Post upgrade steps for No-Spark

• For AWS

• For Azure

• For GCP

From Kyvos 2025.3 onwards, support for the latest Kubernetes version on AWS (EKS), Azure (AKS), and GCP (GKE) for cluster upgrades has been added.

• EKS and GKE: Kubernetes version 1.32 is supported.

• AKS: Kubernetes version 1.31 is supported.

To upgrade EKS, refer to AWS Documentation.

To upgrade AKS, refer to Azure Documentation.

To upgrade GKE, refer to GCP Documentation.

From Kyvos 2025.4 onwards, the latest Kubernetes version, 1.32, on AWS (EKS), is supported for fresh deployments and cluster upgrades.

To configure Kubernetes to the latest release on AWS, perform the following steps.

1. Open OIDC role.

2. Click the Create inline policy option.

   Open

   

3. Copy the OIDC-POLICY.JSON content and paste it in the Specify Permission section.

   Open

   

4. Search the NODE_GROUP_ROLE_ARN in the pasted content and replace it with the ARN mentioned in the following image.

   Open

   

5. Open trust entity of OIDC role and click Edit.

6. Add system:serviceaccount:kube-system:cluster-autoscaler in the array of condition.

7. Go to the NodeGroup Role and remove the GetSecret policy from the role.

1. Upgrade the cluster with the release version you want to upgrade to.

2. Update the IAM Stack automated_deployment_iam_role.json and select yes to give EKS-related permissions to the IAM role.

3. Create an EKS cluster using CreateEks.json.

4. Run the following commands one by one on every Kyvos node to install kubectl

   1. curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

   2. unzip awscliv2.zip

   3. sudo ./aws/install --bin-dir /usr/local/bin/ --install-dir /usr/local/aws-cli --update o curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/1.29.3/2024-04-19/bin/linux/amd64/kubectl

   4. chmod +x ./kubectl

   5. sudo chown kyvos:kyvos kubectl

   6. sudo mv kubectl /bin/

   7. sudo mkdir -p /home/kyvos/.kube

   8. sudo chown -R kyvos:kyvos /home/kyvos/.kube

5. Run the commands below from sudo user on Kyvos Manager node to install eksctl.

   1. curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$ (uname -s)_amd64.tar.gz" | tar xz -C /tmp

   2. sudo cp /tmp/eksctl /bin/

6. Once the EKS cluster is created, go to the created node then go to Security.

7. Click the eks-cluster-sg-kyvosEks-{STACK-NAME}-random number as Security group.

8. Add inbound rule to the above security group with TCP 6903 and source group will be the Security Group attached to the Analytical Server.

9. Add inbound rule to the Web server security group with TCP 2181 and source group will be the Security Group which was mentioned above (eks-cluster-sg-kyvosEks-{STACK-NAME}-random number).

10. Add inbound rule to the Analytical Server security group with TCP 2181 and source group will be the Security Group which was mentioned above (eks-cluster-sg-kyvosEks-{STACK-NAME}-random number).

11. Add inbound rule to the Analytical Server security group with TCP 45460 and source group will be the Security Group which was mentioned above (eks-cluster-sg-kyvosEks-{STACK-NAME}-random number).

12. Add inbound rule to the Analytical Server security group with TCP 6803 and source group will be the Security Group which was mentioned above (eks-cluster-sg-kyvosEks-{STACK-NAME}-random number).

13. Open the deployment bucket permission section and add the ARN of OIDC and Node group role in the array.

14. Once the above changes are done, navigate to compute cluster page on Kyvos Manager and click on Native. Choose Containerized Kubernetes.

15. Provide the name of the Kubernetes Cluster, then Node Pool name and then the K8S auth role name. The name of the role can be found in the resource section of the EKS creation stack.

16. Copy the value of the EKSOidcRole key and that is the K8S auth role name.

17. Validate the information and click Save.

1. Create an AKS cluster via script. To create the AKS cluster, refer to Azure documentation.

2. Upload the CreateAks.json script (available in Azure Installation files folder) and complete the parameters given in the script.

3. Once the AKS cluster is created, configure it through Kyvos Manager on the Computer cluster page.

After creating compute master, you can configure to process the semantic model on a Compute Master (Independent Cluster), rather than on the Analytical Server. By default, semantic model processing runs on the Analytical Server within the same process.

To configure Kubernetes on GCP, perform the following steps.

1. Execute the following commands using the gcloud CLI to link the Kubernetes Service account to the IAM Service account.

   • gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:PROJECT_ID.svc.id.goog[kyvos-compute/kyvos-sa]"

     NOTE: Namespace can be custom.

     In the above-mentioned commands, replace the following:

     • IAM_SA_NAME: a name for your new IAM service account.

     • IAM_SA_PROJECT_ID: the project ID for your IAM service account.

     • PROJECT_ID: your Google Cloud project ID.

2. Additionally, if using a shared Virtual Network, below roles and permissions are required on by Default service account of Kubernetes (service-PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com) on project of Shared Virtual Network

   • Compute Network User

   • kubernetes_role (create a custom role)

     • compute.firewalls.create

     • compute.firewalls.delete

     • compute.firewalls.get

     • compute.firewalls.list

     • compute.firewalls.update

     • compute.networks.updatePolicy

     • compute.subnetworks.get

     • container.hostServiceAgent.use

3. · Add the following roles to the existing IAM Kyvos service account:

   • roles/iam.serviceAccountTokenCreator (Service Account Token Creator)

   • roles/container.developer (Kubernetes Engine Developer)

   • roles/container.clusterAdmin (Kubernetes Engine Cluster Admin)

4. Add the below permissions to existing service account:

   • compute.instanceGroupManagers.update

   • compute.instanceGroupManagers.get

5. SSH on All Instances one by one and run the below commands-

   • sudo apt-get update

   • sudo apt-get install apt-transport-https ca-certificates gnupg curl -y

   • curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg

   • echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list

   • sudo apt-get update && sudo apt-get install google-cloud-cli -y

   • sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin

   • sudo apt-get install kubectl

6. To install the Google Cloud CLI on all Kyvos nodes, refer to Google documentation.

7. Create Kubernetes cluster using Deployment scripts.

8. Open Kyvos Manager, go to Compute cluster page, Click the Kyvos Native tab.

9. Fill in the required inputs. Value provided to Worker Nodes Maximum Count should be same as you configured in templates. Click Save.

10. On Kyvos Manager > navigate to the Kyvos Properties page, ensure that the value of the KYVOS_PROCESS_COMPUTE_SUBTYPE property is Kubernetes compute.

If you use ARM architecture instances (Graviton) for Kyvos, you must also use them for dedicated compute, similarly for non-Graviton instances.
To create a new dedicated compute cluster, see the Working with dedicated compute cluster (AWS, Azure, and GCP) section.

• To a dedicated compute cluster by downloading the PostCreationDedicatedComputeAWS.json JSON file available in the AWS installation Files folder,

• To a dedicated compute cluster by downloading the PostCreationDedicatedComputeAzure.json JSON file available in the Azure installation Files folder,

• To a dedicated compute cluster by downloading the PostCreationDedicatedComputeGCP.json JSON file available in the GCP installation Files folder.

In case of an existing deployment upgraded to version 2025.4, you must update the PostCreationDedicatedCompute script on the dedicated compute cluster for all clouds (AWS, Azure, and GCP). See the Working with dedicated compute cluster (AWS, Azure, and GCP) section and follow case 2 as specified for all cloud platforms (AWS, Azure, and GCP), and delete the existing attached script.

After deploying Kyvos using no-Spark processing model, perform the following post deployment steps.

1. Modify the values of the following properties in the advance properties of semantic model job:

   • kyvos.process.compute.type=KYVOS_COMPUTE
     This property is required only if the Default Compute Cluster Type is External at the application level

   • kyvos.build.aggregate.type=TABULAR
     This property is not required if the semantic model is configured for Kyvos compute-based processing.

You need to add the Storage Blob Data Contributor role and add external location on the Azure portal.

• To add the Storage Blob Data Contributor role,

  1. On the Home page of the Azure portal, search for Storage Accounts.

  2. On the Storage Accounts page, select the storage account that is used for deployment.

  3. Navigate to Access Control (IAM).

  4. Select the Storage Blob Data Contributor role from the list.

  5. In the Assign Access to section, select Managed Identity.

  6. Click Select Member.

  7. On the Select Managed Identity dialog, select the Access Connector for Azure Databricks from the list.

  8. Click Review+assign and click save the permission.

     Open

     

• To add an external location,

  1. Go to Databricks workspace. In the left pane, click Catalog.

  2. Click Settings, and then click External Locations.

     Open

     

  3. On the External Location page, click Create location.

  4. On the Create Location dialog, add external location name, select the credentials from the list, and URL
     The URL must be in abfss://<Container name >@<Storage name >.dfs.core.windows.net/<Cluster engine_work directroy>
     For example, abfss://kyvoscontainer@kyvossa05751.dfs.core.windows.net/user/engine_work

  5. Click Create. Click Grant and select all privileges and grant them to the user whose token is used for while creating SQL Warehouse connection.

     Open

     

  6. Click Grant. The Permission is assigned.

After deploying Kyvos, please follow these steps:

1. Access the Kubernetes console and add taints.

2. Create an auto-scaler separately and in parallel to the node group from the Kubernetes console.

3. Log in to Kyvos Manager.

4. In the navigation pane, click on Utilities, then Manage Configuration Files.

5. On the Manage Configuration Files page, find the file named kyvos-compute-worker-job.yaml.template and click Download. The file will be downloaded.

6. Open the downloaded file and add the taint details (ensuring proper indentation) from the terminal.

7. After updating the file, click the corresponding Upload button.

8. On the Kyvos Manager node, navigate to the following path:
   /data/kyvos/installs/kyvosmanager_war/kyvosmanager/cloud/aws/templates/kyvos-k8s/
   Then run the following command:

   kubectl delete -f kyvos-compute-worker-disk-class.yaml

9. Open the file using the vi editor:

   vi kyvos-compute-worker-disk-class.yaml

10. In the file, search for the keyword gp2, and then add the following lines:

    encrypted: "true" kmsKeyId: arn:aws:kms:us-east-1:712283365795:key/eb18d30a-c5b6-408f-93c2-c5d8e098999a

11. Apply the updated file again using the following command:

    kubectl apply -f kyvos-compute-worker-disk-class.yaml

12. Save the changes on the Compute Server page.

13. Trigger the sanity check from Kyvos Manager. After this, both Kyvos and Kyvos Manager are upgraded to the latest version.

14. After the upgrade, repeat all of the above steps (1 to 13) without terminal access.

15. Resave the Compute Server page and trigger the sanity check again from Kyvos Manager.