Deploy DSPM Sidecar on OCI via Terraform

Overview

The Netskope Data Security Posture Management (DSPM) application (also known as Netskope One DSPM) uses sidecars to scan your data stores and send results back to the Netskope DSPM platform. In Oracle Cloud Infrastructure (OCI) environments, you can deploy these sidecars as compute instances using Terraform.

This guide explains how to deploy Netskope DSPM sidecars on OCI via Terraform, validate connectivity, and optionally configure the sidecars to use an HTTPS proxy.

Prerequisites

Ensure you have the following OCI and local environment requirements ready.

OCI Prerequisites:

• DSPM Sidecar Image: You have a Pre-Authenticated Request (PAR) URL for the DSPM OCI Sidecar Image (request from Netskope Support).
• User Permissions: The OCI user performing the deployment must have policies assigned that grant the following permissions:
  • manage instance-family
  • read app-catalog-listing
  • use volume-family
  • use virtual-network-family
• OCI Tenancy and Compartment: An OCI tenancy, compartment, and identity configuration with permissions to create virtual cloud networks (VCNs), subnets, and security lists or network security groups.

Local Environment Prerequisites:

• OCI CLI: You have the OCI command-line interface installed and configured to authenticate with your OCI tenancy using an API key.
• Terraform Environment: Terraform installed and configured to manage resources in your OCI tenancy.

DSPM Prerequisites:

• Netskope DSPM Tenant: Your DSPM tenant hostname (e.g., mytenant.goskope.com).
• Sidecar Pool Token: A generated token from the DSPM console.

Architecture

Netskope DSPM uses a flexible architecture where you deploy one or more sidecars alongside your main application. These sidecars connect directly to your data stores to collect samples, which a local DLP appliance then scans. Afterward, the sidecars upload the classification results back to the Netskope DSPM application.

A single sidecar can efficiently scan multiple data stores within its installed environment. Although you typically deploy one sidecar per isolated network (such as a VPC or VNet), you can install multiple sidecars to achieve higher scalability and redundancy. In these highly available setups, the Netskope DSPM application automatically load-balances scan operations across all healthy sidecars within a given pool.

The following diagram illustrates the relationship between Netskope DSPM resources and your environment:

Configure Outbound Egress

Since Netskope hosts and manages the Netskope DSPM application, you must update your firewall or security group settings to allow outbound egress. Configure your allowlist on port 443 using the following group.

• Required for Core Connectivity: Add these addresses to ensure the sidecar can communicate with the DSPM platform. Substitute [TENANT] with your actual tenant name:

  Address
  [TENANT].goskope.com
  sidecar-[tenant].goskope.com
  netskope-dspm-release.s3.us-west-2.amazonaws.com
  995750983908.dkr.ecr.us-west-2.amazonaws.com

Required for Installation Packages (Temporary): Add these addresses to download the necessary packages during the installation process, if your container or environment needs to pull additional dependencies.

Note: These domains are required only for the initial setup. You can remove them from your allowlist after the sidecars are fully deployed.

• api.snapcraft.io
• dashboard.snapcraft.io
• *.snapcraftcontent.com

Configure Sidecar Pool

To set up the relationship between your sidecars and Netskope DSPM-hosted tenant, you will provide the sidecars with unique authentication tokens generated within our Sidecar Administration UI.

1. Log in to the Netskope DSPM application.

2. Go to the Administration > Sidecar menu.

3. Click Add Sidecar Pool.

4. On the Details tab, complete the following field:

   Field	Value
   Name	Any friendly value to describe the sidecar pool.

5. Click Save.

6. Click Copy at the bottom of the Sidecar Authentication Token modal to save the generated token to your clipboard.

   

7. Click the X button to exit the modal.

Since you haven’t yet associated this token with a sidecar, the sidecar pool will appear only when you click the Show Inactive Sidecars icon in the upper right, with empty Version, Status, and DLP Status columns for now.

Import the Sidecar Image

First, import the custom DSPM Sidecar image into your OCI tenancy so that it is available for deployment.

1. Log in to the Oracle Cloud Console.
2. Go to Compute > Custom Images.
3. Click Import Image.
4. In the Import Image dialog, complete the following fields:
   • Compartment: Choose the compartment where you want the image to reside.
   • Name: Enter a descriptive name for the image.
   • Operating System: Select Ubuntu.
   • Import from: Select Object Storage URL.
   • Object Storage URL: Paste the PAR URL you received from Netskope Support.
   • Image Type: Select OCI.
5. Click Import Image.
6. Wait for the image status to change from “Importing” to “Available” before proceeding.

Plan Your OCI Terraform Deployment

Before you run Terraform, review the key logical values you will need to input during the deployment:

Parameter	Value
region	The name of the region where the sidecar will be deployed (e.g., us-sanjose-1).
compartment_id	The OCID of the compartment where the sidecar will be deployed.
availability_domain	The availability domain where the sidecar will be deployed.
subnet_id	The OCID of the subnet where the sidecar will be deployed.
image_id	The OCID of the DSPM Sidecar image you imported in Step 1.
ssh_public_key_path	The local path to the SSH public key to use for the sidecar instance.
netskope-dspm_host	The host for the Netskope DSPM SaaS instance (e.g., example.goskope.com).
sidecar_token	An existing or newly generated sidecar token from the Netskope UI.

Deploy the Sidecar on OCI via Terraform

Use Terraform to provision the OCI infrastructure and deploy the Netskope DSPM sidecar instance.

1. Download the Terraform scripts from the following URL:
   https://netskope-dspm-release.s3.us-west-2.amazonaws.com/oci-sidecar-dlp.zip
2. Unzip the file and navigate into the extracted folder in your command line interface.
3. Initialize the Terraform environment by running the following command:
   terraform init A success message will appear when the initialization is complete.
4. To validate your configuration and view the planned resources, run the following command:
   terraform plan
5. When prompted, enter the required parameters defined in the planning step above (or define them in your terraform.tfvars file).
6. Begin the deployment by running the apply command:
   terraform apply
7. Terraform will display a list of the resources to be created. Type yes and press Enter to confirm and execute the deployment.
8. Upon successful completion, the script will output the details of the newly created compute instance, such as its OCID, name, and region.

Validate the Sidecar Deployment

After the Terraform deployment finishes, verify that the sidecar instance is running in OCI:

1. In the OCI Console, go to Compute > Instances.
2. Locate the sidecar instance created by your Terraform deployment.
3. Confirm that the instance Lifecycle state is Running.
4. Confirm that the instance is attached to the expected VCN, subnet, and security lists or network security groups.
5. If allowed by your security policies, connect to the instance using SSH and verify that the sidecar services or containers are running.

Validate Sidecar Connection

When deploying sidecar, you’ll need to ensure that the sidecar has the ability to reach your tenant. Take the following steps to verify the connectivity from the sidecar.

1. Log in to the Netskope DSPM application.
2. Go to Administration > Sidecar.
3. For the sidecar(s) in question, validate that:
   • The Version column is populated.
   • The Status indicator is green. 
   • The DLP Status column shows a healthy connection to your DLP appliance.

It may take a few minutes for newly-running sidecars to communicate with the Netskope DSPM application.

Configure for an SSL Proxy Environment (Optional)

If your organization routes outbound traffic through an SSL proxy, configure the sidecar to use a HTTPS proxy. This allows the sidecar to communicate with the Netskope DSPM platform through your designated proxy while still running on OCI.

How you configure the proxy depends on how the Terraform templates set up the instance:

• If Terraform passes environment variables or user data to the sidecar: Set or update the HTTPS_PROXY value in your Terraform variables file or user data template, and then rerun terraform apply.
• If you manage configuration directly on the instance: Set the HTTPS_PROXY environment variable or equivalent configuration on the sidecar instance (for example, in the sidecar service unit or container environment) and restart the sidecar service.

After the proxy configuration is updated, redeploy or restart the sidecar instance so that the new settings take effect. You can verify that the sidecar is healthy under Administration > Sidecar by checking the Status and DLP Status columns.

Rotate Sidecar Tokens

If your security practices require regular token rotation, or your sidecar stops communicating with the Netskope DSPM application due to an invalid token, rotate the sidecar pool token and update the OCI sidecar configuration.

Generate a New Token in Netskope DSPM

Use this procedure to create a new sidecar pool token in the Netskope DSPM console

1. Log in to your Netskope DSPM instance.
2. Go to Administration > Sidecar to open the Sidecar Administration screen.
3. For the sidecar pool registration whose token you want to rotate, click the Generate New Token icon.
4. The Generate New Token modal is displayed. Review the information and click Confirm.
5. Click Copy at the bottom of the modal to save the generated token to your clipboard.
6. Close the modal.

Apply the New Token in OCI

After generating the new token, update your OCI deployment to use it. You can update the sidecar token via Terraform or directly on the instance, depending on how your deployment is configured:

• If deployed via Terraform: Update the SIDECAR_POOL_TOKEN value in your Terraform variables file, run terraform apply, and confirm the changes. Terraform updates the sidecar configuration so that it uses the new token.
• If configured directly on the instance: Update the sidecar configuration on the OCI instance with the new token and restart the sidecar service to apply the change.

After the update, confirm under Administration > Sidecar that the affected sidecar shows healthy Status values.

Upgrade the Sidecars

To upgrade the Netskope DSPM sidecars deployed via OCI Terraform:

1. Obtain the updated Netskope DSPM sidecar image or version information from your Netskope account team.
2. Update the relevant image or version variable in your Terraform configuration to point to the new sidecar version.
3. Run terraform plan to review the planned changes.
4. Run terraform apply to apply the upgrade.
5. In the OCI Console, confirm that the sidecar instance is running with the updated image and that the instance logs do not report errors.
6. In the Netskope DSPM application, go to Administration > Sidecar and verify that:
   • The Version column reflects the updated version.
   • The Status and DLP Status columns show healthy values.