Migration to Google Cloud

Google Cloud Platform Pre-requisites

Working with GCP credentials

To allow IBM Live Migration service to connect to your GCP project in order to replicate your source machines to a GCP Target infrastructure, you will need to generate GCP credentials and enter them into the IBM Live Migration Service. These credentials are GCP Project ID and GCP JSON Private Key

This section provides step-by-step instructions for the following:

1. Generating the Required GCP Credentials
2. Using Your GCP Credentials

Generating the Required GCP Credentials

To generate the required GCP credentials, you require to create at least one GCP project with one service account and assign the required Identity and Access Management (IAM) role to this account. This IAM role identifies GCP permissions.

During the service account creation, you are provided with a Private Key. The private key and the Project ID are credentials that you need to enter into the IBM Live Migration Service console.

The instructions below describe the steps to follow to generate the credentials. The steps include:

1. Preparing your GCP account.
2. Obtaining the GCP project ID.
3. Creating a service account with the required permissions and generating a private Key.
4. [Optional] Regenerating your private Key.

Preparing the GCP Account

Before you can generate GCP credentials, you will need the following:

1. Google Cloud Platform account - if you do not have a Google account, create an account by logging into the Google account signup page.

   

2. Billing- if you do not have an active GCP billing account, you need to create one, or enable an existing billing account which is disabled. To create or enable a billing account, sign in to the GCP console, and follow GCP billing instructions:

   • Enabling billing

   • General billing

     

3. GCP Project - GCP credentials are associated with a specific GCP project. A project serves as the base level organizing entity.It is required for housing GCP and all its resources. Therefore, if you do not have a GCP project, create a new project and enable its Compute Engine.

Creating a new GCP project

Sign in to the GCP console. Then, follow the GCP instructions on creating a project using the Select Project dialog box - Create project button. After you create a new project, you need to enable the Compute Engine.

Enabling the Compute Engine of a project

1. In the GCP console, click on the project dropdown and select your project.

   

2. Select your new project from the project list.

   

3. Open the Products & services menu, select APIs & Services Dashboard.

   

4. On the Dashboard page, click ENABLE APIs & SERVICES option.

   

5. This takes you to the API Library page. On the Library page, search for Compute Engine API in the search box.

   

6. Click on Compute Engine API from the search results.

   

7. On the Google Compute Engine API page, click ENABLE.

   

8. You see an API enabled confirmation box.

   

Obtaining the GCP Project ID

Once you have a GCP project with an enabled compute engine, you need to obtain the Project ID, which is a unique identifier of the project.

1. Sign in to the GCP console

   

2. In the GCP console, click on the project dropdown and select your project.

   

3. You will find the Project ID under the Project info section on your Dashboard. Copy the Project ID and save in a secure location.

   

Creating a GCP Service Account and Private key

Once you have a GCP account, an active billing account and a GCP project with an enabled compute engine, you can create a service account. During service account creation, you will enable the IAM role requisite to help act on GCP resources. You can also create a private key that is part of the IBM Live Migration Service console GCP credentials.

1. Open your project and click on the Products and services menu and navigate to IAM & admin > Service accounts.

   

2. On the Service accounts page, click Create service account.

   

3. On the Create service account dialog box, set the following:

   

   • Service account name - enter a name for the new service account.
   • Service account ID - this field auto completes after you enter a registered service account name.
   • Furnish a new private key - select this checkbox.
   • Once this checkbox is selected, two additional options for this Key type appear: JSON and P12. You select the JSON option.
   • Once you have filled out the properties, click CREATE

4. On the next page, select the Project > Owner (Full access to all resources) role and click CONTINUE.

   

5. On the Create service account screen, under the Service account permission (optional) select a role from the dropdown filter.

   

6. On the next page, under the Create key (optional) field, click CREATE KEY.

   

   • Select the JSON option and click CREATE.

     

   • The key will be automatically saved onto your computer.

     

   • Click DONE.

     

     ImportantSave the downloaded JSON file in an accessible and secured location. This file contains the service account Private Key you need to enter the Migration Console. If you misplaced the JSON file, you create a new one, as described in Step 8 below.

7. You will see your new Service account on the Service Accounts page.

   

   If you want to use your current Private Key, you have now completed the process of generating the required GCP credentials. The next step is entering your Project ID and Private Key in the IBM Live Migration Service.

8. (Optional) Customers that already have an existing account but forgot their Private Key or lost their JSON file may want to create a new private key for an existing account. The Service Accounts page enables you to create a new Private Key for the new service account, or to create a Private Key for a service account that currently does not have a key.

   To create a new Private Key for an existing service account, click the Options button at the end of the service account row. Then, select the Create key option, and define the new key according to the instructions on Step 3 above.

   

   

Once the new Private Key is created, save the downloaded JSON file in an accessible and secured location. If you already have a JSON file with a Private Key, replace the old file with the new one.

Re-Generating Your GCP Private Key

If you want to generate a new Private Key, you can do it either through the Service Account page or the Credentials page. The APIs & services > Credentials page provides you with an additional way to generate a Private Key to a new or existing service account.

The instructions below describe how to re-generate a Private Key in an existing service account with an existing key through the APIs & services > Credentials page. You can also use the Credentials page to create a new service account with a new key.

For more information on using the APIs & services - Credentials page, see the following GCP documentation:

• Credentials, access, security, and identity
• Generating a service account credential

Regenerating a Private Key:

From your project, open the Products & services menu navigate to APIs & services > Credentials.

On the Credentials page, click the Create credentials button and select Service account key.

On the Create service account key page, click the Service account drop-down list and select the service account for which you want to create a new key. Select JSON under Key type and click Create.

A confirmation message will appear informing you that your new service account and key have been created and that the JSON file that contains your key has been downloaded to your computer.

Your new Service account Private Key will be displayed on the Credentials page.

[Optional] By default, the IAM role of the new Private Key is the same as that of the existing key. If you want to check the IAM role of the key, and possibly change it, navigate to IAM & admin > IAM.

On the IAM page you can see and change the role of your service account by clicking the dropdown menu and selecting a role. This role will apply to all of the keys in the account.

After you re-generate a Private Key, you can enter it into IBM Live Migration Service user console instead of the old key. You can then delete the old key. However, you should take into consideration that if you delete a key, your applications will no longer be able to access GCP resources using that key.

Using Your GCP Credentials

After generating the required GCP credentials, enter the credentials into the IBM Live Migration Service User Console.

1. Sign in to the IBM Live Migration Service User Console.

2. From the Projects dropdown menu, select the project to which the GCP credentials should be assigned to.

   

3. Click Setup & Info in the main navigational menu to the left. From the Setup & Info, click the GCP CREDENTIALS tab.

   

   The GCP CREDENTIALS page allows for setting up the replication Staging Network on GCP and manage and monitor resources on your GCP Target infrastructure.

4. Enter your Project ID taken from the GCP portal into the Google Cloud Platform Project ID field.

   

   NoteReminder- Your Project ID is displayed under the Project Info category on your GCP Dashboard.

   

   NoteSometimes, the Project ID also appears in the JSON file that contains your Private Key.

   

5. Enter the JSON Private Key into the Google Cloud Platform JSON Private Key field by clicking the link, click here to choose file.

   

6. Navigate to the location of your downloaded JSON file. Select the file and click Open.

   

   The User Console will automatically upload the file and populate the Google Cloud Platform JSON Private Key field. Click Save.

   

   Your GCP credentials are now saved in your IBM Live Migration Service Project.

In this event, you can attempt the following troubleshooting steps:

• Verify that Billing and Compute Engine are enabled in your GCP project (as illustrated in the Preparing your GCP Account section).
• Verify that the correct Project ID is entered and NOT the Project Name (as illustrated in the Obtaining the GCP Project ID section).
• Check the IAM role of the Private Key, and if required, change it to Owner (as illustrated in the Creating a GCP Service Account and Private Key section)
• Create a new Private Key (as illustrated in the Re-Generating Your GCP Private Key section).
• Retry the steps in the above Generating the Required GCP Credentials section with the latest updated credentials within the GCP console.