Privacy Portal Installation

Download the OnPrem consumer installer from the URL provided by OneTrust.

Unzip the downloaded installer.

Open a command line and navigate the directory to extracted installer .../k8sdeployemnt/

Place the pfx certificate in the following path /ds-portal/k8s-deployment

Navigate to the terminal and change directory to the above path.

Run the below command to get the base64 format of the pfx file:

cat {pfxname}.pfx | base64 | tr -d " \t\n\r"     

Navigate to the package downloaded path and go to the following path …\ds-portal\k8s-deployment\_templates\secrets

Open the internal-certificate.yml file.

In the wildcard_ssl.pfx: placeholder enter the Base 64 code of the SSL certificate and select Save.

Run the below command via terminal to generate the cert. After running the command, it will ask you to enter the certificate password. Enter it and .crt file will be generated.

openssl pkcs12 -in <pfx file name>.pfx -nodes -nokeys -nomac -out <enter the file name as ds-cert.crt>

To generate .key file , run the below command. After running the command, it will ask you to enter the certificate password. Enter it and the .key file will be generated.

openssl pkcs12 -in <pfx file name>.pfx -nocerts -nodes -out <enter the file name as ds-cert.key>

Place both the ds-cert.crt and ds-cert.key in the ../admin-portal/k8s-deployment/ path.

Edit the application-onprem.properties as follows:

1. app.host.url={OneTrust admin-portal URL}

2. host.url={consumer portal URL}

3. Set the db.*properties with SQL Server information

   db.hostname=
   db.port=
   db.username=
   db.password=

Navigate to .../k8s-deployment/tools and extract ds-portal-keystore.zip

Open the Windows Subsystem for Linux or bash command line and point it to the folder .../k8s-deployment/tools/ds-portal-keystore/keystore

Run the command ./get-key-data-subject-auth.sh and enter the following values:

1. Enter Distinguished Name (e.g.cn=OneTrust, OU=IT): cn=OneTrust, OU=IT

2. Keypair validity: 365

3. Auth key alias: AuthJWT

A file named cert.txt will be generated in the same folder. Create a new text file as cert-auth.txt and copy the generated content values from cert.txt file and also update in the application-onprem.properties

Again navigate back to the .../k8s-deployment/tools/ds-portal-keystore/keystore and take the backup of the cert.txt

Navigate back to the Windows Subsystem for Linux or bash command line and run the ./get-keystore-data-subject.sh and enter the following values:

1. Enter Distinguished Name (e.g.cn=OneTrust, OU=IT): cn=OneTrust, OU=IT

2. Keypair validity: 365

3. DS key alias: DsJWT

A file named cert.txt would have generated in the same folder. Copy the values of the below generated content values in cert.txt file and update in the ds-request-onprem.properties

dsrequest.receipt.jwt.keystore.secretKeyName=
dsrequest.receipt.jwt.key.password=
dsrequest.receipt.jwt.keystore.password=
dsrequest.receipt.jwt.keystore.base64=

In ds-gateway-onprem.properties and turnstile-onprem.properties files, set the value for the below property:

server.ssl.key-store-password= {the pfx file's password}  
dsar.webform.domain={Enter both admin-portal and Consumer-portal domain names}

In the installation package navigate to folder …/ds-portal/k8s-deployment/inventory_template

Open and edit .envs file and make the below changes to enter preferred namespace name and the host selected for installation.

export OT_DS_NAMESPACE=
export OT_DS_HOST= 

Provide the values for the docker registry configuration:

export OT_DOCKER_REGISTRY=
export DOCKER_USER=
export DOCKER_PASSWORD= 

In SELF MANAGED CLUSTER section export CLUSTER_NAME="" should be blank

In WINDOWS CLUSTER section export LOCAL_CLUSTER="false" should be false

Follow the below steps based on the tech stack of the application is being installed, then return to step 5.

Give the values for the Password Encryption:

export IS_ENCRYPTION="false"  

Save the file once the above values are updated.

From the admin portal copy the encryption.jks file from the following folder path …/ k8s-deployment/tools/admin-portal-keystore/keystore, and paste it in encryption dependencies folder (...ds-portal\k8s-deployment\encryption_dependencies)

Navigate to ..../admin_portal/k8s-deployment/_templates/secrets and open config.properties file, copy the following properties:

encrypt.key-store.location=file:/config/encryption_dependencies/encryptKeyStore.jks
encrypt.key-store.password= (get from the application.onprem)
encrypt.key-store.alias=configKey
encrypt.key-store.secret= (same as encrypt.key-store.password)
encrypt.key-store.type=JCEKS

Navigate to the command line terminal (WSL or bash) where we will execute the shell scripts.

Execute installation script by entering ./install_ds_portal.sh encrypt.

Enter docker registry password

Confirm the printed parameters are accurate.

 Do these values look good? (y/n): {Enter "y" if the above enter value is good}

Once the Deployment is done, run the below command:

kubectl get pods -n {namespace}

Get the config pod name, run the below command run the below command to encrypt the password by modifying the value:

kubectl -n {namespace} exec -it {config pod name} -- sh -c "curl http://localhost:8100/encrypt -d {password/secret key to encrypt}"

Encrypt the all the passwords in \ds-portal\k8s-deployment\properties\services\application-onprem.properties file using the command in step 7.

SQL

db.password=

Redis

spring.redis.password=

Encryption placeholders

dsrequest.receipt.jwt.keystore.password=
dsrequest.receipt.jwt.key.password=

Navigate to …/ds-portal/k8s-deployment and create a new folder called inventory

Copy the .envs file from inventory_template folder to newly created inventory folder.

Navigate back to a terminal where we executed the shell scripts.

Change the directory to .../k8s-deployment/

Run the installation script by executing ./install_ds_portal.sh install command. You will be prompted to install any of the required dependencies if they do not exist.

Enter docker registry password

The values updated as part of the .envs file for the cloud selected will be displayed.

Confirm the printed parameters are accurate.

Do these values look good? (y/n): {Enter "y" if the above enter value is good}

In next steps it prints the components to be installed.

Do these values look good? (y/n): {Enter "y" if the above enter value is good}

The installer will create the namespaces/services/deployments in the cluster based on the input values provided.

Check the running pods in the namespace by executing below command:

kubectl get pods -n {namespace}

After all the services are healthy, we need to update the DNS domain name in the selected cloud provider.

Execute the below command to get the public IP address:

kubectl get ingress –n {namespace}

Copy the external IP address of the load balancer type.

Add the DNS entry in the DNS manager for the IP address obtained.

Enter the following URL into your browser: https://hostname/ui/#/error

Once the installation is complete, ensure the portal can be accessed at https://hostname/ui/#/error