Set Up Transporter Network Tunnels using Helm Charts

Deploying the Transporter network tunnel using using Helm charts provides automated and efficient configuration management. Transporter can be deployed in a new or existing cluster environment.

System Architecture

The following diagram displays Kubernetes deployment options.

As displayed, deployment options include encrypting traffic at either the pod or ingress level. You can omit encryption when interacting with both ingress and pod. You can also choose to interact directly with the service and pod without involving ingress.

Resiliency and Redundancy Considerations

• Resiliency: Transporter supports resiliency
• Redundancy: Transporter does not support redundancy. You cannot run multiple Docker Containers of the Transporter and then load balance between them. In addition, you cannot run more than replica sets of more than one pod. Therefore you should monitor the pod

Installation Options

You can install the Helm chart and set configurations through either the Helm install command on CLI or by downloading the Helm chart values.yaml file.

Requirements

Before installing Transporter through either of the two methods outlined above, you must fulfill the following requirements:

• Fulfill the Requirements listed in Manage Transporter (Network Tunnel)
• Open firewall rules before deployment
• Ensure DNS resolution within the environment. Public DNS resolution is not required
• Have Administrator access to your VCS/Terraform Enterprise in order to create a webhook
• Have a Kubernetes/OpenShift cluster (supported versions v1.18 - 1.27)
• Install the Helm client
• Create a Kubernetes resource for TLS secrets containing the certificate and private key when enabling TLS on the Transporter client pod or ingress controller

  EXAMPLE: To create a TLS secret named: transporter-tls from local private.key and public.crt files run: kubectl create secret tls transporter-tls --key private.key --cert public.crt.
• Download the Transporter Client Helm chart: The available image tags are located in the following Docker Hub repository

  To use a specific transporter image tag other than the latest version, uncomment the image.tag and set it to the required tag (for example, 0.0.5).

Install Transporter using the Helm install command in the CLI

1. Retrieve the mandatory Transporter client environment variables required for the Helm chart setup.

   These variables are generated through the Docker deploy setup in the console, as displayed below.

   1. On the Application Security console, select Home > Settings > Network Tunnels.

      

      The Manage Integrations step of the installation wizard is displayed.

      
   2. Select New Transporter.

      The Manage Integrations modal expands to display additional fields.

      
   3. Fill in the provided fields.

      • Transporter Name: The Transporter name serves a dual purpose: it acts as a unique identifier to group and define multiple connections on Prisma Cloud, while also functioning as the ‘Alias’ required for the transporter to successfully connect to the correct customer tenant. This alias is essential, particularly when multiple transporters are configured on the tenant, ensuring seamless and accurate connections. The Transporter name cannot contain spaces
      • Transporter URL: The URL that your firewall or proxies route to the Transporter at the port configured in the Port section
      • Port: The Transporter URL is a proxy URL with a port number you must define. This information will also be used in the Docker files that are configured in Transporter to communicate with Prisma Cloud
      • Prisma Cloud Access Key ID: The Access Key ID generated as part of the Requirements above
      • Prisma Cloud Secret Key: The Secret key generated as part of the Requirements above
      • TLS Certificate path: The path to the TLS certificate in order to use Transporter. Webhooks use the certificate path to integrate with Transporter. Ensure that the path is for the specified Transporter client URL and port
      • TLS Certificate key path: The path to the TLS certificate key. Allows WebSockets to encrypt traffic (communicate over HTTP).
      • Provider Self Signed CA certificate path (Optional): The path for the self-signed CA certificate of your VCS/Terraform Enterprise provider when using self-signed certificates.
      • VPN/Proxy CA certificate path (Optional): The path for the self-signed CA certificate of your VPN/proxy provider when using self-signed certificates, if it differs from the self-signed certificate used by the provider
      • Proxy URL (Optional): The proxy URL, when using a proxy
   4. Select Next.

      The Deploy Client step of the wizard is displayed.

      
   5. Select Using Docker commands from the Run Image field.
   6. Copy and save the environment variables from the Docker Run CLI command field.

      Add applicable values relevant to your deployment to the environment variables that you have retrieved.
   7. Add the commands to your deployment, modifying values as required.
2. Customize your Helm chart by enabling TLS on the pod or by configuring ingress with TLS.

   1. Option #1: Deploy with TLS on the pod

      Run the following commands using the Transporter environment variables generated during the installation procedure above in the directory where you extracted the Helm chart ZIP file:

      ---
      helm install transporter \
          --set transporter.accessKey=<PRISMA_ACCESS_KEY> \
          --set transporter.secretKey=<PRISMA_ACCESS_KEY> \
          --set transporter.serverUrl=<wss_address_provided_by_prisma_cloud> \
          --set transporter.transporterAlias=<transporter_alias_provided_by_prisma_cloud> \
          --set transporter.transporterUrl=transporter.bridgecrew.cloud \
          --set transporter.tls.enabled=true \
          --set transporter.logLevel=info \
          --set "ingress.hosts[0].host=transporter.bridgecrew.cloud" \
          --set "ingress.hosts[0].paths[0].path='\'" \
          --set tls.enabled=true \
          --set tls.secretName="" \
          --set tls.certificate="tls.crt" \
          --set tls.key="tls.key" \
          --set certificateAuthority.enabled=false \
          --set certificateAuthority.socketCa="" \
          --set certificateAuthority.httpsCa="" \
          --set certificateAuthority.secretName="" \
      ---

   2. Option #2: Deploy with Ingress Enabled and TLS Configured on Ingress (Pod TLS Disabled)

      Requirement: Before running the helm install commands below, you must uncomment the ingress.tls section of the values.yaml file.

      Run the following commands with the Transporter environment variables that were generated in step 1 above in the folder where you extracted the Helm chart ZIP file:

      ---
      helm install transporter \
          --set transporter.accessKey=<PRISMA_ACCESS_KEY> \
          --set transporter.secretKey=<PRISMA_ACCESS_KEY> \
          --set transporter.serverUrl=wss://api0-transporter/wss/transporter \
          --set transporter.transporterAlias=transporter-alias \
          --set "transporter.transporterUrl=transporter.bridgecrew.cloud" \
          --set transporter.logLevel=info \
          --set ingress.enabled=true \
          --set "ingress.hosts[0].host=transporter.bridgecrew.cloud" \
          --set "ingress.hosts[0].paths[0].path='\'" \
      ---

3. Modify Kubernetes Service settings as required.

   EXAMPLE: Configure service type and port settings.

   ---
   helm install transporter \
   ..
       --set service.type=LoadBalancer \
       --set service.port=8000 \
   ..
   ---

4. Modify the Resources section as required.

   Requirement: Make sure to uncomment the resources.limits section of the values.yaml before running helm install.

   ---
   helm install transporter \
   ..
       --set resources.requests.cpu=12000m \
       --set resources.requests.memory=12288Mi \
       --set resources.limits.cpu=16000m \
       --set resources.limits.memory=16384Mi \
   ..
   ---

5. Verify successful deployment by inspecting the Transporter logs.

   EXAMPLE:

   

Install Transporter through the values.yaml file

1. Execute steps 1-8 of Install Transporter through Helm install command on CLI above.
2. Configure the following Transporter ENVIRONMENT variables that were generated in step 1 under the transporter section of the values.yaml file:

   • accessKey: The Prisma Cloud access key
   • secretKey: The Prisma Cloud secret key
   • serverUrl: Transporter server URL (for example: wss://api0-transporter/wss/transporter)
   • transporterAlias: The name (alias) that you assign to the Transporter
   • transporterUrl: The URL of the Transporter client that serves as the endpoint for all requests from the VCS/Terraform Enterprise

     The Transporter URL is used by the VCS/Terraform Enterprise to access the transporter client. Ensure that name resolution is enabled on the VCS/Terraform Enterprise side and that it correctly resolves to the Transporter Client (that is, hosts file or DNS record).
3. Customize your Helm chart by enabling TLS on the pod or configuring ingress with TLS.

   1. Option #1: Deploy with TLS on the pod

      Prerequisite: To enable TLS on the Transporter client pod or ingress controller you need to create a TLS secret Kubernetes resource with the certificate and private key.

      EXAMPLE: To create a TLS secret named: transporter-tls from local private.key and public.crt files run: kubectl create secret tls transporter-tls --key private.key --cert public.crt.

      Configure the following settings:

      • Set transporter.tls.enabled: true
      • transporter.tls.secretName: Use the TLS Kubernetes secret’s name
      • transporter.tls.certificate: "tls.crt"
      • transporter.tls.key: "tls.key"
   2. Option #2: Deploy with Ingress Enabled and TLS Configured on Ingress (Pod TLS Disabled)

      Configure the ingress section in the values.yaml as follows:

      • Enable ingress ingress.enabled: true.
      • Modify the host address under ingress.hosts.
      • Enable TLS on ingress:

        • Disable pod level TLS: set transporter.tls.enabled: false
        • Uncomment the ingress.tls section
        • Modify the ingress.tls.secretName with the value of the TLS secret’s name
        • Modify the host address under the ingress.tls section
4. Modify Kubernetes Service settings under the service section of the values.yaml file.

   For example, if you want to switch from using the ClusterIP service type to the LoadBalancer service type, make the necessary changes in the values.yaml file.

   EXAMPLE: Set the service to a different type (LoadBalancer) and port (8000):

   ---
   service:
       port: 8000
       type: LoadBalancer
   ---

5. Modify the resources section to adjust the Kubernetes resource requests and limits according to your specifications. The chart uses the recommended minimum resource requests based on hardware limitations.

   See prerequisites above for hardware limitations.
6. Install the Helm chart: run: helm install transporter in the folder where you extracted the Helm chart ZIP file.
7. Verify successful deployment by inspecting the Transporter logs. Refer to step 5 of Install Transporter using the Helm install command in the CLI above.

Verify Deployment and Connectivity

You can verify that the transporter has been successfully deployed and is connected to your providers through both the Prisma Cloud console and your CLI.

• Prisma Cloud console: In Application Security select Home > Settings > Manage Network Tunnels > Manage Integrations. Select that your Transporter in the Transporter field, and verify connectivity by checking for a displayed message

  
• CLI: To retrieve logs in your Kubernetes environment displaying the establishment of a connection between the Transporter and your provider, run kubectl logs [POD_NAME] -c [CONTAINER_NAME].

Health Check

The health check provides about the VCS/Terraform Enterprise integrations and the most recent connection establishment time. The Transporter runs health checks every hour, and you manually refresh the connection at any time through Prisma Cloud.

For more on health checks see Transporter Health Check.

Enable Logs

Configure logging to capture and store system events, errors, and activities for analysis and troubleshooting purposes through both CLI commands and the values.yaml file. By default, the logging level is set to info. You can customize the logging level by adjusting the logLevel parameter. Example: --set transporter.logLevel=debug.

• CLI commands: To enable logging through CLI commands, add this parameter: --set transporter.logLevel=debug in either step 2 option #1 Deploy with TLS on the pod or option #2 Deploy with Ingress Enabled and TLS Configured on Ingress (Pod TLS Disabled) from the Install Transporter using the Helm install command in the CLI section above
• values.yaml file: Logging values are pre-configured in the values.yaml chart file