Set up an Agent

Click on the desired cloud provider and follow the installation and configuration instructions:

AWS

Overview

Follow the steps below to install and configure an agent within your Amazon Web Services (AWS) environment.

Prerequisites

Step One - Create an Agent

Follow the Create an Agent guide to define an agent and generate the bootstrap config file that will be used in step two.

Step Two - Launch an agent in AWS

  1. Log in to the AWS Console
  2. Click the link below that matches the region where your AWS resources reside:
AWS RegionAWS Region (short name)
US East (N. Virginia)us-east-1
US East (Ohio)us-east-2
US West (N. California)us-west-1
US West (Oregon)us-west-2
Asia Pacific (Mumbai)ap-south-1
Asia Pacific (Osaka)ap-northeast-3
Asia Pacific (Seoul)ap-northeast-2
Asia Pacific (Singapore)ap-southeast-1
Asia Pacific (Sydney)ap-southeast-2
Asia Pacific (Tokyo)ap-northeast-1
Canada (Central)ca-central-1
Europe (Frankfurt)eu-central-1
Europe (Ireland)eu-west-1
Europe (London)eu-west-2
Europe (Paris)eu-west-3
Europe (Stockholm)eu-north-1
South America (São Paulo)sa-east-1
  1. Verify the agent AMI is selected and click Launch
  2. Choose an instance type
TIP

An instance with at least 3 vCPUs and 4 GiB of memory is recommended for optimal performance.

For testing, the t2.micro (free tier) instance type is sufficient.

  1. Click Next: Configure Instance Details
  2. Review the details and verify that the selected VPC is the same as the AWS resource you are trying to access
TIP

For the agent to properly connect to the Control Plane servers, it requires outbound Internet access.

Verify that the Auto-assign Public IP option is set to Enable.

If your requirements do not allow the instance to have a public IP, please review the section How do instances without public IP addresses access the Internet in this AWS FAQ.

  1. Scroll to the bottom of the page and under User data paste or upload a file containing the JSON payload generated in step one
  2. Click Next: Add Storage and review settings
  3. Click Next: Add Tags and optionally add any tags
  4. Click Next: Configure Security Group
NOTE

SSH is not required. Control Plane will never need to connect directly to the agent.

  1. Click Review and Launch and verify the details are correct
  2. Click Launch. The console will prompt you to select or create a key-pair.
TIP

If you do not have an AWS key-pair created, the console will help you to create one.

Since the agent instance will never need to be connected to, you may proceed without a key-pair.

  1. Click Launch Instances

  2. After a few moments, the instance will launch and ready to process requests.

Next Steps

Now that you have an agent configured and running, it can be used within an identity to allow your workload to connect to your internal AWS resources.

Azure

Overview

Follow the steps below to install and configure an agent within your Microsoft Azure environment.

Prerequisites

Step One - Create an Agent

Follow the Create an Agent guide to define an agent and generate the bootstrap config file that will be used in step two.

Step Two - Launch an agent in Azure

  1. Log in to the Azure Console
  2. From the Azure homepage, click the Marketplace icon.
  3. In the Marketplace search bar, enter:
copy
Control Plane Secure Communications Agent
  1. Press Enter
  2. There will be two results for the agent. When you click the Create dropdown, choose the agent that shows gen-1.
  3. Use these recommended settings for the Create a virtual machine wizard:
  • Basic
    • Subscription: Choose the appropriate subscription
    • Resource Group: Choose the appropriate resource group. If necessary, create a new one.
    • Virtual machine name: Enter Control-Plane-Agent-01. If installing multiple agents, increment the number.
    • Region: Select a region closest to your other Azure resources
    • Availability options: Select No infrastructure redundancy required. Use a different option for your environment if you are running in production.
    • Image: Leave as gen-1
    • Size: An instance with at least 2 vCPUs and 4 GiB of memory is recommended for optimal performance.
    • Authentication type: Select SSH public key
    • Username: Leave as azureuser
    • SSH public key source: Choose the appropriate key. If necessary, create a new one.
    • Key pair name: Select appropriate key, or if creating a new one, use the default or update the key name.
    • Public inbound ports: Select None. The agent does not need any inbound ports open.
    • Click Next: Disks
  • Disks
    • OS disk type: Select Premium SSD
    • Encryption type: Select (Default) Encryption at-rest with a platfor-managed key
    • Click Next: Networking
  • Networking
    • Virtual network: Choose an appropriate network or use the new network that will be created
    • Subnet: Choose appropriate network or use the default
    • Public IP: Select None
    • NIC network security group: Select Basic
    • Public inbound ports: Select None
    • Click Next: Management
  • Management
    • Enable basic plan for free: Enabled
    • Boot diagnostics: Select Enable with managed storage account
    • Enable OS guest diagnostics: Disabled
    • System assigned managed identity: Disabled
    • Enable auto-shutdown: Disabled
    • Patch orchestration options: Select Image default
    • Click Next: Advanced
  • Advanced
    • Custom data: Paste the JSON text generated from Step One into the textbox
    • Click Next: Tags
  • Tags
    • Optional: Enter any necessary tags
    • Click Next: Review + create
  • Review + create
    • Review all the settings and enter any missing values
    • Click Create
    • If you requested to create a new key pair, a modal will pop-up requesting to download the private key. Click Download private key and create resource.

The agent virtual machine will begin the deployment process. After a few moments, the agent will be running, connecting to the Control Plane servers, and ready to process requests.

Next Steps

Now that you have an agent configured and running, it can be used within an identity to allow your workload to connect to your internal Azure resources.

GCP

Overview

Follow the steps below to install and configure an agent within your Google Cloud Platform (GCP) environment.

Prerequisites

Step One - Create an Agent

Follow the Create an Agent guide to define an agent and generate the bootstrap config file that will be used in step two.

Step Two - Launch agent in GCP

  • Using the Google Cloud SDK
  1. Install the latest SDK
  2. If necessary, log in using gcloud init
  3. Execute the following command. Use a unique INSTANCE_NAME and the bootstrap file that was created in step one.
copy
gcloud compute instances create INSTANCE_NAME --image controlplane-agent-546-282446475-1442e61 --image-project cpln-build --metadata-from-file=user-data=PATH/AGENT_NAME-bootstrapConfig.json
TIP

For optimal performance:

  • An instance with at least 2 vCPUs and 4 GB of memory is recommended
  • The instance should be deployed in the same VPC and region as your GCP resources
  1. After a few moments, the command will return and show the status of the instance.
  2. The agent will now be running, connecting to the Control Plane servers, and ready to process requests.

Step Three - Configure Firewall

By default, the GCP firewall rules open the common SSH, RDP, and ICMP ports to the world and allows all internal ports within the VPC. The agent does not need any of these ports open.

At a minimum, the agent needs to be able to connect to your GCP resources and the Internet.

Next Steps

Now that you have an agent configured and running, it can be used within an identity to allow your workload to connect to your internal GCP resources.

Private Network

Overview

Follow the steps below to install and configure an agent within your private network.

Prerequisites

  • Review the Agent reference page
  • Install the CLI

Step One - Create an Agent

Follow the Create an Agent guide to define an agent and generate the bootstrap config file that will be used in step two.

Step Two - Launch agent locally

  1. Open a new shell and execute the following command. Use the bootstrap file that was created in step one.
copy
cpln agent up --bootstrap-file=PATH/AGENT_NAME-bootstrapConfig.json
TIP

If you are using Windows, follow these instructions:

  • Configure Docker to not use the WSL 2 based engine
  • Run the cpln command above using a Windows command prompt and not usingWSL
  1. The agent will now be running, connecting to the Control Plane servers, and ready to process requests.

Next Steps

Now that you have an agent configured and running, it can be used within an identity to allow your workload to connect to your local resources.

TIP

When running an agent locally, it is running within a local Docker container. When configuring an identity network resource, you must use the IP of the network adapter that Docker installed on the local machine.

Copyright © 2021 Control Plane Corporation. All rights reserved. Revision 30221ec6
Contents