Before you begin the process of deploying Glasswall Halo, ensure that you have the following tools and resources installed and setup.

## System requirements

The following guide has been written assuming it is being run on a Linux shell. If running on a different shell, some of the commands may need to be modified to run.

If running on Windows, please ensure you are using Windows subsystem for Linux.

## Required tools

  * [Helm](https://helm.sh/docs/intro/install/)
  * [Kubectl](https://kubernetes.io/docs/tasks/tools/)
  * [AWS CLI](https://aws.amazon.com/cli/)

## Required AWS resources

### 1. EKS cluster

  * Recommended total of at least 8 vCPU and 32 GB RAM.
  * Minimum node size is 4 vCPU and 16 GB RAM.
  * For production workloads a minimum of 2 nodes is recommended.
  * Make sure the EKS cluster has an IAM OIDC provider.
    * Please refer to [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) to determine if the cluster has an IAM OIDC provider or if you need to create one.
  * In the steps below, the EKS cluster is referred to as: **eksname**


**Note** : Glasswall Halo does not support ARM64 node VMs.

For guidance on creating an EKS cluster please refer to:

  * [Create EKS Cluster - Console](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)
  * [Create EKS Cluster - CLI ](https://docs.aws.amazon.com/cli/latest/reference/eks/create-cluster.html)
  * [AWS Elastic Kubernetes Service - Best Practices](https://aws.github.io/aws-eks-best-practices/)


### 2. EFS

An AWS Elastic File System (EFS) is used to create persistent volumes in EKS.

  * Create the EFS in the same VPC where the EKS is created.

For guidance on creating EFS please refer to:

  * [Create EFS - Console ](https://docs.aws.amazon.com/efs/latest/ug/gs-step-two-create-efs-resources.html)
  * [Create EFS - CLI](https://awscli.amazonaws.com/v2/documentation/API/latest/reference/efs/index.html)

### 3. IAM roles for service accounts

Two IAM roles need to be created for 2 Kubernetes service accounts deployed through the Helm charts. The Amazon Resource Names (ARN) of these roles are required during deployment of the Helm charts.

>- **Role 1:** role-cdrp-efs-csi-`<suffix\>`
>- **Role 2:** role-cdrp-ext-secrets-`<suffix\>`

- This [shell script](/.attachments/create-aws-roles.sh) can be used to create the IAM roles.
- Pass AWS region, EKS cluster name, filesystem ID and suffix as 4 arguments to the script. for e.g.

```bash
bash create-aws-roles.sh eu-west-1 eks-cdrp-dev fs-582a03f3 dev
```
For guidance on creating IAM roles for service accounts, please refer to [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).

### 4. MongoDB database

MongoDB stores Glasswall Halo content management policies and is used by the `cdrplatform-policy-api` service.

- Deploy a DocumentDB instance that is compatible with the MongoDB API.
>- You can skip this step if you do not require the Policy Management API or the Asynchronous API.
- If DocumentDB is not available in AWS GovCloud, use MongoDB Controllers for Kubernetes (MCK) to deploy MongoDB in the EKS cluster.

**Note:** alternatively, MongoDB can be deployed directly within your cluster using the MongoDB Helm charts, as described in [Step 7](/halo/eks-step-7).

## Access to Glasswall Artifact Registry

  * You are provided with a token & token ID to access [Glasswall's Artifact Registry](https://glasswallhub.azurecr.io).
  * This allows you to directly pull container images and Helm charts from your AKS cluster.
  * In the steps below, the token and token ID will be referred to as: **token** and **token_id**.

* * *


<!-- markdownlint-disable MD033 -->
<div class="text--center margin-top--lg" style={{display: 'flex', justifyContent: 'center', gap: '12px'}}>
  <a href="/halo/eks-step-1" class="button button--primary">
    Continue
  </a>

  <a href="https://www.glasswall.com/support" class="button button--primary button--lg">
    Need help?
  </a>
</div>
<!-- markdownlint-disable MD033 -->