Patch Deployment

This section explains the process, requirements, and best practices for deploying Kyvos patches in existing environments.

• Single-Click Patch Deployment for Kyvos Manager and Kyvos

• Kyvos Patch Deployment

• Kyvos Manager Patch Deployment

• Migrating Kyvos Repository to PostgreSQL: (from v13 to v16)

You can now deploy a patch on an existing Kyvos Manager and Kyvos version.

From Kyvos 2025.8 onwards, support for Kyvos JRE and Tomcat is included through the Kyvos Bundle. This is particularly useful for addressing JRE and Tomcat vulnerabilities via Kyvos patch deployment, without requiring a full Kyvos upgrade.

You can deploy a patch for Kyvos Manager and Kyvos with a single click using the patch bundle, which may or may not contain a Kyvos patch bundle. If the Kyvos patch bundle is included in the patch bundle, the Kyvos patch deployment will follow the Kyvos Manager patch deployment.

If you deploy a patch for Kyvos Manager, you must initiate the Kyvos patch deployment afterward, if applicable.

To deploy a patch on an existing Kyvos version, perform the following steps.

You can deploy patch for Kyvos Manager. The following steps are applicable to all cloud environments (AWS, Azure, GCP) and on-premises environment.

To deploy patch for Kyvos Manager, perform the following steps.

1. On the Kyvos Manager, click Application Update > Patch.

2. The Patch page is displayed with the current version details of Kyvos.

3. Select Kyvos Manager from the Upgrade list.

4. In the Locate Bundle By, select any of the following options, and provide the corresponding details.

   1. Path: Provide the Kyvos Manager bundle path on the node on which Kyvos Manager is running.

   2. File: Click the Select Bundle link to choose the Kyvos bundle from a list of compatible versions. Or, click the Upload New Bundle link to upload the package to be used for the upgrade.

   3. Version: Enter the Kyvos Bundle Key to access the bundle, and then click the Fetch Versions button. Select the required version from the Version list to which you want to upgrade. All future versions available for upgrading will be displayed.

5. Click the required Select Patch from a list of compatible versions.

6. Click the Patch Now button on the top-right of the page.

7. On the displayed confirmation message box, enter your Kyvos Manager Password to confirm the patch deployment.

Open

To minimize downtime and prevent data loss during the PostgreSQL upgrade, follow these steps.

1. Log in to Kyvos Manager.

2. Navigate to Application Update > Patch. On the page, apply the provided Kyvos patch.

3. Perform basic sanity checks on the system.

4. Stop all Kyvos services.

5. Stop the Kyvos Manager from the current Kyvos Manager home path using the stop-km.sh script.

6. Take a database dump for the delverepo, kmrepo, and usagerepo (for cloud only) databases.

   ./pg_dump -c -C --host=localhost --port=45421 --dbname=delverepo --username=postgres -f delverepodump.sql ./pg_dump -c -C --host=localhost --port=45421 --dbname=kmrepo --user=postgres -f kmrepodump.sql ./pg_dump -c -C --host=localhost --port=45421 --dbname=usagerepo --user=postgres -f usagerepodump.sql

7. Stop the existing PostgreSQL (version 13) from the <<KYVOS-INSTALL-PATH>>/postgres/bin/ path using the stop-pg script.

8. Rename the existing postgres folder (parallel to the kyvos folder) to postgres_13.  

9. Move the extracted postgres16.9 folder from inside the ../kyvos/ folder to the same level as the postgres_13 folder.

10. Rename postgres16.9 to postgres.

11. Start the new PostgreSQL (version 16) from the <<KYVOS-INSTALL-PATH>>/postgres/bin/ folder using the start-pg command.

12. Validate that all required blank databases are created in the shipped PostgreSQL 16, with each database owned by the expected user.

13. If TLS is enabled on the Kyvos cluster, copy the two certificate files: server.crt and server.key — to postgres/data/ from the original PostgreSQL installation, and update the three TLS-related properties in postgresql.conf

    1. ssl = on

    2. Update the certificate and key file names with their respective values.

    3. Stop and then start postgres from PATH>>/postgres/bin/ folder using the start-pg command and stop-pg command.

14. Update passwords if the passwords of user accounts (kmdbuser or postgres) differ from the defaults, update them in PostgreSQL 16.
    ALTER USER <user name> WITH PASSWORD 'XXXXX';

15. Import database dumps for delverepo, kmrepo, and usagerepo (for clouds only) into their respective databases using the PostgreSQL superuser (postgres).

    ./psql -U postgres -p 45421 -h localhost -f /data/kyvos/app/postgres_13/bin/delverepodump.sql ./psql -U postgres -p 45421 -h localhost -f /data/kyvos/app/postgres_13/bin/kmrepodump.sql ./psql -U postgres -p 45421 -h localhost -f /data/kyvos/app/postgres_13/bin/usagerepodump.sql

16. Validate that all tables are imported.

17. Start Kyvos Manager from the current Kyvos Manager home path using the start-km.sh script (Validate cluster is displayed).

18. Start all Kyvos services and validate successful startup and functionality.