> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Domino on GCP

This topic describes how to deploy Domino components on [Google Kubernetes Engine (GKE)](https://cloud.google.com/kubernetes-engine/docs/concepts/kubernetes-engine-overview). GKE is hosted on [Google Cloud Platform (GCP)](https://cloud.google.com/docs/overview).

## Set up HTTPS certificate

1. Run the following to create the `domino-platform` namespace:

   ```shell theme={null}
   kubectl create namespace domino-platform
   ```

2. To make your application available through HTTPS, use the certificate for the project’s domain name to create a secret:

   ```shell theme={null}
   kubectl -n domino-platform create secret tls my-cert --key=<path to your private key> --cert=<path to your cert>
   ```

## Create a GKE configuration file

1. Get the `$FLEETCOMMAND_AGENT_TAG` for your target release from the [releases](/6.3/admin/installation/releases) page.

2. Use environment variables to set some values used by the `ddlctl` CLI. This simplifies the commands you’ll run while installing Domino components:

   ```shell theme={null}
   unset HISTFILE
   export QUAY_USERNAME=<`quay.io` username provided by Domino>
   export QUAY_PASSWORD=<`quay.io` password provided by Domino>
   export FLEETCOMMAND_AGENT_TAG=<Tag that corresponds to the version of Domino deployed>
   ```

3. Generate a GKE configuration file:

   ```shell theme={null}
   ddlctl create config --agent-version $FLEETCOMMAND_AGENT_TAG --preset gke
   ```

   <Warning>
     Changing the defaults in the generated configuration can affect the deployment. If you must adjust its parameters, contact a Domino representative.
   </Warning>

4. You must reference the Terraform output from the infrastructure deployment described in [Provision infrastructure and runtime environment](/6.3/admin/installation/manage-deployments/gcp/infrastructure) to complete the configuration. If you don’t have the output saved, run `terraform output` to retrieve it.

5. Open the generated configuration file and edit the following attributes:

   * `name`: The name of the deployment. This can’t be changed post-deployment.

   * `hostname`: The host name for the Domino install (for example, `domino.example.com`).

   * `storage_class.block.type`: `gce`

   * `storage_class.shared.type`: `nfs`

   * `storage_class.shared.nfs.server`: The `google_filestore_ip_address` from the Terraform output.

   * `storage_class.shared.nfs.mount_path`: `/share1` (This must match the `google_filestore_file_share` Terraform output).

   * `blob_storage.projects.type`: `shared`

   * `blob_storage.logs.type`: `shared`

   * `blob_storage.backups.type`: `gcs`

   * `blob_storage.backups.gcs.bucket`: The `google_bucket_name` from the Terraform output.

   * `blob_storage.backups.gcs.service_account_name`: The `google_platform_service_account` from the Terraform output.

   * `blob_storage.backups.gcs.project_name`: The `google_project` from the Terraform output.

   * `helm.image_registries.*.username`: Your `quay.io` username.

   * `helm.image_registries.*.password`: Your `quay.io` password.

   * `image_building.cloud_registry_auth.gcp.service_account`: The `google_gcr_service_account` from the Terraform output.

   * `internal_docker_registry` : `null`

   * `external_docker_registry`: The `google_artifact_registry` from the Terraform output.

6. Add the following code to the end of the file:

   ```shell theme={null}
   release_overrides:
     nginx-ingress:
       chart_values:
         controller:
           kind: Deployment
           hostNetwork: false
           service:
             enabled: true
             type: LoadBalancer
             annotations:
               cloud.google.com/backend-config: '{"ports": {"80":"nginx-ingress-controller","443":"nginx-ingress-controller"}}'
           extraArgs:
             default-ssl-certificate: domino-platform/my-cert
   ```

Domino recommends that you keep a backup copy of your final configuration file. To do this, use the following command:

```shell theme={null}
cp domino.yml{,.backup-$( date +%s )}
```

## Install

With your configuration file ready, you can create a `Domino` custom resource using `ddlctl`:

```shell theme={null}
$ ddlctl create domino --config {path-to-config-yaml} --agent-version $FLEETCOMMAND_AGENT_TAG
```

If you would prefer to just generate the `Domino` custom resource YAML, you can supply the `--export` flag and pipe the result to a file.

When the installation completes successfully, you should see a message that says:

```
2019-11-26 21:20:20,214 - INFO - fleetcommand_agent.Application - Deployment complete.
Domino is accessible at $YOUR_FQDN
```

**Create a network policy if you use your own ingress controller**

If you use your own NGINX ingress controller by specifying `ingress_controller.install = false`, then you need to create a network policy in the Domino `platform` and `compute` namespace.

Here is an example of a network policy that allows ingress from the nginx namespace:

```shell theme={null}
kubectl -n <domino-namespace> apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: external-nginx
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: nginx
  podSelector: {}
  policyTypes:
  - Ingress
EOF
```

**Set up DNS**

Run the following to get the external IP to access your instance’s Domino management plane:

```shell theme={null}
kubectl -n domino-platform get svc nginx-ingress-controller
```

You can use this to update your DNS records accordingly.

## Validate your installation

1. Go to `https://<YOUR-DOMAIN>/auth/`

2. Login with the username `keycloak` and the password from the `keycloak-http` secret in the `domino-platform` namespace.

3. Use the following command to get the password:

   ```shell theme={null}
   echo -e "\nyour password is: $(kubectl get secret keycloak-http  -n domino-platform --template={{.data.password}} | base64 -d)\n"
   ```

4. Go to **Users** in the navigation pane and click **Add User**.

5. Enter the username, first name, last name, and email address, and then click **Save**.

6. Go to the **Credentials** tab and add a password.

7. Optional: Disable **Temporary**.

8. Click **Set Password.**

9. Go to **Role Mappings**.

10. From **Client Roles**, select **domino-play**.

11. Select the **User** role and add it to your user.

12. Go to the main page for your Domino deployment (for example, `https://\<YOUR-DOMAIN\>`) and sign in with your new Domino user.

13. Go to **Environments > Domino Standard Environment Py3.8 R4.1 > Revisions** and make sure the revision is active. If not, use **Build Logs** to try to solve the problem.

14. Go to **Projects > Quick-start > Workspaces** and launch a new workspace using Jupyter (this can take a while).

15. When the new workspace is created open `main.ipynb` and confirm that you can execute the script without errors.

## Enable user registration

Use [Keycloak](/6.3/admin/identity-and-access/authentication/keycloak-set-up) to [enable user registration](/6.3/admin/identity-and-access/authentication/keycloak-set-up#_enable_or_disable_user_registration), so users can access your fresh Domino install. Keycloak is a user authentication service that runs on a pod in your cluster.