Skip to main content
Version: Next

Prerequisites

Before you begin the process of deploying Glasswall's CDR Platform, check that you have the following tools and resources installed and setup.

Required Tools​

Required Azure Resources​

1. AKS Instance​

  • Recommended total of at least 8 vCPU and 32 GB RAM.
  • Minimum node size is 4 vCPU and 16 GB RAM.
  • For production workloads a minimum of 2 nodes is recommended.
  • In the steps below, the AKS cluster is referred to as: aksname

Note: Glasswall CDR platform does not support ARM64 node VMs.

For guidance on creating an AKS cluster please refer to:

2. Key Vault​

  • CDR Platform secrets are managed using Azure Key Vault. These secrets are synced into the AKS cluster via External Secrets.
  • In the steps below, the Key Vault is referred to as: kvname

For guidance on creating an Azure Key Vault please refer to:

3. Storage Account​

  • A storage account is used to store reports for each file processed by the platform. The SKU of the storage account does not impact performance, but we recommend at least GRS configuration.
  • An additional storage account is used as Azure File Share backing the cluster's Persistent Volume. This is added to the AKS cluster's resource group automatically.
  • In the steps below, the storage account that collects the CDR reports is referred to as: saname

File Shares:

  • 1 x 10TB Provisioned Capacity (1100.0 MiB /s throughput)
    • Used for the Glasswall Halo transient file store and Glasswall Halo Rabbit MQ

4. Database​

Option 1 - MongoDB Database​

  • MongoDB can be used to store the CDR Platform content management policies, data for asynchronous file processing and metrics.

  • Deploy a CosmosDB with MongoDB API compatibility.

    • Ensure that the instance is setup with the appropriate throughput allocation, depending on how much data is expected to pass through the CDR Platform

    NOTE - Alternatively, MonogoDB can deployed directly inside of your cluster. Deployable using the MongoDB Helm Charts, as seen in Step 8.

Option 2 - CosmosDB Database​

  • Alternatively, CosmosDB can be used to store the CDR Platform content management policies, data for asynchronous file processing and metrics.
  • Deploy a CosmosDB instance in Azure.
    • Ensure that the instance is setup with the appropriate throughput allocation, depending on how much data is expected to pass through the CDR Platform

5. App registrations​

  • A domain name must be configured for the Cleanroom (portal service) to use SSO authentication.
  • Azure app resigrations are needed when SSO authentication using Azure AD needs to be enabled
  • There are 3 App registrations that needs to be created -
    1. cdrplatform-api-access
    2. cdrplatform-portal-access
    3. cdrplatform-portal-client
  • Attached shell script helps to create these 3 app registrations. Pass domain name you would like to use for the portal as an argument to the shell script. For example, to use cleanroom.glasswall.com as the domain name run the script:
bash create-azure-app-registrations.sh cleanroom.glasswall.com

Note: the steps below assume each resource is in the same resource group referred to as: rgp

Access to Glasswall Artifact Registry​

  • You are provided with a Token & Token ID to access Glasswall's Artifact Registry.
  • This allows you to directly pull container images and Helm charts from your AKS cluster.
  • In the steps below, the Token and Token ID will be referred to as: token and token_ID.

Assigning Variables​

Variables assigned before you begin​

The variables mentioned in prerequisites above need to be assigned before you can begin the CDR Platform installation. You'll need to replace "..." with your own values.

  • Azure Resource Group name: rgp="..."
  • Azure Kubernetes Service name: aksname="..."
  • Azure Key Vault name: kvname="..."
  • Azure Storage Account name: saname="..."
  • Azure Container Registry Token ID: token_ID="..."
  • Azure Container Registry Token: token="..."

Variables assigned during steps​

The following variables will need to be assigned during the installation process as resources are created.

  • Azure Storage Account connection string: saconnstring="..."
  • Managed Identity Access to Key Vault get and list permissions using objectid: objectID="..."
  • Managed Identity Access to Key Vault using Client ID for Helm install: MIclientID="..."
  • Database provider used to configure which Database platform to connect to: database_provider="..."

Please ensure the correct database provider is setup and relevant secrets are in the KeyVault as mentioned in Step 3.

VariableProvider
mongoMongoDB
cosmosCosmosDB