This page walks through everything you need before running the installation: the right tooling, a GCP project with sufficient permissions and APIs, a deployment path, a Cloud DNS zone, Vertex AI model access, and the platform artifacts. Work through the steps in order, then run the preflight check to confirm you are ready.

1. Install the required tooling

Install the following on the machine you will run Terraform from:

Authenticate the gcloud CLI to your target project before continuing:

gcloud auth application-default login
gcloud config set project <project_id>

2. Prepare your GCP project

You deploy into your own GCP project. Two things must be in place: the required APIs, and sufficient IAM for the deploying identity.

Enable the required APIs

The module does not enable any APIs itself — enabling them is entirely a prerequisite. Enable at least:

gcloud services enable \
  container.googleapis.com compute.googleapis.com dns.googleapis.com \
  secretmanager.googleapis.com cloudkms.googleapis.com \
  networksecurity.googleapis.com certificatemanager.googleapis.com \
  aiplatform.googleapis.com

Deployer IAM

The identity running terraform apply needs permissions to create and manage, by category:

Treat this as the breadth of access the deploying identity needs, not a hand-minimized least-privilege role set.

The platform artifacts are public (Terraform Registry and Docker Hub), so no registry credentials are needed — only outbound access to Docker Hub: the helm provider pulls the ao-data-platform chart during apply, and the GKE nodes pull the ao-llm-worker image at runtime.

3. Choose your deployment path

The Terraform module supports two paths. Decide which applies before configuring it:

4. Configure domains and DNS

The OpenTelemetry Collector and ClickHouse are exposed through a single internal GKE Gateway with DNS names and publicly trusted TLS. Decide on:

• A domain for the OpenTelemetry Collector endpoint (e.g. otel.acme.com) — passed as otel_collector_domain
• A domain for the ClickHouse endpoint (e.g. clickhouse.acme.com) — passed as clickhouse_domain
• A Cloud DNS managed zone already serving those domains — passed by zone name (e.g. acme-com, not acme.com.) as dns_zone

Unlike some clouds, the DNS zone is not optional here: whenever the module deploys the chart, clickhouse_domain, otel_collector_domain, and dns_zone are all required — TLS certificates are issued by Let's Encrypt via DNS-01 validation against the zone, so there is no manual-DNS fallback on the module-managed path.

Two related settings:

• dns_zone_project — set this if the zone lives in a different project than the cluster; the module grants the DNS controllers zone-scoped access there.
• dns_zone_visibility — defaults to "public", which Let's Encrypt DNS-01 requires (the validation TXT records must be publicly resolvable). The A records themselves point at the Gateway's private IP — a public zone does not expose the endpoints.

5. Enable Claude models in Vertex AI Model Garden

The platform's LLM worker runs evaluations against Claude models on Vertex AI. Vertex serves them serverlessly — there is nothing to deploy — but each project must enable access to the Claude models once, manually, in the Vertex AI Model Garden: open each model card, click Enable, and accept the terms.

Enable the following models:

• Claude Haiku 4.5
• Claude Sonnet 5
• Claude Opus 4.8

There is no Terraform resource or API for this step, and access can take up to 24–48 hours to become active — do it ahead of the deploy, or the worker's evaluation calls fail until it lands. Everything else about Vertex access (a least-privilege predict-only IAM role for the worker) is handled by the module.

6. Get the platform artifacts

All three artifacts are public — no Monte Carlo-issued credentials or registry login are required:

You don't fetch these by hand: terraform init pulls the module from the Registry, the helm provider pulls the chart during terraform apply, and the GKE nodes pull the image at runtime. You set the chart registry and version (and pin the image tag) as module inputs on the installation page.

7. Run the preflight check

Confirm your environment is ready. Each command below should succeed before you proceed to installation:

# Terraform is installed and >= 1.7
terraform version

# gcloud resolves to the target project
gcloud config get-value project

# The GKE auth plugin is installed
gke-gcloud-auth-plugin --version

# kubectl is installed (server check comes after the cluster exists)
kubectl version --client

# The Cloud DNS zone exists and serves your domains
gcloud dns managed-zones describe <dns_zone> --project <dns_project_id>

# The required APIs are enabled
gcloud services list --enabled \
  | grep -E 'container|compute|dns|secretmanager|cloudkms|networksecurity|certificatemanager|aiplatform'

# Optional: confirm you can reach the public chart on Docker Hub (no login required)
helm pull oci://registry-1.docker.io/montecarlodata/ao-data-platform --version 4.0.0

If gcloud config get-value project returns the wrong project, or terraform version reports below 1.7, fix those before continuing.

Next steps

Continue to Installation.