Deploying Edge Services on GCP

This guide helps you deploy Redact Edge in a GCP environment, either as a standalone container on Google Cloud Run or as part of a Google Kubernetes Engine (GKE) cluster. Choose the deployment method that best fits your needs: Cloud Run for simplicity or GKE for scalable production workloads.

Prerequisites

Ensure you have the following before starting the deployment:

A GCP account with sufficient IAM permissions to manage Cloud Run or GKE resources
gcloud CLI installed and authenticated with your account
Docker installed and configured (optional)
Access to Pangea's private Docker Hub repository (granted by a Pangea representative)
Set up Vault/Redact services to get below environment variables

Environment Configuration

Configure the required environment variables and set up Docker access for your deployment.

Environment Variables

Use values from your Pangea Console to set these environment variables:

PANGEA_CSP=aws                            # Cloud Service Provider
PANGEA_VAULT_SERVICE_TOKEN_ID=pvi_XXX     # Vault Service Token ID
PANGEA_VAULT_TOKEN=pts_XXX                # Vault Token
PANGEA_REGION=us                          # Deployment Region
PANGEA_REDACT_TOKEN=XXX                   # Redact Service Token

These variables can be found in your Pangea Console under the Edge Configuration section:

Navigate to your Pangea Console
Go to "Services" → "Redact" -> and under Settings, you will find "Edge"
After you complete the preliminary steps for this, you should find the following:

Redact Edge secrets

Copy these directly from the console so you can set these variables in your environment using:

export PANGEA_CSP=aws
export PANGEA_VAULT_SERVICE_TOKEN_ID=your_token_id
# ... repeat for other variables

note

Keep these tokens secure and never commit them to version control.

Docker Registry Access

Pull the Redact Edge container image from Pangea's private repository:

docker pull pangeacyber/redact:latest

Cloud Run Deployment

For simpler workloads, deploy Redact Edge using Google Cloud Run.

Enable Cloud Run API Ensure that the Cloud Run API is enabled in your project:
```
gcloud services enable run.googleapis.com
```

Build and Push the Image If required, tag the image and push it to Google Container Registry (GCR):

docker tag pangeacyber/redact:latest gcr.io/<your-project-id>/redact:latest
docker push gcr.io/<your-project-id>/redact:latest

Deploy to Cloud Run Deploy the container to Cloud Run:

gcloud run deploy redact-edge \
  --image=gcr.io/<your-project-id>/redact:latest \
  --region=us-central1 \
  --platform=managed \
  --allow-unauthenticated \
  --memory=2Gi \
  --port=8000 \
  --set-env-vars "PANGEA_REGION=us,PANGEA_CSP=aws,PANGEA_VAULT_TOKEN=<your-vault-token>,PANGEA_VAULT_SERVICE_TOKEN_ID=<your-service-token-id>"

Test the Service Replace <service-url> with the URL of your deployed service to test:

curl -sSLX POST 'https://<service-url>/v1/redact' \
  -H 'Authorization: Bearer <your-redact-token>' \
  -H 'Content-Type: application/json' \
  -d '{"text":"Sensitive data SSN: 123-45-6789"}'

GKE Deployment

For production environments, deploy Redact Edge on GKE to take advantage of container orchestration, scaling, and high availability features.

Create a GKE Cluster

If you don’t have a GKE cluster, follow the GKE Quickstart Guide to create one.
note
Some requirements for the cluster:
- Ensure an AMD64 node pool is available unless ARM64 compatibility is required.
- Configure the VPC and networking settings appropriate for your environment.
- For this deployment, use an nginx ingress controller to expose services externally.

Configure Access to Your Cluster

Use the gcloud CLI to configure kubectl access and create a namespace:

gcloud container clusters get-credentials <cluster-name> --zone <zone> --project <project-id>
kubectl create namespace pangea-edge

Create a Docker Pull Secret

To pull the Redact Edge image from Pangea's private repository, create a file named pangea_dockerhub_pull_secret.yaml:
```
apiVersion: v1
kind: Secret
metadata:
  name: pangea-registry-key
  namespace: pangea-edge
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: [base64-encoded-docker-config]
```
note
Replace [base64-encoded-docker-config] with the base64-encoded Docker credentials. More details can be found here.
Apply the Docker Pull Secret

Save and apply the secret to the namespace:
```
kubectl apply -f pangea_dockerhub_pull_secret.yaml
```
Create a Vault Token Secret

Create a secret for the Vault token in a file named pangea_vault_token.yaml:
```
apiVersion: v1
kind: Secret
metadata:
  name: vault-token
  namespace: pangea-edge
type: Opaque
data:
  PANGEA_VAULT_TOKEN: [base64-encoded-vault-token]
```
note
Replace [base64-encoded-vault-token] with the base64-encoded Vault token obtained from the environment configuration.
Apply the Vault Token Secret

Save and apply the secret to the namespace:
```
kubectl apply -f pangea_vault_token.yaml
```

Deploy Redact Edge

Create a deployment configuration file named pangea_redact_eph_deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: pangea-edge
  name: redact-edge
  labels:
    app: redact-edge
spec:
  replicas: 2
  selector:
    matchLabels:
      app: redact-edge
  template:
    metadata:
      labels:
        app: redact-edge
    spec:
      containers:
        - name: redact-edge
          image: pangeacyber/redact:latest
          env:
            - name: PANGEA_REGION
              value: "us"
            - name: PANGEA_CSP
              value: "aws"
            - name: PANGEA_VAULT_TOKEN
              value: "/var/run/secrets/PANGEA_VAULT_TOKEN"
            - name: PANGEA_VAULT_SERVICE_TOKEN_ID
              value: "<your-service-token-id>"
            - name: REDACT_CONFIG_DATA_COMMON_CLOUD_ONPREM_BM_RECORD_LOCAL_SUBMISSION_ENABLED
              value: "true"
          volumeMounts:
            - name: ephemeral-storage
              mountPath: "/var/pangea/data"
            - name: pangea-vault-token
              mountPath: /var/run/secrets
          ports:
            - containerPort: 8000
      volumes:
        - name: ephemeral-storage
          emptyDir: {}
        - name: pangea-vault-token
          secret:
            secretName: vault-token

      imagePullSecrets:
        - name: pangea-registry-key

Apply the deployment:

kubectl apply -f pangea_redact_eph_deployment.yaml

Expose the Deployment

Create a service file named pangea_redact_service.yaml to expose the deployment:

apiVersion: v1
kind: Service
metadata:
  namespace: pangea-edge
  name: redact-edge-service
spec:
  type: LoadBalancer
  selector:
    app: redact-edge
  ports:
    - protocol: TCP
      port: 8000
      targetPort: 8000

Apply the service configuration:

kubectl apply -f pangea_redact_service.yaml

Set Up Ingress

Create an ingress configuration file named simple-edge-ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: redact-edge-ingress
  namespace: pangea-edge
spec:
  ingressClassName: gce
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: redact-edge-service
                port:
                  number: 8000

Apply the ingress configuration:

kubectl apply -f simple-edge-ingress.yaml

Test the Deployment

Use the external IP address from the load balancer to test:

curl -sSLX POST 'http://<load-balancer-ip>:8000/v1/redact' \
  -H 'Authorization: Bearer <your-redact-token>' \
  -H 'Content-Type: application/json' \
  -d '{"text":"This is test text with sensitive data SSN:123-45-6789"}'

Monitoring and Troubleshooting

Use the gcloud CLI or kubectl to debug:

# View logs for Cloud Run
gcloud logging read "resource.labels.service_name=redact-edge" --limit=100

# View pod logs for GKE
kubectl logs -n pangea-edge -l app=redact-edge

# Check pod status for GKE
kubectl get pods -n pangea-edge

Was this article helpful?

Deploying Edge Services on GCP

Prerequisites​

Environment Configuration​

Environment Variables​

Docker Registry Access​

Cloud Run Deployment​

GKE Deployment​

Monitoring and Troubleshooting​