Presidio (presidio)
Detection (analyzer) and masking (anonymizer) of personal data in prompts, answers and documents, with English and French spaCy models.
Generated from catalog/services/presidio.yaml: do not edit by hand.
Summary
| Version | 2.2.366 |
| Use | install and configure, configure and connect |
| Layer | functional (AI catalog) |
| Category | Security and policies |
| Installation methods | python, podman |
| External connection | no |
| Sandbox only | no |
Licence
| SPDX identifier | MIT |
| Licence policy | core licence (MIT or Apache-2.0) |
| Licence exception | - |
| Platform component | presidio |
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
| Kind | Package | Version | Licence | Details |
|---|---|---|---|---|
| container image | mcr.microsoft.com/presidio-analyzer | 2.2.362 | MIT | image key analyzer, used by analyzer, digest sha256:286e3fa7f3a7426e775e8564fe1870f1ba8f999d3ab8bbb8cc46a44355d9d6e9 |
| container image | mcr.microsoft.com/presidio-anonymizer | 2.2.362 | MIT | image key anonymizer, used by anonymizer, digest sha256:a10a12a2a613d13cf29d3ad3641e3258444dd8c90403dd644a0a114c472c2483 |
| Python package | presidio-analyzer | 2.2.366 | MIT | interpreters, in order of preference python3.11, python3.12 |
| Python package | presidio-anonymizer | 2.2.366 | MIT | interpreters, in order of preference python3.11, python3.12 |
| Python package | spacy | >=3.7,<4 (range) | MIT | interpreters, in order of preference python3.11, python3.12 |
| Python package | en_core_web_lg | 3.8.0 | MIT | interpreters, in order of preference python3.11, python3.12 |
| Python package | fr_core_news_lg | 3.8.0 | LGPLLR | interpreters, in order of preference python3.11, python3.12 |
| Python package | flask | >=3.0 (range) | BSD-3-Clause | interpreters, in order of preference python3.11, python3.12 |
| Python package | gunicorn | >=22.0 (range) | MIT | interpreters, in order of preference python3.11, python3.12 |
Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|---|---|
python | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64, aarch64 (not restricted by the descriptor) |
podman | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64, aarch64 (not restricted by the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- at least 4096 MB of memory (warning,
memory).
Network and ports
| Component | Port name | Port | Opened in the host firewall |
|---|---|---|---|
analyzer | api | 5002/tcp | yes |
anonymizer | api | 5003/tcp | yes |
Services and connections needed
This service has no dependency.
Installation methods and modes
| Method | Default | What the method uses |
|---|---|---|
python | yes | a Python virtual environment holding the Python packages of the descriptor |
podman | - | the container images of the descriptor, run by Podman under systemd |
Components
| Component | Kind | Installation methods | Ports |
|---|---|---|---|
Analyzer (analyzer) | master | python, podman | 5002/tcp |
Anonymizer (anonymizer) | master | python, podman | 5003/tcp |
Single server (standalone) (default)
One analyzer and one anonymizer.
What the mode deploys:
| Component | Placement |
|---|---|
analyzer | min 1, max 1 |
anonymizer | min 1, max 1 |
Replicated (replicated)
Several stateless instances of each API behind the load balancer.
What the mode deploys:
| Component | Placement |
|---|---|
analyzer | min 2, recommended 2 |
anonymizer | min 2, recommended 2 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select Presidio. The card shows the licence
MIT. Pick the Method amongpython,podman(defaultpython). -
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode:
standalone(default),replicated. Each mode deploys the components listed in Installation methods and modes. With several components, place each one on its hosts in Component placement (Suggest placement proposes a placement that respects the cardinalities). -
Bindings. This service has no dependency: the Bindings step has nothing to bind.
-
Configure. On the Configure step, review the parameters (see Configuration parameters). Passwords left empty with a generated default are generated and sealed by the Manager.
-
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.
Connect an existing service
| Schemes | https, http |
| Default port | 5002 |
| Authentication | none |
| Health check | /health |
| Authentication method | Fields | Description |
|---|---|---|
none | - | The REST APIs of the Presidio analyzer and anonymizer have no authentication: expose them on the internal network only. |
Official documentation: https://microsoft.github.io/presidio/
| Field | Type | Default | Description | Notes |
|---|---|---|---|---|
Anonymizer URL (anonymizer_url) | url | - | Anonymizer URL of the existing service. | required |
High availability
| Cluster | replicas (replication) |
| High availability | external (external) |
| Failover | load balancer (load-balancer) |
| Replication | none (none) |
| Quorum | none (none) |
| Discovery | none (none) |
| Entry point | load balancer (load-balancer) |
| Official documentation | https://microsoft.github.io/presidio/installation/ |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|---|---|---|---|---|
standalone | standalone (standalone) | single (single) | - | 1 | One analyzer and one anonymizer. |
replicated | ha (ha) | active-active (active-active) | - | 2 | Several stateless analyzers and anonymizers behind the load balancer. |
Notes
- Each instance loads its spaCy models in memory: plan the memory of every host.
Configuration parameters
Network
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|---|---|---|---|---|---|---|
Analyzer port (analyzer_port) | port | 5002 | - | no | no | yes | Port of the analyzer API (/analyze). |
Anonymizer port (anonymizer_port) | port | 5003 | - | no | no | yes | Port of the anonymizer API (/anonymize). |
TLS (tls_enabled) | bool | false | - | no | no | yes | Serve both APIs in HTTPS with a certificate of the Manager CA: the gunicorn server of each API loads it (certfile and keyfile settings passed in GUNICORN_CMD_ARGS, for the python method and for the official images alike); the health checks and the client addresses then use https. |
Language models
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|---|---|---|---|---|---|---|
Languages (languages) | list | ["en", "fr"] | - | no | no | yes | Languages of the spaCy models loaded by the analyzer. |
Workers (workers) | int | 2 | min 1, max 16 | no | no | yes | Worker processes of each API (each one loads the models). (recommended clamp(floor(host.cpu_count / 4), 1, 8)) |
Endpoints
| Endpoint | Scheme | Component | Port | Path | TLS parameter | Binding parameters | Binding secrets | Provisioning command |
|---|---|---|---|---|---|---|---|---|
analyzer | http | analyzer | 5002 (analyzer_port) | - | tls_enabled | - | - | - |
anonymizer | http | anonymizer | 5003 (anonymizer_port) | - | tls_enabled | - | - | - |
Client configuration files
Files rendered for the client configuration download:
presidio.env(client.env.j2)
Commands
| Command | Component | Target | Description |
|---|---|---|---|
Analyzer logs (logs) | analyzer | chosen host | Last lines of the analyzer journal. |
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|---|---|
analyzer | HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.ip or '127.0.0.1' }}:{{ config.analyzer_port }}/health | Expected 200; 60 retries; interval 2 s; timeout 5 s |
anonymizer | HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.ip or '127.0.0.1' }}:{{ config.anonymizer_port }}/health | Expected 200; 30 retries; interval 2 s; timeout 5 s |
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|---|---|---|---|
memory | memory_mb {"min": 4096} | at least 4096 MB of memory | warning | analyzer |
analyzer_port_free | port_free {"param": "analyzer_port"} | port 5002 free on the host | blocking | analyzer |
anonymizer_port_free | port_free {"param": "anonymizer_port"} | port 5003 free on the host | blocking | anonymizer |
Uninstall
Paths removed when the data is purged: {{ paths.log }}.
Upstream documentation
- Homepage: https://microsoft.github.io/presidio
- Source: https://github.com/microsoft/presidio
- High availability: https://microsoft.github.io/presidio/installation/
- Authentication: https://microsoft.github.io/presidio/