{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Applies to","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"type":"emoji","attrs":{"id":"atlassian-check_mark","text":":check_mark:","shortName":":check_mark:"}},{"text":" Kyvos Enterprise ","type":"text"},{"type":"emoji","attrs":{"id":"atlassian-cross_mark","text":":cross_mark:","shortName":":cross_mark:"}},{"text":" Kyvos Cloud (SaaS on AWS) ","type":"text"},{"type":"emoji","attrs":{"id":"atlassian-cross_mark","text":":cross_mark:","shortName":":cross_mark:"}},{"text":" Kyvos AWS Marketplace","type":"text"}]},{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-cross_mark","text":":cross_mark:","shortName":":cross_mark:"}},{"text":" Kyvos Azure Marketplace ","type":"text"},{"type":"emoji","attrs":{"id":"atlassian-cross_mark","text":":cross_mark:","shortName":":cross_mark:"}},{"text":" Kyvos GCP Marketplace ","type":"text"},{"type":"emoji","attrs":{"id":"atlassian-cross_mark","text":":cross_mark:","shortName":":cross_mark:"}},{"text":" Kyvos Single Node Installation (Kyvos SNI) ","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Before you start the automated installation for Kyvos on Azure, ensure you have the following information.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Prerequisites to deploy Kyvos using Databricks","type":"text","marks":[{"type":"link","attrs":{"href":"#databricks"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Prerequisites to deploy Kyvos using Kubernetes","type":"text","marks":[{"type":"link","attrs":{"href":"#kubernetes"}}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites to deploy Kyvos using Databricks ","type":"text"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"databricks"},"legacyAnchorId":{"value":"PrerequisitesforKyvosDeploymentonAzure-databricks"}},"macroMetadata":{"macroId":{"value":"403c4e375d6b640873c3b7615838848fc00ba8517c7858a1d250ac8239b1ebd3"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"88e1aab8-11db-4be3-baf9-eb446d58f85c"}}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"Tip","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download the ","type":"text"},{"text":"Azure Installation Files","type":"text","marks":[{"type":"link","attrs":{"href":"https://expanse.kyvosinsights.com/s/5b7i7t9qJcYXrZe"}}]},{"text":" folder and keep all the requisite files handy.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You will see an","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"Azure Deployment Prerequisites Checklist","type":"text","marks":[{"type":"link","attrs":{"href":"https://expanse.kyvosinsights.com/s/PrHk4NeDASz8dtT"}}]},{"text":",","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"containing a list of all the prerequisites. It is recommended to read before starting installation and deployment.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From Kyvos 2023.5 onwards, the Contributor role permission must be attached to the managed identity on the resource level for starting and stopping Postgres Flexible server during the cluster scheduling.","type":"text"}]}]}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Resource Group ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal#create-resource-groups"}}]},{"text":"for all Kyvos resources. We recommend you keep an empty resource group that will only be used for deploying Kyvos resources. The deployment user must have ","type":"text"},{"text":"Owner ","type":"text","marks":[{"type":"strong"}]},{"text":"rights on this resource group. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" If your network resources (for deploying Kyvos) are available in a separate Resource Group (other than the one mentioned in Point 1), create a Custom role for the user deploying the cluster with the following permissions. Refer to the ","type":"text"},{"text":"Configuring Roles for Deployment User","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69409431"}}]},{"text":" section for details on creating and assigning roles.","type":"text"},{"type":"hardBreak"},{"text":"NOTE","type":"text","marks":[{"type":"strong"}]},{"text":": This is not required if you are creating network resources using the Kyvos provided template.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/subnets/read","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/read","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/networkSecurityGroups/read","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/subnets/write","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/subnets/join/action","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/networkSecurityGroups/join/action","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Managed Identity","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal"}}]},{"text":" for Kyvos resources with the following information:","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text"},{"text":"NOTE: ","type":"text","marks":[{"type":"strong"}]},{"text":" As mentioned in the attached Prerequisites sheet, this is optional. It will be created if the value for ","type":"text"},{"text":"Enable Managed Identity Creation","type":"text","marks":[{"type":"strong"}]},{"text":" is set as ","type":"text"},{"text":"True ","type":"text","marks":[{"type":"strong"}]},{"text":" in the ARM. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you want to use your existing Managed Identity, you will need these details: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Managed Identity Name ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Managed Identity Resource Group Name","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"NOTE: ","type":"text","marks":[{"type":"strong"}]},{"text":"If using an existing Managed Identity, ensure that NO permissions are assigned to it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To use an ","type":"text"},{"text":"Azure Active Directory (AAD) token ","type":"text","marks":[{"type":"strong"}]},{"text":"for Managed Identity authentication, we recommend using an existing Managed Identity and providing the permissions to access Databricks as explained in ","type":"text"},{"text":"Configure Managed Identity in Azure Databricks","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69408484"}}]},{"text":" section.","type":"text"},{"type":"hardBreak"},{"text":"NOTE","type":"text","marks":[{"type":"strong"}]},{"text":": The below-mentioned permissions have been added to the Kyvos 2022.3 release. ","type":"text"},{"type":"hardBreak"},{"text":"If you want to create a new Managed Identity with the deployment, perform the following steps after completing the cluster deployment.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Managed Identity in Azure Databricks","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69408484"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run JAR services from the Kyvos Manager. For this, navigate to the Kyvos Manager home page, and click the Actions menu on the dashboard. Select ","type":"text"},{"text":"Sync Operation > Run JAR services ","type":"text","marks":[{"type":"strong"}]},{"text":"option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart the BI Server.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"NOTE","type":"text","marks":[{"type":"strong"}]},{"text":": Post deployment of the cluster, you can change the Databricks Authentication type from the Databricks page on Kyvos Manager. ","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Important

When switching from AAD to PAT, you need to provide personal access token, which is saved as a secret in your Azure Key Vault and is read from there for authentication purposes. For this:

Go to Key Vault Secret.
Add KYVOS -DATABRICKS-SERVICE-TOKEN-DefaultHadoopCluster01 and provide the DB token value and click Save.

When switching from PAT to AAD, perform the following steps:

Configure Managed Identity in Azure Databricks
Run JAR services from the Kyvos Manager. For this, navigate to the Kyvos Manager home page, and click the Actions menu on the dashboard. Select Sync Operation > Run JAR services option.
Restart the BI Server

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Important","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"When switching from AAD to PAT, you need to provide ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0e101a"}}]},{"text":"personal access token, which is saved as a secret in your Azure Key Vault and is read from there for ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0e101a"}}]},{"text":"authentication purposes. For this:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0e101a"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0e101a"}}]},{"type":"hardBreak"},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0e101a"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to Key Vault Secret.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add","type":"text"},{"text":" ","type":"text"},{"text":" ","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"KYVOS","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"-DATABRICKS-SERVICE-TOKEN-DefaultHadoopCluster01","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":" and provide the DB token value and click ","type":"text"},{"text":"Save.","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"paragraph","content":[{"text":"When switching from PAT to ","type":"text"},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"AAD, perform the following steps:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0e101a"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Managed Identity in Azure Databricks","type":"text","marks":[{"type":"link","attrs":{"href":"https://documentation.kyvosinsights.com/display/KD20233/Configure+Managed+Identity+in+Azure+Databricks"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run JAR services from the Kyvos Manager. For this, navigate to the Kyvos Manager home page, and click the Actions menu on the dashboard. Select ","type":"text"},{"text":"Sync Operation > Run JAR services ","type":"text","marks":[{"type":"strong"}]},{"text":"option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart the BI Server","type":"text"}]}]}]}]}],"version":1},"reason":"An info macro in a list item can't be created or edited in the new editor."}}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Valid License file for Kyvos.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Secret Key to access the Kyvos bundle.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For ","type":"text"},{"text":"wizard-based deployment","type":"text","marks":[{"type":"strong"}]},{"text":", the Managed Identity should have the following permissions.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Tag Contributor role ","type":"text","marks":[{"type":"strong"}]},{"text":"attached to the Resource group. This allows you to apply tags on the Kyvos machine and storage without having access to the entity itself.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Virtual Machine Contributor","type":"text","marks":[{"type":"strong"}]},{"text":" role on the Resource group. This allows Kyvos to start, stop, create, and manage virtual machines in it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reader ","type":"text","marks":[{"type":"strong"}]},{"text":"on the Resource group. This allows a user to read deployment-related information.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Website Contributor role ","type":"text","marks":[{"type":"strong"}]},{"text":"attached tn the Resource group. This allows you to update schedule expression on the Azure function app (used for Automatic scheduling of Query Engines/BI Server).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Storage blob data contributor","type":"text","marks":[{"type":"strong"}]},{"text":" role attached to the storage/container account. This allows getting read/write access.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Contributor role","type":"text","marks":[{"type":"strong"}]},{"text":" attached on the managed identity to get Subscription ID and permission attached on the managed identity.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Contributor role","type":"text","marks":[{"type":"strong"}]},{"text":" permission must be attached to managed identity on resource level to start/stop Postgres Flexible server through scheduling.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Service Endpoints required on ","type":"text"},{"text":"Subnet","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":":","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Azure Storage (Microsoft.Storage)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"strong"},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=azure-portal#grant-access-from-a-virtual-network"}}]},{"text":":","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=azure-portal#grant-access-from-a-virtual-network"}}]},{"text":" This model enables you to secure and control the level of access to your storage accounts so that only applications requesting data over the specified set of networks or through the specified set of Azure resources can access a storage account. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Azure Key Vault (Microsoft.KeyVault)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"strong"},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints"}}]},{"text":": ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints"}}]},{"text":"The virtual network service endpoints for Azure Key Vault allow you to restrict access to a specified virtual network. The endpoints also allow you to restrict access to a list of IPv4 (internet protocol version 4) address ranges. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Azure App Service (Microsoft.Web)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"strong"},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions"}}]},{"text":":","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions"}}]},{"text":" By setting up access restrictions, you can define a priority-ordered allow/deny list that controls network access to your app. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Azure SQL Database (Microsoft.Sql)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"strong"},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/virtual-network/toc.json"}}]},{"text":": ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/virtual-network/toc.json"}}]},{"text":"Security feature that controls whether the server for your databases and elastic pools in ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":"Azure SQL Database","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview"}}]},{"text":" or for your dedicated SQL pool (formerly SQL DW) databases in ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":"Azure Synapse Analytics","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is"}}]},{"text":" accepts communications that are sent from particular subnets in virtual networks. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":" ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Databricks ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/databricks/clusters/create"}}]},{"text":"cluster with the following parameters:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Databricks Runtime Version:","type":"text","marks":[{"type":"strong"}]},{"text":" Select version 10.4 LTS (includes Apache Spark 3.2.1, Scala 2.12) ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Autopilot Options:","type":"text","marks":[{"type":"strong"}]},{"text":" Select the following: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Enable autoscaling:","type":"text","marks":[{"type":"strong"}]},{"text":" Select this to enable autoscaling.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Terminate after ___ minutes of inactivity","type":"text","marks":[{"type":"strong"}]},{"text":". Set the value as ","type":"text"},{"text":"30","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Worker type:","type":"text","marks":[{"type":"strong"}]},{"text":" Recommended value","type":"text"},{"text":" E16dsv4 ","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":" Min 2 Max 10","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Min Worker:","type":"text","marks":[{"type":"strong"}]},{"text":" Recommended value","type":"text"},{"text":" 2","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Max Workers: ","type":"text","marks":[{"type":"strong"}]},{"text":"Recommended value","type":"text"},{"text":" 10","type":"text","marks":[{"type":"strong"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Driver Type:","type":"text","marks":[{"type":"strong"}]},{"text":" Recommended value ","type":"text"},{"text":" E8dsv4 ","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Advanced options","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"You MUST assign read rights on ADLS Gen2 from where you want to read raw data ","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Spark Configurations","type":"text","marks":[{"type":"strong"}]},{"text":" define the required Service Principal to read and write on ADLS Gen2","type":"text"},{"type":"hardBreak"},{"text":"Sample configuration ","type":"text"}]},{"type":"codeBlock","content":[{"text":"spark.sql.parquet.int96AsTimestamp true\nspark.hadoop.spark.sql.parquet.binaryAsString false\nspark.hadoop.fs.azure.account.oauth2.client.secret {{secrets/kyvoskeys/kyvossecret}}\nspark.databricks.preemption.enabled false\nspark.hadoop.fs.azure.account.oauth2.client.endpoint https://login.microsoftonline.com/%7BTenant-ID%7D/oauth2/token \nspark.sql.parquet.binaryAsString false\nspark.hadoop.fs.azure.account.oauth2.client.id {Service-Principal-Client-ID}\nspark.hadoop.fs.azure.account.auth.type OAuth\nspark.hadoop.fs.azure.account.oauth.provider.type org.apache.hadoop.fs.azurebfs.oauth2.ClientCredsTokenProvider\nspark.hadoop.spark.sql.parquet.int96AsTimestamp true\nspark.hadoop.fs.azure.account.oauth2.msi.tenant {Tenant-ID}\nspark.sql.caseSensitive false\nspark.hadoop.spark.sql.caseSensitive false","type":"text"}]},{"type":"paragraph","content":[{"text":"NOTE","type":"text","marks":[{"type":"strong"}]},{"text":": You can directly provide the Secret for your Service Principal.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You must change Spark configurations to use managed disk. Ensure that you must not change the configuration in the default root (/tmp) volume.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Spark Configurations","type":"text","marks":[{"type":"strong"}]},{"text":", add the ","type":"text"},{"text":"spark.local.dir /local_disk0 ","type":"text","marks":[{"type":"strong"}]},{"text":"property where the ","type":"text"},{"text":"local_disk0","type":"text","marks":[{"type":"strong"}]},{"text":" is the managed disk.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Optionally, you can execute the ","type":"text"},{"text":"df -h","type":"text","marks":[{"type":"strong"}]},{"text":" command from a notebook for verification.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the ","type":"text"},{"text":"SPARK_WORKER_DIR=/local_disk0","type":"text","marks":[{"type":"strong"}]},{"text":" in the ","type":"text"},{"text":"Environment variables","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"For security concerns, put the Secrets in Key Vault, and assign it to Databricks. See details for Azure Key Vault Configuration for Kyvos.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":600,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":960,"id":"13975628-2a42-4e42-b31e-3fc2dd6a0640","collection":"contentId-69408355","type":"file","height":453}}]}]}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Databricks information:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Databricks Cluster Id: ","type":"text","marks":[{"type":"strong"}]},{"text":"To obtain this ID, click the Cluster Name on the Clusters page in Databricks. ","type":"text"},{"type":"hardBreak"},{"text":"The page URL shows /#/settings/clusters/. The cluster ID is the number after the","type":"text"},{"text":" /clusters/","type":"text","marks":[{"type":"strong"}]},{"text":" component in the URL of this page.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Databricks Cluster Organization ID:","type":"text","marks":[{"type":"strong"}]},{"text":" To obtain this ID, click the Cluster Name on the Clusters page in Databricks. ","type":"text"},{"type":"hardBreak"},{"text":"The number after o= in the workspace URL is the organization ID. For example, if the workspace URL is ","type":"text"},{"text":"https://westus.azuredatabricks.net/?o=7692xxxxxxxx","type":"text","marks":[{"type":"link","attrs":{"href":"https://westus.azuredatabricks.net/?o=7692xxxxxxxx"}}]},{"text":" , then the organization ID is 7692xxxxxxxx.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Object Id of Service Principal","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"assigned to Databricks. To obtain this, search ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#323130"}}]},{"text":" ","type":"text"},{"text":"App registration >","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":" Search and select your ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#323130"}}]},{"text":" ","type":"text"},{"text":"Service Principal","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":" name. Click the value of ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#323130"}}]},{"text":" ","type":"text"},{"text":" Managed application in local directory","type":"text","marks":[{"type":"strong"}]},{"text":". The overview page will display the ","type":"text"},{"text":"Object ID","type":"text","marks":[{"type":"strong"}]},{"text":" of the Service Principal.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key Vault URL","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":" If this is not provided, Kyvos will automatically create a new Key Vault for Azure passwords.","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text"},{"text":"NOTE: ","type":"text","marks":[{"type":"strong"}]},{"text":"You can","type":"text"},{"text":" create your own Key Vault ","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69408545"}}]},{"text":"for use with Kyvos. ","type":"text"},{"type":"hardBreak"},{"text":"If using an existing Key vault, ensure that the ","type":"text"},{"text":"Soft Delete","type":"text","marks":[{"type":"strong"}]},{"text":" property is enabled, or you can enable it later. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Permissions needed on Key Vault:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Assigned managed identity should have permission Secret Permissions (GET, LIST, and SET)","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For externally created Key Vault, provide the Databricks token manually in the Key Vault:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to Key Vault Secret.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add ","type":"text"},{"text":" KYVOS -DATABRICKS-SERVICE-TOKEN-DefaultHadoopCluster01 ","type":"text","marks":[{"type":"strong"}]},{"text":" and provide DB token value and save.","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" In case of Automated deployment, Wizard-based deployment, and/or if using an existing Azure Database for Postgres Flexible Server, ensure that a separate subnet attached to it with delegation (Microsoft.DBforPostgreSWL/flexibleServers and service endpoints Storage, KeyVault, SQL and Web). ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To use externally created Flexible Server in deployments, use ","type":"text"},{"text":"ARM template","type":"text","marks":[{"type":"link","attrs":{"href":"https://expanse.kyvosinsights.com/s/PrHk4NeDASz8dtT"}}]},{"text":" (","type":"text"},{"text":"FlexibleServerKyvosManagerRepository","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"FlexibleServerKyvosRepository","type":"text","marks":[{"type":"strong"}]},{"text":") to create Flexible Server that can be used in the deployments directly. OR, if you create Flexible Server through Microsoft, then you need to complete the following steps. For more information about how to create Flexible Server, refer to ","type":"text"},{"text":"Microsoft documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/quickstart-create-server-portal"}}]},{"text":". ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Kyvos repository ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Database name must be delverepo.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Username must be Postgres","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Following tags are expected on the external repository:","type":"text"},{"type":"hardBreak"},{"text":"UsedBy - Kyvos","type":"text"},{"type":"hardBreak"},{"text":"ROLE - DATABASE","type":"text"},{"type":"hardBreak"},{"text":"LAYER - Metadata_Storage","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Kyvos Manager repository ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Database name must be kmrepo.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Username must be kmdbuser","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Following tags are expected on the external repository:","type":"text"},{"type":"hardBreak"},{"text":"UsedBy - Kyvos","type":"text"},{"type":"hardBreak"},{"text":"ROLE - DATABASE_KM","type":"text"},{"type":"hardBreak"},{"text":"LAYER - Metadata_Storage","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To deploy the Kyvos cluster through the Kyvos Manager wizard method using ","type":"text"},{"text":"password-based authentication","type":"text","marks":[{"type":"strong"}]},{"text":" for service nodes, ensure that the ","type":"text"},{"text":"permissions listed here","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20233/pages/16354983"}}]},{"text":" are available on all the VM instances for Linux users deploying the cluster.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" To deploy the Kyvos cluster through the Kyvos Manager wizard method using ","type":"text"},{"text":"custom hostnames","type":"text","marks":[{"type":"strong"}]},{"text":" for resources, ensure that the ","type":"text"},{"text":"steps listed here ","type":"text","marks":[{"type":"link","attrs":{"href":"https://documentation.kyvosinsights.com/display/KD20233/Custom+hostnames+configuration+for+resources+to+be+used+in+Kyvos+deployment"}}]},{"text":"are completed. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Azure logged-in user should have the following rights to create Kyvos resources using ARM templates.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Owner Access on Resource group being used for deployment of Kyvos resources.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key and Secret Management rights on the Key vault if using an existing Key vault.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Networking: ","type":"text","marks":[{"type":"strong"}]},{"text":"Kyvos ARM template will need information about Vnet, Subnet, Network Interface/Security Group that will be used by Kyvos Machines.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a ","type":"text"},{"text":"Network Interface/Security Group","type":"text","marks":[{"type":"strong"}]},{"text":" with the following ports opened in ","type":"text"},{"text":"Inbound","type":"text","marks":[{"type":"strong"}]},{"text":" rules. ","type":"text"},{"type":"hardBreak"},{"text":"6602, 6903, 6703, 45450, 45460, 6603, 6803, 45440, 6605, 8081, 8080, 45421, 45564, 4000, 7009, 22, 8443, 8444. 9443, 9444.","type":"text"},{"type":"hardBreak"},{"text":"To enable Web Portal High Availability,","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If using Session Management, you will need 45564 and 4000 ports opened in ","type":"text"},{"text":"Inbound","type":"text","marks":[{"type":"strong"}]},{"text":" rules","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If using Azure Load Balancer, you will need port 80. ","type":"text"},{"type":"hardBreak"},{"text":"See ","type":"text"},{"text":"Ports required for Kyvos","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69412826"}}]},{"text":" for details.","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":"SSH Key pair","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"strong"}]},{"text":" consisting of a private key and a public key.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Storage account permission and recommendations:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Managed identity attached to the storage/container should have ","type":"text"},{"text":"storage blob data contributor","type":"text","marks":[{"type":"strong"}]},{"text":" permission.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the storage account is in a separate Resource Group (different from the one in which the Managed Identity exists), then the Managed Identity should have a ","type":"text"},{"text":"Reader","type":"text","marks":[{"type":"strong"}]},{"text":" role assigned to it at the Storage Account level. This permission is needed by the Kyvos Manager validation framework to check if the Storage Account is accessible or not.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Service principle attached to the Databricks cluster should have","type":"text"},{"text":" storage blob data contributor","type":"text","marks":[{"type":"strong"}]},{"text":" permission on the storage/container.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Soft deletion property must be disabled.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Storage account must be of type ADLS GEN 2.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"If the Databricks cluster and Kyvos resources are deployed in different networks, then VNET peering MUST be enabled between both networks. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"type":"hardBreak"},{"text":"Refer to ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":"VNet Peering","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}},{"type":"link","attrs":{"href":"https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal"}}]},{"text":" for more information. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#16191f"}}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you want to use Environment Validation to verify resources before Kyvos deployment, Databricks network peering, and port validation, you need to provide a set of additional permission on the Managed Identity. If Managed identity does not have the required permission, environment validation would fail in case of different networks are used in Kyvos and Databricks cluster. ","type":"text"},{"type":"hardBreak"},{"text":" In this case, you can add permissions to the managed identity using any of the two methods explained below:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Define a ","type":"text","marks":[{"type":"strong"}]},{"text":" custom role ","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://documentation.kyvosinsights.com/display/KD20233/Configuring+custom+role+for+network+peering+to+use+environment+validation"}}]},{"text":"with the following permissions","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/subnets/read","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/read","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/networkSecurityGroups/read","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read ","type":"text"},{"type":"hardBreak"},{"text":"OR","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Assign the following permissions without creating custom roles: ","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reader permission on both virtual networks used in peering","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reader permission on network security group [For port validation]","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" To access the Usage Dashboard, you need to provide ","type":"text"},{"text":"permissions","type":"text","marks":[{"type":"link","attrs":{"href":"https://documentation.kyvosinsights.com/display/KD20233/Configuring+Permissions+for+Usage+Dashboard"}}]},{"text":" after completing the deployment. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When upgrading Kyvos","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" ","type":"text"},{"text":" from an older version than 2022.1","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" ","type":"text"},{"text":", ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":"you must ensure the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"jq utility must be installed on the Query Engine instances.","type":"text"}]},{"type":"paragraph","content":[{"text":"Manual steps to download jq utility on the Query Engine instances:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SSH into the instance using the command:","type":"text"},{"type":"hardBreak"},{"text":"ssh -i pemfile kyvos@qe_ip","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run the following commands:","type":"text"}]},{"type":"codeBlock","content":[{"text":"cd /data/kyvos/installs/bin/\nwget https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 -O jq\nchmod a+x jq","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Upgrade Policy","type":"text","marks":[{"type":"strong"}]},{"text":" for Virtual Machine Scale Set should be set as ","type":"text"},{"text":"Manual","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When upgrading Kyvos","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" ","type":"text"},{"text":" from an older version than 2023.1","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" ","type":"text"},{"text":", ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#242424"}}]},{"text":" you must ensure the following: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"jq utility must be installed on the BI Server instances.","type":"text"}]},{"type":"paragraph","content":[{"text":"Manual steps to download jq utility on the BI Server instances:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SSH into the instance using the command:","type":"text"},{"type":"hardBreak"},{"text":"ssh -i pemfile kyvos@bi_ip","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run the following commands:","type":"text"}]},{"type":"codeBlock","content":[{"text":"cd /data/kyvos/installs/bin/\nwget https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64 -O jq\nchmod a+x jq","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When upgrading Kyvos from an older version than 2023.1, you must run the ","type":"text"},{"text":"openFirewallPortBi.sh","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://expanse.kyvosinsights.com/s/5DnHSXbRey24kw6"}}]},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"https://expanse.kyvosinsights.com/s/5DnHSXbRey24kw6"}}]},{"text":"script from the sudo user on all BI Server Instances. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Automated Azure deployment, ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Newly created Flexible Server:","type":"text","marks":[{"type":"strong"}]},{"text":" User provided password will be used for repository. No password change is required. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Existing Flexible Server:","type":"text","marks":[{"type":"strong"}]},{"text":" Password of the existing repository needs to be provided. No password change is required. ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Wizard-based Azure deployment, ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Kyvos Shared repository, password of existing repository needs to be provided. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Kyvos non-shared repository, password of repository can be provided as any value to which it will be changed. However for this change to work properly actual password of repository needs to be as delve123@","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If using pre-created external repository for Kyvos Manager, the initial password must ","type":"text"},{"text":"kyvosmanager#123","type":"text","marks":[{"type":"strong"}]}]}]}]}]}]},{"type":"panel","attrs":{"panelIconId":"atlassian-info","panelIcon":":info:","panelColor":"#FFFAE6","panelType":"custom"},"content":[{"type":"paragraph","content":[{"text":"Important","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Please save the details for future reference, as deployment will fail if you provide wrong details. ","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites to deploy Kyvos using Kubernetes ","type":"text"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"kubernetes"},"legacyAnchorId":{"value":"PrerequisitesforKyvosDeploymentonAzure-kubernetes"}},"macroMetadata":{"macroId":{"value":"888a3c8d519e58cd1f1d23fad3d7fe7d7bd46fd2014c8ca157a9d9854903e0f6"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"b9617e6b-4668-4584-9731-0bf32ec19f7e"}}]},{"type":"paragraph","content":[{"text":"Before deploying the Kubernetes cluster, it is recommended that you refer to the ","type":"text"},{"text":"Prerequisites to deploy Kyvos using Databricks","type":"text","marks":[{"type":"link","attrs":{"href":"#databricks"}}]},{"text":" section for the complete set of permissions required for deploying Kyvos. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Additionally, for creating an AKE cluster, you must complete the following prerequisites. ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you use an existing Virtual Network, a subnet with at least a /23 mask is required.","type":"text"},{"type":"hardBreak"},{"text":"IP Address requirements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Max Number of agentpool nodes = 1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Max Number of userpool nodes = 10","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Max Surge = 10 % = 2 nodes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Total nodes = Max Number of agentpool nodes + Max Number of userpool nodes + Max Surge","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Total nodes = 1 + 10 + 2 = 13 nodes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Max Pods per node = 30 (Minimum Limit from Azure End)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Total IP required = Total Nodes + Total nodes * Max Pods","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Total IP required = 13 + 13 * 30 = 403","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Following Service Points are required on the subnet: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Storage","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.ContainerRegistry","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.Sql","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Microsoft.KeyVault","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"For more details, see ","type":"text"},{"text":"Azure documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://learn.microsoft.com/en-us/azure/aks/concepts-network-ip-address-planning#ip-address-sizing"}}]},{"text":". ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Optional Information ","type":"text"}]},{"type":"paragraph","content":[{"text":" In addition to the prerequisites, you can also keep the following information handy according to your business requirements. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Boot Diagnostics Storage Account Uri:","type":"text","marks":[{"type":"strong"}]},{"text":" This is needed to store the Bootup logs of the VM. In case the value is empty, the boot diagnostics feature will be disabled for all Kyvos VMs.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Analytics Workspace Name and ","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Resource Group Name: ","type":"text","marks":[{"type":"strong"}]},{"text":"This is needed for enabling Log Analytics virtual machine extension for VMs used for monitoring Azure VM.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Shared Image Gallery Information:","type":"text","marks":[{"type":"strong"}]},{"text":" If you want to use your hardened images as a base OS for Kyvos VMs, then you will need the information for the following parameters:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Gallery Resource Group Name: ","type":"text","marks":[{"type":"strong"}]},{"text":"Name of the Resource Group in which the Gallery resides.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Gallery Subscription ID: ","type":"text","marks":[{"type":"strong"}]},{"text":"Subscription ID in which Gallery resides.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Gallery Name:","type":"text","marks":[{"type":"strong"}]},{"text":" Name of the Shared Image Gallery. An Azure image gallery is a repository for managing and sharing custom images. An image source can be an existing Azure VM. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Gallery Image Definition Name: ","type":"text","marks":[{"type":"strong"}]},{"text":" Name of the Image Definition. Image definitions are created within a gallery and carry information about the image and requirements for using it internally. This includes whether the image is Windows or Linux, release notes, and minimum and maximum memory requirements. It is a definition of a type of image. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Gallery Image Version Name: ","type":"text","marks":[{"type":"strong"}]},{"text":" Name of the Image Version in the ","type":"text"},{"text":"..","type":"text","marks":[{"type":"strong"}]},{"text":" format. ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"Azure Function Name: ","type":"text","marks":[{"type":"strong"}]},{"text":"If you want to use pre-created functions, then you can either provide the name of the function at the time of creating Kyvos resources through Kyvos Manager (Wizard-based deployment), or you can ","type":"text"},{"text":"create the function externally","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69408659"}}]},{"text":" (from the Azure portal), using the ","type":"text"},{"text":"azure_functions.json ","type":"text","marks":[{"type":"strong"}]},{"text":"template file or ","type":"text"},{"text":"azure_functions_secure.json","type":"text","marks":[{"type":"strong"}]},{"text":" file (for enhanced security) available in the Azure Installation Files folder. If upgrading from an older version (prior to 2021.3), you can use the steps mentioned in the section ","type":"text"},{"text":"Post-upgrade Steps","type":"text","marks":[{"type":"link","attrs":{"href":"https://kyvosdocumentation.atlassian.net/wiki/spaces/KD20242/pages/69412064"}}]},{"text":".","type":"text"}]}]}]}],"version":1}

Browser not supported