Private Cloud Installation (AWS)

This guide walks you through the installation of Pangea Private Cloud services, enabling you to run Pangea AI security solutions within your cloud environment.

Overview of Pangea Private Cloud installation process

Install the Pangea Private Cloud Operator using Helm.
Deploy a PostgreSQL database for service data.
Install the PangeaCluster resource to deploy Pangea services and UI.
Verify that all services are running and healthy.
Update the deployment to enable additional services as needed.
Monitor, scale, and maintain the deployment.

Install Pangea Cluster Operator

Pangea services are deployed and managed using the Pangea Private Cloud Operator. The operator includes a Custom Resource Definition (CRD) for the PangeaCluster resource, automating the installation, configuration, scaling, and lifecycle management of Pangea services within your Kubernetes cluster.

Set up namespace

Create a dedicated namespace for the operator. Optionally, you can set this namespace as the default for your current context.

Create and set a namespace
kubectl create namespace pangea-private-cloud-operator
kubectl config set-context --current --namespace pangea-private-cloud-operator

Create Kubernetes secret for Pangea registry

Use your Pangea's private OCI registry credentials to create a Kubernetes secret for pulling Docker images. For example:

Export registry credentials
export PANGEA_REGISTRY_USERNAME="psa_txznaa3f6f7y2sstcrtzvf7pp6yi34is"
export PANGEA_REGISTRY_PASSWORD="pck_ol74sv...74d44p"

Create a Kubernetes secret for the Pangea registry
kubectl create secret docker-registry pangea-registry \
  --docker-server="registry.pangea.cloud" \
  --docker-username="$PANGEA_REGISTRY_USERNAME" \
  --docker-password="$PANGEA_REGISTRY_PASSWORD" \
  --namespace pangea-private-cloud-operator \
  --dry-run=client -o yaml | kubectl apply -f -

Install operator

Install the Pangea Private Cloud Operator in its namespace using a Helm chart from the Pangea registry.

In your custom Helm values file, specify the image pull secret:

my-values.yaml
image:
  imagePullSecrets:
    - name: pangea-registry

Install the operator using Helm, referencing your custom values file:

Sign in to the Pangea registry
helm registry login registry.pangea.cloud \
--username "$PANGEA_REGISTRY_USERNAME" \
--password-stdin <<< "$PANGEA_REGISTRY_PASSWORD"

Install Pangea Private Cloud Operator
helm install pangea-cluster-operator \
oci://registry.pangea.cloud/private-cloud/charts \
--values "my-values.yaml" \
--namespace pangea-private-cloud-operator \
--version 0.8.7

Verify operator installation
kubectl get all --namespace pangea-private-cloud-operator

Example output
NAME                                                     READY   STATUS    RESTARTS   AGE
pod/pangea-cluster-operator-controller-5676f8894-4f2z8   1/1     Running   0          79s

NAME                                                                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
service/pangea-cluster-operator-controller-manager-metrics-service   ClusterIP   172.20.99.156   <none>        8443/TCP   79s

NAME                                                 READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/pangea-cluster-operator-controller   1/1     1            1           79s

NAME                                                           DESIRED   CURRENT   READY   AGE
replicaset.apps/pangea-cluster-operator-controller-5676f8894   1         1         1       79s

Deploy Pangea services

After installing the operator, deploy Pangea services and UI by creating a PangeaCluster resource.

Set up namespace

Create a dedicated namespace for your Pangea Private Cloud deployment. Optionally, you can set this namespace as the default for your current context.

Create and set a namespace
kubectl create namespace pangea-private-cloud
kubectl config set-context --current --namespace pangea-private-cloud

Create Kubernetes secret for Pangea registry

Use your Pangea's private OCI registry credentials to create a Kubernetes secret for pulling Docker images. For example:

Export registry credentials
export PANGEA_REGISTRY_USERNAME="psa_txznaa3f6f7y2sstcrtzvf7pp6yi34is"
export PANGEA_REGISTRY_PASSWORD="pck_ol74sv...74d44p"

Create a Kubernetes secret for the Pangea registry
kubectl create secret docker-registry pangea-registry \
  --docker-server="registry.pangea.cloud" \
  --docker-username="$PANGEA_REGISTRY_USERNAME" \
  --docker-password="$PANGEA_REGISTRY_PASSWORD" \
  --namespace pangea-private-cloud \
  --dry-run=client -o yaml | kubectl apply -f -

Deploy database

Pangea services require a PostgreSQL database to store user data, authentication records, authorization policies, and other service-related information.

The example below shows a sample PostgreSQL deployment configuration.

Set database credentials
export DB_USERNAME="pangea_user"
export DB_PASSWORD="pangea_user"

Create a Kubernetes secret for the database credentials
kubectl create secret generic db-secret \
  --from-literal=username="$DB_USERNAME" \
  --from-literal=password="$DB_PASSWORD" \
  --namespace pangea-private-cloud

postgres.yaml - PostgreSQL StatefulSet and Service
apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-initdb
  namespace: pangea-private-cloud
data:
  init-databases.sql: |
    CREATE DATABASE authn           OWNER pangea_user;
    CREATE DATABASE authz           OWNER pangea_user;
    CREATE DATABASE embargo         OWNER pangea_user;
    CREATE DATABASE msf             OWNER pangea_user;
    CREATE DATABASE gateway         OWNER pangea_user;
    CREATE DATABASE hotpg           OWNER pangea_user;
    CREATE DATABASE puc             OWNER pangea_user;
    CREATE DATABASE bmserviceglobal OWNER pangea_user;
    CREATE DATABASE vault           OWNER pangea_user;
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  namespace: pangea-private-cloud
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: docker.io/pgvector/pgvector:pg16
          env:
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: db-secret
                  key: username
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-secret
                  key: password
            - name: PGDATA
              value: /var/lib/postgresql/data
          ports:
            - containerPort: 5432
          volumeMounts:
            - name: postgres-storage
              mountPath: /var/lib/postgresql
            - name: initdb
              mountPath: /docker-entrypoint-initdb.d
      volumes:
        - name: initdb
          configMap:
            name: postgres-initdb
  volumeClaimTemplates:
    - metadata:
        name: postgres-storage
      spec:
        storageClassName: pangea-private-cloud-storage
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: pangea-private-cloud
spec:
  type: ClusterIP
  ports:
    - port: 5432
      targetPort: 5432
  selector:
    app: postgres

Deploy PostgreSQL
kubectl apply --filename postgres.yaml --namespace pangea-private-cloud

Deploy PangeaCluster

Create a PangeaCluster custom resource to define and deploy Pangea services and the UI. Required services are enabled by default, and you can configure additional services based on your use case.

Required services

authn - AuthN enables user and service-to-service authentication.
gateway - Acts as the entry point for requests, routing them to the appropriate services.
access - Manages access control to platform resources.
authz - AuthZ provides authorization services to determine whether a user or system can perform specific actions.
bmservice - Manages metering for usage tracking.
puc-service - Powers service configuration through the Pangea User Console (PUC).
console - Hosts the Pangea User Console, providing a UI for managing and monitoring services.
vault - Vault securely stores and manages secrets, tokens, and encryption keys, and provides API-based access to them.
audit - Secure Audit Log records a tamperproof audit trail of application and service events.
note
Secure Audit Log integrates with other services to provide Activity Log functionality. The following services have Activity Log enabled by default:
- AI Guard
- Prompt Guard
- AuthN
- AuthZ
- Vault

Additional services

The following security services can be added to Private Cloud deployments:

ai-guard - AI Guard protects data and interactions with LLMs by blocking malicious prompts and safeguarding sensitive information.
prompt-guard - Prompt Guard detects prompt injection and jailbreak attempts in AI applications. This service integrates with AI Guard.
redact - Redact removes sensitive information such as PII and confidential data from text. This service integrates with AI Guard.
embargo - Embargo restricts access to resources based on country or region.
intelligence - Detects malicious entities and data using threat intelligence feeds from major providers:

Example PangeaCluster manifest

Define the Pangea services for your Private Cloud deployment in the services field of the PangeaCluster manifest. The example below shows a configuration for deploying services that secure AI-powered application flows.

pangea-cluster.yaml - PangeaCluster custom resource
apiVersion: cluster.pangea.cloud/v1beta1
kind: PangeaCluster
metadata:
  name: pangea-cluster
  namespace: pangea-private-cloud
  labels:
    reconcile: "true"
spec:
  version: 0.8.7
  common:
    image:
      registry: registry.pangea.cloud
      tag: 0.8.7
    database:
      host: postgres.pangea-private-cloud.svc.cluster.local
      port: 5432
      name: msf
      auth:
        usernameSecretRef:
          name: db-secret
          key: username
        passwordSecretRef:
          name: db-secret
          key: password
    csp:
      bucket_name: pangea-private-cloud-bucket
  imagePullSecrets:
    - name: pangea-registry
  services:
    authn:
      enabled: true
    gateway:
      enabled: true
    access:
      enabled: true
    authz:
      enabled: true
    bmservice:
      enabled: true
    puc-service:
      enabled: true
      database:
        name: puc
    console:
      enabled: true
    vault:
      enabled: true
    audit:
      enabled: true
      database:
        name: hotpg
    ai-guard:
      enabled: true
      resources:
        limits:
          cpu: 750m
          memory: 7Gi
        requests:
          cpu: 250m
          memory: 5Gi
      startupProbe:
        initialDelaySeconds: 1
        failureThreshold: 30
        periodSeconds: 20
        successThreshold: 1
        timeoutSeconds: 1
    prompt-guard:
      enabled: true
      resources:
        limits:
          cpu: 1000m
          memory: 7Gi
        requests:
          cpu: 1000m
          memory: 5Gi
      startupProbe:
        initialDelaySeconds: 1
        failureThreshold: 30
        periodSeconds: 20
        successThreshold: 1
        timeoutSeconds: 1
    redact:
      enabled: true
      resources:
        limits:
          cpu: 1000m
          memory: 6Gi
        requests:
          cpu: 1000m
          memory: 3Gi
      startupProbe:
        initialDelaySeconds: 1
        failureThreshold: 30
        periodSeconds: 20
        successThreshold: 1
        timeoutSeconds: 1

kubectl apply --filename pangea-cluster.yaml

note

AI Guard, Prompt Guard, and Redact are resource-intensive services that may require special configuration for reliable performance. These services support AI security use cases and typically require higher CPU and memory allocations than other Pangea services.

Updating PangeaCluster deployment

To add services to an existing deployment, update the services field in the PangeaCluster manifest and reapply the configuration.

pangea-cluster.yaml - Add Pangea services
  ...
  services:
    ...
    embargo:
      enabled: true
    intelligence:
      enabled: true

Update PangeaCluster with additional services
kubectl apply -f pangea-cluster.yaml

Verify deployment

Use Pangea support tool

Check the health of your deployment using the Pangea support tool:

Download the script and make it executable.

curl -sS https://registry.pangea.cloud/help.sh > help.sh
chmod 755 help.sh

Verify the script's integrity using the checksum provided by Pangea.
Example checksum file
```
b3ee79308adacca97fd03b43c59d7d926d1fddec96dc41a97025496972e52f0e  help.sh
```
Verify the script's integrity using the checksum received from Pangea
```
sha256sum --check help.sh.sha256
```
If the output is help.sh: OK, run the tool.
Execute the Pangea support tool
```
./help.sh
```

note

To run the support tool without verification, you can pipe the script directly into your shell:

Run Pangea support tool without verification
curl -sS https://registry.pangea.cloud/help.sh | sh

The script lists operators, clusters, databases, statuses, and service‑health details.

Example output of the Pangea support tool
k8s context  : arn:aws:eks:us-west-2:180197846871:cluster/dev
tool version : 0.1.2
==
OPERATORS
=========
deploy/private-cloud-operator-controller in pangea-private-cloud-operator
  wants 1 replica(s)
    controller-manager registry.pangea.cloud/private-cloud/operator:0.8.7 Always
      has
        pod/private-cloud-operator-controller-665bd75499-2856l
          registry.pangea.cloud/private-cloud/operator:0.8.7 / registry.pangea.cloud/private-cloud/operator@sha256:99268bb25e29fac7132ed5c32e5352fbf5e2440ea27559ce52c941ebaadcb486

CLUSTERS
========
crd/pangeaclusters.cluster.pangea.cloud:
  pangea-cluster in pangea-private-cloud
database
  user db-secret/username
  pass db-secret/password
  postgres.pangea-private-cloud.svc.cluster.local:5432/msf

status:        : poi_u4vgabiakr5ufjtt2wytiepmkpjm4dgd Ready
service images : registry.pangea.cloud/private-cloud 0.8.7
version        : 0.8.7

services
  access          okay
  ai-guard        okay
  audit           okay
  authn           okay
  authz           okay
  bmservice       okay
  embargo         okay
  gateway         UNHEALTHY
request_id: prq_lktoga5jg6drzmylgtonz675kgufofvh
request_time: "2025-07-01T00:17:52.367353Z"
response_time: "2025-07-01T00:17:52.367542Z"
status: NotFound
summary: Resource was not found
result: null
  puc-service     okay
  redact          okay
  vault           okay
crd/pangeaclusters.prashant.pangea.cloud:
konstantin.lapine@Konstantins-MacBook-Pro-2 pangea-cyber-playground % curl -sS https://registry.pangea.cloud/help.sh | sh
k8s context  : arn:aws:eks:us-west-2:180197846871:cluster/dev
tool version : 0.1.2
==
OPERATORS
=========
deploy/private-cloud-operator-controller in pangea-private-cloud-operator
  wants 1 replica(s)
    controller-manager registry.pangea.cloud/private-cloud/operator:0.8.7 Always
      has
        pod/private-cloud-operator-controller-665bd75499-2856l
          registry.pangea.cloud/private-cloud/operator:0.8.7 / registry.pangea.cloud/private-cloud/operator@sha256:99268bb25e29fac7132ed5c32e5352fbf5e2440ea27559ce52c941ebaadcb486

CLUSTERS
========
crd/pangeaclusters.cluster.pangea.cloud:
  pangea-cluster in pangea-private-cloud
database
  user db-secret/username
  pass db-secret/password
  postgres.pangea-private-cloud.svc.cluster.local:5432/msf

status:        : poi_u4vgabiakr5ufjtt2wytiepmkpjm4dgd Ready
service images : registry.pangea.cloud/private-cloud 0.8.7
version        : 0.8.7

services
  access          okay
  ai-guard        okay
  audit           okay
  authn           okay
  authz           okay
  bmservice       okay
  embargo         okay
  gateway         UNHEALTHY
request_id: prq_7j2balmiyrwa24ew6hpr7f7yx4wl6kgo
request_time: "2025-07-01T00:45:09.192877Z"
response_time: "2025-07-01T00:45:09.193053Z"
status: NotFound
summary: Resource was not found
result: null
  puc-service     okay
  redact          okay
  vault           okay

If you see any issues with the deployment or service health, proceed to the Troubleshooting section.

Open admin console

To access the Pangea User Console and service APIs, forward a local port to the pangea-cluster-console service. Both the UI and API traffic are routed through this gateway endpoint.

Forward local port to the Pangea User Console
kubectl port-forward services/pangea-cluster-console 8000:8000 --namespace pangea-private-cloud

Open your browser and navigate to http://localhost:8000 . When prompted, sign up and create your organization and first project.

On the Console home page, click a service in the left-hand navigation to activate it. Follow the prompts and accept the default settings for quick setup.

On the service Overview page, note the configuration details, including the default token. You can use this information to test the service APIs.

Try service APIs

The example below shows how to use the Secure Audit Log service to capture application events.

Set environment variables
export PANGEA_AUDIT_TOKEN="pts_zabthp...hteya3"

Test API request to the Secure Audit Log service
curl -sSLX POST 'localhost:8000/api/audit/v1/log' \
-H "Authorization: Bearer $PANGEA_AUDIT_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
  "event": {
    "message": "I am a test log message"
  }
}'

Example output
{
  "request_id": "prq_5xjv6u6ayd3hux64vcuj5f4b6cyfhwmg",
  "status": "Success",
  "summary": "Logged 1 record(s)",
  "result": {
    "hash": "8ab152cf05f5f722b8ca6ca84b35e70abc0e010ca059ef428c2914c1eda27ec2"
  },
  ...
}

You can view the logged event in the Pangea User Console under View Logs on the Secure Audit Log service page.

Troubleshooting

Check status of PangeaCluster resources

Check status of deployed resources
kubectl get all,pvc,secrets --namespace pangea-private-cloud

Example output
kubectl get all,pvc,secrets
NAME                                              READY   STATUS             RESTARTS          AGE
pod/pangea-cluster-access-585699db57-zcct6        1/1     Running            0                 16h
pod/pangea-cluster-ai-guard-b94f4f976-rkbjz       1/1     Running            0                 16h
pod/pangea-cluster-audit-7dbdddd56-l4pjc          1/1     Running            0                 16h
pod/pangea-cluster-authn-65d798984f-4bnnw         1/1     Running            0                 16h
pod/pangea-cluster-authz-6fdfd647b9-vwhtn         1/1     Running            0                 16h
pod/pangea-cluster-bootstrap-ui-authn-h9mm7       0/1     Completed          0                 16h
pod/pangea-cluster-console-66fdf79c7b-jljzw       1/1     Running            0                 16h
pod/pangea-cluster-embargo-5654b6cfb8-twrgj       0/1     CrashLoopBackOff   128 (3m13s ago)   10h
pod/pangea-cluster-gateway-594df449bc-fl5c6       1/1     Running            0                 16h
pod/pangea-cluster-migrate-authn-pqnmx            0/1     Completed          0                 16h
pod/pangea-cluster-migrate-authz-pds97            0/1     Completed          0                 16h
pod/pangea-cluster-migrate-embargo-njpvz          0/1     Completed          0                 10h
pod/pangea-cluster-migrate-gateway-pp568          0/1     Completed          0                 16h
pod/pangea-cluster-migrate-puc-service-l9jxl      0/1     Completed          0                 16h
pod/pangea-cluster-publish-ai-guard-5r9sp         0/1     Completed          0                 16h
pod/pangea-cluster-publish-audit-q28cn            0/1     Completed          0                 16h
pod/pangea-cluster-publish-authz-4vpm6            0/1     Completed          0                 16h
pod/pangea-cluster-puc-service-7dc48cc55b-ggqg7   1/1     Running            0                 16h
pod/postgres-0                                    1/1     Running            0                 54m

NAME                                 TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
service/pangea-cluster-access        ClusterIP   172.20.233.4     <none>        8000/TCP,8001/TCP   16h
service/pangea-cluster-ai-guard      ClusterIP   172.20.233.210   <none>        8000/TCP            16h
service/pangea-cluster-audit         ClusterIP   172.20.190.129   <none>        8000/TCP            16h
service/pangea-cluster-authn         ClusterIP   172.20.204.46    <none>        8000/TCP,8001/TCP   16h
service/pangea-cluster-authz         ClusterIP   172.20.171.100   <none>        8000/TCP            16h
service/pangea-cluster-console       ClusterIP   172.20.218.247   <none>        8000/TCP            16h
service/pangea-cluster-gateway       ClusterIP   172.20.135.178   <none>        8000/TCP,8001/TCP   16h
service/pangea-cluster-puc-service   ClusterIP   172.20.249.250   <none>        8000/TCP            16h
service/postgres                     ClusterIP   172.20.93.66     <none>        5432/TCP            9d

NAME                                         READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/pangea-cluster-access        1/1     1            1           16h
deployment.apps/pangea-cluster-ai-guard      1/1     1            1           16h
deployment.apps/pangea-cluster-audit         1/1     1            1           16h
deployment.apps/pangea-cluster-authn         1/1     1            1           16h
deployment.apps/pangea-cluster-authz         1/1     1            1           16h
deployment.apps/pangea-cluster-console       1/1     1            1           16h
deployment.apps/pangea-cluster-embargo       0/1     1            0           10h
deployment.apps/pangea-cluster-gateway       1/1     1            1           16h
deployment.apps/pangea-cluster-puc-service   1/1     1            1           16h

NAME                                                    DESIRED   CURRENT   READY   AGE
replicaset.apps/pangea-cluster-access-585699db57        1         1         1       16h
replicaset.apps/pangea-cluster-ai-guard-b94f4f976       1         1         1       16h
replicaset.apps/pangea-cluster-audit-7dbdddd56          1         1         1       16h
replicaset.apps/pangea-cluster-authn-65d798984f         1         1         1       16h
replicaset.apps/pangea-cluster-authz-6fdfd647b9         1         1         1       16h
replicaset.apps/pangea-cluster-console-66fdf79c7b       1         1         1       16h
replicaset.apps/pangea-cluster-embargo-5654b6cfb8       1         1         0       10h
replicaset.apps/pangea-cluster-gateway-594df449bc       1         1         1       16h
replicaset.apps/pangea-cluster-puc-service-7dc48cc55b   1         1         1       16h

NAME                        READY   AGE
statefulset.apps/postgres   1/1     9d

NAME                                           STATUS     COMPLETIONS   DURATION   AGE
job.batch/pangea-cluster-bootstrap-ui-authn    Complete   1/1           10s        16h
job.batch/pangea-cluster-migrate-authn         Complete   1/1           10s        16h
job.batch/pangea-cluster-migrate-authz         Complete   1/1           9s         16h
job.batch/pangea-cluster-migrate-embargo       Complete   1/1           19s        10h
job.batch/pangea-cluster-migrate-gateway       Complete   1/1           10s        16h
job.batch/pangea-cluster-migrate-puc-service   Complete   1/1           24s        16h
job.batch/pangea-cluster-publish-access        Complete   1/1           5s         16h
job.batch/pangea-cluster-publish-ai-guard      Complete   1/1           16s        16h
job.batch/pangea-cluster-publish-audit         Complete   1/1           14s        16h
job.batch/pangea-cluster-publish-authz         Complete   1/1           6s         16h
job.batch/pangea-cluster-publish-cluster       Complete   1/1           55s        16h

NAME                                                STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS       VOLUMEATTRIBUTESCLASS   AGE
persistentvolumeclaim/postgres-storage-postgres-0   Bound    pvc-3d015ac1-aaa1-4673-b401-90330027f639   1Gi        RWO            pangea-ephemeral   <unset>                 9d

NAME                                                   TYPE                             DATA   AGE
secret/db-secret                                       Opaque                           2      10d
secret/pangea-cluster-access-access-s2stoken           Opaque                           1      16h
secret/pangea-cluster-access-authn-s2stoken            Opaque                           1      16h
secret/pangea-cluster-access-authz-s2stoken            Opaque                           1      16h
secret/pangea-cluster-access-vault-s2stoken            Opaque                           1      16h
secret/pangea-cluster-ai-guard-audit-s2stoken          Opaque                           1      16h
secret/pangea-cluster-ai-guard-domain-intel-s2stoken   Opaque                           1      16h
secret/pangea-cluster-ai-guard-ip-intel-s2stoken       Opaque                           1      16h
secret/pangea-cluster-ai-guard-prompt-guard-s2stoken   Opaque                           1      16h
secret/pangea-cluster-ai-guard-redact-s2stoken         Opaque                           1      16h
secret/pangea-cluster-ai-guard-url-intel-s2stoken      Opaque                           1      16h
secret/pangea-cluster-ai-guard-user-intel-s2stoken     Opaque                           1      16h
secret/pangea-cluster-ai-guard-vault-s2stoken          Opaque                           1      16h
secret/pangea-cluster-audit-bmservice-s2stoken         Opaque                           1      16h
secret/pangea-cluster-audit-redact-s2stoken            Opaque                           2      16h
secret/pangea-cluster-audit-vault-s2stoken             Opaque                           1      16h
secret/pangea-cluster-authn-secrets                    Opaque                           5      16h
secret/pangea-cluster-authz-audit-s2stoken             Opaque                           2      16h
secret/pangea-cluster-gateway-bmservice-s2stoken       Opaque                           1      16h
secret/pangea-cluster-gateway-route-token              Opaque                           1      16h
secret/pangea-cluster-org-config-token                 Opaque                           1      16h
secret/pangea-cluster-tls-2f9c4                        Opaque                           1      16h
secret/pangea-registry                                 kubernetes.io/dockerconfigjson   1      10d

Common issues and resolutions

Issue	Resolution
`Pending` pod status	Verify that the PostgreSQL database is running and reachable.
`CrashLoopBackOff` pod status	Check the database configuration and credentials.
Image pull failures	Ensure your Pangea registry secret is correctly configured and present in the namespace.
`Unauthorized` (403) API response	Confirm that you are using a valid and correctly scoped API token.

Report issues

If you encounter deployment or service health issues that you cannot resolve, contact Pangea Support for assistance.

Next steps

Configure ingress

The steps above let you quickly deploy and test Pangea services in your environment. To make your environment accessible, configure an ingress controller. For production deployments, ensure ingress is terminated with TLS.

Configure services and access their APIs

Your Pangea User Console provides an intuitive interface for configuring services and managing access. It includes contextual links to related documentation, which you can access directly if needed:

Admin Guide - Learn how to configure a Pangea project and manage service access.

Services - Explore how to configure Pangea services and use them to implement security guardrails in your applications.

APIs - Access interactive reference documentation for service and management APIs.

SDKs - Reference guides for integrating Pangea SDKs into your applications.

Implement guardrails in your applications

The Integration Options guide outlines patterns for implementing AI security guardrails using Pangea services. These include integrations through API gateways and AI frameworks, with SDKs and direct API calls available when needed.

Uninstall Private Cloud

Delete Pangea Cluster

Delete PangeaCluster resources and Pangea registry secret
kubectl delete PangeaCluster pangea-cluster --namespace pangea-private-cloud
kubectl delete secret pangea-registry --namespace pangea-private-cloud

Uninstall Private Cloud operator

Uninstall the operator and delete the Pangea registry secret
helm uninstall pangea-cluster-operator --namespace pangea-private-cloud-operator
kubectl delete secret pangea-registry --namespace pangea-private-cloud-operator

Delete database resources

For example:

Remove the PostgreSQL StatefulSet and associated resources
kubectl delete statefulsets.apps postgres --namespace pangea-private-cloud
kubectl delete services postgres --namespace pangea-private-cloud
kubectl delete persistentvolumeclaims postgres-storage-postgres-0 --namespace pangea-private-cloud
kubectl delete configmap postgres-initdb --namespace pangea-private-cloud
kubectl delete secret db-secret --namespace pangea-private-cloud

Delete namespaces

Delete Pangea Private Cloud namespace

kubectl delete namespace pangea-private-cloud

Delete operator namespace

kubectl delete namespace pangea-private-cloud-operator

note

Deleting Pangea resources from the cluster does not remove external persistent data. This includes audit logs stored in S3, database snapshots, and any other infrastructure managed outside of Kubernetes. Make sure to manually delete or archive this data if required.

Was this article helpful?

Overview of Pangea Private Cloud installation process​

Install Pangea Cluster Operator​

Set up namespace​

Create Kubernetes secret for Pangea registry​

Install operator​

Deploy Pangea services​

Set up namespace​

Create Kubernetes secret for Pangea registry​

Deploy database​

Deploy PangeaCluster​

Required services​

Additional services​

Example PangeaCluster manifest​

Updating PangeaCluster deployment​

Verify deployment​

Use Pangea support tool​

Open admin console​

Try service APIs​

Troubleshooting​

Check status of PangeaCluster resources​

Common issues and resolutions​

Report issues​

Next steps​

Configure ingress​

Configure services and access their APIs​

Implement guardrails in your applications​

Uninstall Private Cloud​

Delete Pangea Cluster​

Uninstall Private Cloud operator​

Delete database resources​

Delete namespaces​

Overview of Pangea Private Cloud installation process

Install Pangea Cluster Operator

Set up namespace

Create Kubernetes secret for Pangea registry

Install operator

Deploy Pangea services

Set up namespace

Create Kubernetes secret for Pangea registry

Deploy database

Deploy PangeaCluster

Required services

Additional services

Example PangeaCluster manifest

Updating PangeaCluster deployment

Verify deployment

Use Pangea support tool

Open admin console

Try service APIs

Troubleshooting

Check status of PangeaCluster resources

Common issues and resolutions

Report issues

Next steps

Configure ingress

Configure services and access their APIs

Implement guardrails in your applications

Uninstall Private Cloud

Delete Pangea Cluster

Uninstall Private Cloud operator

Delete database resources

Delete namespaces