Managing Credentials from Kyvos Manager
This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here. |
|---|
This section describes how to manage credentials in Kyvos Manager, including changing the Kyvos repository password and configuring password encryption algorithms to ensure secure storage and access of sensitive information used by Kyvos services.
Note
From Kyvos 2024.9 onwards, post deployment, you can decrypt secret information by selecting the None option, which keeps the values in plain text.
From Kyvos 2023.3 onwards, you can see the last operation details, including progress status and start time. To view more comprehensive details, simply click the View Details link, which will take you to the Operations page where you can view the operation information in detail.
The Manage Credentials feature in Kyvos Manager enables you to:
Functionality | AWS | Azure | GCP | On-prem |
|---|---|---|---|---|
Change Node Authentication |
|
|
|
|
Change Repository Password |
|
|
|
|
|
|
|
| |
Change Password Encryption |
|
|
|
|
Changing Repository Password
This feature allows you to change the Kyvos repository password provided at the time of cluster deployment. The Analytical Server uses this password to connect to the Kyvos repository.
To change the password, perform the following steps.
On the Kyvos Manager navigation pane, click Manage Credentials.
Click Change repository password.
On the displayed Change Repository Password dialog box, provide the Current Password, New Password, and Confirm New Password.
Provide Kyvos Manager Password to continue.
Click the Save button to save your change.
Important
You MUST restart the Analytical Server to bring the new password into effect.
Encryption Algorithm Migration
From Kyvos 2026.7 onwards, Kyvos supports migration of the encryption algorithm from AES_128_GCM to AES_256_GCM. Perform the following steps to migrate the encryption algorithm.
Note
For Azure: Ensure that the Managed Identity is granted “Delete” permission on the Key Vault. Without this permission, the key disposal process will fail.
For GCP: For successful migration, ensure that the existing Kyvos service accounts are assigned the “Secret Manager Secret Version Manager” IAM role. This is required for automatic retention and disposal of old secret versions.
For all cloud environments: If a user has upgraded from Kyvos 2026.5 or any earlier release and then migrates from AES_128_GCM to AES_256_GCM encryption, then in the case of rollback, they must migrate back to AES_128_GCM encryption. This is required because versions prior to 2026.6 do not support AES_256_GCM encryption.
Navigate to Security > Manage Credentials > Encryption Algorithm and then click Change encryption algorithm.
From the Encryption Algorithm list, select the required encryption algorithm.
Enter the Kyvos Manager administrator password, and then click Change.
Restart the Analytical Server for the changes to take effect.
On-Demand Encryption Secret Key Rotation
From Kyvos 2026.7 onwards, Kyvos supports on-demand encryption secret key rotation.
Note
The Rotate Encryption Algorithm Key option is available only when the selected encryption algorithm is AES_256_GCM.
Perform the following steps to rotate the encryption key.
Navigate to Security > Manage Credentials.
Under Encryption Algorithm, click Rotate Encryption Algorithm Key.
Enter the Kyvos Manager administrator password, and then click Rotate.
Important
Encryption algorithm key rotation is also supported when multiple key vaults are configured.
On-demand encryption algorithm key rotation also supports secret stores configured at connection level. When the encryption key is rotated, the keys stored in the secret stores are also rotated. The regular periodic key rotation continues as usual.
Changing Password Storage
Kyvos Manager allows you to migrate your repository passwords (like SMTP, LDAP, Repository, OIDC, etc.) from the configuration file to a secrets manager like AWS Secrets Manager, Azure Key Vault, or GCP Secrets Manager.