Deploying Kyvos on AWS

Security Configurations

Select the name of the Key Pair to be used with EC2 instances

A key pair consisting of a public key (stored by AWS), and a private key file (stored by the user). Together, they allow you to connect to your instance securely.

Enter the SSH Private Key text

Provide the text of your SSH key. To get this, open your .pem file in edit mode, and copy the complete text.

Enable SSH for EMR/Databricks/EKS cluster

This is not applicable to Databricks, as SSH is not supported on it. Hence, false is selected by default and cannot be changed.

S3 Configurations

S3 Bucket Name

Enter the S3 bucket name based on your selection during template generation:

• If you selected Create bucket with Kyvos deployment, enter the name of the bucket to be created.

• If you did not select Create bucket, enter the name of the existing bucket you want to use.

Note: See the AWS rules for naming buckets. Additionally, Kyvos does not allow. (dot) to be used for Bucket Name. The cluster may fail to deploy if you do not meet these requirements.

Network Configurations

VPC

Select the VPC in which EC2 instances will be launched.

Note: If you have created your VPC using the NAT Gateway template or the Internet Gateway template, select that VPC here.

Subnets

Select the Subnet to be attached to EC2 instances.

Note: In the case of Kyvos Web Portal HA (High Availability) or an RDS repository, you must select at least two subnets from different Availability Zones. Otherwise, you have to select only one subnet.

VPC Endpoint ID Used to access Private API Gateway

Enter the VPC Endpoint ID to enable access to the private API Gateway for deploying the Lambda function in a private environment.

IAM Roles Configurations

EC2 instances IAM Role

Provide the name of the IAM Role that you want to attach to the EC2 instance.

Lambda functions IAM role

Provide the name of the IAM Role that you want to attach to the Lambda functions.

RDS Configurations 

Create a new subnet group for RDS? 

Select ‘True’ to create a new subnet group for RDS.

Enter the name of existing Subnet group 

If creating a new subnet group for RDS is false, enter the name of the existing subnet group.

Choose the version of RDS which needs to be launched

Enter the RDS version to be launched. 

Note:

The Postgres version is upgraded to 16.12 for both new deployments and upgrades.

Instance Name of shared RDS

Enter the database instance identifier name of shared RDS.

Note: This parameter is displayed only when you use the existing RDS option during the Kyvos template creation.

Use shared RDS cluster

Enter the database instance identifier name of shared RDS.

Note: This parameter is displayed only when you use the existing RDS option during the Kyvos template creation.

AMI Configurations

Enter the AMI default logged in Linux user

Each Linux instance launches with a default Linux system user account. For more details, refer to AWS documentation.

Note: This option is displayed only if you selected the Custom Image option at the time of creating the template.

Enter the AMI ID to be used for launching Kyvos Instances

Provide the AMI ID.

Note: This option is displayed only if you selected the Custom Image option at the time of creating the template.

Custom Prefix Configurations

Custom Prefix EC2 Instances

Enter the prefix to be appended before Virtual Machines.

Note: The prefix can be up to 20 characters long and must begin and end with a word character.

Custom Prefix Volumes

Enter the prefix to be appended before Disks of Virtual Machines.

Note: The prefix can be up to 20 characters long and must begin and end with a word character.

Custom Prefix Other Services

Enter the prefix to be appended before the services: security groups, EMR, load balancer, and RDS (if included).

Note: The prefix can be up to 20 characters long and must begin and end with a word character.

Custom Prefix Secret Manager

Enter the prefix to be appended before Secret Manager.

Note: The prefix can be up to 20 characters long and must begin and end with a word character.

The parameter is displayed only when you select the Deploy with Enhanced Security checkbox while creating the CFT template.

Load-Balancer Configuration

Select the Public Subnets to be used for elastic load balancer

Select 2 public subnets, each from a different availability zone. Make sure that the public subnet's availability zone matches the availability zone of the private subnets in which Kyvos instances are launched.

Dedicated Compute Configurations

Dedicated Compute Minimum Nodes

Enter the minimum required number of worker nodes.

Dedicated Compute Minimum Nodes

Enter the maximum required number of worker nodes.

Kubernetes Configurations
(creating with new Kubernetes cluster)

NodeInstanceType

Enter the EC2 instance type for the worker nodes.
Note: If the value of the node Instance is less than the recommended value, you must set the following value in the HELIX_PARTICIPANT_MAX_CONCURRENT_TASKS Kyvos property through Kyvos Manager.

MinPodCount

Enter the number of Pod count.

MaxWorkerNodeCount

Enter the maximum desired number of worker nodes.

Kubernetes Configurations
(Using existing Kubernetes cluster)

Name of the Existing Kubernetes Cluster

Enter the name of the Existing Kubernetes Cluster.

Name of the Existing Node Group

Enter the name of the Existing Node Group name.

Name of the Existing IAM Role attached to Add-On's of the Kubernetes Cluster

Enter the name of the existing IAM Role attached to Add-On's of the Kubernetes Cluster.

Name of the Existing IAM Role attached to the NodeGroup

Enter the name of the existing IAM Role attached to the NodeGroup.

Count of the minimum worker

Specify the number of minimum worker nodes.

Note: Value of this parameter cannot be 0 and larger than the value of parameter MaxWorkerNodeCountExisting.

Count of the maximum worker

Specify the number of maximum worker nodes.

Note: If the values of MinPodCount and MaxWorkerNodeCount are the same, then scaling will be disabled.

Type of NodeGroup

Select one of the following options:

• Dedicated

• Shared

Note: If parameter KubernetesClusterType is Dedicated, then the value of this parameter should be dedicated.

Compute Pod NameSpace

Enter the namespace for the compute pod.

Note: If parameter ‘KubernetesClusterType’ is Shared, then the provided namespace must exist. If parameter ‘KubernetesClusterType’ is Dedicated, Kyvos will create the specified namespace.

Kyvos Configurations

Enter the Access key

Access key to access the Kyvos bundle. Contact us if you haven't received it yet.

Enter the Secret key

Secret key to access the Kyvos bundle. Contact us if you haven't received it yet.

Kyvos Work Directory

Enter the work directory path to be used by Kyvos.

Kyvos License Information

Enter the temporary Kyvos license key provided in your onboarding email. Copy the content of the license file here.

Show hostname for cluster deployment

Select true to use the hostname for cluster deployment.

DatabaseKmRepo

Enter the name of the database to be used for Kyvos Manager Repository.

Note: This parameter is displayed only when you select the Create New RDS option during the Kyvos template creation.

KyvosManagerRepoDBInstanceIdentifierName

Instance name of the shared RDS.

Note: This parameter is displayed only when you select the Existing RDS option during the Kyvos template creation.

PostgresPassword

Provide the password used for Postgres.

RDSPasswordKmRepo

Specifies the value of the password used for Kyvos Manager Repository. The password can include any printable ASCII character except "/", """, "@" and single quote.

Note: This parameter is displayed only when you select the ‘Create New’ or ‘Use Existing’ RDS option during the Kyvos template creation.

SecretName

Enter the name of your existing Secret Manager. If blank, a new Secret Manager will be created automatically.

Allowed IP Range

Provide the range of IP addresses allowed to access Kyvos Instances. Use 0.0.0.0/0 to allow all users access.

UsernameKmRepo

Enter the username to be used for connecting to the Kyvos Manager Repository.

Note: This parameter is displayed only when you select the ‘Create New’ or ‘Use Existing’ RDS option during the Kyvos template creation.

EKS

Processes semantic models and aggregations

EC2 instances

Host Kyvos services — Analytical Server, Query Engines, Kyvos Manager, Kyvos Web Portal, and Postgres

S3

Stores the Kyvos semantic model

RDS

Kyvos repository (alternative to the default bundled Postgres database)

Lambda

Enables the scheduling (cluster ON) features

API Gateway

Provides the REST URL for the Lambda function

CloudWatch Event

Schedules the Kyvos Analytical Server

Secrets Manager

Stores passwords — Kyvos DB password, Active Directory password, and SMTP password (if configured)

Security Group

Applied to Databricks and Kyvos instances, pre-configured with the requisite ports (see Port requirements for inbound rule details)