The Bring Your Own Cloud (BYOC) plan offers you the flexibility to tailor your cloud infrastructure instead of depending on a hosted service. It allows you to utilize the advantages of your chosen cloud provider, maintain full control over your environment, and adjust configurations to suit your specific needs.

​
Architecture overview

Before creating a BYOC deployment, familiarize yourself with the following architecture. In the BYOC environment, the entire data plane is deployed in the user’s space. To manage the RisingWave clusters within this environment, we deploy two key services for operation delegation:
  • Agent Service: This service manages Kubernetes (K8s) and cloud resources. It handles tasks such as managing RisingWave Pods, storage services (including AWS S3, GCS, and Azure Blob Storage), IAM roles/accounts associated with the RisingWave cluster, network endpoints, etc.
  • RWProxy: This is a TCP proxy that routes SQL statements from the control plane to the appropriate RisingWave instances. Control plane will issue SQL queries to retrieve cluster metadata and health status.

​
Create a BYOC environment

Follow the steps below to create your own cloud environment.
  1. Navigate to the Projects page and click Create project.
  2. Select a deployment mode. Choose BYOC.
  3. Select a service provider. Choose your cloud platform (AWS, GCP, or Azure) and your preferred region. See Resource and permission for more details.
    If you’re using AWS, ensure you’re not using the AWS account root user for any deployment or operational tasks. Always use IAM users or roles with appropriate permissions instead.
  4. Prepare the BYOC environment section. Click Setup now and follow the steps to set up your BYOC environment. Please note that the final command rwc byoc apply --name xxx may take 30 to 40 minutes to complete, and a progress bar will keep you informed of its progress. During this time, it’s crucial to ensure a stable internet connection. If the command is interrupted or fails due to network instability, you can safely retry it.
    When you run the command rwc byoc apply --name xxx, it will deploy some resources in your AWS/GCP/Azure environment, such as AWS S3/Google Cloud Storage/Azure Blob Storage and EKS/GKE/AKS clusters. Please do not modify the configuration of these resources. If you encounter any issues during this process, please contact our support team.
  5. Select compute size in RWU. For most users, standard sizes offer the best performance and cost balance. Choose Custom if the standard sizes don’t meet your workload requirements. To learn more about the nodes, see the architecture of RisingWave.
  6. Click Summary, then Confirm, and run the command that appears to set up a BYOC cluster in your environment.
Once the cluster is successfully created, you can manage it through the portal just like hosted clusters.

​
Configure custom settings

RisingWave provides several custom settings for BYOC deployments. To enable this feature, you need to create a configuration file containing the custom settings. These settings can be applied when creating a new BYOC environment or updating an existing one. Below are supported custom settings:
  1. Container security context that applies to all RisingWave namespaces, including:
    • cloudagent (hosting the agent service for Kubernetes operation delegation)
    • rwproxy (hosting psql proxy for RisingWave clusters)
    • risingwave-operator-system (hosting RisingWave operator managing the RisingWave cluster CRD)
    • rwc-* (namespaces hosting RisingWave clusters)
    For more information, please see Security context.
  2. Namespace labels to enforce Pod Security Standard for all namespaces mentioned above. For more information, please see Pod Security Admission labels for namespaces.
  3. Tags for Cloud vendor resources managed by RisingWave.
  4. AWS custom EKS AMI version for the EKS nodes.

​
Create a configuration file

  1. Create a file at path BYOC_CONFIG with desired custom settings. You can include only the settings you need and omit others: 
    container_security_context:
allowPrivilegeEscalation: false
capabilities:
   drop:
   - ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65521
seccompProfile:
   type: RuntimeDefault
pod_security_admission_labels:
pod-security.kubernetes.io/enforce: restricted
extra_tags:
foo: bar
aws_settings:
eks_node_ami_release_version: 1.32.0-20241225
  2. Save the file path $BYOC_CONFIG, as you will use it in the later steps.

​
Apply to a BYOC environment

You may either create a new BYOC environment or update your existing one to apply the custom settings.
  1. Run the following command to create a new BYOC environment with custom settings. $BYOC_CONFG is the file path of the config file created in last step.
$ rwc byoc create \
	--cidr $BYOC_CIDR \
	--cloud-account-id $ACCOUNT_ID \
	--name $BYOC_NAME \
	--custom-settings-path $BYOC_CONFIG
  1. Apply custom settings to the new BYOC environment. This may take up to 30 minutes.
$ rwc byoc apply --name $BYOC_NAME

​
Resource and permission

When you customize your cloud platform, refer to the following notes to see what we’ve set up for you and the permissions you need to enable.
  • Required service-linked role The role AWSServiceRoleForAutoScaling needs to be in place. If it is not ready yet, you need to create it manually. See Create a service-linked role for detailed steps.
  • Required quota increase For optimal performance, the quota for managed node groups per cluster should be increased to 36 or more. See Service quotas for more details.
  • Required permissions for BYOC environment creation/deletion The IAM role/user requires the following roles to create or delete a BYOC environment:
    • AmazonDynamoDBFullAccess
    • AmazonEC2FullAccess
    • AmazonElasticContainerRegistryPublicReadOnly
    • AmazonPrometheusFullAccess
    • AmazonS3FullAccess
    • AmazonVPCFullAccess
    • AWSKeyManagementServicePowerUser
    • CloudWatchLogsFullAccess
    • IAMFullAccess
    Additionally, attach a policy that includes the following permissions: 
    {
   "Version": "2012-10-17",
   "Statement": [
      {
            "Sid": "BYOCAdditionalAccess",
            "Effect": "Allow",
            "Action": [
               "eks:*",
               "kms:*",
               "rds:DescribeDBInstances",
               "rds:StopDBInstance",
               "rds:StartDBInstance",
               "rds:CreateDBSubnetGroup",
               "rds:DeleteDBSubnetGroup",
               "rds:ModifyDBSubnetGroup",
               "rds:DescribeDBSubnetGroups",
               "rds:AddTagsToResource",
               "rds:RemoveTagsFromResource",
               "rds:ListTagsForResource"
            ],
            "Resource": "*"
      }
   ]
}
  • Resources provisioned in BYOC environment We will set up the following resources in a BYOC environment:
    • 1 VPC: including VPC, its subnets, security, and IPs to host all BYOC resources.
    • 1 EKS cluster: to host all service and RisingWave clusters workloads.
    • 2 S3 buckets: for RisingWave cluster data and infra state data respectively.
    • 2 Internal network load balancer: to expose Agent Service and RWProxy.
    • (Optional) 1 External network load balancer: to expose RWProxy to the Internet.
    • A few IAM roles for EKS and K8s workloads, and each role is granted the least privilege it requires.
  • Required permission for deployed services The deployed service will need the permissions to perform the following actions:
    • AmazonDynamoDBFullAccess
    • AmazonEC2FullAccess
    • AmazonElasticContainerRegistryPublicReadOnly
    • AmazonPrometheusFullAccess
    • AmazonS3FullAccess
    • AmazonVPCFullAccess
    • AWSKeyManagementServicePowerUser
    • CloudWatchLogsFullAccess
    • IAMFullAccess
    Additionally, attach a policy that includes the following permissions: 
    {
   "Version": "2012-10-17",
   "Statement": [
      {
            "Sid": "BYOCAdditionalAccess",
            "Effect": "Allow",
            "Action": [
               "eks:*",
               "kms:*",
               "rds:DescribeDBInstances",
               "rds:StopDBInstance",
               "rds:StartDBInstance",
               "rds:CreateDBSubnetGroup",
               "rds:DeleteDBSubnetGroup",
               "rds:ModifyDBSubnetGroup",
               "rds:DescribeDBSubnetGroups",
               "rds:AddTagsToResource",
               "rds:RemoveTagsFromResource",
               "rds:ListTagsForResource"
            ],
            "Resource": "*"
      }
   ]
}

​
Data encryption

RisingWave Cloud implements comprehensive data encryption to protect your information:

​
Data at rest

  • S3 storage: All data stored in AWS S3 is automatically encrypted at rest using AWS default encryption keys
  • EBS volumes: All EBS volumes are encrypted at rest using AWS KMS managed keys
    • KMS keys are automatically rotated according to AWS security best practices
    • This includes all data stored on EBS volumes attached to RisingWave nodes

​
Data in transit

  • Client connections to RisingWave are secured using SSL/TLS

​
Delete a BYOC environment

Follow the steps below to delete a BYOC environment deployed in your cloud.
  1. Delete all BYOC projects running in the environment. Navigate to the Projects page, click the delete icon to delete all of your BYOC projects.
  2. Delete resources you created that are not managed by RisingWave, such as VPC Peerings, GCP Firewalls, and other common resources you might have used.
  3. Open the terminal and execute the following commands: 
    $ rwc byoc terminate --name default-byoc-environment # This may take 2-3 minutes.
$ rwc byoc delete --name default-byoc-environment # This may take 30-40 minutes.