Bring your own cloud

The Bring Your Own Cloud (BYOC) plan offers you the flexibility to tailor your cloud infrastructure instead of depending on a hosted service. It allows you to utilize the advantages of your chosen cloud provider, maintain full control over your environment, and adjust configurations to suit your specific needs.

​

Architecture overview

Before creating a BYOC deployment, familiarize yourself with the following architecture. In the BYOC environment, the entire data plane is deployed in the user’s space. To manage the RisingWave clusters within this environment, we deploy two key services for operation delegation:

• Agent Service: This service manages Kubernetes (K8s) and cloud resources. It handles tasks such as managing RisingWave Pods, storage services (including AWS S3, GCS, and Azure Blob Storage), IAM roles/accounts associated with the RisingWave cluster, network endpoints, etc.
• RWProxy: This is a TCP proxy that routes SQL statements from the control plane to the appropriate RisingWave instances.

​

Create a BYOC environment

Follow the steps below to create your own cloud environment.

1. Navigate to the Projects page and click Create project.
2. Select a deployment mode. Choose BYOC.
3. Select a service provider. Choose your cloud platform (AWS, GCP, or Azure) and your preferred region. See Resource and permission for more details.

4. Prepare the BYOC environment section. Click Setup now and follow the steps to set up your BYOC environment. Please note that the final command rwc byoc apply --name xxx may take 30 to 40 minutes to complete, and a progress bar will keep you informed of its progress. During this time, it’s crucial to ensure a stable internet connection. If the command is interrupted or fails due to network instability, you can safely retry it.

5. Select compute size in RWU. For most users, standard sizes offer the best performance and cost balance. Choose Customized if the standard sizes don’t meet your workload requirements. To learn more about the nodes, see the architecture of RisingWave.

6. Click Summary, then Confirm, and run the command that appears to set up a BYOC cluster in your environment.

Once the cluster is successfully created, you can manage it through the portal just like hosted clusters.

​

Configure custom settings

RisingWave provides several custom settings for BYOC deployments. To enable this feature, you need to create a configuration file containing the custom settings. These settings can be applied when creating a new BYOC environment or updating an existing one.

Below are supported custom settings:

1. Container security context that applies to all RisingWave namespaces, including:

   • cloudagent (hosting the agent service for Kubernetes operation delegation)
   • rwproxy (hosting psql proxy for RisingWave clusters)
   • risingwave-operator-system (hosting RisingWave operator managing the RisingWave cluster CRD)
   • rwc-* (namespaces hosting RisingWave clusters)

   For more information, please see Security context.

2. Namespace labels to enforce Pod Security Standard for all namespaces mentioned above.

   For more information, please see Pod Security Admission labels for namespaces.

3. Tags for Cloud vendor resources managed by RisingWave.

4. AWS custom EKS AMI version for the EKS nodes.

​

Create a configuration file

1. Create a file at path BYOC_CONFIG with desired custom settings. You can include only the settings you need and omit others:

container_security_context:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 65521
  seccompProfile:
    type: RuntimeDefault
pod_security_admission_labels:
  pod-security.kubernetes.io/enforce: restricted
extra_tags:
  foo: bar
aws_settings:
  eks_node_ami_release_version: 1.32.0-20241225

2. Save the file path $BYOC_CONFIG, as you will use it in the later steps.

​

Apply to a BYOC environment

You may either create a new BYOC environment or update your existing one to apply the custom settings.

$ rwc byoc create \
	--cidr $BYOC_CIDR \
	--cloud-account-id $ACCOUNT_ID \
	--name $BYOC_NAME \
	--custom-settings-path $BYOC_CONFIG

$ rwc byoc apply --name $BYOC_NAME

​

Resource and permission

When you customize your cloud platform, refer to the following notes to see what we’ve set up for you and the permissions you need to enable.

​

Data encryption

RisingWave Cloud implements comprehensive data encryption to protect your information:

​

Data at rest

• S3 storage: All data stored in AWS S3 is automatically encrypted at rest using AWS default encryption keys
• EBS volumes: All EBS volumes are encrypted at rest using AWS KMS managed keys
  • KMS keys are automatically rotated according to AWS security best practices
  • This includes all data stored on EBS volumes attached to RisingWave nodes

​

Data in transit

• Client connections to RisingWave are secured using SSL/TLS

​

Delete a BYOC environment

Follow the steps below to delete a BYOC environment deployed in your cloud.

1. Delete all BYOC projects running in the environment. Navigate to the Projects page, click the delete icon to delete all of your BYOC projects.
2. Delete resources you created that are not managed by RisingWave, such as VPC Peerings, GCP Firewalls, and other common resources you might have used.
3. Open the terminal and execute the following commands:

$ rwc byoc terminate --name default-byoc-environment # This may take 2-3 minutes.
$ rwc byoc delete --name default-byoc-environment # This may take 30-40 minutes.