Manufacturing Connect installation guide

Manufacturing Connect is an integrated edge-to-cloud Industrial IoT platform that provides everything you need to put industrial data to work to enable smart manufacturing. The solution is purpose-built to collect, process and analyze data at the edge, then rapidly integrate the data with the Google Cloud Platform for analytics, AI and machine learning. This document is a guide to install the MC in Google Cloud Platform (GCP).

Pre-installation tasks

Define environment variables

export GCP_PROJECT_ID='your-gcp-project-id'
export REGION='us-central1'
export ZONE='us-central1-c'
export NETWORK_NAME="sfp-private-network"
export SUBNET_NAME="sfp-subnet"
export GKECLUSTER="mc-cluster"

MDE network/subnet names were changed since MDE 1.3.0. If Manufacturing Connect is deploying or will be deployed with MDE 1.3.0 in one GCP project, please update these environment variables accordingly.

export NETWORK_NAME=mde-private-network
export SUBNET_NAME="mde-subnet"

Enable GCP services

gcloud services enable --project=${GCP_PROJECT_ID} container.googleapis.com

Create a network If MDE is not installed

gcloud compute networks create "$NETWORK_NAME" --project="$GCP_PROJECT_ID" \
  --description="MDE private network" \
  --subnet-mode=custom \
  --mtu=1460 \
  --bgp-routing-mode=regional
gcloud compute networks subnets create "$SUBNET_NAME" --project="$GCP_PROJECT_ID" \
  --range=10.154.0.0/20 \
  --network="$NETWORK_NAME" \
  --region="$REGION" \
  --enable-private-ip-google-access

Create GKE cluster

The MC's services are deployed into a Kubernetes cluster. The cluster must be created before deploying the MC from the Google Cloud Marketplace. UBUNTU_CONTAINERD is the only supported image type for GKE nodes The MC can be deployed on public or private GKE cluster

Deployment on public GKE cluster

gcloud beta container --project "${GCP_PROJECT_ID}" clusters create $GKECLUSTER --zone "${ZONE}" \
    --no-enable-basic-auth --release-channel "regular" --machine-type "e2-standard-2" --image-type "UBUNTU_CONTAINERD" \
    --disk-type "pd-standard" --disk-size "100" --metadata disable-legacy-endpoints=true \
    --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" \
    --max-pods-per-node "110" --num-nodes "3" --logging=SYSTEM,WORKLOAD --monitoring=SYSTEM \
    --enable-ip-alias  --no-enable-intra-node-visibility --default-max-pods-per-node "110" \
    --no-enable-master-authorized-networks --addons HorizontalPodAutoscaling,HttpLoadBalancing,GcePersistentDiskCsiDriver \
    --enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 \
    --maintenance-window-start "2022-05-21T02:00:00Z" --maintenance-window-end "2022-05-22T02:00:00Z" \
    --maintenance-window-recurrence "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR,SA,SU" \
    --workload-pool "${GCP_PROJECT_ID}.svc.id.goog" --enable-shielded-nodes --node-locations "${ZONE}" \
    --network "${NETWORK_NAME}" --subnetwork "${SUBNET_NAME}" --labels "goog-packaged-solution=mfg-mde"

Deployment on private GKE cluster

gcloud beta container clusters create $GKECLUSTER --project "$GCP_PROJECT_ID" --zone "$ZONE" \
            --no-enable-basic-auth --release-channel "regular" --machine-type "e2-standard-2" --image-type "UBUNTU_CONTAINERD" \
            --disk-type "pd-standard" --disk-size "100" --metadata disable-legacy-endpoints=true \
            --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" \
            --max-pods-per-node "110" --num-nodes "3" --logging=SYSTEM,WORKLOAD --monitoring=SYSTEM \
            --enable-ip-alias  --no-enable-intra-node-visibility --default-max-pods-per-node "110" \
            --enable-master-authorized-networks --addons HorizontalPodAutoscaling,HttpLoadBalancing,GcePersistentDiskCsiDriver \
            --enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 \
            --maintenance-window-start "2022-11-21T02:00:00Z" --maintenance-window-end "2022-11-22T02:00:00Z" \
            --maintenance-window-recurrence "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR,SA,SU" \
            --workload-pool "$GCP_PROJECT_ID.svc.id.goog" --enable-shielded-nodes --node-locations "$ZONE" \
            --network "$NETWORK_NAME" --subnetwork "$SUBNET_NAME" --labels "goog-packaged-solution=mfg-mde" \
            --enable-private-nodes --enable-private-endpoint --master-ipv4-cidr 10.155.1.0/28

Kubernetes control nodes CIDR --master-ipv4-cidr 10.155.1.0/28 here is just an example. It can be modified according to a customer's network setup

Prepare GCP project

Follow this guide https://cloud.google.com/marketplace/docs/manage-billing#before_you_begin

Deploy The Manufacturing Connect via Google Cloud Marketplace

Purchase the Manufacturing Connect for a billing account

A person with GCP Billing Admin role needs to open the MC the Google Marketplace page
click PURCHASE
click MANAGE ACCOUNTS
link a service account that was created in the previous step

Deploy the Manufacturing Connect to partcular GCP project

After you've created a Kubernetes cluster, you can deploy the MC from the Google Cloud Marketplace.
Click Configure then follow the on-screen instructions. In dropdown list Reporting service account select the service account name.
If the MC is deployed on private GKE cluster select Internal Load Balancer option.

Once finished, review the post installation steps below.

Post-installation tasks

Change initial credentials (mandatory)

Open GKE applications list in your GCP project
Click on the application which is just installed
Click on Show Info Panel
Follow instructions to get the application urls and initial credentials
Change MC Admin password
Change MC Keycloak Admin password

Upload GCP credentials (optional)

Open MC Admin Console
Click Settings/Cloud Settings
Follow instructions for Generate Key in the Cloud Credentials section

Set GCS bucket (optional)

Open MC Admin Console
Click Settings/Cloud Settings
Select Google Cloud Storage in Storage settings
To create a bucket follow instructions for Create bucket
Set bucket name
Click Save

Assotiate a domain name with MC Instance. Mandatory only if Google Authorization is needed for the MC instance

assotiate MC external IP address with a domain name
Open MC Admin Console
Open Settings/Entrypoints
Set the new domain name
Click Save

Setup Google Authentification (optional)

a domain name must be associated with the MC instance

OAuth consent screen

Open APIs & Services OAuth consent screen https://console.cloud.google.com/apis/credentials/consent
Select External type
In testing mode External allows add up to 100 google account from any organization
Internal type allows only users within the current organization
On the next screen set mandatory attributes
- App Name
- User support email
- Add authorized domain
  Let’s say for MC we are going to use domain name test.mc.domain.com then we need to set domain.com as an authorized domain
- Developer contact information

Create OAuth 2.0 credentials

Open APIs & Services OAuth credentials screen https://console.cloud.google.com/apis/credentials
Create OAuth client ID
Application type: Web application
Authorized redirect url: https://<your-domain>/auth/realms/standalone/broker/google/endpoint

Setup MC Keycloak

Open Keycloak Admin console
Click Identity Providers
Select Google from the list
Set Client ID and Secret ID use values from the previous step
Set First Login Flow to google-login
Click Save

Grant permissions to google accounts

Open MC Admin Console
Click Users
Add a new user (set google email)
Enable the user
Grant Admin role if required

Upgrading Manufacturing Connect

Prepare values to run upgrade script

GCP project id
Zone where GKE cluster is deployed
GKE cluster name
Kebernetes namespace where Manufacturing Connect is deployed

Clone git repository

git clone https://github.com/litmusautomation/mc-gcp-marketplace.git

Run upgrade script

TARGET_VERSION is required MC target version, for example 2.8.0-120

cd mc-gcp-marketplace
./upgrade-mc.sh 'GCP_PROJECT_ID' 'ZONE' 'GKECLUSTER' 'NAMESPACE' 'TARGET_VERSION'