Using System-assigned Managed Identity in Kyvos for Azure Deployments

This section describes how to configure and enable System-Assigned Managed Identity for Kyvos Azure deployments. This allows Kyvos services to securely access Azure resources without using explicit credentials.

By default, Kyvos uses User-Assigned Managed Identity on Azure deployments. However, you can also use System-Assigned Managed Identity for other services.

To configure System-Assigned Managed Identity for other services, edit the value of the VM_IDENTITY property in the global.properties file from Kyvos Manager.

• If System-Assigned Managed Identity is enabled on the Kyvos cluster and DFS is used for reading cuboids (kyvos.query.dfs.read=Cuboid), ensure the system-assigned identity attached to the Query Engine VMSS has the Storage Blob Data Contributor role on the Storage Account.

• If you want to proceed with wizard-based deployment using System-Assigned Managed Identity, you must complete the following post-deployment configuration:

  1. Go to /kyvosmanager/bin/setenv.sh and add the following parameters:

     MI_CLIENT_ID="Client Id of User Assigned Managed Identity" ADDITIONAL_SYS_PROPS="-DAZURE_CLIENT_ID=$MI_CLIENT_ID"

  2. Restart Kyvos Manager.

• After configuring the VM_IDENTITY property, you must enable System-Assigned Managed Identity on Kyvos VMs. This is a one-time activity for both fresh deployments and upgrades.

• You must enable the System assigned option on all Kyvos VMs and VMSS, using the steps below.

To enable System Assigned Identity, perform the following steps.

1. Navigate to your VM on the Azure portal, and then go to the Identity section.

2. Under the System assigned tab, set Status to On, and click Save.
   
   

   Open