Deploy DSPM Sidecars on GCP via Cloud Run - Netskope Technical Documentation

Overview

The Netskope DSPM application (also known as Netskope One DSPM) requires seamless connectivity to scan your data stores. However, as per common security practices, businesses tend to deny proper firewall egress between their internal networks and external applications. Such limitations impact the operational use of Netskope DSPM and reduce the full return value of your subscription.

To overcome this, Netskope DSPM provides a flexible collection architecture consisting of one or many sidecars you can deploy alongside your data stores. These sidecars collect necessary metadata and transfer it to the Netskope DSPM application. Within this central management console, you can take action on insights from across all data stores regardless of where they are hosted.

Prerequisites

Before deploying sidecars, you must have a DLP appliance available in the same network. For prerequisites and deployment instructions, see DSPM Sidecar Administration Overview and Deploy the DLP Appliance for DSPM

Ensure you meet the following requirements:

Netskope DSPM Tenant: You will need a Netskope DSPM-hosted tenant to receive the sidecar-collected metadata.
Required Toolsets: Validate that you are running the latest versions of the following tools in your terminal:
- terraform --version (Ver 1.3.2 or higher)
- gcloud --version (Ver 435.0.1 or equivalent)
DLP Appliance Connectivity: Sidecars require connectivity to a local DLP appliance to perform classification activities using your DLP Profiles and Rules. Before deploying the sidecar, ensure the following:
- A DLP appliance has been deployed and is accessible within the same network where the sidecar will be installed (or in directly connected networks, to avoid additional peering or complex routing).
- The sidecar and DLP appliance must be able to communicate via HTTPS (port 443).
- You have generated or obtained the required REST API v1 Key and License Key.

Architecture

Netskope DSPM uses a flexible architecture where you deploy one or more sidecars alongside your main application. These sidecars connect directly to your data stores to collect samples, which a local DLP appliance then scans. Afterward, the sidecars upload the classification results back to the Netskope DSPM application.

DLP appliance integration is not currently supported for OCI-based sidecar deployments.

A single sidecar can efficiently scan multiple data stores within its installed environment. Although you typically deploy one sidecar per isolated network (such as a VPC or VNet), you can install multiple sidecars to achieve higher scalability and redundancy. In these highly available setups, the Netskope DSPM application automatically load-balances scan operations across all healthy sidecars within a given pool.

The following diagram illustrates the relationship between Netskope DSPM resources and your environment:

Configure Outbound Egress

You can skip this step if the environment where you plan to install the sidecar already has unrestricted public outbound internet access.

Since Netskope hosts and manages the Netskope DSPM application, you must update your firewall or security group settings to allow outbound egress. Configure your allowlist on port 443 using the following group.

Required for Core Connectivity: Add these addresses to ensure the sidecar can communicate with the DSPM platform. Substitute [TENANT] with your actual tenant name:

Address
[TENANT].goskope.com
sidecar-[tenant].goskope.com
netskope-dspm-release.s3.us-west-2.amazonaws.com
995750983908.dkr.ecr.us-west-2.amazonaws.com

Address
`[TENANT].goskope.com`
`sidecar-[tenant].goskope.com`
`netskope-dspm-release.s3.us-west-2.amazonaws.com`
`995750983908.dkr.ecr.us-west-2.amazonaws.com`

Configure Sidecar Pool

To set up the relationship between your sidecars and Netskope DSPM-hosted tenant, you will provide the sidecars with unique authentication tokens generated within our Sidecar Administration UI.

If you already have an existing sidecar pool token to use, you can skip this section. Otherwise, follow these instructions to acquire a new token.

Log in to the Netskope DSPM application.
Go to the Administration > Sidecar menu.
Click Add Sidecar Pool.
On the Details tab, complete the following field:

Field Value
Name Any friendly value to describe the sidecar pool.
Click Save.
Click Copy at the bottom of the Sidecar Authentication Token modal to save the generated token to your clipboard.
Click the X button to exit the modal.

Field	Value
Name	Any friendly value to describe the sidecar pool.

Since you haven’t yet associated this token with a sidecar, the sidecar pool will appear only when you click the Show Inactive Sidecars icon in the upper right, with empty Version, Status, and DLP Status columns for now.

The above-generated token will be used for each individual sidecar within the sidecar pool.

Setting Up Google Cloud Credentials

This step will allow Terraform to create resources on your behalf in your Google Cloud account with the gcloud CLI.

You can skip to the next section if you’re already provisioned Google Cloud credentials for Terraform, for example using a service account.

More information about Terraform authentication is available on the Terraform Registry page for the Google Cloud provider.

At the terminal prompt or command shell type gcloud auth application-default login and complete the authentication from your browser.

You can confirm this step was successful by running the following command:

gcloud auth list

You should see your GCP user account listed in the command’s output.

Setting up the GCP Configuration

Copy the following URL in your browser window to download the requisite Terraform scripts:
```
https://netskope-dspm-release.s3.us-west-2.amazonaws.com/gcp-sidecar-dlp.zip
```
Extract the Netskope DSPM Terraform scripts in your local system folder, which will create a folder named deploy.

Running the Terraform Script

Navigate to the deploy folder created from the extraction above.
From that directory, run the following command to initiate your Terraform environment.
```
terraform init
```
If your initialization is successful, you will see a message like “Terraform has been successfully initialized!”
To validate that you have all the pre-requisites configuration details available for the installation, run the following command
```
terraform plan
```

When prompted, enter the following variables:

If any of these details are not available with you or you receive an error please revisit the Prerequisites section at the start of the document before continuing further.

Variable	Details
region	The Google Cloud region in which you want to launch the container (e.g. `us-west1`
project	The Google Cloud project in which you want to launch the container.
netskope_dspm_host	Your tenant URL minus the protocol. For example, if your tenant is accessed using `https://example.goskope.com`, your value will be `example.goskope.com`.
sidecar_pool_token	An existing sidecar token, or a new one generated in the Register Sidecar Pool section above.

To initiate the Terraform installation, run the following command from the deploy folder.
```
terraform apply
```
- The script will begin and perform the following actions:
  - Prompt you to input. Provide the same set of 6 configuration details in sequence as listed in the table above.
  - Check for errors. In the event an error occurs, follow the on-screen instructions for correcting and resuming.
  - Outputs a resource modification list. To learn more about the resources created by the script, please expand the section below.
  - Prompt you to confirm before executing. To confirm you must type yes.
    
    When the script completes successfully and the GCP resources are provisioned correctly, the output will be similar to the following example.
```
Apply complete! Resources: 1 added, 0 changed, 1 destroyed.

Outputs:

ids = "i-0dc55679d6d318d76"
ssh_ip = [
"XXX.XXX.XXX.XXX",
]
```

Validate Sidecar Connection

When deploying sidecar, you’ll need to ensure that the sidecar has the ability to reach your tenant. Take the following steps to verify the connectivity from the sidecar.

Log in to the Netskope DSPM application.
Go to Administration > Sidecar.
For the sidecar(s) in question, validate that:
- The Version column is populated.
- The Status indicator is green.
- The DLP Status column shows a healthy connection to your DLP appliance.

It may take a few minutes for newly-running sidecars to communicate with the Netskope DSPM application.

If these values do not update, re-check your configuration (sidecar pool token, tenant hostname, network access, and DLP connectivity) and redeploy if needed. For additional troubleshooting guidance, see Troubleshooting DSPM with DLP.

Upgrading Sidecars

You may need to occasionally upgrade your sidecars so they remain compatible with your Netskope DSPM application.

To upgrade your sidecar deployment, simply destroy the previous instance by running the following command from the deploy folder.

terraform destroy

After the container is destroyed, repeat the steps in the Running the Terraform Script section above.

Configure for an SSL Proxy Environment (Optional)

If your organization routes outbound traffic through an SSL proxy, you must perform the following steps to allow your sidecar to communicate with the Netskope DSPM platform.

Use an SSH client to connect to the sidecar’s IP address
In the Helm chart folder, open the values.yaml file.
Add an entry at the bottom of the file for the httpsProxy value eg.
```
httpsProxy: https://192.168.1.17
```
Redeploy the Helm chart

When deployment is complete, your sidecar should immediately begin communicating via the designated proxy.

Next Steps: Link Sidecar to DLP Appliance

After deployment, you must link your newly deployed sidecar to a DLP appliance to enable data classification.

For detailed instructions, see Link a DLP Appliance to a Sidecar Pool.