Deploy DSPM Sidecars via Helm

Overview

The Netskope DSPM application (also known as Netskope One DSPM) requires seamless connectivity to scan your Data Stores. However, as per common security practices, businesses tends to deny proper firewall egress between their internal networks and external applications. Such limitations impact the operational use of Netskope DSPM and reduce the full return value of your subscription.

To overcome this, Netskope DSPM provides a flexible collection architecture, consisting of one or many sidecars you deploy alongside your Data Stores. These sidecars collect necessary metadata and transfer it to the Netskope DSPM application. Within this central management console, you can take action on insights from across all Data Stores regardless of where they are hosted.

These instructions explain how to provision all resources necessary for running sidecars within your own Kubernetes cluster. 

Prerequisites

DLP Appliance Connectivity

Sidecars require connectivity to a local DLP appliance to perform classification activities using your DLP Profiles and Rules. Before deploying the sidecar, ensure the following:

• A DLP appliance has been deployed and is accessible within the same network where the sidecar will be installed (or in directly connected networks, to avoid additional peering or complex routing).
• The sidecar and DLP appliance must be able to communicate via HTTPS (port 443).
• You have generated or obtained the required REST API v1 Key and License Key.

Architecture

Netskope DSPM uses a flexible architecture where you deploy one or more sidecars alongside your main application. These sidecars connect directly to your data stores to collect samples, which a local DLP appliance then scans. Afterward, the sidecars upload the classification results back to the Netskope DSPM application.

A single sidecar can efficiently scan multiple data stores within its installed environment. Although you typically deploy one sidecar per isolated network (such as a VPC or VNet), you can install multiple sidecars to achieve higher scalability and redundancy. In these highly available setups, the Netskope DSPM application automatically load-balances scan operations across all healthy sidecars within a given pool.

The following diagram illustrates the relationship between Netskope DSPM resources and your environment:

Configure Outbound Egress

Since Netskope hosts and manages the Netskope DSPM application, you must update your firewall or security group settings to allow outbound egress. Configure your allowlist on port 443 using the following group.

• Required for Core Connectivity: Add these addresses to ensure the sidecar can communicate with the DSPM platform. Substitute [TENANT] with your actual tenant name:

  Address
  [TENANT].goskope.com
  sidecar-[tenant].goskope.com
  netskope-dspm-release.s3.us-west-2.amazonaws.com
  995750983908.dkr.ecr.us-west-2.amazonaws.com

Configure Sidecar Pool

To set up the relationship between your sidecars and Netskope DSPM-hosted tenant, you will provide the sidecars with unique authentication tokens generated within our Sidecar Administration UI.

1. Log in to the Netskope DSPM application.

2. Go to the Administration > Sidecar menu.

3. Click Add Sidecar Pool.

4. On the Details tab, complete the following field:

   Field	Value
   Name	Any friendly value to describe the sidecar pool.

5. Click Save.

6. Click Copy at the bottom of the Sidecar Authentication Token modal to save the generated token to your clipboard.

   

7. Click the X button to exit the modal.

Since you haven’t yet associated this token with a sidecar, the sidecar pool will appear only when you click the Show Inactive Sidecars icon in the upper right, with empty Version, Status, and DLP Status columns for now.

Install Helm Chart

1. Download the correct Helm Chart package from the following URL:

   https://netskope-dspm-release.s3.us-west-2.amazonaws.com/helm-dspm-sidecar-dlp.zip

2. Extract the package contents. 

3. Go to the extracted netskope directory.

4. Run the following command to install Netskope DSPM, substituting the following parameters: 

Note: many deployment parameters can be customized via the command below. We recommend you inspect the contents of the values.yaml file before running this command to familiarize yourself with the deployment parameters and their default values. If you want to change any of the defaults, simply append additional ---set <variable>=<value> flags to the command below.

helm upgrade --install netskope netskope --namespace netskope --create-namespace --values netskope/values.yaml \
--set image.tag=dlp-latest \
--set sidecarName=Netskope-DSPM-Sidecar \
--set image.pullPolicy=Always \
--set daseraMainApplicationHost=... \
--set sidecarPoolToken=... \
--set sidecarCount=... \
--set httpsProxy=...

When the installation is complete, the Helm Chart will display output similar to the following example:

Deployment complete!

Please visit the Sidecar Adminstration page at https://example.goskope.com/platform-settings/sidecar to confirm the sidecars were successfully registered.

Resources Created

Each time it is deployed, the Helm Chart will manage deployment and management of the following:

• One or more pod(s) for individual Netskope DSPM sidecars

You can run the kubectl command to view additional detail on each pod.

Validate Sidecar Connection

When deploying sidecar, you’ll need to ensure that the sidecar has the ability to reach your tenant. Take the following steps to verify the connectivity from the sidecar.

1. Log in to the Netskope DSPM application.
2. Go to Administration > Sidecar.
3. For the sidecar(s) in question, validate that:
   • The Version column is populated.
   • The Status indicator is green. 
   • The DLP Status column shows a healthy connection to your DLP appliance.

It may take a few minutes for newly-running sidecars to communicate with the Netskope DSPM application.

Upgrading Sidecars

You may need to occasionally upgrade your sidecars so they remain compatible with your Netskope DSPM application instance or tenant.

To upgrade sidecars that were deployed via Helm, you must redeploy the Helm chart using the instructions within the Install Helm Chart section above.

Configure for an SSL Proxy Environment (Optional)

If your organization routes outbound traffic through an SSL proxy, you must perform the following steps to allow your sidecar to communicate with the Netskope DSPM platform.

1. Use an SSH client to connect to the sidecar’s IP address

2. In the Helm chart folder, open the values.yaml file.

3. Add an entry at the bottom of the file for the httpsProxy value eg.

   httpsProxy: https://192.168.1.17

4. Redeploy the Helm chart

When deployment is complete, your sidecar should immediately begin communicating via the designated proxy.

Next Steps: Link Sidecar to DLP Appliance

After deployment, you must link your newly deployed sidecar to a DLP appliance to enable data classification.

For detailed instructions, see Link a DLP Appliance to a Sidecar Pool.