Overview

The Netskope One DSPM application requires seamless connectivity to scan your data stores. However, as per common security practices, businesses tend to deny proper firewall egress between their internal networks and external applications. Such limitations impact the operational use of Netskope One DSPM and reduce the full return value of your subscription.

To overcome this, Netskope One DSPM provides a flexible collection architecture consisting of one or many sidecars you can deploy alongside your data stores. These sidecars collect necessary metadata and transfer it to the Netskope One DSPM application. Within this central management console, you can take action on insights from across all data stores regardless of where they are hosted.

Prerequisites

You will need a Netskope One DSPM-hosted tenant to receive the sidecar-collected metadata. Ensure you can log in to your tenant before proceeding.

Validate the latest version of the required toolsets by running the following commands at your terminal prompt:

terraform --version (Ver 1.3.2 or higher)
gcloud --version (Ver 435.0.1 or equivalent)

Architecture

Register Sidecar

To set up the relationship between your sidecars and Netskope One DSPM-hosted tenant, you will provide the sidecars with unique authentication tokens generated within our Sidecar Administration UI.

If you already have an existing sidecar token to use, you can skip this section. Otherwise, follow these instructions to acquire a new token.

Excerpt: Sidecar: Registration

Log into the Netskope One DSPM application. Navigate to the Platform Settings > Sidecar m

To set up the relationship between your sidecars and Netskope One DSPM-hosted tenant, you will provide the sidecars with a unique authentication token generated within our Sidecar Administration UI.

If you already have an existing sidecar pool token to use, you can skip this section. Otherwise, follow these instructions to acquire a new token.

1. Log into the Netskope One DSPM application.
2. Navigate to the Platform Settings > Sidecar menu to display the Sidecar Administration screen.
3. Click the Add Sidecar Pool button.
4. The Add Sidecar Pool modal is displayed.
5. On the Details tab, complete the following field:

Field	Value
Name	Any friendly value to describe the sidecar pool.

6. Click Save.
7. Click Copy at the bottom of the Sidecar Authentication Token modal to save the generated token to your clipboard. 

9. Click the “x” button to exit the modal.

Since you haven't yet associated this token with a sidecar, the sidecar pool will appear only when you click the Show Inactive Sidecars icon in the upper right, with empty Version and Status columns for now.

The above-generated token will be used for each individual sidecar within the sidecar pool.

Setting up Google Cloud credentials

This step will allow Terraform to create resources on your behalf in your Google Cloud account with the gcloud CLI. 

At the terminal prompt or command shell type gcloud auth application-default login and complete the authentication from your browser. 

You can confirm this step was successful by running the following command:

gcloud auth list

You should see your GCP user account listed in the command's output.
 

Download the Netskope One DSPM Terraform package

Copy the following URL in your browser window to download the requisite Terraform scripts 

https://Netskope One DSPM-release.s3.us-west-2.amazonaws.com/sidecar-gcp-terraform.zip

Extract the Netskope One DSPM Terraform scripts in your local system folder, which will create a folder named deploy.

Running the Terraform Script

Navigate to the deploy folder created from the extraction above.

From that directory, run the following command to initiate your Terraform environment. 

terraform init

To validate that you have all the pre-requisites configuration details available for the installation, run the following command

terraform plan

When prompted, enter the following variables:

To initiate the Terraform installation, run the following command from the deploy folder.

terraform apply

The script will begin and perform the following actions:

1. Prompt you to input - Provide the same set of 2 configuration details in sequence, as listed in the table above.
2. Check for errors - In the event an error occurs, follow the on-screen instructions for correcting & resuming. 
3. Outputs a resource modification list. To learn more about the resources created by the script, please expand the section below.
4. Prompt you to confirm before executing. To confirm, you must type yes.

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

...

Validate Sidecar Connection

Once a sidecar is running, you can now validate it is properly communicating with your Netskope One DSPM application. 

1. Log into the Netskope One DSPM application.
2. Navigate to the Platform Settings > Sidecar screen.
3. For the sidecar(s) in question, validate that the Version column is populated and its matching Status indicator is green. 

It may take a few minutes for newly-running sidecars to communicate with the Netskope One DSPM application. If both values have not updated after 20 minutes, double-check that you configured your sidecars correctly and update the pool token, if necessary.
 

Upgrading Sidecars

You may need to occasionally upgrade your sidecars so they remain compatible with your Netskope One DSPM application.

To upgrade your sidecar deployment, simply destroy the previous instance by running the following command from the deploy folder.

terraform destroy

After the container is destroyed, repeat the steps in the “Running the Terraform Script” section above.
 

Next Steps