Versions Compared

Old Version 3

changes.mady.by.user Sarabjeet Kaur

Saved on

compared with

New Version 4

changes.mady.by.user Sarabjeet Kaur

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Panel
panelIconIdatlassian-note
panelIcon:note:
bgColor#DEEBFF

Note

  • The role permissions may not update instantly. Changes may take 2-5 minutes to sync and apply.

  • For Azure, only :

    • If the Resource Group of the Virtual Network is other than Kyvos, you must add custom roles with

    required permission are needed if the

    • the required permissions, as mentioned below in the (Scaling Permissions) table. If Virtual Network is in

    a different Resources Group (except Kyvos Resource Group). No

    • the same Resource Group as Kyvos, no additional permission is required for scaling nodes as Azure Managed Identity has Contributor access rights

    on

    • to all resources of the given Resource Group.

    For Azure Enterprise, create a custom role with the required permissions.

    • While creating a custom role, add the Resource IDs for the following services in the assignable scope:

      • Application Gateway

      • Virtual Network

      • Network Security Group

    • Once the custom role is created, it must be assigned to each of the above-listed services.

    • No permission is required for Query Engine disk increase and disk decrease.

Scaling Permissions

 Functionality

AWS (IAM Role)

AZURE

GCP

Increase Node

ec2:GetLaunchTemplateData
ec2:CreateLaunchTemplate
ec2:RunInstances

  • Microsoft.Network/networkSecurityGroups/read

  • Microsoft.Network/networkInterfaces/write

  • Microsoft.Network/virtualNetworks/subnets/join/action

  • Microsoft.Network/networkSecurityGroups/join/action

NOTE: Applicable only when Virtual Network is in another Resource Group.

compute.subnetworks.use
(applicable for Marketplace only when shared VPC is used)

compute.instances.create
compute.disks.create
compute.disks.use
compute.instances.setServiceAccount
compute.instances.use

Decrease Node

ec2:DeleteLaunchTemplate
ec2:TerminateInstances

  • Microsoft.Network/applicationGateways/write
    (applicable only for Web Portal)

  • Microsoft.Network/networkSecurityGroups/read

  • Microsoft.Network/networkInterfaces/write

  • Microsoft.Network/virtualNetworks/subnets/join/action

  • Microsoft.Network/networkSecurityGroups/join/action

NOTE: Applicable only when Virtual Network is in another Resource Group.

compute.subnetworks.use
(applicable for Marketplace only)

compute.instances.delete
compute.instances.detachDisk
compute.disks.delete

Query Engine
Increase Disk

ec2:CreateVolume
ec2:AttachVolume
ec2:ModifyInstanceAttribute
ec2:DescribeVolumes

 Contributor Access

compute.instances.get

compute.disks.create

compute.instances.attachDisk

compute.disks.use

compute.disks.setLabels

Query Engine

Decrease Disk

ec2:DetachVolume
ec2:DeleteVolume

  Contributor Access

compute.instances.detachDisk
compute.disks.delete

Load Balancer Entry Addition

TargetGroup

elasticloadbalancing:DescribeTargetGroups

elasticloadbalancing:RegisterTargets

 Microsoft.Network/applicationGateways/write
(applicable only for Web Portal)

 Instance Group

compute.instanceGroups.get
compute.instanceGroups.update

Load Balancer Entry Deletion

Target Group

elasticloadbalancing:DescribeTargetGroups

elasticloadbalancing:DeregisterTargets

 Microsoft.Network/applicationGateways/write

(applicable only for Web Portal)

 Instance Group

compute.instanceGroups.get
compute.instanceGroups.update

Health Check

Target Group Health Check Probe

elasticloadbalancing:ModifyTargetGroup 

  Contributor Access

Instance Group Health Check

compute.instanceGroups.get
compute.instanceGroups.update

...