Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.risingwave.com/llms.txt

Use this file to discover all available pages before exploring further.

The Bring Your Own Cloud (BYOC) plan offers you the flexibility to tailor your cloud infrastructure instead of depending on a hosted service. It allows you to utilize the advantages of your chosen cloud provider, maintain full control over your environment, and adjust configurations to suit your specific needs.

​
Architecture overview

Before creating a BYOC deployment, familiarize yourself with the following architecture. In the BYOC environment, the entire data plane is deployed in the user’s space. To manage the RisingWave clusters within this environment, we deploy two key services for operation delegation:
  • Agent Service: This service manages Kubernetes (K8s) and cloud resources. It handles tasks such as managing RisingWave Pods, storage services (including AWS S3, GCS, and Azure Blob Storage), IAM roles/accounts associated with the RisingWave cluster, network endpoints, etc.
  • RWProxy: This is a TCP proxy that routes SQL statements from the control plane to the appropriate RisingWave instances. Control plane will issue SQL queries to retrieve cluster metadata and health status.

​
Prerequisites

BYOC uses the rwc (RisingWave Cloud CLI) to provision and manage environments. Before continuing, install and authenticate the CLI by following Install the RisingWave Cloud CLI. Once rwc cluster list runs successfully in your chosen region, you are ready to create a BYOC environment.

​
Create a BYOC environment

Follow the steps below to create your own cloud environment.
  1. Navigate to the Projects page and click Create project.
  2. Select a deployment mode. Choose BYOC.
  3. Select a service provider. Choose your cloud platform (AWS, GCP, or Azure) and your preferred region. See Resource and permission for more details.
    If you’re using AWS, ensure you’re not using the AWS account root user for any deployment or operational tasks. Always use IAM users or roles with appropriate permissions instead.
    If you’re using AWS with AWS Firewall Manager (FMS) security group policies enabled, please contact our support team before creating a BYOC environment. FMS automatically attaches managed security groups to EC2 instances, which requires additional configuration to prevent node stability issues.
  4. Prepare the BYOC environment section. Click Setup now and follow the steps to set up your BYOC environment. Please note that the final command rwc byoc apply --name xxx may take 30 to 40 minutes to complete, and a progress bar will keep you informed of its progress. During this time, it’s crucial to ensure a stable internet connection. If the command is interrupted or fails due to network instability, you can safely retry it.
    When you run the command rwc byoc apply --name xxx, it will deploy some resources in your AWS/GCP/Azure environment, such as AWS S3/Google Cloud Storage/Azure Blob Storage and EKS/GKE/AKS clusters. Please do not modify the configuration of these resources. If you encounter any issues during this process, please contact our support team.
  5. Select compute size in RWU. For most users, standard sizes offer the best performance and cost balance. Choose Custom if the standard sizes don’t meet your workload requirements. To learn more about the nodes, see the architecture of RisingWave.
  6. Click Summary, then Confirm, and run the command that appears to set up a BYOC cluster in your environment.
Once the cluster is successfully created, you can manage it through the portal just like hosted clusters.

​
Configure custom settings

RisingWave provides several custom settings for BYOC deployments. To enable this feature, you need to create a configuration file containing the custom settings. These settings can be applied when creating a new BYOC environment or updating an existing one. Below are all supported custom settings:

​
General settings

SettingTypeDescription
container_security_contextObjectKubernetes SecurityContext applied to all containers in RisingWave-managed namespaces: cloudagent, rwproxy, risingwave-operator-system, and rwc-*.
pod_security_admission_labelsMapPod Security Admission labels applied to all RisingWave-managed namespaces.
extra_tagsMapCustom tags applied to cloud vendor resources managed by RisingWave.
disable_external_cluster_accessBooleanWhen set to true, disables external (Internet-facing) access to RisingWave clusters.

​
AWS settings (aws_settings)

SettingTypeDescription
eks_node_ami_release_versionStringCustom AMI release version for EKS nodes. If omitted, the default AMI is used.

​
Metrics settings (metrics_settings)

SettingTypeDescription
discarded_risingwave_metrics_regexListA list of regular expressions matching metric names to discard when scraping RisingWave.
risingwave_scraping_interval_secsIntegerScraping interval in seconds for RisingWave metrics.

​
Create a configuration file

  1. Create a file at path BYOC_CONFIG with desired custom settings. You can include only the settings you need and omit others: 
    # General settings
container_security_context:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 65521
  seccompProfile:
    type: RuntimeDefault
pod_security_admission_labels:
  pod-security.kubernetes.io/enforce: restricted
extra_tags:
  foo: bar
disable_external_cluster_access: true

# AWS-specific settings
aws_settings:
  eks_node_ami_release_version: 1.32.0-20241225

# Metrics settings
metrics_settings:
  discarded_risingwave_metrics_regex:
    - "^risingwave_.*_total$"
  risingwave_scraping_interval_secs: 30
  2. Save the file path $BYOC_CONFIG, as you will use it in the later steps.

​
Apply to a BYOC environment

You may either create a new BYOC environment or update your existing one to apply the custom settings.
  1. Run the following command to create a new BYOC environment with custom settings. $BYOC_CONFIG is the file path of the config file created in the previous step.
$ rwc byoc create \
	--cidr $BYOC_CIDR \
	--cloud-account-id $ACCOUNT_ID \
	--name $BYOC_NAME \
	--custom-settings-path $BYOC_CONFIG
  1. Apply custom settings to the new BYOC environment. This may take up to 30 minutes.
$ rwc byoc apply --name $BYOC_NAME

​
Resource and permission

When you customize your cloud platform, refer to the following notes to see what we’ve set up for you and the permissions you need to enable.
  • Required service-linked role The role AWSServiceRoleForAutoScaling needs to be in place. If it is not ready yet, you need to create it manually. See Create a service-linked role for detailed steps.
  • Required quota increase For optimal performance, the quota for managed node groups per cluster should be increased to 36 or more. See Service quotas for more details.
  • Required permissions for BYOC environment creation/deletion The IAM role/user requires the following roles to create or delete a BYOC environment:
    • AmazonDynamoDBFullAccess
    • AmazonEC2FullAccess
    • AmazonElasticContainerRegistryPublicReadOnly
    • AmazonPrometheusFullAccess
    • AmazonS3FullAccess
    • AmazonVPCFullAccess
    • AWSKeyManagementServicePowerUser
    • CloudWatchLogsFullAccess
    • IAMFullAccess
    Additionally, attach a policy that includes the following permissions: 
    {
   "Version": "2012-10-17",
   "Statement": [
      {
            "Sid": "BYOCAdditionalAccess",
            "Effect": "Allow",
            "Action": [
               "eks:*",
               "kms:*",
               "rds:DescribeDBInstances",
               "rds:StopDBInstance",
               "rds:StartDBInstance",
               "rds:CreateDBSubnetGroup",
               "rds:DeleteDBSubnetGroup",
               "rds:ModifyDBSubnetGroup",
               "rds:DescribeDBSubnetGroups",
               "rds:AddTagsToResource",
               "rds:RemoveTagsFromResource",
               "rds:ListTagsForResource"
            ],
            "Resource": "*"
      }
   ]
}
  • Resources provisioned in BYOC environment We will set up the following resources in a BYOC environment:
    • 1 VPC: including VPC, its subnets, security, and IPs to host all BYOC resources.
    • 1 EKS cluster: to host all service and RisingWave clusters workloads.
    • 2 S3 buckets: for RisingWave cluster data and infra state data respectively.
    • 2 Internal network load balancer: to expose Agent Service and RWProxy.
    • (Optional) 1 External network load balancer: to expose RWProxy to the Internet.
    • A few IAM roles for EKS and K8s workloads, and each role is granted the least privilege it requires.
  • Required permission for deployed services The deployed service will need the permissions to perform the following actions:
    • AmazonDynamoDBFullAccess
    • AmazonEC2FullAccess
    • AmazonElasticContainerRegistryPublicReadOnly
    • AmazonPrometheusFullAccess
    • AmazonS3FullAccess
    • AmazonVPCFullAccess
    • AWSKeyManagementServicePowerUser
    • CloudWatchLogsFullAccess
    • IAMFullAccess
    Additionally, attach a policy that includes the following permissions: 
    {
   "Version": "2012-10-17",
   "Statement": [
      {
            "Sid": "BYOCAdditionalAccess",
            "Effect": "Allow",
            "Action": [
               "eks:*",
               "kms:*",
               "rds:DescribeDBInstances",
               "rds:StopDBInstance",
               "rds:StartDBInstance",
               "rds:CreateDBSubnetGroup",
               "rds:DeleteDBSubnetGroup",
               "rds:ModifyDBSubnetGroup",
               "rds:DescribeDBSubnetGroups",
               "rds:AddTagsToResource",
               "rds:RemoveTagsFromResource",
               "rds:ListTagsForResource"
            ],
            "Resource": "*"
      }
   ]
}

​
Data encryption

RisingWave Cloud implements comprehensive data encryption to protect your information:

​
Data at rest

  • S3 storage: All data stored in AWS S3 is automatically encrypted at rest using AWS default encryption keys
  • EBS volumes: All EBS volumes are encrypted at rest using AWS KMS managed keys
    • KMS keys are automatically rotated according to AWS security best practices
    • This includes all data stored on EBS volumes attached to RisingWave nodes

​
Data in transit

  • Client connections to RisingWave are secured using SSL/TLS

​
Delete a BYOC environment

Follow the steps below to delete a BYOC environment deployed in your cloud.
  1. Delete all BYOC projects running in the environment. Navigate to the Projects page, click the delete icon to delete all of your BYOC projects.
  2. Delete resources you created that are not managed by RisingWave, such as VPC Peerings, GCP Firewalls, and other common resources you might have used.
  3. Open the terminal and execute the following commands: 
    $ rwc byoc terminate --name default-byoc-environment # This may take 2-3 minutes.
$ rwc byoc delete --name default-byoc-environment # This may take 30-40 minutes.