> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/manage-network-tunnel/deploy-transporter-helmcharts.md).
# Set Up Transporter Network Tunnels using Helm Charts
Deploying the Transporter network tunnel using using Helm charts provides automated and efficient configuration management. Transporter can be deployed in a new or existing cluster environment.
## System Architecture
The following diagram displays Kubernetes deployment options.
As displayed, deployment options include encrypting traffic at either the pod or ingress level. You can omit encryption when interacting with both ingress and pod. You can also choose to interact directly with the service and pod without involving ingress.
## Resiliency and Redundancy Considerations
* **Resiliency**: Transporter supports resiliency
* **Redundancy**: Transporter does not support redundancy. You cannot run multiple Docker Containers of the Transporter and then load balance between them. In addition, you cannot run more than replica sets of more than one pod. Therefore you should monitor the pod
## Installation Options
You can install the Helm chart and set configurations through either the Helm install command on CLI or by [downloading](https://bc-helm-charts-153454541801.s3.us-west-2.amazonaws.com/transporter/transporter.zip) the Helm chart `values.yaml` file.
## Requirements
Before installing Transporter through either of the two methods outlined above, you must fulfill the following requirements:
* Fulfill the [Requirements](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/manage-network-tunnel/manage-network-tunnel.md#requirements) listed in [Manage Transporter (Network Tunnel)](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/manage-network-tunnel/manage-network-tunnel.md)
* Open firewall rules before deployment
* Ensure DNS resolution within the environment. Public DNS resolution is not required
* Have Administrator access to your VCS/Terraform Enterprise in order to create a webhook
* Have a Kubernetes/OpenShift cluster (supported versions v1.18 - 1.27)
* Install the [Helm client](https://helm.sh/docs/intro/install/)
* Create a Kubernetes resource for TLS secrets containing the certificate and private key when enabling TLS on the Transporter client pod or ingress controller
EXAMPLE: To create a TLS secret named: **transporter-tls** from local private.key and public.crt files run: `kubectl create secret tls transporter-tls --key private.key --cert public.crt`.
* Download the Transporter Client Helm chart: The available image tags are located in the following [Docker Hub repository](https://hub.docker.com/r/bridgecrew/transporter/tags)
To use a specific transporter image tag other than the latest version, uncomment the `image.tag` and set it to the required tag (for example, 0.0.5).
## Install Transporter using the Helm install command in the CLI
1. Retrieve the mandatory Transporter client environment variables required for the Helm chart setup.
These variables are generated through the Docker deploy setup in the console, as displayed below.
1. On the **Application Security** console, select **Home** > **Settings** > **Network Tunnels**.
The **Manage Integrations** step of the installation wizard is displayed.
2. Select **New Transporter**.
The **Manage Integrations** modal expands to display additional fields.
3. Fill in the provided fields.
* **Transporter Name**: The Transporter name serves a dual purpose: it acts as a unique identifier to group and define multiple connections on Prisma Cloud, while also functioning as the ‘Alias’ required for the transporter to successfully connect to the correct customer tenant. This alias is essential, particularly when multiple transporters are configured on the tenant, ensuring seamless and accurate connections. The Transporter name cannot contain spaces
* **Transporter URL**: The URL that your firewall or proxies route to the Transporter at the port configured in the Port section
* **Port**: The Transporter URL is a proxy URL with a port number you must define. This information will also be used in the Docker files that are configured in Transporter to communicate with Prisma Cloud
* **Prisma Cloud Access Key ID**: The Access Key ID generated as part of the [Requirements](#requirements) above
* **Prisma Cloud Secret Key**: The Secret key generated as part of the [Requirements](#requirements) above
* **TLS Certificate path**: The path to the TLS certificate in order to use Transporter. Webhooks use the certificate path to integrate with Transporter. Ensure that the path is for the specified Transporter client URL and port
* **TLS Certificate key path**: The path to the TLS certificate key. Allows WebSockets to encrypt traffic (communicate over HTTP).
* **Provider Self Signed CA certificate path (Optional)**: The path for the self-signed CA certificate of your VCS/Terraform Enterprise provider when using self-signed certificates.
* **VPN/Proxy CA certificate path (Optional)**: The path for the self-signed CA certificate of your VPN/proxy provider when using self-signed certificates, if it differs from the self-signed certificate used by the provider
* **Proxy URL (Optional)**: The proxy URL, when using a proxy
4. Select **Next**.
The **Deploy Client** step of the wizard is displayed.
5. Select **Using Docker commands** from the **Run Image** field.
6. Copy and save the environment variables from the **Docker Run CLI command** field.
Add applicable values relevant to your deployment to the environment variables that you have retrieved.
7. Add the commands to your deployment, modifying values as required.
2. Customize your Helm chart by enabling TLS on the pod or by configuring ingress with TLS.
1. **Option #1: Deploy with TLS on the pod**
Run the following commands using the Transporter environment variables generated during the installation procedure above in the directory where you extracted the Helm chart ZIP file:
```yml
---
helm install transporter \
--set transporter.accessKey= \
--set transporter.secretKey= \
--set transporter.serverUrl= \
--set transporter.transporterAlias= \
--set transporter.transporterUrl=transporter.bridgecrew.cloud \
--set transporter.tls.enabled=true \
--set transporter.logLevel=info \
--set "ingress.hosts[0].host=transporter.bridgecrew.cloud" \
--set "ingress.hosts[0].paths[0].path='\'" \
--set tls.enabled=true \
--set tls.secretName="" \
--set tls.certificate="tls.crt" \
--set tls.key="tls.key" \
--set certificateAuthority.enabled=false \
--set certificateAuthority.socketCa="" \
--set certificateAuthority.httpsCa="" \
--set certificateAuthority.secretName="" \
---
```
2. **Option #2: Deploy with Ingress Enabled and TLS Configured on Ingress (Pod TLS Disabled)**
Requirement: Before running the `helm install` commands below, you must uncomment the `ingress.tls` section of the `values.yaml` file.
Run the following commands with the Transporter environment variables that were generated in **step 1** above in the folder where you extracted the Helm chart ZIP file:
```yml
---
helm install transporter \
--set transporter.accessKey= \
--set transporter.secretKey= \
--set transporter.serverUrl=wss://api0-transporter/wss/transporter \
--set transporter.transporterAlias=transporter-alias \
--set "transporter.transporterUrl=transporter.bridgecrew.cloud" \
--set transporter.logLevel=info \
--set ingress.enabled=true \
--set "ingress.hosts[0].host=transporter.bridgecrew.cloud" \
--set "ingress.hosts[0].paths[0].path='\'" \
---
```
3. Modify Kubernetes **Service** settings as required.
EXAMPLE: Configure service type and port settings.
```yml
---
helm install transporter \
..
--set service.type=LoadBalancer \
--set service.port=8000 \
..
---
```
4. Modify the **Resources** section as required.
Requirement: Make sure to uncomment the `resources.limits` section of the `values.yaml` before running `helm install`.
```yml
---
helm install transporter \
..
--set resources.requests.cpu=12000m \
--set resources.requests.memory=12288Mi \
--set resources.limits.cpu=16000m \
--set resources.limits.memory=16384Mi \
..
---
```
5. Verify successful deployment by inspecting the Transporter logs.
EXAMPLE:
## Install Transporter through the `values.yaml` file
1. Execute **steps 1-8** of [Install Transporter through Helm install command on CLI](#install-helm-cli) above.
2. Configure the following Transporter ENVIRONMENT variables that were generated in **step 1** under the **transporter** section of the `values.yaml` file:
* **accessKey**: The Prisma Cloud access key
* **secretKey**: The Prisma Cloud secret key
* **serverUrl**: Transporter server URL (for example: wss\://api0-transporter/wss/transporter)
* **transporterAlias**: The name (alias) that you assign to the Transporter
* **transporterUrl**: The URL of the Transporter client that serves as the endpoint for all requests from the VCS/Terraform Enterprise
The Transporter URL is used by the VCS/Terraform Enterprise to access the transporter client. Ensure that name resolution is enabled on the VCS/Terraform Enterprise side and that it correctly resolves to the Transporter Client (that is, hosts file or DNS record).
3. Customize your Helm chart by enabling TLS on the pod or configuring ingress with TLS.
1. **Option #1: Deploy with TLS on the pod**
Prerequisite: To enable TLS on the Transporter client pod or ingress controller you need to create a TLS secret Kubernetes resource with the certificate and private key.
EXAMPLE: To create a TLS secret named: *transporter-tls* from **local private.key** and **public.crt** files run: `kubectl create secret tls transporter-tls --key private.key --cert public.crt`.
Configure the following settings:
* **Set transporter.tls.enabled**: true
* **transporter.tls.secretName**: Use the TLS Kubernetes secret’s name
* **transporter.tls.certificate**: "tls.crt"
* **transporter.tls.key**: "tls.key"
2. **Option #2: Deploy with Ingress Enabled and TLS Configured on Ingress (Pod TLS Disabled)**
Configure the **ingress** section in the `values.yaml` as follows:
* Enable ingress **ingress.enabled**: true.
* Modify the host address under **ingress.hosts**.
* Enable TLS on ingress:
* Disable pod level TLS: set **transporter.tls.enabled**: false
* Uncomment the `ingress.tls` section
* Modify the `ingress.tls.secretName` with the value of the TLS secret’s name
* Modify the host address under the `ingress.tls` section
4. Modify Kubernetes Service settings under the **service** section of the `values.yaml` file.
For example, if you want to switch from using the ClusterIP service type to the LoadBalancer service type, make the necessary changes in the `values.yaml` file.
EXAMPLE: Set the service to a different type (LoadBalancer) and port (8000):
```yml
---
service:
port: 8000
type: LoadBalancer
---
```
5. Modify the **resources** section to adjust the Kubernetes resource requests and limits according to your specifications. The chart uses the recommended minimum resource requests based on hardware limitations.
See prerequisites above for hardware limitations.
6. Install the Helm chart: run: `helm install transporter` in the folder where you extracted the Helm chart ZIP file.
7. Verify successful deployment by inspecting the Transporter logs. Refer to *step 5* of [Install Transporter using the Helm install command in the CLI](#install-helm-cli) above.
## Verify Deployment and Connectivity
You can verify that the transporter has been successfully deployed and is connected to your providers through both the Prisma Cloud console and your CLI.
* **Prisma Cloud console**: In **Application Security** select **Home** > **Settings > Manage Network Tunnels > Manage Integrations**. Select that your Transporter in the **Transporter** field, and verify connectivity by checking for a displayed message
* **CLI**: To retrieve logs in your Kubernetes environment displaying the establishment of a connection between the Transporter and your provider, run `kubectl logs [POD_NAME] -c [CONTAINER_NAME]`.
## Health Check
The health check provides about the VCS/Terraform Enterprise integrations and the most recent connection establishment time. The Transporter runs health checks every hour, and you manually refresh the connection at any time through Prisma Cloud.
For more on health checks see [Transporter Health Check](/content-collections/application-security/manage-network-tunnel/transporter-health-check.md).
## Enable Logs
Configure logging to capture and store system events, errors, and activities for analysis and troubleshooting purposes through both CLI commands and the `values.yaml` file. By default, the logging level is set to `info`. You can customize the logging level by adjusting the `logLevel` parameter. Example: `--set transporter.logLevel=debug`.
* **CLI commands**: To enable logging through CLI commands, add this parameter: `--set transporter.logLevel=debug` in either **step 2** option #1 Deploy with TLS on the pod or option #2 Deploy with Ingress Enabled and TLS Configured on Ingress (Pod TLS Disabled) from the [Install Transporter using the Helm install command in the CLI](#install-helm-cli) section above
* **values.yaml** file: Logging values are pre-configured in the `values.yaml` chart file
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/manage-network-tunnel/deploy-transporter-helmcharts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.