Azure Disaster Recovery on SaaS

This documentation is for Kyvos 2026.6.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.6.x. To view documentation for other Kyvos versions, click here.

Overview

This page describes the steps required to perform Disaster Recovery (DR) for a Kyvos SaaS deployment on Azure. The process includes preparing Azure resources for failover, configuring Key Vault data, switching PostgreSQL Flexible Server instances to the DR region, and completing the necessary post-recovery tasks.

Following these steps helps ensure that critical platform components are available and operational in the disaster recovery environment.

On this page:

1 Overview
2 Prerequisites
3 Steps For Disaster Recovery

Note

The Kyvos Manager UI will be accessible to the customer only after all the required DR steps are completed.

Prerequisites

Before you perform the DR, ensure that the following prerequisites are met:

The customer’s primary cluster must have DR enabled.
Ensure that the primary cluster deployment and Kyvos deployment are successfully completed before initiating the DR preparation steps.

Steps For Disaster Recovery

Step 1: Storage Account Preparation for Failover

Prepare the storage account for disaster recovery.

Steps:

Navigate to the Storage Account associated with the primary cluster.
In the left navigation pane, go to Data Management.
Select Redundancy.
Click Prepare for failover.
Choose Unplanned Failover.
Enter yes and click Failover.

This step takes approximately 10 minutes and prepares the storage account to support failover operations in case of a disaster.

Step 2: Key Vault Administrator Role Assignment (Primary Cluster)

Assign the Key Vault Administrator role through Access control (IAM) at the Key Vault scope to the user account or service principal used for the replication process. This role provides the required data-plane permissions to access and manage keys, secrets, and certificates needed by the replication script.

Step 3: Key Vault Replication

The secrets and keys from the primary Key Vault need to be replicated to the DR Key Vault.

Steps:

Open the configuration file:
key-vault-config.sh
Fill in all the required parameters, including:
- Primary Key Vault details
- DR Key Vault details
- Resource group information
- Subscription details
Once the configuration is complete, execute the replication script:
./key-vault-replicate.sh

This script will create and replicate the required secrets, keys, and certificates from the primary Key Vault to the DR Key Vault.

Step 4: PostgreSQL Flexible Server – Switchover

For disaster recovery readiness, the PostgreSQL Flexible Server instances used by Kyvos and KyvosManager must be switched over to the DR region.

Steps:

Perform the following steps for both Flexible servers:

Kyvos PostgreSQL Flexible Server
KyvosManager PostgreSQL Flexible Server

Navigate to the PostgreSQL Flexible Server in the Azure portal.
Go to Settings > Replication.
Verify that the existing replication configuration is correct.
Do not modify the existing configuration.
Click Switch over to primary.

This will promote the replica server in the DR region as the new primary server.

Step 5: Cluster Deployment and Disaster Recovery

Deploy the DR cluster with the Kyvos SaaS DR template, providing the necessary details. Ensure to select the appropriate Recovery Mode:

Auto: Automates disaster recovery; doesn’t require any manual steps.
Manual: Requires user’s intervention to perform disaster recovery steps.

After the DR cluster is deployed, log in to Kyvos Manager through the Kyvos SaaS Portal. Based on the selected Recovery Mode, follow the corresponding disaster recovery procedure: