/
Adding Azure Kubernetes Cluster Permissions

Adding Azure Kubernetes Cluster Permissions

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

✅ Enterprise: Azure

Overview

This section describes the required permissions and roles for accessing and managing an Azure Kubernetes Service (AKS) cluster used in a Kyvos deployment. Following these guidelines ensures proper cluster validation and smooth resource operations.

Important points

  • JRE 17 must be installed on the cluster if you use Kubernetes. For new deployments, JRE 17 is installed by default.

  • The permissions in this section are only required when the Kubernetes cluster is created externally, and you want to configure it for automated deployment or post-deployment/post-upgrade operations from Kyvos Manager.

  • No permission is required for new Kubernetes deployments when you select to create a new Kubernetes cluster within Kyvos.

  • If the Managed Identity (MI) of Kubernetes is different from Kyvos and TLS is enabled in Kyvos, ensure that the Kubernetes MI has ‘Get Secret’ permission on the Key Vault.

On this page:

For Existing Kubernetes Cluster

Ensure that you perform the following when using the existing Kubernetes cluster.

  1. The Compute Namespace is pre-created.

  2. A Storage Class is pre-configured.

  3. A dedicated namespace is assigned to each Kyvos application.

  4. If using a shared/existing Kubernetes cluster, ensure the user node pool must have the taint-ComputeWorkerOnly=true:NoSchedule

  5. To configure taints as per your requirement, modify the kyvos-compute-worker-job.yaml.template from Kyvos Manager on the Manage Configuration Files and save the changes. Then, navigate to Kyvos and Ecosystem > Compute Cluster and reapply the configuration to make it effective.

Permissions for Automated Deployment

Required permissions differ based on your Authentication and Authorization setting and whether the cluster is dedicated or shared.

  • Authentication: Microsoft Entra ID with Azure RBAC (AAD Enabled)

    image-20241220-093012.png

     

Cluster Type

Required Actions

Cluster Type

Required Actions

Dedicated

No action required.

Shared

  1. Namespace and Kyvos Managed Identity (MI) must already exist, with Azure Kubernetes Service RBAC Admin on the namespace.

  2. Download kyvos-compute-worker-disk-class.yaml and run kubectl apply -f kyvos-compute-worker-disk-class.yaml using a user/MI with Admin privileges on the cluster (creates the storage class). Tags in the file can be updated with comma-separated values if needed.

Note

This applies only when an existing Managed Identity is in use.

  • Authentication and Authorization: Local Accounts with Kubernetes RBAC (AAD is disabled)

    image-20241220-092905.png

     

Cluster Type

Required Actions

Cluster Type

Required Actions

Dedicated

No action required.

Shared

Namespace must already be created.

For Switching or Configuring Cluster After Deployment

The steps below also apply to wizard-based deployments, when configuring an existing Kubernetes cluster.

To use existing Kubernetes

  • If Authentication and Authorization is set to Microsoft Entra ID authentication with Azure RBAC (AAD is enabled)

    1. To configure as a dedicated cluster

      1. Assign Azure Kubernetes Service RBAC Cluster Admin to kyvos MI on Kubernetes .

      2. Assign Virtual Machine Contributor on Managed resource group of Kubernetes to Kyvos MI.

      3. Storage Blob Data Contributor to Kubernetes Managed Identity on bucket.

    2. To configure as a shared Cluster:

      1. Either namespace should be already created or provide Azure Kubernetes Service RBAC Cluster Admin permission to Kyvos Managed Identity on Kubernetes.

      2. Download kyvos-compute-worker-disk-class.yaml file and execute the kubectl apply –f kyvos-compute-worker-disk-class.yaml command from the user/MI which has Admin privileges on Kubernetes cluster. This is to create storage class. If required, you can update the tags in the file by passing comma-separated values.

      3. If namespace is already created, then Kyvos Managed Identity must have Azure Kubernetes Service RBAC Admin on namespace and Azure Kubernetes Service Cluster User Role on Kubernetes.

      4. Assign Reader on Managed resource group of Kubernetes to Kyvos Managed Identity.

      5. Storage Blob Data Contributor to Kubernetes Managed Identity on bucket.

  • If Authentication and Authorization is set to Local Accounts with Kubernetes RBAC (AAD is disabled)

    1. To configure as a dedicated Cluster

      1. Assign Contributor to Kyvos MI on Kubernetes.

      2. Assign Virtual Machine Contributor on Managed resource group of Kubernetes to Kyvos MI.

      3. Storage Blob Data Contributor to Kubernetes Managed Identity on bucket.

    2. To configure as a shared Cluster

      1. If namespace is already created, then Kyvos MI must have Azure Kubernetes Service Cluster User Role on Kubernetes.

      2. Assign Reader on Kubernetes to Kyvos MI.

      3. Assign Reader on Managed resource group of Kubernetes to Kyvos MI.

      4. Storage Blob Data Contributor to Kubernetes MI on bucket.

Note

If scaling is enabled in any of the following cases of shared Kubernetes cluster, the following roles must be assigned to Kyvos Managed Identity on the Kubernetes cluster.

  1. "Microsoft.ContainerService/managedClusters/agentPools/write"

  2. "Microsoft.ContainerService/managedClusters/agentPools/read"

Enhanced security

  1. Kubernetes Subnet must be allowed in networking rules of Kyvos storage account.

  2. Kubernetes Subnet must be allowed in networking rules of Kyvos Key Vault.

Prerequisites for the Proxy Server Node Pool

Kyvos will require a dedicated user node pool for running Proxy server pod.
Node Pool Configuration

Setting

Recommended Value

Setting

Recommended Value

Pool Mode

User

Purpose

Runs kyvos-proxy-server

Instance Size

Standard_D2s_v4

Scale Method

Autoscale

Minimum Node Count

0

Maximum Node Count

2

Operating System

Ubuntu Linux

OS Disk Size

100 GB

OS Disk Type

Standard_LRS

  • This node must have labels:

    • key: "worker-type"

    • value: "application"

Note

  • The label values above are defaults. If you change them, update the corresponding values in Kyvos Manager > Compute Cluster page as well.

  • A restart is required after configuring the node pool.

Networking Permissions

To retrieve the private IP of the Load Balancer, the Managed Identity associated with the AKS cluster must have these permissions on the VNet assigned to the cluster:

  • Microsoft.Network/virtualNetworks/subnets/read

  • Microsoft.Network/virtualNetworks/subnets/join/action

Namespace Requirements

  • Either namespace for proxy server should be already created or provide Azure Kubernetes Service RBAC Cluster Admin permission to Kyvos Managed Identity on Kubernetes.

  • If namespace for proxy server is already created, then Kyvos Managed Identity must have Azure Kubernetes Service RBAC Admin on namespace and Azure Kubernetes Service Cluster User Role on Kubernetes

Important

While configuring TLS:

  • Before changing any TLS-related properties in Kyvos Manager, ensure all compute worker pods are terminated.

  • After making any TLS configuration changes, you must reapply the configuration from the Kyvos Compute Cluster page.

 

Copyright Kyvos, Inc. 2026. All rights reserved.