Skip to main content
  1. CloudM
  2. Migrate
  3. ...
  4. Deployment Options
  5. Self-Hosted
  6. Installation & Infrastructure
  7. Installation

Deploying CloudM Migrate from Google Cloud Marketplace

Updated

This guide walks you through deploying CloudM Migrate into your own Google Cloud project from Google Cloud Marketplace. The Marketplace deployment installs the same self-hosted CloudM Migrate product you would install by hand, and sets up the Google Cloud infrastructure around it for you. It is written for CloudM partners and for customers deploying CloudM Migrate themselves.

You need a CloudM Migrate licence from CloudM or a CloudM partner. The Marketplace listing deploys the software but does not include a licence. The Google Cloud resources the deployment creates (virtual machines, disks, network and storage) are billed to your Google Cloud project.

What gets deployed

The deployment creates the following in your Google Cloud project, in the region and zone you choose:

  • A Windows Server 2022 primary server. This runs the CloudM Migrate web console and the primary migration service.
  • A managed instance group of Windows Server 2022 secondary servers, which do the migration work. You choose how many.
  • Optionally, a standalone Ubuntu 22.04 VM for PostgreSQL and a standalone Ubuntu 22.04 VM for Redis. If you leave these off, PostgreSQL and Redis run on the primary server.
  • A VPC network with one subnet per cluster, a Cloud Router and Cloud NAT so the servers can reach the internet, and a static external IP address for each primary server.
  • Firewall rules. Remote Desktop (port 3389) and SSH (port 22) to the primary server are only allowed through Identity-Aware Proxy (IAP). The web console (ports 80 and 443) is only reachable from the IP ranges you enter in the form.
  • Four Secret Manager secrets holding the passwords you enter in the form, a VM service account, and a Cloud Storage bucket holding the installation scripts.

After the infrastructure is created, each server downloads the CloudM Migrate installer from the URL you provide and installs itself. The secondary servers wait until the primary server has finished before they install.

Clusters

A cluster is one complete CloudM Migrate deployment: a primary server, its secondary servers and, if you choose them, its database VMs, all in their own subnet. Most deployments need one cluster. You can deploy up to 10 independent clusters at once, for example to keep separate customers or projects apart.

Before you start

Google Cloud project

  • A Google Cloud project with billing enabled. We recommend a new project used only for CloudM Migrate. Several resource names are fixed (for example the firewall rules and the Cloud NAT router), so deploying twice into the same project causes name conflicts.
  • Enough Compute Engine quota in the region you plan to use. Add up the vCPUs of every VM you plan to deploy (see the default machine types in the table below) and check them against your CPU quota for that machine family. Each cluster also uses one static external IP address. You can check and request quota on the IAM & Admin > Quotas page in the Google Cloud console.
Server Default machine type vCPU / memory Default disk
Primary e2-standard-4 4 vCPU, 16 GB 200 GB
Secondary (each) e2-standard-2 2 vCPU, 8 GB 100 GB
PostgreSQL (if standalone) e2-standard-2 2 vCPU, 8 GB 50 GB
Redis (if standalone) e2-standard-2 2 vCPU, 8 GB 50 GB

APIs

In a new project, Marketplace asks you to enable the Compute Engine API and the Infrastructure Manager API before it shows the deployment form. The deployment turns on the rest itself. Your organisation policies must allow all of them:

  • Compute Engine API (compute.googleapis.com)
  • Identity and Access Management (IAM) API (iam.googleapis.com)
  • Secret Manager API (secretmanager.googleapis.com)
  • Cloud Storage API (storage.googleapis.com)
  • Cloud Identity-Aware Proxy API (iap.googleapis.com)
  • Cloud Resource Manager API (cloudresourcemanager.googleapis.com)
  • Infrastructure Manager API (config.googleapis.com)
  • Service Usage API (serviceusage.googleapis.com)

IAM roles

Marketplace runs the deployment through Infrastructure Manager, using a service account. That service account needs these project roles:

Role What it is used for
roles/config.agent Running the deployment through Infrastructure Manager
roles/compute.admin VMs, instance groups and templates, VPC, subnets, firewall rules, Cloud Router and NAT, static IP addresses
roles/iam.roleAdmin Creating the custom IAM role used by the VMs
roles/iam.serviceAccountAdmin Creating the VM service account
roles/iam.serviceAccountUser Attaching the service account to the VMs
roles/resourcemanager.projectIamAdmin Granting project roles to the VM service account and to your IAP tunnel members
roles/secretmanager.admin Storing the passwords in Secret Manager
roles/serviceusage.serviceUsageAdmin Enabling the required APIs
roles/storage.admin Creating the deployment bucket and uploading the installation scripts

When you deploy, choose to create a new service account and Google Cloud grants these roles for you. Your own Google account must be allowed to create service accounts and grant project roles to do this. A project Owner can.

On your own computer

  • The Google Cloud CLI (gcloud), signed in with an account that is one of your IAP tunnel members. You use it to open the IAP tunnel to the primary server.
  • A Remote Desktop client.

Things to have ready

  • The CloudM Migrate installer link (see the next section).
  • An email address and password for the CloudM Migrate web console administrator.
  • The Google accounts or groups that should be able to connect to the servers over Remote Desktop.
  • The public IP address ranges, in CIDR notation, that should be able to reach the web console.
  • Four passwords: web console, Windows administrator, PostgreSQL and Redis. Each must meet the password rules described in the form walkthrough below.

Get the installer link

The form asks for a link to the CloudM Migrate installer. You choose the version, and the servers download it during installation.

  1. Open the latest Migrate release notes. You can also find them in the Product updates category.
  2. Find the version you want to deploy and copy its installer link. Links look like https://storage.googleapis.com/cloudmigrator/CloudM-Migrate-x.x.x.x-x64.exe.
  3. Keep the link to paste into the CloudM Installer URL field.

CloudM Support may sometimes give you a link to a hotfix or beta build. Those links start with https://storage.googleapis.com/cloudmigrator-beta/. Paste them into the same field in the same way.

The field only accepts links that start with https://storage.googleapis.com/cloudmigrator/ or https://storage.googleapis.com/cloudmigrator-beta/ and end in .exe or .msi.

Fill in the deployment form

Open the CloudM Migrate listing in Google Cloud Marketplace, select your project and start the deployment.

If the Compute Engine API or the Infrastructure Manager API is not enabled in the project yet, an Enable APIs panel opens first. Select Enable and wait for both to show as enabled. The deployment form then opens.

The Enable APIs panel, listing Compute Engine API and Infrastructure Manager API as not enabled

The form is split into the sections below, in the order they appear.

The form checks most values as you type: the Resource Name Prefix, the CloudM Installer URL, the Web Admin Email, the Windows and PostgreSQL usernames, the number fields and the 16-character minimum for passwords. The rest of the password rules, and the IAP Tunnel Members and Allowed Web IP Ranges rules, are only checked after you select Deploy. If one of those values is wrong, the deployment stops with Error: Invalid value for variable and nothing is created in your project. Correct the value and deploy again.

Deployment Settings

Deployment Settings section of the Marketplace form, showing Region, Zone, Resource Name Prefix and Number of Clusters

Field What to enter Default
Region The Google Cloud region for the deployment. Choose one close to your source or destination data. europe-west1
Zone A zone in that region. The primary and database VMs are created here. europe-west1-b
Resource Name Prefix A short prefix used in every resource name, for example cm-primary. 2 to 4 characters: lowercase letters, numbers and hyphens, starting with a letter and ending with a letter or number. cm
Number of Clusters How many independent clusters to deploy, from 1 to 10. Each gets its own subnet, primary server, secondary servers and, if selected, database VMs. 1

Windows limits computer names to 15 characters, and the longest name the deployment creates is the PostgreSQL VM (for example cm-10-postgres with 10 clusters). If you deploy 10 clusters, use a prefix of 3 characters or fewer.

CloudM Configuration

CloudM Configuration section, showing CloudM Installer URL, Web Admin Email and Web Admin Password

Field What to enter
CloudM Installer URL The installer link you copied from the release notes.
Web Admin Email The email address you will use to sign in to the CloudM Migrate web console.
Web Admin Password The password for that sign-in. See the password rules below.

Windows Credentials

Windows Credentials section, showing Windows Admin Username and Windows Admin Password

Field What to enter Default
Windows Admin Username The local administrator account created on the Windows servers. You use it to sign in over Remote Desktop. 3 to 20 characters, starting with a letter, using letters, numbers, underscores or hyphens. None
Windows Admin Password The password for that account. None

Database Credentials

Database Credentials section, showing PostgreSQL Username, PostgreSQL Password and Redis Password

Field What to enter Default
PostgreSQL Username The database user CloudM Migrate connects as. 3 to 64 characters, starting with a letter, using letters, numbers and underscores only. None
PostgreSQL Password The password for that database user. None
Redis Password The password Redis requires from CloudM Migrate. None

Password rules

All four passwords follow the same rules. The form checks the 16-character minimum as you type. The other rules are checked when the deployment runs, so a password that breaks one stops the deployment:

  • At least 16 characters.
  • At least one uppercase letter, one lowercase letter, one number and one special character such as ! @ # $ %. Underscores and spaces do not count as special characters.
  • No character repeated 3 or more times in a row, such as aaa, 111 or @@@. Two in a row is fine.
  • None of the blocked words below anywhere in the password, in upper or lower case. A blocked word inside a longer string still counts: Juniper!Falcon7123 is rejected because it contains 123.
Password Blocked words
Web Admin Password password, admin, cloudm, 123, abc, qwerty, example, sample, change_me, s3cur3, myv3ry, str0ng
Windows Admin Password password, admin, windows, 123, abc, qwerty, example, sample, change_me, myv3ry, str0ng, c0mpl3x
PostgreSQL Password password, postgres, database, 123, abc, qwerty, example, sample, change_me, d@tab@s3, sup3r, str0ng
Redis Password password, redis, cache, 123, abc, qwerty, example, sample, change_me, r3d1s, myv3ry, str0ng

change_me also covers change-me, change.me and change me.

The passwords are stored in Secret Manager in your project, so you can look them up later.

Primary Server

Primary Server section, showing machine type, disk size and disk type

Field What to enter Default
Primary Server Machine Type The machine type for the primary server. e2-standard-4
Primary Server Disk Size (GB) Boot disk size, from 50 to 2000 GB. 200
Primary Server Disk Type One of pd-standard, pd-balanced, pd-ssd or hyperdisk-balanced. pd-standard

The defaults are based on the CloudM Migrate system requirements. Check that article before you size the servers down. If you pick hyperdisk-balanced, choose a machine type that supports Hyperdisk; E2 machine types do not.

Secondary Servers

Secondary Servers section, showing machine type, disk settings, count and Max Users Per Secondary Server

Field What to enter Default
Secondary Server Count How many secondary servers to create in each cluster. Enter 0 for none. 1
Secondary Server Machine Type The machine type for the secondary servers. e2-standard-2
Secondary Server Disk Size (GB) Boot disk size, from 50 to 2000 GB. 100
Secondary Server Disk Type Same options as the primary server. pd-standard
Max Users Per Secondary Server How many users each secondary server migrates at the same time, from 1 to 1000. 20

To size the deployment, work from how many users you want to migrate at the same time. Each secondary server processes up to the Max Users Per Secondary Server value at once, so with the default of 20, three secondary servers can migrate up to 60 users at the same time. Leave the value at 20 unless you have sized the servers for a different load. The Multi-Server Installation article explains how primary and secondary servers share the work.

The primary server also runs the secondary migration service, so it migrates users as well. If you set Secondary Server Count to 0, the primary server does all the migration work on its own.

Database Configuration

Database Configuration section with Standalone Redis VM and Standalone PostgreSQL VM selected, showing the extra machine type and disk fields

CloudM Migrate uses PostgreSQL for its data and Redis for queuing. You can run each on the primary server or on its own Ubuntu VM.

Field What to enter Default
Standalone Redis VM Turn on to run Redis on its own VM. Recommended for production. Off
Standalone PostgreSQL VM Turn on to run PostgreSQL on its own VM. Recommended for production. Off
Redis VM Machine Type, Redis Disk Size (GB), Redis Disk Type Shown only when Standalone Redis VM is on. Disk size from 20 to 500 GB. e2-standard-2, 50, pd-standard
PostgreSQL VM Machine Type, PostgreSQL Disk Size (GB), PostgreSQL Disk Type Shown only when Standalone PostgreSQL VM is on. Disk size from 20 to 500 GB. e2-standard-2, 50, pd-standard
PostgreSQL Max Connections The maximum number of database connections, from 1500 to 4000. Applies whether PostgreSQL runs on the primary server or its own VM. 1500
Layout Redis PostgreSQL Good for
Both off Primary server Primary server Evaluation and small migrations
Standalone Redis only Own VM Primary server Large queues that need more memory
Standalone PostgreSQL only Primary server Own VM Workloads that need dedicated disk I/O for the database
Both on Own VM Own VM Production migrations (recommended)

Network & Security

Network and Security section, showing IAP Tunnel Members and Allowed Web IP Ranges with example entries

Field What to enter
IAP Tunnel Members The Google accounts that can connect to the servers over Remote Desktop through IAP. Each entry must start with its type: user:, group:, serviceAccount: or domain:. For example user:jane@company.com or group:it-admins@company.com. Entries without a prefix are rejected. Each member is given the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) on the project.
Allowed Web IP Ranges The public IP ranges that can reach the web console on ports 80 and 443, in CIDR notation. For a single address add /32, for example 203.0.113.10/32. For a network enter its range, for example 198.51.100.0/24. An address without a / suffix is rejected.

Add yourself to IAP Tunnel Members. Anyone not listed needs the IAP-secured Tunnel User role granted by hand before they can connect over Remote Desktop. If you leave Allowed Web IP Ranges empty, the web console is not reachable from the internet and you can only open it from a browser on the primary server.

Deploy

  1. Check your entries and select Deploy.
  2. Wait for the deployment to show as active. Creating the infrastructure takes about 10 minutes.

A CloudM Migrate deployment in progress in Solution deployments, showing resources being created

After deployment

CloudM Migrate installs on the servers after the deployment itself finishes. Allow about 20 minutes after the deployment shows as active before the web console responds. Until then the web address does not respond or shows an error. That is expected and does not mean the deployment failed.

Deployment outputs

The Details tab of a finished deployment in Solution deployments, showing the Outputs section

When the deployment finishes, its details page in the Google Cloud console (Solution deployments) shows these outputs:

Output What it shows
Cloudm Web Admin Url The web console address for each cluster, for example Cluster 1: https://203.0.113.20.
Rdp Connection The command that opens an IAP tunnel to each primary server and starts Remote Desktop.
Readiness Check The command that shows whether CloudM Migrate has finished installing. See the next section.
Iap Tunnel Members The accounts that can connect to the servers through IAP.
Deployment Summary The number of clusters, the region and zone, whether Redis and PostgreSQL run on their own VMs, and the number of secondary servers.
Clusters, Primary Server, Secondary Servers The names and IP addresses of the servers in each cluster.
Postgresql Server, Redis Server Where PostgreSQL and Redis run: on the primary server or on their own VMs.
Network Name, Network Config The VPC network and the subnet range for each cluster.
Script Bucket Name The Cloud Storage bucket that holds the installation scripts.
Service Account Email The service account the servers run as.

Check the installation has finished

Each primary server marks itself ready when CloudM Migrate has installed. Run this command, replacing PROJECT_ID with your project ID:

gcloud compute instances list --filter='name~-primary$' --project=PROJECT_ID --format='table(name,zone,metadata.items[cloudm-status])'

When the installation has finished, the output looks like this:

NAME        ZONE            CLOUDM-STATUS
cm-primary  europe-west1-b  ready

When the CLOUDM-STATUS column shows ready, the installation on that primary server is complete. Secondary servers install after their primary is ready, so they finish a little later.

Find the passwords in Secret Manager

The four passwords you entered are stored in Secret Manager in your project, named after your resource name prefix:

  • PREFIX-webadmin-password
  • PREFIX-windows-admin-password
  • PREFIX-postgresql-password
  • PREFIX-redis-password

To view one in the Google Cloud console:

  1. Go to Security > Secret Manager and select your project.
  2. Select the secret, for example cm-windows-admin-password.
  3. On the Versions tab, open the actions menu on the latest version and select View secret value.

Secret Manager listing the four CloudM Migrate secrets: cm-postgresql-password, cm-redis-password, cm-webadmin-password and cm-windows-admin-password

Or from the command line:

gcloud secrets versions access latest --secret=cm-windows-admin-password --project=PROJECT_ID

You need permission to read secret values, for example the Secret Manager Secret Accessor role.

Connect to the primary server

Remote Desktop to the primary server goes through IAP, so you connect through a tunnel from your own computer. Sign in to gcloud with an account listed in IAP Tunnel Members first.

  1. Open a terminal and start the tunnel. The Rdp Connection output has the server name and zone filled in for you. With the defaults it looks like this:

    gcloud compute start-iap-tunnel cm-primary 3389 --local-host-port=localhost:13389 --zone=europe-west1-b --project=PROJECT_ID
  2. Leave that terminal open. The tunnel stays up while the command runs.
  3. Open your Remote Desktop client and connect to localhost:13389.
  4. Sign in with the Windows admin username and the Windows admin password.

A terminal running the IAP tunnel and listening on port 13389, with Remote Desktop asking for credentials to connect to localhost:13389

With more than one cluster, primary servers are named PREFIX-1-primary, PREFIX-2-primary and so on. Use a different local port for each tunnel if you want several open at once.

Sign in to the web console

You can open the web console either way:

  • From your browser: open the address in the Cloudm Web Admin Url output, for example https://203.0.113.20. This works from the IP ranges you entered in Allowed Web IP Ranges. Use https://; plain http:// is not served.
  • From the primary server: connect over Remote Desktop and open https://cloudm.local in a browser on the server.

The server uses a self-signed certificate issued to CloudM.local, so your browser shows a certificate warning. Accept it to continue, then sign in with the web admin email and web admin password.

The CloudM Migrate web console sign-in page

Apply your licence

CloudM Migrate licences are applied to each migration project in the web console, not to the server. When a project has no licence, its licence status shows in red. Select it to open License information, enter your licence key and select Apply license. For how licences are counted and consumed, see How is CloudM Migrate licensed?

This is the same as licensing any other CloudM Migrate installation. Nothing about it is specific to Marketplace.

Check it worked

The installation scripts check each step as they go, and stop with an error in the serial log if a step fails. Before the primary server reports ready, they:

  • wait for the standalone PostgreSQL VM to report that it is ready, if you chose one, and check the primary server can connect to the database
  • check the CloudM Migrate installer completed without an error
  • configure Redis with the password you set

After marking itself ready, the primary server checks the web console responds on the server. Each secondary server waits for its primary to be ready, checks it can reach the primary server, installs the secondary migration service and runs a health check.

Then check it yourself:

  1. Sign in to the web console.
  2. Go to Service manager and check each secondary server appears with a Service state of Running and the same version as the primary.
  3. Create a source or destination connection and run Test connection. A passing test confirms your new servers can reach that platform. See Create New Source Connection and Create New Destination Connection for the setup steps for each platform.

Troubleshooting

The installation has not finished after 30 minutes

If cloudm-status has not reached ready 30 minutes after the deployment became active, read the primary server's serial port output. The installation scripts write their progress and any errors there.

gcloud compute instances get-serial-port-output cm-primary --zone=ZONE --project=PROJECT_ID

You can also see it in the console: open the VM in Compute Engine > VM instances, then Logs > Serial port 1 (console).

Common causes:

  • Failed to download CloudM installer: the installer link is wrong or the file no longer exists. Check the link against the release notes.
  • Cannot reach PostgreSQL server or Database connectivity test failed: the standalone PostgreSQL VM did not start or did not finish its setup. Check that VM's serial output too.
  • CloudM installer failed with exit code: the CloudM Migrate installer itself failed. Send the logs to CloudM Support.
  • The VMs were not created at all: the project may not have enough quota for the machine types you chose. Check the deployment's error in Solution deployments.

Once you can connect to the server, the full installation log is at C:\temp\cloudm-secure-install.log.

A value is rejected

If the form marks a field, fix it before you deploy. If the deployment stops with Error: Invalid value for variable, nothing was created: check the value it names against the rules below, correct it and deploy again.

  • Passwords: check the password rules above. The most common cause is a blocked word such as 123 or admin somewhere in the password.
  • IAP Tunnel Members: each entry needs its prefix, such as user: or group:.
  • Allowed Web IP Ranges: each entry needs a / suffix, such as /32 for a single address.
  • Resource Name Prefix: 2 to 4 lowercase characters, and 3 or fewer if you deploy 10 clusters.
  • CloudM Installer URL: must be a storage.googleapis.com/cloudmigrator/ or cloudmigrator-beta/ link ending in .exe or .msi.

These values are all rejected:

Field Value entered Why it is rejected
Web Admin Password Juniper!Falcon7123 Contains 123
Web Admin Password Kx9#Short! Fewer than 16 characters
Web Admin Password Kx9mNp2vLq7wRtYb No special character
Web Admin Password Kx9_mNp2_vLq7_wRtY An underscore is not a special character
Web Admin Password Kx9#mNp2!vLq7wRRR RRR is the same character 3 times in a row
Web Admin Password Kx9#CloudMDemo!vLq Contains cloudm
Windows Admin Password Kx9#AdminDemo!vLqT Contains admin
PostgreSQL Password Kx9#Str0ngDemo!vLq Contains str0ng
Redis Password Kx9#RedisDemo!vLqT Contains redis
IAP Tunnel Members jane@company.com Missing the user: prefix
Allowed Web IP Ranges 203.0.113.10 Missing /32

Remote Desktop does not connect

  1. Check the account you are signed in to gcloud with is listed in IAP Tunnel Members, or has the IAP-secured Tunnel User role on the project.
  2. Check the primary server is running in Compute Engine > VM instances.
  3. Check the tunnel command is still running in its terminal, and that you are connecting to the same local port.
  4. Check the installation has reached ready. The Windows admin account is created during installation.

To give another account access after deployment:

gcloud projects add-iam-policy-binding PROJECT_ID --member=user:EMAIL --role=roles/iap.tunnelResourceAccessor

The web console does not load

  1. Check cloudm-status shows ready.
  2. Check you are using https://.
  3. Check your public IP address is inside one of the Allowed Web IP Ranges. If you left the field empty, the console is only reachable from a browser on the primary server.
  4. Connect to the primary server over Remote Desktop and try https://cloudm.local there.

A deployment failed or you want to remove it

  1. In the Google Cloud console, go to Solution deployments in your project.
  2. Find the CloudM Migrate deployment and select Delete. This removes the VMs, network, secrets, storage bucket and IAM resources the deployment created.
  3. If the delete fails or leaves resources behind, check for leftover resources before you deploy again: VMs, instance groups and templates, disks, static IP addresses and Secret Manager secrets starting with your prefix, the PREFIX-net network, the cloudm-allow-iap and cloudm-allow-http firewall rules, and the cloudm-nat-router router. Leftover resources with the same names cause the next deployment to fail.

If you are not sure what to remove, contact CloudM Support before deleting anything.

Getting help

If you contact CloudM Support about a Marketplace deployment, include:

  • the project ID, region and zone
  • the number of clusters, number of secondary servers and database layout (the Deployment Summary output)
  • the serial port output from the primary server and from any VM that did not finish
  • the installer link you used
Was this article helpful?
1 out of 1 found this helpful