Network Communication
This documentation is for Kyvos 2026.6.x. To view documentation for other Kyvos versions, click here. |
|---|
Overview
This section explains how to configure network communication settings in Kyvos Manager to enable secure communication between Kyvos services and Kyvos Manager using protocols such as HTTP, HTTPS, and TLS, including certificate and mutual authentication configurations.
Note
You can see the last performed network communication operation details, including progress status and start time, by clicking the i icon located next to the Revert button. To view more comprehensive details, simply click the View Details link, which will take you to the Operations page, where you can view the operation information in detail.
You can also define HTTP2 configuration from the Network Communication page. Further, you can specify HTTP2 configuration for the Kyvos Web portal even if TLS is not enabled.
The Network Communication page allows you to configure secured communication settings (HTTPS/TLS) for Kyvos and Kyvos Manager.
Kyvos supports TLS communication with Mutual Authentication for all internal communications and authentication-related information. Mutual authentication is used when the server wants to authenticate the client as a trusted partner. The server requests mutual authentication, and the client needs to present its certificate to the server while establishing the connection.
Configuring TLS communication settings
Important
From Kyvos release 2026.5 onwards, all cloud, managed services, and SaaS deployments running with JRE 17 must use SAN-enabled TLS certificates. The certificate's Subject Alternative Name (SAN) extension must include the IP addresses and/or hostnames of all Analytical Server, Web Portal, Query Engine, and Kyvos Manager nodes. Certificates that do not contain the required SAN entries are not supported. Users must validate and update their certificates before upgrading to this release.
This is not applicable for on-premises (Java8) setup. For more details, click here.
To configure the TLS communication settings for the cluster from Kyvos Manager, click Security > Network Communication.
The following figure displays the Network Communication page.
On the Network Communication page, select one of the following options and complete the parameters displayed for the selected option.
Select with TLS on all Kyvos Services and Kyvos Manager
Secured HTTPS on Kyvos Web Portal Only
HTTP
Enter details as:
Area | Parameter/Field | Comments/Description |
|---|---|---|
| HTTP Protocol | Select the HTTP Protocol to use. Before enabling HTTP2, ensure that the prerequisites are completed. |
TLS Configuration | TLS Protocol | Select the version for SSL/TLS protocol to be used. For multiple versions, select the corresponding checkboxes. |
| TLS Certificate mode | Select one of the following certificate mode.
|
| Keystore | This file is used by the server when secure communication is enabled and required by the client when mutual authentication is enabled. Specify the Keystore by selecting one of the following:
|
| Keystore Password | Enter the keystore password. |
| Truststore | This file is required by the client when secure communication is enabled and required by the server when mutual authentication is enabled. Specify the Truststore by selecting one of the following:
|
| Truststore Password | Enter the truststore password. Note: If not specified, the last provided password will be used. To change, enter a new password. |
| Cipher Suite | Enter the encryption algorithm to be used for communication over the TLS layer. |
| Enable Mutual Authentication | Select to enable mutual authentication. |
| Custom Attributes for Mutual Authentication connector | Here, provide the key value pair for the Connector. |
| Skip Host Name Verification | Select Yes to skip host name verification to enable TLS communication in IP address based cluster. NOTE: It is mandatory to skip host name verification to enable TLS communication in IP address based cluster. The property HOSTNAME_VERIFIER value will be updated in the "globals.properties" file. |
Kyvos Web Portal Configuration | Certificate |
|
| Keystore | This file is used by the server when secure communication is enabled and required by the client when mutual authentication is enabled. Specify the Keystore by selecting one of the following:
|
| Keystore Password | Enter the keystore password. |
Custom Attributes for HTTP2 over TLS connector | Custom Attributes for HTTP2 over TLS connector | Here, provide the key value pairs for the following parameters:
|
Note
If HTTPS is enabled for the Kyvos Web portal with TLS not enabled and Analytical Server is not on the Web server node, perform the following steps for the correct working of the Dashboard Sharing via email.
Make sure valid certificates are present on the Web server node and Analytical Server node.
Go to the Analytical Server nodes on which the Web server is not configured.
Open the olapengine.properties file and set the value of CLIENT_URL to non-http Kyvos URL with 8081 port. For example, CLIENT_URL= http://cdh1.kyvostest.com:8081/kyvos
Restart the Analytical Server.
Important
If you use Proxy Server with Kubernetes compute sub type, while configuring TLS:
Before changing any properties from Kyvos Manager, ensure that all the computer worker pods are terminated.
If you make any changes in configurations of TLS, you must re-apply the configurations from the Kyvos Compute Cluster page.
From Kyvos 2026.2 onwards, validation checks for PostgreSQL TLS certificates include the truststore.jks and keystore.jks files.
TLS configuration on the required nodes occurs only if the certificate extraction succeeds.
If extraction fails, the system waits for the configured timeout (currently 60 seconds), logs a message, and skips the TLS configuration to avoid incomplete or inconsistent setup.
The PostgreSQL certification and extraction include the following:
For Install PG, the certificate extraction is performed only on the Kyvos Manager node. However, configuration happens in configuration files of Kyvos and placed on all the nodes of cluster.
For Bundled PostgreSQL, the certificate extraction is performed only on the Kyvos Manager node. However, certificate configuration is performed on all nodes, including , Query Engine, Kyvos Manager, and Kyvos Web Portal.
For External Repository, the certificate configuration are not performed on any node.