Deploy ICAP server

Follow the steps to deploy icap-server and icap profile management API

• Follow all the steps in the Deployment section to deploy Halo depending on the cloud provider. Once the Halo is up and running follow below steps to deploy ICAP server.
• Pull icap-server helm chart

helm pull oci://glasswallhub.azurecr.io/helm/icap-server --version 1.3.0 --untar --untardir .

• Install icap-server helm chart

  • Option A: Without MTLS enabled

    helm upgrade --install icap-server icap-server --atomic \
        --set image.tag="137321" \
        --set image.repository="glasswallhub.azurecr.io/icap-server" \
        --set configuration.HALO__Version=2.10.0 \
        -n cdrplatform

  • Option B: With MTLS enabled

    • Create mtls certificates by following step 3 in corresponding cloud provider.
    • Run the below command to sync the Kubernetes secrets with the secrets provider immediately.

    kubectl annotate externalsecret external-secret force-sync=$(date +%s) --overwrite

    • Deploy the helm chart

    helm upgrade --install icap-server icap-server --atomic \
        --set image.tag="137321" \
        --set image.repository="glasswallhub.azurecr.io/icap-server" \
        --set configuration.HALO__Version=2.10.0 \
        --set configuration.ENABLE_MTLS=yes \
        -n cdrplatform

Please note: the icap-server deployment runs a cache cleanup job post-install and post-upgrade. Read more about ICAP server caching in Caching.

• Install icap profile management API in api-access by setting the CLIENTS__IcapProfile__BaseAddress configuration.

helm upgrade --install cdrplatform-api-access cdrplatform-api-access \
 --set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
 --set image.tag=141985 \
 --set configuration.CLIENTS__IcapProfile__BaseAddress="http://policy-api:8080" \
 --atomic

Full list of available options for the api-access helm chart can be found in the Deployment steps based on the cloud provider used.

Specifying database provider

In the deployment of the helm chart the database provider can be configured with the configuration 'DATABASE__PROVIDER'. At the time of writing, Mongo and Cosmos are supported options.

--set configuration.DATABASE__Provider="Mongo"