Common Prerequisites for Deployment on Azure

This custom role is not required if the network resources are created using the Kyvos-provided template.

For information about creating and assigning the custom role, see the Configuring Roles for Deployment User section.

A Managed Identity can be used for Kyvos resources.

Managed Identity is optional. It is created when 'Enable Managed Identity Creation' is set to 'True' in the ARM template.

If you want to use an existing Managed Identity, provide the following details:

If you use an existing Managed Identity, ensure that no permissions are assigned to it.

Provide the Key Vault URL to use during deployment.

You can also create your own Key Vault for use with Kyvos.

If you use an existing Key Vault, the assigned Managed Identity must have the following Secret permissions:

Kyvos requires information about the VNet, subnet, and Network Interface/Security Group that will be used by Kyvos machines.

Configure the following service endpoints on the subnet. These allow access to the corresponding Azure services from the specified subnet and help control network access.

Create a Network Interface/Security Group with the following ports opened in the Inbound rules:

For more information, see Ports required for Kyvos.

If you use an existing Virtual Network, the subnet must have at least a /23 mask.

For automated deployment, wizard-based deployment, or when using an existing Azure Database for PostgreSQL Flexible Server, ensure the Flexible Server has a separate subnet attached with the following:

To use an externally created Flexible Server, you can use the ARM template containing:

• FlexibleServerKyvosManagerRepository

• FlexibleServerKyvosRepository

Alternatively, if you create the Flexible Server directly through Microsoft, complete the configuration described in the sections below. For more information, refer to the Microsoft documentation.

The Azure logged-in user must have the following permissions to create Kyvos resources using ARM templates:

• Owner access on the Resource Group used for deploying Kyvos resources.

• Key and Secret Management rights on the Key Vault, if an existing Key Vault is used.

Ensure the storage account meets the following requirements:

• The Managed Identity attached to the storage/container must have Storage Blob Data Contributor permission.

• If the storage account is in a different Resource Group from the Managed Identity, assign the Managed Identity the Reader role at the Storage Account level. This is required by the Kyvos Manager validation framework to verify storage account accessibility.

• Soft deletion must be disabled.

• The storage account must be of type ADLS Gen2.

To access the Usage Dashboard, provide the required permissions after completing the deployment. See Configuring Permissions for Usage Dashboard.

The following limits and requirements apply for AKS deployment:

For more details, see the Azure documentation.

In addition to the prerequisites, keep the following information handy based on your business requirements.

• Boot Diagnostics Storage Account URI: Used to store the bootup logs of the VM. If left empty, the boot diagnostics feature will be disabled for all Kyvos VMs.

• Log Analytics Workspace Details: Required to enable the Log Analytics virtual machine extension, used for monitoring Azure VMs.

• • Workspace Name

  • Resource Group Name

• Shared Image Gallery Information: If you want to use your hardened images as the base OS for Kyvos VMs, you'll need the following parameters:

• Azure Function Name: If you want to use pre-created functions, you have two options:

  • Provide the function name while creating Kyvos resources through Kyvos Manager (wizard-based deployment), or

  • Create the function externally via the Azure portal, using the azure_functions.json template (or azure_functions_secure.json for enhanced security), available in the Azure Installation Files folder.