LightBeam Installer

---

1.0 LightBeam Installation

NOTE:

• Dockerhub registry access is needed from all worker nodes of the Kubernetes cluster.

• Outbound traffic to access datasource APIs such as google APIs, Microsoft APIs, and Slack APIs depends on the data sources registered.

a. Copy the lightbeam-chart.zip file shared by the LightBeam team on the Jump Box.

b. Verify the default storage class name in override-values.yaml

c. Install the LightBeam chart:

Note: Verify cluster has all outbound internet access.

If you are installing the LightBeam chart on a self-managed kubernetes cluster, add the --self_managed flag to the installer script as shown below. Replace this with --eks or --aks if you are installing the chart on AWS EKS or Azure kubernetes. The --spectra flag specifies the spectra deployment.

On-prem

export DOCKER_USERNAME="lbcustomers" DOCKER_REGISTRY_PASSWORD="<DOCKER_REGISTRY_TOKEN>" KBLD_REGISTRY_HOSTNAME="docker.io" KBLD_REGISTRY_USERNAME="lbcustomers" KBLD_REGISTRY_PASSWORD="<DOCKER_REGISTRY_TOKEN>"

cd lightbeam-chart/

#Command for on-prem 
nohup bash installer/lb-install.sh --install --self_managed --spectra --values charts/lightbeam/values.yaml --final_values  charts/lightbeam/values.yaml --freeze_values charts/lightbeam/freeze-values.yaml --override_values charts/lightbeam/override-values.yaml --auth_url http://192.168.99.1 2>&1 &

Note: In command above replace 192.168.99.1 with IP of the master node. 

While on-prem installation is in progress proceed to 2.0 LightBeam UI Access (Manadatory for on-prem) and complete the steps.

For managed clusters hosted in AWS, Azure, GCP run the following command.

EKS

nohup bash installer/lb-install.sh --install --eks --spectra --values charts/lightbeam/values.yaml --final_values  charts/lightbeam/values.yaml --freeze_values charts/lightbeam/freeze-values.yaml --override_values charts/lightbeam/override-values.yaml  2>&1 &

AKS

nohup bash installer/lb-install.sh --install --aks --spectra --values charts/lightbeam/values.yaml --final_values  charts/lightbeam/values.yaml --freeze_values charts/lightbeam/freeze-values.yaml --override_values charts/lightbeam/override-values.yaml  2>&1 &

GKE

nohup bash installer/lb-install.sh --install --gke --spectra --values charts/lightbeam/values.yaml --final_values  charts/lightbeam/values.yaml --freeze_values charts/lightbeam/freeze-values.yaml --override_values charts/lightbeam/override-values.yaml  2>&1 &

Contact [email protected] for DOCKER_REGISTRY_TOKEN

One can verify the installation by running `kubectl get pods -n lightbeam` and check the status of all pods. Review installation progress with command

tail -f nohup.out # To review install progress

(Optional) Install the logging and monitoring chart

Update the default storage class name in standalone-cluster.yaml as used for installing LightBeam.

helm install logging charts/lightbeam-logging/ --namespace logging --create-namespace -f charts/lightbeam-logging/standalone-cluster.yaml  --debug
helm install logging charts/lightbeam-monitoring --namespace monitoring --create-namespace -f charts/lightbeam-monitoring/standalone-cluster.yaml --debug. 

d. Post-install setup:

Use the following command to get the address to access Lightbeam UI

kubectl get ingress -n lightbeam

---

2.0 LightBeam UI Access (Manadatory for on-prem)

Create the following script and systemd service to access LightBeam using Jump Box IP address.

• Create new file:

vi /usr/local/bin/lightbeam.sh

#!/usr/bin/env bash
trap 'kill $(jobs -p)' EXIT
/usr/bin/kubectl port-forward service/kong-proxy -n lightbeam --address 0.0.0.0 80:80 443:443 --kubeconfig /root/.kube/config &
PID=$!
/bin/systemd-notify --ready
while(true); do
    FAIL=0
    kill -0 $PID
    if [[ $? -ne 0 ]]; then FAIL=1; fi
    status_code=`curl -s -o /dev/null -w "%{http_code}" http://localhost/api/health`
    echo "Lightbeam cluster health check: $status_code"
    if [[ $? -ne 0 || $status_code -ne 200 && $status_code -ne 301 ]]; then FAIL=1; fi
    if [[ $FAIL -eq 0 ]]; then /bin/systemd-notify WATCHDOG=1; fi
    sleep 1
done

• Change permission of file:

chmod u+x /usr/local/bin/lightbeam.sh

• Create new file:

vi /etc/systemd/system/lightbeam.service

[Unit]
Description=LightBeam Application
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service

StartLimitIntervalSec=500
StartLimitBurst=10000

[Service]
Type=notify
Restart=always
RestartSec=1
TimeoutSec=5
WatchdogSec=5
ExecStart=/usr/local/bin/lightbeam.sh

[Install]
WantedBy=multi-user.target

• Enable and start services:

systemctl enable lightbeam; systemctl start lightbeam; systemctl status lightbeam

• Access LightBeam UI using Public IP of node and Port 80:

http://<JUMPBOX_VM_PUBLIC_IP>:80

Note: Here, Public IP of the Jumpbox VM can be used.

---

3.0 LightBeam Upgrade

The LightBeam team shares the latest release LightBeam chart which needs to be copied on the Jump Box. Upgrade the LightBeam chart:

NOTE: Dockerhub registry access is needed from all worker nodes of the kubernetes cluster.

The --spectra flag specifies the spectra deployment.

export DOCKER_USERNAME="lbcustomers" DOCKER_REGISTRY_PASSWORD="<DOCKER_REGISTRY_TOKEN>" KBLD_REGISTRY_HOSTNAME="docker.io" KBLD_REGISTRY_USERNAME="lbcustomers" KBLD_REGISTRY_PASSWORD="<DOCKER_REGISTRY_TOKEN>"

cd lightbeam-chart/

nohup bash installer/lb-install.sh --upgrade --self_managed --spectra --values charts/lightbeam/values.yaml --final_values  charts/lightbeam/values.yaml --freeze_values charts/lightbeam/freeze-values.yaml --override_values charts/lightbeam/override-values.yaml  2>&1 &

tail -f nohup.out # To review install progress

One can verify the upgrade by running kubectl get pods -n lightbeam and checking the status of all pods.

As part of upgrade, the following actions are taken:

• Pausing datasource scanning and processing.

• Updating latest database schema.

• Updating all LightBeam services to the respective release versions. As part of this step, all latest release version Docker images from Dockerhub registry are downloaded on respective worker nodes.

• A post-upgrade job is executed which resumes scans for all data sources and starts processing, also verifies all services health.

---

About LightBeam

LightBeam automates Privacy, Security, and AI Governance, so businesses can accelerate their growth in new markets. Leveraging generative AI, LightBeam has rapidly gained customers’ trust by pioneering a unique privacy-centric and automation-first approach to security. Unlike siloed solutions, LightBeam ties together sensitive data cataloging, control, and compliance across structured and unstructured data applications providing 360-visibility, redaction, self-service DSRs, and automated ROPA reporting ensuring ultimate protection against ransomware and accidental exposures while meeting data privacy obligations efficiently. LightBeam is on a mission to create a secure privacy-first world helping customers automate compliance against a patchwork of existing and emerging regulations.

For any questions or suggestions, please get in touch with us at: [email protected].