploy and manage yourself.

Immuta with ElasticSearchImmuta without ElasticSearch

Dependencies

Immuta Detect

Audit of Immuta and data platform events

Legacy audit

Immuta Monitors

Sensitive data discovery

For guidance on how to configure the IEHC to deploy Immuta with or without ElasticSearch, see one of the guides below:

For more information about legacy features and services no longer enabled in the recommended deployment of Immuta, see the Legacy features and services section.

Version requirements

Kubernetes versions

Kubernetes distributionKubernetes versions

Elastic Kubernetes Service (EKS)

1.25 - 1.31

Azure Kubernetes Service (AKS)

1.27 - 1.29

Google Kubernetes Engine (GKE)

1.26 - 1.29

Red Hat OpenShift

1.25 - 1.29

SUSE Rancher Government (RKE2)

1.25 - 1.29

SUSE K3s - For evaluation purposes only

1.25 - 1.29

Metadata database (PostgreSQL)

PostgreSQL incompatibilities

Immuta is not compatible with PostgreSQL abstraction layers, such as Amazon Aurora.

  • PostgreSQL 15.0 or newer

  • The pgcrypto extension must be enabled

ElasticSearch

  • ElasticSearch v7 API or newer

  • OpenSearch compatible with ElasticSearch v7 API or newer

Cache (Redis/Memcached)

Built-in cache

The IEHC manages its own Memcached deployment inside the cluster. The key-value cache can optionally be externalized post installation.

  • Redis 7.0 or newer

  • Memcached 1.6 or newer

Temporal

Built-in Temporal server

The IEHC deploys a Temporal server and its requisite components. However, you may choose to use your own Temporal instance.

  • Temporal 1.24.2 or newer

Infrastructure recommendations

Kubernetes distributionIngressExternal metadata databaseExternal ElasticSearch

Amazon Elastic Kubernetes Service (EKS)

AWS Load Balancer Controller

Azure Kubernetes Service (AKS)

Azure Application Gateway Ingress Controller

Google Kubernetes Engine (GKE)

GKE Ingress Controller

Red Hat OpenShift

OpenShift Ingress Operator

SUSE Rancher Government (RKE2)

Ingress NGINX Controller

SUSE K3s - For evaluation purposes only

Traefik

Legacy features and services

Some legacy services and features are no longer enabled in the recommended configuration of the IEHC. The table below lists these features and provides links to documentation that outlines how to enable them in Immuta.

FeatureImmuta Enterprise Helm chart configuration

Legacy audit

Set each of the following global.featureFlags in your immuta-values.yaml file to false:

  • AuditService

  • detect

  • auditLegacyViewHide

Legacy conditional tags

Set the following global.featureFlags in your immuta-values.yaml file to false: DiscoverDeprecateLegacyTags

Legacy sensitive data discovery

Data platforms

Policies

  • Masking with format preserving masking (unless using the Snowflake integration)

  • Masking with k-anonymization

  • Masking using randomized response (unless using the Snowflake integration)

Next step

Follow the Getting started guide to install Immuta.

Last updated

Was this helpful?

Copyright © 2014-2024 Immuta Inc. All rights reserved.