Control Plane

First, run this GCP command to obtain new credentials:

gcloud auth application-default login

Your browser will open to connect to GCP, and then you will get this message:

You are now logged in as your-GCP-account-email.

You can change your current project by running:

gcloud config set project <PROJECT-ID>

Replace the PROJECT-ID placeholder with your current GCP project ID.

You may get this error message, and you should enter Y:

WARNING: Your active project does not match the quota project in your local Application Default Credentials file. This might result in unexpected quota issues.

To update your Application Default Credentials quota project, use the following command.

gcloud auth application-default set-quota-project <PROJECT-ID>

You might encounter the following on your first run:

WARNING: You do not appear to have access to project [<PROJECT-ID>], or it does not exist._
Are you sure you wish to set property [core/project] to <PROJECT-ID>?_
Do you want to continue (Y/n)?_

Type Y, and you will see:

Updated property [core/project].

Next, run this command to verify your GCP project:

gcloud config get-value project

Clone this repository which contains all the Terraform configuration to set up the infrastructure.

git clone https://github.com/devzero-inc/self-hosted-tf.git

Run cd self-hosted-tf/examples/gcp/control-and-data-plane to get into the directory.

Then, run this to install all the required Providers.

terraform init

Run this to create all the GCP resources such as VPC, GKE, Filestore, Autoscaler, etc.

terraform apply

Kubeconfig set up

Set up your local kubeconfig to connect to the GKE cluster:

gcloud container clusters get-credentials <cluster-name> --region <region> --project <project-id>

Download Credentials of your Service Account

Go to IAM & Admin > Service Accounts in the GCP Console. Click Vault-Service-Account which is created with the terraform. Go to the KEYS tab and click ADD KEY:

Click Create new key and select JSON key type to download the key in the JSON format as credentials.json.

Create Secret in the GKE Cluster

Create a generic secret in the GKE Cluster which will be used to access the Vault-Service-Account

kubectl create secret generic kms-creds --from-file=sa-credentials.json=/path/to/credentials.json -n devzero

Helm Registry Credentials

Contact the DevZero team at support@devzero.io to get the helm registry credentials.

helm registry login registry.devzero.io --username <your-username> --password <your-password>

Setting up CRDs

Install the CRDs which are prerequisites to set up a DevZero Control Plane on the GKE cluster.

helm install dz-control-plane-crds oci://registry.devzero.io/devzero-control-plane/beta/dz-control-plane-crds -n devzero --create-namespace

Set up your Route 53 Domain

Ignore this step if you already have a domain. But if you don't have one, register a domain on AWS Route 53.

Install Helm Charts

Download values.yaml from here and install the helm charts to set up the DevZero control plane.

helm install dz-control-plane oci://registry.devzero.io/devzero-control-plane/beta/dz-control-plane -n devzero -f /path/to/values.yaml --set domain=<domain_name> --set issuer.email=support@devzero.io

Ingress Setup

Get the ingress service in the cluster:

kubectl get ingress -n devzero

Copy the address of your ingress services.

Create new Records in Route 53

Create an A record and add the address of your ingress service in the value. Set the record name as *:

Create another A record keeping the Subdomain empty. Add the address of your ingress service in the value:

Visit the DevZero Dashboard

Go to <your-dz-control-plane-web-host>/dashboard to check out the DevZero UI.