/
Prerequisites for Wizard-Based Deployment on Azure

Prerequisites for Wizard-Based Deployment on Azure

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

✅ Enterprise: Azure

1. Overview

This section describes the prerequisites and system requirements you must meet before manually creating Kyvos resources on Azure. Before creating the Kyvos resources, ensure that the following prerequisites are in place.

2. Common Prerequisites for Kyvos Enterprise and Azure.

Before completing the prerequisites listed on this page, complete the Common Prerequisites for Kyvos Enterprise and Azure.

3. Flexible Server Prerequisites

Prerequisites for configuring an Azure Database for PostgreSQL Flexible Server as the repository for Kyvos and Kyvos Manager during Azure deployments:

  • A separate subnet must be attached with delegation to Microsoft.DBforPostgreSQL/flexibleServers and service endpoints for Storage, KeyVault, SQL, and Web.

  • If using an existing Azure Database for Postgres Flexible Server: Contributor role permission must be attached to the managed identity at the resource level to start/stop the Postgres Flexible Server through scheduling.

  • The Flexible Server must be in the same resource group and region as the other Kyvos cluster resources. If not in the same resource group, Start/Stop functionality during scheduling will not work.

  • To use an externally created Flexible Server:

    • Use the ARM templates FlexibleServerKyvosManagerRepository and FlexibleServerKyvosRepository (available in the Azure Installation Files folder), OR

    • Create a Flexible Server version 16 (supported for both new deployments and upgrades) via Microsoft, then complete the configuration below. Refer to Microsoft documentation for creating a Flexible Server.

3.1 Repository Configuration

Setting

Kyvos Repository

Kyvos Manager Repository

Setting

Kyvos Repository

Kyvos Manager Repository

Database name

delverepo

kmrepo

Username

postgres

kmdbuser

Expected Tags

UsedBy - Kyvos
ROLE - DATABASE
LAYER - Metadata_Storage

UsedBy - Kyvos
ROLE - DATABASE_KM
LAYER - Metadata_Storage

3.2. Flexible Server Password

Flexible Server password prerequisites for Wizard based deployment:

Scenario

Password Requirement

Scenario

Password Requirement

Kyvos shared repository

Password of the existing repository must be provided

Kyvos non-shared repository

Password must be delve123@ (user may provide any password of choice on the wizard window; the Kyvos repository password will be changed after deployment)

External repository used for Kyvos Manager

Password must be kyvosmanager#123

On this page:

Read prerequisites:

Next step:

4. Flexible Server Configuration as the Kyvos Manager Repository

To configure Flexible Server as a Kyvos Manager repository, perform the following steps.

  1. Create a Flexible Server. See section 3, Prerequisites for Flexible Server section, as mentioned below in this section.

  2. Once Kyvos Manager node is created and extracted the bundle. You must not start Kyvos Manager services.  

  3. Configure the jdbc.properties of Kyvos Manager (manually) with the Flexible Server details:  

    1. Ensure Kyvos Manager is not started before configuring jdbc.properties. The file is located at: /data/kyvos/installs/kyvosmanager_war/kyvosmanagerdata/server/db

    2. Replace the server name in the JDBC URL with the Flexible Server's server name, port, and SSL setting:

      jdbc.url=jdbc:postgresql://<Servername>:<port>/kmrepo?sslmode=require

      For example,

      jdbc.url=jdbc:postgresql://kyvosmanager-postgresserver-5122.postgres.database.azure.com:5432/kmrepo?sslmode=require

    3. jdbc.username must be kmdbuser.

    4. Set useBundledRepo and manageBundledRepoService to false.

  4. Go to /data/kyvos/installs/kyvosmanager_war/kyvosmanager/bin and execute the ./start-km.sh command to start Kyvos Manager.

5. Managed Identity Permissions

The Managed Identity must have the following permissions:

  • Tag Contributor on the Resource group — allows applying tags to the Kyvos machine and storage without granting access to the resource itself.

  • Virtual Machine Contributor on the Resource group — allows Kyvos to start, stop, create, and manage virtual machines within it.

  • Reader on the Resource group — allows reading deployment-related information.

  • Website Contributor on the Resource group — allows updating the schedule expression on the Azure Function App (used for automatic scheduling of Query Engines/Analytical Server).

  • Storage Blob Data Contributor on the storage account/container — allows read/write access to blob data.

  • Contributor on the managed identity itself — allows retrieving the Subscription ID and confirming permissions attached to the managed identity.

  • Contributor on the resource (at the resource level) — required to start/stop the PostgreSQL Flexible Server through scheduling.

5.1 Secret Permissions for an Existing Key Vault

If you use an existing Key Vault, the assigned Managed Identity must have the following Secret permissions:

Permission

Purpose

Permission

Purpose

GET

Retrieve secret values

LIST

View available secrets

SET

Create or update secrets

6. Important points

  • Using the same external repository instance is not recommended/certified for both Kyvos Manager and Kyvos.

  • Cluster scheduling with a non-shared repo will cause the DB instance to go down, so Kyvos Manager will not work properly.

  • If the same repository instance is used, the database for Kyvos Manager and Kyvos must be different:

    • Default database name for Kyvos: delverepo

    • Default database name for Kyvos Manager: kmrepo

  • If the same external repository instance is ever configured in both Kyvos Manager and Kyvos, ensure that on the Switch Repository page of Kyvos Manager, the Shared repository option is checked and the configuration is saved.

Copyright Kyvos, Inc. 2026. All rights reserved.