Edge Services (AWS)

This guide helps you deploy Edge Services (e.g., Redact or AI Guard) in an AWS environment as part of an EKS cluster.

Prerequisites

Ensure you have the following before starting the deployment:

An AWS account with sufficient IAM permissions to manage EKS resources
AWS CLI installed and configured with your credentials
Docker installed and configured (optional)
Access to Pangea's private Docker Hub repository (granted by a Pangea representative)
Set up Vault/Edge services to get below environment variables

Environment configuration

Select a service from the buttons below to configure your Edge Deployment.

Service

AI Guard

Redact

Environment variables

Use values from your Pangea Console to set these environment variables.

PANGEA_CSP=aws                            # Cloud Service Provider
PANGEA_VAULT_TOKEN=pts_XXX                # Vault Token
PANGEA_REGION=us                          # Deployment Region
PANGEA_AI_GUARD_TOKEN=XXX                 # Service Token for AI Guard

These variables can be found in your Pangea Console under the Edge Configuration section:

Navigate to your Pangea Console
Go to "Services" >> Select your service (e.g., "Redact" or "AI Guard") >> and under Settings, you will find "Edge"
After you complete the preliminary steps for this, you should find the following page:

AI Guard Edge secrets

Copy these directly from the console so you can set these variables in your environment using:

export PANGEA_CSP=aws
export PANGEA_VAULT_TOKEN=pts_XXX
# ... repeat for other variables

note

Keep these tokens secure and never commit them to version control.

Docker registry access

Pull the Edge Service container image from Pangea's private repository.

docker pull pangeacyber/aiguard-edge:latest

note

You will need to be granted access via Pangea to follow this step. This will be a good preliminary step to ensure your environment is set up to follow the rest of the guide.

EKS deployment

For production environments, deploy Edge Services on AWS Elastic Kubernetes Service (EKS) to take advantage of container orchestration, scaling, and high availability features.

Create an EKS cluster

If you don't have an EKS cluster, follow the EKS setup guide to create one.
note
Some requirements for the cluster:
- Ensure your cluster has sufficient IAM permissions for Kubernetes.
- Use an AMD64-compatible node group unless ARM64 is required.
- Configure appropriate VPC networking for your EKS cluster.

Configure access to your cluster

Use the AWS CLI to retrieve cluster credentials and configure kubectl:

aws eks update-kubeconfig --region <region> --name <cluster-name>
kubectl create namespace pangea-edge

Create a Docker pull secret

To pull the Edge Service image from Pangea's private repository, create a file named pangea_dockerhub_pull_secret.yaml:
```
apiVersion: v1
kind: Secret
metadata:
  name: pangea-registry-key
  namespace: pangea-edge
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: [base64-encoded-docker-config]
```
note
Replace [base64-encoded-docker-config] with the base64-encoded Docker credentials. More details can be found here.
Apply the Docker pull secret

Save the file and apply it to the namespace:
```
kubectl apply -f pangea_dockerhub_pull_secret.yaml
```
Create a Vault token secret

Create a secret for the Vault token in a file named pangea_vault_token.yaml:
```
apiVersion: v1
kind: Secret
metadata:
  name: vault-token
  namespace: pangea-edge
type: Opaque
data:
  PANGEA_VAULT_TOKEN: [base64-encoded-vault-token]
```
note
Replace [base64-encoded-vault-token] with the base64-encoded Vault token from the environment configuration.
Apply the Vault token secret

Save the file and apply it to the namespace:
```
kubectl apply -f pangea_vault_token.yaml
```

Deploy Edge service

Create a deployment file named pangea_ai_guard_deployment.yaml.

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: pangea-edge
  name: ai-guard-edge
  labels:
    app: ai-guard-edge
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ai-guard-edge
  template:
    metadata:
      labels:
        app: ai-guard-edge
    spec:
      containers:
        - name: ai-guard-edge
          image: pangeacyber/ai-guard:latest
          env:
            - name: PANGEA_REGION
              value: "us"
            - name: PANGEA_CSP
              value: "aws"
            - name: PANGEA_VAULT_TOKEN
              value: "/var/run/secrets/PANGEA_VAULT_TOKEN"
          volumeMounts:
            - name: ephemeral-storage
              mountPath: "/var/pangea/data"
            - name: pangea-vault-token
              mountPath: /var/run/secrets
          ports:
            - containerPort: 8000
          imagePullPolicy: IfNotPresent
          resources:
            requests:
              cpu: 500m # 500 millicores (0.5 CPU)
              memory: 4Gi # 4 GiB of memory
      volumes:
        - name: ephemeral-storage
          emptyDir: {}
        - name: pangea-vault-token
          secret:
            secretName: vault-token

      imagePullSecrets:
        - name: pangea-registry-key

Apply the deployment:

kubectl apply -f pangea_ai_guard_deployment.yaml

Expose the deployment

Create a service file named pangea_ai_guard_service.yaml:

apiVersion: v1
kind: Service
metadata:
  namespace: pangea-edge
  name: ai-guard-edge-service
spec:
  type: LoadBalancer
  selector:
    app: ai-guard-edge
  ports:
    - protocol: TCP
      port: 8000
      targetPort: 8000

Apply the service configuration:

kubectl apply -f pangea_ai_guard_service.yaml

Set up ingress

Create an ingress configuration file named simple-edge-ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ai-guard-edge-ingress
  namespace: pangea-edge
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ai-guard-edge-service
                port:
                  number: 8000

Apply the ingress configuration:

kubectl apply -f simple-edge-ingress.yaml

Test your deployment

Use the external IP provided by the load balancer to test. You can get the external IP by running this command:

kubectl get service ai-guard-edge-service -n pangea-edge

Then test the API using:

curl -sSLX POST 'http://<external-ip>:8000/v1beta/text/guard' \
  -H 'Authorization: Bearer <your-ai-guard-token>' \
  -H 'Content-Type: application/json' \
  -d '{"text": "This is test text with sensitive data SSN: 234-56-7890"}'

Monitoring and troubleshooting

Use the AWS CLI or kubectl to debug:

# EKS logs
kubectl logs -n pangea-edge -l app=redact-edge

# Check pod status
kubectl get pods -n pangea-edge

note

If you're not receiving a response, it's often due to a pod restart. You can use the above commands to check the pod logs.

Was this article helpful?

Edge Services (AWS)

Prerequisites​

Environment configuration​

Environment variables​

Docker registry access​

EKS deployment​

Monitoring and troubleshooting​

Prerequisites

Environment configuration

Environment variables

Docker registry access

EKS deployment

Monitoring and troubleshooting