Prerequisites

Overview

This document outlines the prerequisites and foundational requirements for deploying Governance Studio. This entails both installing the application workloads to a Kubernetes cluster and configuring the required cloud resources. This guide provides administrators with an overview of the deployment lifecycle, hardware and software prerequisites, and the required infrastructure components.

Deployment architecture

To successfully install the platform, specific infrastructure components must be prepared. The installation is driven from a deployment host that applies configurations to the target Kubernetes cluster.

It is recommended to prepare a dedicated machine to act as the deployment host. This host must have network access to the Kubernetes cluster and the ability to download the deployment Helm package. For troubleshooting purposes, it is recommended that the host also has access to the provisioned cloud resources and the deployed platform components (for example, the ability to query REST APIs using curl or wget).

Governance Studio is deployed using Helm charts. The deployment mechanism connects to the target cluster and applies the Helm configurations. While the guide provides sufficient information, executing this process requires foundational knowledge of kubectl and helm.

The target environment is a Kubernetes cluster (such as Amazon EKS, Microsoft Azure AKS, or Google Cloud GKE) where the Governance Studio microservices operate.

To ensure data persistence, security, and compliance, the platform integrates with external object storage, key management, and a relational database.

Application data is stored in a PostgreSQL database, which can be deployed internally within the Kubernetes cluster or provisioned as an external managed service.

User authentication and access management are delegated to an OIDC/OAuth 2.0 Identity Provider (IdP), which can be an internal service (Keycloak) or an external enterprise provider.

System requirements

A successful deployment requires administrators to provision specific resources and ensure appropriate access permissions are configured. This section details the resources that must be provided before initiating the deployment process.

Recommended requirements for the deployment host

The deployment host serves as the control point for the installation. It is recommended to manage the configuration files required for installation (such as Helm values) through a version control system like git. Cloning a Git repository containing these configurations directly to the deployment host ensures versioning and traceability.

The recommended specifications for the deployment host are detailed below.

Operating system

Red Hat Enterprise Linux (RHEL) 10 is the preferred operating system. RHEL 9 is also supported and suitable if permitted by organizational policies.

Command line tools

Specific administrative tools must be installed on the deployment host:

• helm and kubectl to manage the Kubernetes deployments.
• telnet, curl, or wget for installation validation.
• A command-line text editor, such as vi or nano, for editing configuration files.

Network access

While the platform can be installed in air-gapped environments, standard deployments require network connectivity to several endpoints:

• The designated image registry to pull or download the deployment charts and platform Docker images.
• The target Kubernetes cluster API to execute helm and kubectl commands.
• A secrets management service, such as AWS Secrets Manager, for retrieving credentials. This is optional but highly recommended.

Ensure that appropriate registry credentials are provided to allow the Kubernetes cluster to download the platform container images.

SSL certificates

If the organization utilizes a Private Certificate Authority (CA) to secure internal resources, the necessary trusted root SSL certificates must be pre-installed on the host system. This ensures that tools like curl, helm, and kubectl can establish secure HTTPS connections to registries, APIs, and cloud services without certificate validation errors.

Cloud infrastructure requirements

Governance Studio delegates state (data) management, cryptography, and authentication to cloud infrastructure. Administrators must ensure these resources are provisioned prior to initiating the platform deployment. At a high level, the following infrastructure must be provisioned and accessible from the Kubernetes cluster:

• Kubernetes Cluster: A supported managed Kubernetes environment is required to host the platform workloads.
  • Ingress and DNS: A valid DNS record must point to a configured NGINX Ingress Controller connected to the cluster. This endpoint must be secured with valid TLS certificate(s).
• Relational Database: A PostgreSQL instance is required for application data persistence. This can be deployed as an internal in-cluster service or as an external managed service.
• Key Management Service: A cryptographic service with permissions to create keys and sign payloads must be available to the platform.
• Object Storage: A storage bucket is required for storing Governance Studio artifacts.
• Identity Provider (IdP): An OIDC/OAuth 2.0 provider must be configured with authorized callback and logout URLs. Authentication services can be provided by an external customer-provisioned service, such as Microsoft Entra ID, or by an internal provider (Keycloak).
• Backup Instruments: Enterprise backup and disaster recovery mechanisms must be available to ensure data durability. This typically involves native cloud backup tools, such as AWS Backup, Google Cloud Backup and DR, or Azure Backup, to safeguard the external database and object storage components.

The following table outlines the required infrastructure components across different cloud providers:

Component	Service: AWS	Service: Google Cloud	Service: Azure
Kubernetes Cluster	Amazon EKS	Google Kubernetes Engine (GKE)	Azure Kubernetes Service (AKS)
Object Storage	Amazon S3	Cloud Storage	Azure Blob Storage
Key Management Service	AWS KMS	Cloud KMS	Azure Key Vault
Database	Amazon RDS for PostgreSQL (or internal)	Cloud SQL for PostgreSQL (or internal)	Azure Database for PostgreSQL (or internal)

Conclusion

Deploying Governance Studio is not a one-shot action. Rather, it is a multi-stage process that consists of the following lifecycle phases:

1. Provisioning the Kubernetes cluster.
2. Provisioning the required cloud resources.
3. Granting access permissions from the cluster to the cloud resources.
4. Configuring the Governance Studio platform.
5. Executing the deployment.
6. Installation qualification.

In enterprise environments, deploying Governance Studio typically requires collaboration across multiple functional teams. Generally, the deployment process involves a cloud infrastructure team to provision external resources (such as object storage, key management systems, and databases), an identity and access management (IAM) or security team to configure identity providers and grant access permissions, and a platform administration team to configure and execute the Helm deployment and manage the Kubernetes workloads.