In this first part, we will be focused on implementing Prerequisites Operations (see image below). Notice the two Swim Lanes (Local, GCP Instance). Each operation is run on the system associated with its specific Swim Lane
“Local” refers to your person/company computer. For me, my local computer is a MacBook Pro that is my daily computer. “GCP Instance”, is a virtual machine instance that we will create in Google GCP.
In each section, I will reference the image above with an arrow identifying the section we are working on.
Basic understanding and access to Google GCP
Google GCP gcloud installed and configured on local computer
Validate Google gcloud Configuration on Local Computer
Alright, let’s start. On your local computer, you should have Google gcloud installed and configured.
On our local computer let’s take a look at gcloud configuration.
gcloud config list
Notice that I’m using a User Account; not a Service Account. Usually a service account will end with gserviceaccount.com.
In the following image, notice that I have compute configuration set for region and zone and you may also have this set. It shouldn’t matter if these values are set or not. In this getting started guide, when we use gcloud commands we will specify where the resource will live.
Create GCP Instance
Let’s create a GCP instance where we will run TiDB.
gcloud compute instances create tidb-vm \
This may take a few moments to complete
Let’s validate the instance is up and running
gcloud compute instances list
If you get an error and are not able to create an instance, you probably do not have valid permissions with the GCP account that gcloud is associated with.
SSH into New GCP Instance
Here we will use the gcloud ssh feature to access our newly created GCP instance.
gcloud compute ssh --zone "us-west1-a" "tidb-vm"
Notice that the server we SSH into has a prompt that references the tidb-vm instance.
GCP Instance - Change Service Account to User Account
We should now be logged into the GCP instance tidb-vm
Let’s do something simple with gcloud that should validate our level of access, or the lack of access.
Let’s get a list of GCP instances .
gcloud compute instances lists
Notice that I received an error. This is because the account associated with gcloud is a Service Account that does not have permissions to get a list of instances. Even though you may not get an error, I recommend following the instructions below to change from a Services Account to your User Account.
A GCP Service Account is a special kind of account used by an application or a virtual machine (VM) instance, not a person. By default, GCP creates a Service Account and adds it to your project and is enabled on all instances.
Let’s see what account we are running as. Here I run two commands that show similar information. Both of these commands provide similar information
gcloud config list
gcloud auth list
Note the account email address and the domain. If it ends in firstname.lastname@example.org, you are running as a service account. In this getting started guide we want to execute gcloud commands with our User Account.
Let’s change the account that gcloud is associated with.
Login with GCP User Account
Here we will change the account that gcloud is associated with from a Service Account to our User Account.
It’s a multi-step process to change the gcloud account.
When running the following command, you will be prompted to enter a passphrase. For simplicity, do not enter a passphrase when prompted. Just hit <return> to provide an empty passphrase.
gcloud compute config-ssh
Let’s see what files were created.
ls -al .ssh/
Notice we now have 3 new files. The primary file we are interested in is the google_compute_engine, which is the private key that TiUP will use for SSH.
Open TiDB Ports on GCP Network
We will want to access TiDB resources (TiDB Dashboard, Grafana, Prometheus) from a browser on your local computer. To do this, we will need to open ports on the GCP network by creating a GCP Firewall Rule.
Below, we are going to create a firewall rule that will allow only our local computer to access TiDB resources.
We want our local computer IP address, NOT the GCP instance IP address. Therefore, run the following command on your local computer. For me, I’m running the following command on my MacBook. Notice in the image below, that the command prompt does not include tidb-vm
host myip.opendns.com resolver1.opendns.com
Notice my blurred-out IP address. We are going to use this IP Address below.
Let’s look at the current firewall rules
gcloud compute firewall-rules list
Notice, by default, that GCP already has some firewall rules. We will create a new firewall rule.
Here are the TiDB ports that we will make available to our local computer: