Document toolboxDocument toolbox

Before you begin with Kyvos deployment on GCP Marketplace

Owned by Sarabjeet Kaur
Oct 09, 2024
4 min read

Applies to: Kyvos Enterprise Kyvos Cloud (SaaS on AWS) Kyvos AWS Marketplace

Kyvos Azure Marketplace Kyvos GCP Marketplace Kyvos Single Node Installation (Kyvos SNI)

You must fulfill the following prerequisites to deploy Kyvos in a GCP environment. 
Permissions required by Google Console users:  

  1. Logged-in users should have the privilege to launch deployment in GCP Deployment Manager.

  2. Logged-in users must have the Viewer and Editor predefined role attached

  3. Logged-in user will need access to VPN, Subnet, Network Interface/Security Group, and Service Account, which will be used by Kyvos to launch compute engines, Dataproc, and Instance Group.

  4. You must create a custom role. To do this, click Roles > Create new role. 
    Provide a name like Kyvos-deployment-role; assign the following permissions, and then attach to the logged-in user service account.

    1. deploymentmanager.deployments.create  

    2. deploymentmanager.deployments.delete  

    3. deploymentmanager.deployments.get  

    4. deploymentmanager.deployments.list  

    5. deploymentmanager.deployments.update  

    6. deploymentmanager.manifests.get  

    7. deploymentmanager.operations.get  

    8. storage.objects.get

    9. compute.subnetworks.use 

Note

The above permissions are only required to launch deployment. To view the resources after deployment, the user must have permission on the relevant resources.

  1. The GCP Deployment manager template is deployed through the logged-in user, and the resources inside the template are created through the default service account of GCP Deployment Manager. 
    To create other Google Cloud resources, Deployment Manager uses the credentials of the Google APIs Service Agent to authenticate to other APIs. The Google APIs Service Agent is designed specifically to run internal Google processes on your behalf. This service account is identifiable using the email: [ PROJECT_NUMBER]@cloudservices.gserviceaccount.com

    1. The above service account must  have the Editor predefined role attached.

    2. Compute Network User: If using a Shared Network, grant the above service account the 'Compute Network User' predefined role to the project where the network originally resides.

    3. You must create a custom role. To do this, click Roles > Create new role .
      Provide a name like Kyvos-deployment-role; assign the cloudfunctions.functions.setIamPolicy permissions, and then attach to the service account.

  2. Static External IP will be required. See Google Documentation for more details.

  3. Dataproc Service Agent service account: Dataproc creates this service account with the Dataproc Service Agent role in a Dataproc user's Google Cloud project. This service account cannot be replaced by a user-specified service account when you create a cluster. This service agent account is used to perform Dataproc control plane operations, such as creating, updating, and deleting cluster VMs. Please refer to Dataproc Service Agent (Control Plane identity) for details.
    By default, Dataproc uses the service-[project-number]@dataproc-accounts.iam.gserviceaccount.com as the service agent account. If that service account doesn't exist, Dataproc uses the Google  APIs service agent account , [project-number]@cloudservices.gserviceaccount.com, for control plane operations. 
    Permission required :    

    The above service account must have the Dataproc Service Agent predefined role attached.

  4. Private Google Access must be enabled for the subnet that you will use for deploying Kyvos and Dataproc clusters.

  5.  Secret Manager API Should be enabled.

  6. If ephemeral IP is selected during Kyvos deployment then the address to static must be promoted . Conversely, if ephemeral IP is not selected, then while restarting the VM, following error messages will appear:

    1. URLs received via email notification will no longer be correct as the IP will change.

    2. URL on Kyvos Manager page to navigate to Kyvos will not be correct as the IP will change.

  7. If the deployment network is in the standard tier, the external static IP should be in the standard tier. Conversely, if the deployment network is in the premium tier, the external static IP should be in the premium tier.

  8. The iam.serviceAccounts.create permission is required for creating a new service account (logged-in user).

  9. Below are the prerequisites when the None option is selected for External IP

    1. Enable Public NAT Gateway, which will let VM connect to Internet Privately without External IP

    2. Use respective VPC which has tunneling configured.
      NOTE: If the prerequisites mentioned above are not completed, there will be discrepancies in Installing Kyvos.

  10. If using shared VPC, the VPC must be shared with the project that you want to access.

    1. Navigate to the VPC network.

    2. Click the Shared VPC.

    3. Go to the ATTACHED PROJECTS tab and attach the project.
      NOTE: This should be performed from the project where the shared VPC network originally resides.

      MicrosoftTeams-image (82)-20240213-064007.png

  11. When deploying in Kyvos in Shared VPC in Shared Project, ensure that the following prerequisites are met.

  1. If VPC is in a different project, add the firewall rules:

    • For adding firewall rules, refer to Google documentation to create VPC firewall rules to shared VPC.

    • For Kyvos Firewall rules, do the following:

      1. Ensure that the following ports are opened/allowed in the Firewall inbound rules for all internal communication between Kyvos instances.
        2121, 2181, 2888, 3888, 4000, 6602, 6903, 6703, 45450, 45460, 45461, 45462, 45463, 45464, 45465, 6603, 6702, 6803, 7003, 45440, 6605, 45421, 45564, 4000, 8080, 8081, 8005, 8009, 8443, 8444, 9443, 22 and 9444.

      2. Ensure that the following ports are opened/allowed in the Firewall inbound rules for all internal communication between the Dataproc cluster and Kyvos.
        3306, 8030, 8031, 8032, 8033, 8042, 8088, 9083, 8188, 18080, 8050, 8051, 8020, 10020, 19888, 10033, 8188, 9870, 10200, 10000, 10002, 22, 45460, 9866, 8998, and 9867
        NOTE: The port 8998 is required for Livy.

      3. Ports 22, 8080, and 8081 should be accessible from outside of the cluster from where you want to access the Web application.

      4. Create a firewall rule with all ports open between Dataproc master and worker nodes using network tags as targets, which will be attached to the Dataproc.
        For more information about the required ports between the Dataproc master nodes and the worker nodes, refer to GCP documentation at: Dataproc Cluster Network Configuration

  2. Add the compute network user permission on the subnet for the following service accounts:

    • service-[project-number]@dataproc-accounts.iam.gserviceaccount.com

    • [PROJECT_NUMBER]@cloudservices.gserviceaccount.com

 

Copyright Kyvos, Inc. All rights reserved.