📝

Prerequisites

1. You are an admin in GCP and have installed Terraform (>= 1.3) with GCP Authentication) (for step 1).
2. You are an Account Owner (for step 2).

This guide outlines how to setup an Agent (with object storage) in your GCP cloud.

The FAQs answer common questions like how to review resources and what integrations are supported.

Steps

1. Deploy the Agent

You can use the mcd-agent Terraform module to deploy the Agent and manage resources as code (IaC).

For instance, using the following example Terraform config:

module "apollo" {
  source  = "monte-carlo-data/mcd-agent/google"
  version = "0.1.2"

  # Required variables
  generate_key = true
  project_id   = "<REPLACE_ME_WITH_YOUR_GCP_PROJECT>"
}

output "url" {
  value       = module.apollo.mcd_agent_uri
  description = "The URL for the agent."
}

output "key" {
  value       = module.apollo.mcd_agent_invoker_key
  description = "The Key file for Monte Carlo to invoke the agent."
  sensitive   = true
}

You can build and deploy via:

terraform init && terraform apply

Note that setting generate_key = true will persist a key in the remote state used by Terraform. Please take appropriate measures to protect your remote state. If you would rather create the key outside of Terraform please set this value to false and see the instructions here.

This module will also activate the Cloud Run API in the project you specified. This resource (API) is not deactivated on destroy.

Additional module inputs, options, and defaults can be found here. And other details can be found here.

2. Register the Agent

After deploying the agent you can register either via the Monte Carlo UI or CLI.

And see here for examples on how to retrieve Terraform output (i.e. registration input).

After this step is complete all supported integrations will automatically use this agent (and object store for troubleshooting and temporary data). You can add these integrations as you normally would using Monte Carlo's UI wizard or CLI.

UI

👍

If you are onboarding a new account, you can also register by following the steps on the onscreen

1. Navigate to settings/integrations/agents and select the Create button.
2. Follow the onscreen wizard for the "GCP" Platform and "Data Store + Agent" Type.

CLI

Use montecarlo agents register-gcp-agent to register.

See reference documentation here. And see here for how to install and configure the CLI. For instance:

montecarlo agents register-gcp-agent \
  --url $(terraform output -raw url) \
  --key-file <(terraform output -json 'key' | jq -r '.[0]' | base64 -d)

FAQs

What integrations does the Agent support?

The agent supports all integrations. Exceptions:

• Data Lake Query Logs from S3 Buckets: https://docs.getmontecarlo.com/docs/s3-events-query-logs

Note that onboarding (connecting) any supported integration will use the agent if one is provisioned. Otherwise any other integrations will use your automatically managed and hosted Data Collector service to connect directly.

Some integrations like dbt core, Atlan, and Airflow either leverage our developer toolkit or are managed by a 3rd party and do not require an Agent. These integrations natively push data to Monte Carlo so an Agent is not required.

Can I review agent resources and code?

Absolutely! You can find details here:

What GCP permissions are necessary for me to deploy and manage the Agent?

• Cloud Run Admin
• Storage Admin
• Role Administrator
• Create Service Accounts
• Delete Service Accounts
• Service Account Key Admin
• Service Account User
• Logs Viewer
• Monitoring Viewer
• Cloud Functions Developer
• Project IAM Admin

Note these are not the same as the permissions the Agent requires to run, which can be found in the module.

How do I retrieve registration input from Terraform?

The url can be retrieved via: terraform output url.

And if not disabled, the key-file can be retrieved via: terraform output -json 'key' | jq -r '.[0]' | base64 -d > mcd-agent-key.json. Otherwise, see here for details on how to create the key outside of Terraform.

How do I monitor the Agent?

The Agent automatically generates a log of all operations, which can retrieved from this CLI command, Cloud Run or the Logs Explorer. For instance with Logs Explorer you can use the following query:

resource.type = "cloud_run_revision"
resource.labels.service_name =~ "mcd-agent-service*"
severity>=DEFAULT

If you have more than one agent in a project you should specify the full ID instead, which is retrievable as an output from Terraform. Metrics and other configuration can also be retrieved from Cloud Run.

How do I upgrade the Agent?

If you have opted out of remote upgrades (i.e. set remote_upgradable = false) you can upgrade the agent image by setting the image variable in the module.

Please reach out to your Monte Carlo representative or support at [email protected] for the correct tag for your deployment.

Otherwise, and by default, Monte Carlo will automatically manage upgrades for you. If this is the case and you'd still like to explicitly upgrade you can do so via the upgrade command on the CLI or "Upgrade" button on the UI.

How do I create a service account key outside of Terraform?

If you set generate_key = false and would prefer to manually provision the service account key you can do so too. To create a JSON Key in the project:

1. Under IAM & Admin, go to the Service Accounts section in your Google Cloud Platform console.

2. Filter for the Invoker Service Account "MCD Agent Invoker SA" created in step 1. To retrieve the full service account email address you can add the following output:

   Example

   output "invoker_sa" {
     value       = module.apollo.mcd_agent_invoker_sa
     description = "The agent invoker SA name."
   }
   

3. Select "Keys" and create a JSON key. A JSON file will download – please keep it safe.

Can I further constraint inbound access (ingress) to the Agent?

👍

Updated IPs

For all accounts created after April 24th, 2024 the Monte Carlo platform will generally use the following IP addresses to connect to your integration (cloud-only), agent (GCP and Azure), and/or object store:

• 34.200.118.118
• 35.169.25.209

Please be sure to allowlist both as requests from the Monte Carlo Platform* can originate from either one. If your account was created before this date, please reach out to your Monte Carlo representative.

*If you are leveraging a Customer-hosted Agent these are not the same as the IP addresses that the agent will use to connect to your resource. See "Egress" FAQs per platform for more details and options to constraint outbound access.

Absolutely! By default Monte Carlo will only make HTTPS requests to the Agent using the service account key you provide during registration.

If you prefer you can further restrict requests to the Agent via an IP allowlist. For instance you can:

1. Reach out to your Monte Carlo representative or support at [email protected] for an IP Address to allowlist. All inbound requests to the agent will originate here.
2. Create a HTTPS Application Load Balancer by following these instructions. Importantly, please be sure to use HTTPS for the protocol as Monte Carlo does not accept the HTTP scheme. This requires a domain, certificate, and external IP reservation. We strongly recommend you do not use self-signed certificate.
3. Create a Cloud Armor policy that denies all traffic, except to the IP address from #1 and attach the HTTPS Load Balancer from #2.
4. Update the Ingress Controls for the Agent's Cloud Run Service to "Internal and Cloud Load Balancing".
5. Test connectivity between Monte Carlo's Service and the Agent (e.g. via the health CLI command).

Can I further constraint outbound access (egress) from the Agent?

Absolutely! As with any Cloud Run Service you can control egress in multiple ways. For instance:

• Using VPC Service Controls with a Service Perimeter and sending all traffic directly to a VPC.
• Setting up a Static outbound IP for use with IP filtering.

Depending on your integration this might be necessary to establish connectivity.

How do I check the reachability between Monte Carlo and the Agent?

Reachability is automatically validated during registration, but you can also use this CLI command or "test" button on the UI to test anytime.

How do I debug connectivity between the Agent and my integration?

Even though each network configuration is unique, you can try the following to help debug connectivity:

1. Double check the connection details provided to Monte Carlo, such as host, port, database, user for typos/omissions.
2. Confirm that the service user you created works (e.g. you are able to log in as the service user).
3. Use the MC network utilities on the integrations page. These utilities are also available via the CLI.
   1. Test TCP Open: Tests if a destination exists and accepts requests. Opens a TCP Socket to a specific port from the agent.
   2. Test Telnet: Checks if Telnet connection is usable from the agent.