Set Up Transporter Network Tunnels using Docker Containers
Deploy the Transporter network tunnel using Docker containers.
Before you begin.
Fulfill the Requirements listed in Manage Transporter (Network Tunnel).
Install Docker. The Transporter Client requires Docker to be installed in your environment with network access to your self-hosted provider, such as your VCS or Terraform Enterprise (Run Tasks).
Proxy: If you are using a proxy, refer to Docker Proxy Integration below for details on proxy connectivity.
Self-signed certificates: As mentioned in Requirements for setting up the Transporter, you must provide the Transporter with a TLS certificate to ensure a secure webhook connection between your version control system and the Transporter. If you are using a self-signed certificate, add a TLS CA certificate environment variables and configure the HTTPS_CA variable. Refer to Self-Signed Certificates below for more information.
On the Application Security console, select Home > Settings > Network Tunnels.
The Manage Integrations step of the installation wizard is displayed.
Fill in the provided fields.
Transporter Name: The Transporter name serves a dual purpose: it acts as a unique identifier to group and define multiple connections on Prisma Cloud, while also functioning as the ‘Alias’ required for the transporter to successfully connect to the correct customer tenant. This alias is essential, particularly when multiple transporters are configured on the tenant, ensuring seamless and accurate connections. The Transporter name cannot contain spaces
Transporter URL: The URL that your firewall or proxies route to the Transporter at the port configured in the Port section
Port: The Transporter URL is a proxy URL with a port number you must define. This information will also be used in the Docker files that are configured in Transporter to communicate with Prisma Cloud
Prisma Cloud Access Key ID: The Access Key ID generated in step 1 above
Prisma Cloud Secret Key: The Secret key generated in step 1 above
TLS Certificate path: The path to the TLS certificate in order to use Transporter. Webhooks use the certificate path to integrate with Transporter. Ensure that the path is for the specified Transporter client URL and port
TLS Certificate key path: The path to the TLS certificate key. Allows WebSockets to encrypt traffic (communicate over HTTP).
Provider Self Signed CA certificate path (Optional): The path for the self-signed CA certificate of your VCS/Terraform Enterprise provider when using self-signed certificates.
VPN/Proxy CA certificate path (Optional): The path for the self-signed CA certificate of your VPN/proxy provider when using self-signed certificates, if it differs from the self-signed certificate used by the provider
Proxy URL (Optional): The proxy URL, when using a proxy
Select Next.
The Deploy Client step of the wizard is displayed.
Copy the command from the Verify and add permissions for set TLS Certificate path field, and run it in your CLI terminal.
This command sets the permissions for the TLS certificate and defines the local path to the certificate. .. Pull the Docker image: Copy the command from the Docker pull CLI field and run it in your CLI terminal.
Select Using Docker commands or Docker compose from the Run Image field to run the image and establish communication between Prisma Cloud and your self-hosted VCS/Terraform Enterprise.
Option #1: Run Image through Docker Commands
Use Docker commands to create a Docker image that contains the code and configuration for establishing communication between Prisma Cloud and your self-hosted VCS/Terraform Enterprise. Then run this image using Docker commands.
Copy and paste the command from the Logs volume command in your terminal to save the Docker logs as a dedicated volume.
Copy and paste the command from the Docker Run CLI command in your terminal to run the pulled Docker image.
Enable debug level logs: Add the
-e LOG_LEVEL=info \environment variable to the list of variables in the Docker Run CLI Command field.
Option #2: Run Image through Docker Compose
Use Docker compose to define a Docker application that contains the code and configuration for establishing communication between Prisma Cloud and your self-hosted VCS/Terraform Enterprise. Then run this application using Docker compose.
Copy and paste the content from the Docker Compose Content field into your file to create and save docker-compose file content that you can use later.
Copy and paste the command from the Docker-Compose CLI Command field in your CLI terminal to run the 'docker-compose' command.
Enable debug level logs: Add the
- LOG_LEVEL=infoenvironment variable to the list of variables in the Docker Compose Content field .The
-dvalue in the command specifies the name of the Docker Compose yml file.
Select Next > Done to complete the integration.
Only after the Transporter has run successfully can Prisma Cloud authenticate and establish a communication channel with your provider (such as VCS/Terraform Enterprise). Once the connection is established, Transporter will use WebSockets to communicate with each other.
Next Step: Select the Transporter that will act as the secure communication channel between the hosted Docker Client and Prisma Cloud.
Refer to Select Transporter and ensure Domain name consistency during Integration for more information.
Verify Deployment and Connectivity
You can verify that the transporter has been successfully deployed and is connected to your providers through both the Prisma Cloud console and your CLI.
On Prisma Cloud console: In Application Security select Home > Settings > Manage Network Tunnels > Manage Integrations. Select that your Transporter in the Transporter field, and verify connectivity by checking for a displayed message
Using your CLI: Run
docker logs [CONTAINER ID]
Add Additional Transporters
You can add a new Transporter to a VCS/ Terraform Enterprise integration in Application Security through Home > Settings > Manage Network Tunnels > Manage Integrations > New Transporter, and repeating the deployment steps above.
Manage Transporter
You can manage the existing Transporter configuration in Application Security through Home > Settings > Manage Network Tunnels > Manage Integrations.
Edit Transporter: Select a Transporter from the menu in the Transporter field > Edit required the values in the same manner as the integration process above
Delete Transporter: Select a Transporter from the menu in the Transporter field > Click Delete Transporter.
To delete the Transporter, you need to first remove the existing VCS/Terraform Enterprise integrations associated with it.
Health Check
The health check provides about the VCS/Terraform Enterprise integrations and the most recent connection establishment time. The Transporter runs health checks every hour, and you manually refresh the connection at any time through Prisma Cloud.
For more on health checks see Transporter Health Check.
Enable Logs
Configure logging to capture and store system events, errors, and activities for analysis and troubleshooting purposes by adding an environment variable. By default, set the logging level to info. You can adjust the logLevel parameter. Examples: -e LOG_LEVEL=debug, - LOG_LEVEL=debug.
See steps 4.1, 4.2 of the deployment setup above to enable logging configuration options.
Self Signed Certificates
Ensure the security of your Transporter Client when using self-signed certificates, by adding TLS CA Certificate environment variables, and configuring the HTTPS_CA variable.
Adding TLS CA Certificate Environment Variables
To enhance security and enable TLS configuration for your Transporter Client, consider including Certificate Authority (CA) certificates.
Configure TLS with HTTPS_CA Variable
When using a self-signed certificate for your Transporter Client, which is a common practice for internal or non-public systems, add the CA certificate that signed your self-signed certificate to the HTTPS_CA environment variable. This step ensures that your VCS/Terraform Enterprise system can verify the domain’s identity and establish a secure connection using HTTPS, even with self-signed certificates. It is a way to establish trust for your self-signed certificate within your environment.
HTTPS_SOCKET_CA
Configure Environment Variable for TLS Proxy (HTTPS_SOCKET_CA)
When working with a TLS termination proxy in a proxy or VPN, configure the 'HTTPS_SOCKET_CA' environment variable with the appropriate CA certificate. This ensures secure TLS communication with properly authenticated endpoints during the TLS handshake process.
This variable is required when the CA certificate used by the proxy differs from the CA certificate used by the Transporter Client (refer to the section above).
HTTPS_SOCKET_CA (TLS Termination Proxy CA)
Docker Proxy Connectivity
Using a proxy enhances security and network efficiency by enabling the establishment of a secure and isolated communication channel between the Prisma Cloud service and your self-hosted version control system, such as GitLab Self Managed or GitHub Server.
The following diagram displays system architecture for proxy connectivity in a Docker Container environment.
NOTES:
In the first diagram the connection between the VCS and Transporter Client does not pass through the firewall, while in the second diagram, the connectivity between the VCS and Transporter Client passes through a firewall
The Connectivity legend for the proxy matches with the legend Transporter connectivity above, except that traffic passes through the firewall from the Transporter Client to the Proxy, and then to the Prisma Cloud Tenant
Configure Proxy Server and Certificate Authority (CA)
Organizations using a proxy server to enhance network security can define the proxy settings using environment variables. To ensure security and integrity, configuring the Certificate Authority (CA) for the proxy is very important.
Configure System Environment Variable
Set up a proxy in your system environment using the following environment variable. HTTPS_PROXY=http://proxy.domain.com:8080.
Configure Container Environment Variable
For containerized environments, configure the following environment variable: docker run -e PORT=8080 -e HTTPS_PROXY=http://proxy.domain.com:8080 bridgecrew/transporter.
Configure Environment Variable for TLS Proxy (HTTPS_SOCKET_CA)
When working with a TLS termination proxy in a proxy or VPN, configure the HTTPS_SOCKET_CA environment variable with the appropriate CA certificate. This ensures secure TLS communication with properly authenticated endpoints during the TLS handshake process.
HTTPS_SOCKET_CA (TLS Termination Proxy CA)
Last updated
Was this helpful?