Applies to:
...
...
Kyvos
...
Enterprise 
...
Kyvos Cloud (
...
SaaS on AWS)
...
Kyvos AWS Marketplace
...
Kyvos Azure Marketplace
...
Kyvos AWS Marketplace GCP Marketplace Kyvos Single Node Installation (Kyvos SNI) Kyvos Free (Limited offering for AWS)
...
Create EC2 Key Pairs
From the AWS console, create two EC2 key pairs and upload them to S3 Bucket (Bucket name should be as per the Cluster name, and it should contain KM & Bastion host PEM keys)
Use Keys in pem file format.
One Key pair will be used to access the bastion host, and the other will be used to access all Kyvos nodes from the Kyvos Manager host.
Used stack name and region in Keys name.
If the stack name is demo, then the key names should be demo_bashtion.pem for the bastion host and demo_km.pem for Kyvos hosts.
Create EMR Keys
Manually create the KMS certificate by enabling In-Transit encryption and upload it on the S3 bucket.
For this, execute the following commands on any Linux/Dev Box (172.26.41.26: root/impetus) to create the certificate to be used by the EMR service.
$
...
openssl
...
req
...
-x509
...
-newkey
...
rsa:1024
...
-keyout
...
privateKey.pem
...
-out
...
certificateChain.pem
...
-days
...
365
...
-nodes
...
-subj
'/C=US/ST=Washington/L=Seattle/O=MyOrg/OU=MyDept/CN=*.<AWS
...
Region>.compute.internal'
Use the region name for a certificate where the cluster will be deployed. In the below example, the cluster will be deployed in the us-east2 region.
Example for us-east-2 region
$
...
openssl
...
req
...
-x509
...
-newkey
...
rsa:1024
...
-keyout
...
privateKey.pem
...
-out
...
certificateChain.pem
...
-days
...
365
...
-nodes
...
-subj
'/C=US/ST=Washington/L=Seattle/O=MyOrg/OU=MyDept/CN=*.us-east-2.compute.internal'
$
...
cp
...
certificateChain.pem
...
trustedCertificates.pem
$
...
zip
...
-r
...
-X
...
<stack-name>-us-east2_emr_cert.zip
...
certificateChain.pem
...
privateKey.pem
...
trustedCertificates.pem
Example for intellicus-dryrun2 cluster
$
...
zip
...
-r
...
-X
...
intellicus-dryrun2-us-east2_emr_cert.zip
...
certificateChain.pem
...
privateKey.pem
...
trustedCertificates.pem
Upload the generated keys to the S3 bucket and delete the certificate zip file from the Linux node.
Kyvos installation bundle access information
...