Install on Google Cloud Platform

Copy link to this section

C3 AI deployment options: guidance for enterprise customers

C3 AI offers flexible deployment models to meet the diverse needs of enterprise customers. Selecting the appropriate deployment option is a critical decision that impacts project timelines, service-level agreements (SLAs), and roles and responsibilities (RACI). This document outlines each option, highlights key considerations, and underscores the benefits of the C3 AI SaaS/PaaS Subscription, which is the recommended approach for most organizations.

Copy link to this section

1. C3 AI SaaS / PaaS subscription (preferred standard option)

The standard C3 AI SaaS/PaaS (Software as a Service / Platform as a Service) subscription is the most typical deployment option to leverage the C3 AI Platform and Applications. It is a fully hosted and managed service by C3 AI in Google Cloud Platform (GCP). Customers may select their preferred GCP region for data residency.

Key Features and Benefits:

• Lower Total Cost of Ownership (TCO): Standardized technologies and processes enable rapid deployment, streamlined support, and efficient issue resolution. C3 AI maintains specific enterprise SLAs to deliver an industry-leading service with lower TCO.
• Reduced Operational Burden: Internal teams can focus on leveraging AI applications for business value, rather than managing infrastructure setup and maintenance.
• Scalability: The SaaS/PaaS model supports seamless scaling as business needs evolve. C3 AI manages all scaling needs and capacity planning required to ensure consistently available platform and applications.
• Security and Compliance: C3 AI employs industry standard cybersecurity and access control practices to safeguard customer applications and data. C3 AI holds and maintains critical compliance attestations like SOC2, ISO27001, and FedRAMP.

Why Choose SaaS/PaaS?

This model is the fastest, most cost-effective way to realize value from C3 AI products and generate AI-driven insights. It is recommended for organizations seeking minimal operational overhead and maximum agility.

Copy link to this section

2. Customer-hosted, C3 AI-managed deployment

For organizations with non-standard data residency, security, or governance requirements, C3 AI supports deployments within a customer's own Google Cloud Virtual Private Cloud (VPC). C3 AI Operations manages the deployment, maintenance, and support within the customer's environment. Your organization will have responsibility for portions of the infrastructure to ensure C3 AI Operations can successfully deploy and manage C3 AI Products. Coordination with C3 AI Operations will be required for future upgrades, change and incident management activities. Additional charges may apply to support a customer-hosted deployment.

Key Considerations:

• Customer Responsibilities:
  • Provide a dedicated GCP project for the C3 AI cluster with Owner access for C3 AI Operations members. C3 AI Operations provisions the VPC via Terraform by default. Provide timely and required access to C3 AI Operations for installation and ongoing support.
  • Manage and troubleshoot infrastructure changes outside C3 AI's control that may affect availability or performance.
  • Assume all infrastructure hosting costs within the customer's cloud account.
  • If the Kubernetes endpoint is private, provision and maintain a bastion host for C3 AI Operations (see Google Cloud access requirements for specifications).
• Control and Access: Customers retain greater control and thus greater responsibility over their GCP subscription and can limit permissions granted to C3 AI.

When to Choose This Option:

This model is suitable for organizations with:

• Internal processes requiring direct control over cloud resources.
• Policies with non-standard local data residency, security, or governance requirements.

Copy link to this section

Summary table

Selecting the right deployment option is essential for project success. C3 AI strongly recommends the SaaS/PaaS Subscription for most enterprises, as it maximizes value, reduces risk, and accelerates time to insight.

If you have questions or require a tailored recommendation, please reach out to your C3 AI representative.

Copy link to this section

Customer-hosted install requirements: checklist

Copy link to this section

Summary

For C3 AI to operate in customer-hosted GCP Cloud accounts, your organization must meet the following requirements consistently throughout the contract term. Deviations from the installation requirements incur additional operational fees.

You agree that your organization will allow C3 AI Operations to deploy all infrastructure required to support the C3 AI applications and platform per this specification and utilizes C3 AI deployment automation. This checklist only applies to customer hosted installations.

Copy link to this section

Naming conventions

Several identifiers throughout this guide -- the GCP project, the C3 AI cluster, and related resources -- must follow the same set of naming rules. The rules apply consistently; any place in this guide that asks for a project name or cluster name refers back to this section.

• Environment prefix:
  • For Dev and QA clusters: <stg><cloud><customerabbreviation>; where <cloud> is gke. For example, stggkecust.
  • For Production clusters: <prd><cloud><customerabbreviation>; where <cloud> is gke. For example, prdgkecust.
• Character rules: Lowercase letters and numbers only. No hyphens, special characters, or diacritics (accented letters). Must start with a letter.
• Length: Fewer than 15 characters total.

Terraform reference: These rules are enforced by the project_name variable, which includes a validation block that rejects values that do not conform.

Copy link to this section

Pre-flight checklist

Before C3 AI Operations can deploy a customer-hosted cluster, complete each of the items below. Requirements that were historically spread across several sections are consolidated here for a single-page review.

For C3 AI Operations to deploy a cluster in a customer-hosted deployment, you must provide the following access, network setup, and infrastructure to C3 AI:

1. Provide C3 Ops with owner access to the GCP Project. C3 AI requires owner privileges to the project to set up an IAM policy and create a role that allows C3 AI Operations to perform installation, setup, and deployment tasks. You can remove owner access after initial setup. You must grant owner access again for new product releases and for any subsequent infrastructure changes, because owner privileges are required to read current infrastructure state.

   Terraform reference: The bootstrap module creates this role automatically. See 1.1 Run the bootstrap module.

2. An IAM role called C3.Ops with access to your dedicated GCP project.

   Terraform reference: The bootstrap module creates the delegated operations role ({project_name}c3dopsrole-01). Assign members via the delegated_iam_role_members variable.

3. If your firewall settings prevent C3 AI Operations from configuring access to required endpoints, you must allow access to the following:

   • Routing to and from the C3 AI network so C3 AI can receive metrics, logs, and observability data to operate the deployment.
   • Connectivity to endpoints that allow C3 AI product functionality.

   Terraform reference: Outbound access is provided via NAT by default. If your organization applies egress filtering, see Endpoint access for the full list of required domains and IPs.

4. New VPC and subnet with at least 1024 IP address (/22) available for C3 deployment. Each subnet must be across three availability zones.

   Terraform reference: Set gke_cidr_block (default: 10.0.0.0/22). The network module creates the VPC and subnets automatically.

5. Static DNS entry for C3 AI URL (for example, c3project.customer.com).

6. Public certificate with the complete chain and the private key. Certificates issued by a public or an internal Certificate Authority are supported. Coordinate with the C3 AI Center of Excellence if you plan to use self-signed or internal-CA certificates so that the required trust chain can be pre-staged in the cluster.

7. Bastion host provisioned and reachable by C3 AI Operations (required only if the Kubernetes endpoint is private and C3 AI Operations cannot deploy the cluster directly). The bastion must have the following software installed:

   • RedHat 8
   • gcloud CLI (latest version)
   • kubectl v1.34
   • Helm v3.12+
   • Helmfile plugin
   • HashiCorp Terraform >= 1.13.0
   • TFSwitch
   • Python 3.12
   • Docker
   • yq
   • jq
   • openssl

   Note: Bastion host provisioning is a customer responsibility and is not included in the C3 AI Terraform modules. See Google Cloud access requirements for the authoritative specification.

8. C3 AI Operations IP allowlist received from your C3 AI account team. The allowlist CIDR blocks must be populated in the ip_allowlist variable on the c3cluster module so that the firewall policy admits inbound traffic from C3 AI Operations. See Endpoint access for the current list.

9. CORS domains list received from the C3 AI Center of Excellence (CoE). Required if the installation includes C3 AI Ex Machina. Populate via the gcs_cors_domains variable on the c3cluster module. See Implement CORS policy for C3 AI Ex Machina.

10. Remote state backend bucket created (recommended). Before running Terraform for the first time, create a GCS bucket to hold remote state for each module. See State management for the recommended backend configuration.

Copy link to this section

C3 AI installation requirements for Google Cloud Platform

The C3 Agentic AI Platform integrates with core Google Cloud services such as Google Compute Engine, Virtual Private Network (VPC), and IAM, enabling cohesive security and infrastructure management.

The C3 Agentic AI Platform requires specific Google Cloud Platform (GCP) cloud services and infrastructure for successful deployment, as well as specific access requirements for C3 AI Operations to install, administer, and upgrade the C3 Agentic AI Platform and C3 AI Applications.

Install and upgrade requirements including Bill of Materials (BOM) details can be reviewed on the documentation site https://docs.c3.ai/versions-and-compatibility/upgrade-requirements/8.11.

The following sections describe the specific services and access needs, including network configurations and subnet requirements, security group egress and ingress rules, and subnet-level access control lists (ACLs).

Copy link to this section

Required Google cloud services

The table below describes the GCP Cloud infrastructure services required by the C3 Agentic AI Platform. You are required to provide the services below configured to C3 AI specifications as documented in the HashiCorp Terraform scripts.

Copy link to this section

Google Cloud access requirements

The table below describes the access requirements for C3 AI Operations to install, administer, and upgrade the C3 AI Applications and C3 Agentic AI Platform.

To ensure security, operational excellence, and customer trust, C3 AI leverages an industry standard privileged access management (PAM) for infrastructure access and authentication. All access by our C3 AI Operations team to customer hosted deployments will be managed exclusively through this PAM solution. This approach ensures every interaction with the systems is secure, fully auditable, and aligned with industry best practices.

Why PAM and what this means for you:

• Centralized Access Control: All infrastructure access is managed through a single, secure platform, reducing complexity and risk.
• Enhanced Security: PAM enforces strong authentication and zero-trust principles, ensuring only authorized personnel can access your systems.
• Full Auditability: Every session and command is logged, providing complete visibility for compliance and security reviews.
• Rapid Access Revocation: Access can be granted or revoked instantly, minimizing exposure during personnel changes or incident response.
• Operational Efficiency: Our Operations team benefits from streamlined workflows, reducing time to resolution for support and maintenance tasks.
• Industry Best Practices: PAM aligns with leading security frameworks and compliance standards, reinforcing trust and reliability.

Requirements of the PAM solution:

• One time use of Service Account role to deploy the cluster and for select infrastructure upgrades
• Service account created in your SSO / Active Directory used to manage the C3 AI Platform
• An additional /28 CIDR IP block for the C3 Software-Defined Perimeter/Management (SDM) peered VPC

C3 AI Operations will deploy and install the PAM solution. You can request an audit log of user access by contacting C3 AI Customer Support.

Copy link to this section

Network configuration

By default, C3 AI Operations provisions the VPC via Terraform following the requirements in the VPC requirements section below. If your organization must pre-provision the VPC per internal policy, coordinate with the C3 AI Center of Excellence. This is a special-case scenario. Terraform reference: If your organization must use existing network resources rather than having the Terraform modules create new ones, set the existing_network_configuration variable. For details, refer to examples/existing_network/README.md in the Terraform module documentation.

Copy link to this section

VPC requirements

Your VPC must meet the requirements described in this section to host a C3 AI cluster.

Copy link to this section

VPC region

The GCP region where the deployment will occur. Refer to GCP documentation for a list of available regions.

Terraform variable: c3_region

Copy link to this section

VPC sizing

The C3 Agentic AI Platform requires six (6) CIDR blocks.

The VPC must have DNS hostnames and DNS resolution enabled.

Copy link to this section

Subnets

The Terraform module creates the following subnets within the VPC for each cluster:

Copy link to this section

VPC Networks

The VPC should have a custom static route to apply a specific 0.0.0.0/0 route and network tags to desired subnets.

Copy link to this section

Additional networking requirements

• Workloads/Resources must be private.
• Subnets must have outbound access to the public network using a cloud native NAT gateway and internet gateway.
• The NAT gateway must be set up in its own subnet that routes quad-zero (0.0.0.0/0) traffic to an internet gateway.

Terraform reference: The network module provisions the NAT gateway automatically with manual IP allocation. Configure additional NAT addresses via network_extra_nat_address_count. Port allocation is controlled by nat_min_ports_per_vm, nat_max_ports_per_vm, and nat_enable_dynamic_port_allocation.

Copy link to this section

Firewall policies

C3 AI must have access to at least one GCP firewall policy and no more than five policies. You can reuse existing policies rather than creating new ones.

Firewall policies must follow the following rules.

Terraform reference: The firewall module is configured via firewall.tf at the root level. The ip_allowlist variable controls which external CIDRs can reach the cluster on port 443. Additional security policies can be added via firewall_extra_security_policies.

Copy link to this section

Endpoint access

If your firewall settings prevent C3 AI Operations from configuring endpoint access, you must allow outbound access to the following endpoints to allow C3 AI product functionality. These endpoints provide access to container registries, language-runtime package repositories (Python, NodeJS, Anaconda), C3 AI artifact servers, and the vault that secures platform credentials. Blocking any of them prevents platform installation, upgrades, or runtime operations. Contact the C3 AI Center of Excellence for a per-endpoint justification if required for security review.

• conda.anaconda.org - Package repository for Conda environments and dependencies
• files.pythonhosted.org - File hosting service for Python packages distributed via PyPI
• github.com - Source code hosting and version control platform
• c3ai.grafana.net - C3 AI's Grafana-hosted monitoring and observability dashboards
• huggingface.co - Repository for pre-trained machine learning models and datasets
• jfrog.c3.ai - C3 AI's internal JFrog Artifactory instance for artifact and package management
• nodejs.org - Official Node.js runtime downloads and documentation
• npmjs.org - Package registry for Node.js/JavaScript dependencies
• prdgkemis.c3.ai - C3 AI endpoint for MIS (Management Information System) access (if required)
• pypi.org - Primary Python package index for installing Python libraries
• pypi.python.org - Legacy Python package index mirror, an alias for PyPI
• registry.c3.ai - C3 AI's private container and artifact registry
• repo.anaconda.com - Anaconda's repository for curated data science packages
• repo.continuum.io - Legacy Continuum Analytics (now Anaconda) package repository
• telemetry.c3.ai - C3 AI endpoint for collecting platform telemetry and usage data
• vault.c3iot.io - C3 AI's HashiCorp Vault instance for secrets and credentials management.

You must allow outbound access to the following endpoints for C3 AI Monitoring. These IP addresses collect standard operational metrics:

• fleet-management-prod-014.grafana.net
• prometheus-prod-36-prod-us-west-0.grafana.net
• logs-prod-021.grafana.net

You must allow inbound access to the following C3 AI Operations endpoints to operate the deployment:

• 12.226.154.130/32
• 13.214.249.29/32
• 18.136.19.189/32
• 34.231.113.223/32
• 34.232.23.54/32
• 34.238.215.224/32
• 34.82.144.175/32
• 52.48.79.190/32
• 54.76.64.220/32
• 70.35.33.244/32

Terraform reference: Add C3 AI Operations IPs to the ip_allowlist variable so that firewall rules permit inbound access. For example:

ip_allowlist = [
  { cidr_block = "34.82.144.175/32", display_name = "C3 AI Operations" }, # ... add all required IPs
]

Outbound access is provided via NAT by default. If your organization applies egress filtering, ensure the endpoints and monitoring IPs listed above are reachable.

Copy link to this section

Egress (outbound)

• Allow all TCP and UDP access to the workspace security group (for internal traffic)
• Allow TCP access to 0.0.0.0/0 for these ports:
  • 443: for C3 AI infrastructure, cloud data sources, and library repositories

Copy link to this section

Ingress (inbound)

• Allow all TCP and UDP access to the workspace firewall policy (for internal traffic)
• 443: for C3 AI application access
• 22: for SSH access to a bastion host

Copy link to this section

Subnet-level network ACLs

Subnet-level network ACLs must not deny ingress or egress to any traffic.

• ALLOW ALL from Source 0.0.0.0/0. This rule must be prioritized.
• Egress:
  • Allow all traffic to the C3 AI cluster VPC CIDR, for internal traffic.
  • Allow TCP access to 0.0.0.0/0 for these ports:
    • 443: for C3 AI infrastructure, cloud data sources, and library repositories.

Copy link to this section

HashiCorp Terraform configuration

HashiCorp Terraform is a popular open-source tool for creating safe and predictable cloud infrastructure across several cloud providers. Terraform scripts are used to create the cloud infrastructure required by the C3 Agentic AI Platform and automate the deployment of the C3 Agentic AI Platform in your Google Cloud Platform (GCP).

Copy link to this section

State management

By default, terraform init stores state on the local filesystem where the command was run. For production customer-hosted deployments, C3 AI strongly recommends configuring a remote state backend on Google Cloud Storage (GCS). A GCS backend provides server-side state locking, encryption at rest, and object versioning, which together prevent concurrent-apply corruption and allow recovery from accidental state changes.

Recommended backend configuration:

terraform {
  backend "gcs" {
    bucket = "TFSTATE_BUCKET"
    prefix = "c3/bootstrap"
  }
}

Guidance:

• Create TFSTATE_BUCKET in advance -- the bucket must already exist before you run terraform init. A common pattern is to create one state bucket per GCP project and use prefix to separate module state.
• Use a distinct prefix for each Terraform module (for example, c3/bootstrap and c3/c3cluster) so state files do not collide.
• Enable Object Versioning on the bucket so prior state revisions can be restored after an accidental state change.
• Restrict IAM on the bucket to the Terraform service account and C3 AI Operations only.

Copy link to this section

Getting started

In this section, you install and configure requirements to use Terraform. You then configure Terraform authentication. Following completion of this section, go to "Installation Steps" section below to deploy and configure the cloud infrastructure required by the C3 Agentic AI Platform.

Copy link to this section

Requirements

To use Terraform to create cloud infrastructure resources required by the C3 Agentic AI Platform in your GCP organization / project, you must have the following:

• A Google Cloud organization. A Google Cloud project in the account. The GCP project name must follow the rules in Naming conventions.

  Terraform reference: Set via project_name. The variable includes a validation rule enforcing the 15 character maximum.

• Privileges to deploy, operate, and delete the infrastructure services. See the README.md file in the downloaded Registry folder for the most up-to-date information.

• On your local development machine, you must have:

  • The HashiCorp Terraform CLI. See Install Terraform on the Terraform website to download the binary of the required Terraform version specified in the main.tf file example in the "Installation Steps" section below. Select AMD64 or ARM64 depending on the which matches the client hardware from which you will run the Terraform scripts.
  • The gcloud CLI. See Install the gcloud CLI on the Google Cloud website.
  • The gcloud CLI, signed in through the gcloud auth application-default login command to obtain user access credentials via a web flow and put them in the well-known location for Application Default Credentials (ADC).

gcloud --project="<project-id>" auth application-default login

NOTE: Replace:

• <project-id> with the specific Google Cloud project ID to use for this deployment. If omitted, then the current project is assumed.

For more details, see Installing Google Cloud SDK and Authorize the gcloud CLI on the Google Cloud website.

Copy link to this section

Installation steps

Installation of the C3 Agentic AI Platform on the Google Cloud Platform (GCP) is a multi-step process due to limitations of HashiCorp Terraform and GCP-specific configuration requirements. The installation process is the following:

1. Enable the VPC and required GCP services.
2. Validate the configuration of the VPC and required GCP services and provide C3 AI Operations access to the cluster.
3. C3 AI Operations completes the installation of the C3 Agentic AI Platform.
4. Environment teardown, if required (for example, rebuild, decommission, or disaster recovery).

To create a VPC, C3 AI requires the use of HashiCorp Terraform and will provide a set of Terraform scripts to assist you in the creation of the VPC and required GCP Services.

A description of the Terraform modules is below. See the README.md file in the downloaded Registry folder for the most up-to-date information.

In addition to the required tools listed in the "HashiCorp Terraform Requirements" section, install TFSwitch, which is a tool used to switch easily between Terraform versions.

See Install TFSwitch and TFSwitch Quick Start on the TFSwitch website for more information.

Copy link to this section

1. Enable the VPC and required GCP services

This guide shows you how to create the cloud infrastructure services required by the C3 Agentic AI Platform using HashiCorp Terraform on GCP.

Copy link to this section

1.1 Run the bootstrap module

This module creates the necessary IAM roles and policies to configure the VPC and required GCP services. Configure a new main.tf file below, replacing the CAPITALIZED variable names with your values.

module "bootstrap" {
  source       = "<c3_url>/tf-registry__c3/gcp/c3//modules/bootstrap"
  version      = ">=VERSION_NUMBER"
  project_id   = "GCP_PROJECT_ID"
  project_name = "GCP_PROJECT_NAME" # Optional : Only when project name is different than project id
  ## PROVIDE BELOW VARIABLES ONLY WHEN YOU ARE CREATING THE PROJECT AND LINKING IT TO A BILLING ACCOUNT ##
  folder_id       = "GCP_PROJECT_FOLDER_ID"
  billing_account = "GCP_BILLING_ACCOUNT"
  is_org_admin    = true
}

provider "google" {}

terraform {
  required_version = ">= 1.13.0"
}

NOTE: Replace:

• GCP_PROJECT_NAME with the name of the C3 AI cluster. The cluster name must follow the rules in Naming conventions.
• VERSION_NUMBER with the version of the bootstrap module listed on the C3 AI BOM for the release version.

Copy link to this section

1.2 Run Terraform commands

After configuring the main.tf file, run the following Terraform commands from the same directory:

tfswitch
terraform init
terraform plan --out out.plan

Review the plan output before applying. Before you run terraform apply, read through the plan and confirm:

• The resource count matches your expectations. For a new bootstrap deployment, no resources should be destroyed.
• No unexpected resource destroys appear in the plan. If the plan shows destroys you did not intend, stop and investigate before applying.
• The target project ID and region match the deployment you intend.
• Module source and version references point to the approved C3 AI registry values.

Once the plan is reviewed and accepted, apply it:

terraform apply "out.plan"

Copy link to this section

1.3 Run the c3cluster module

This module coordinates execution of all other Terraform modules. Configure a new main.tf in a separate directory from the bootstrap module, replacing the CAPITALIZED variable names with your values. Note that you must assume the role created by bootstrap module.

Contact your account manager for the list of IP addresses required by C3 AI. These values will be used to update the ip_allowlist section below.

module "c3cluster" {
  source       = "<c3_url>/tf-registry__c3/gcp/c3"
  version      = ">VERSION_NUMBER"
  c3_region    = "us-west1"
  project_id   = "GCP_PROJECT_ID"
  project_name = "GCP_PROJECT_NAME" # Only use it when project name is different than project id

  # Please reach out to C3 CoE to obtain C3 control IPs
  ip_allowlist = [
    {
      cidr_block   = "CIDR_TO_WHITELIST",
      display_name = "WHITELISTED_CIDR_NAME"
    },
  ]

  # Please reach out to C3 CoE to obtain the list of Domains to whitelist for CORS
  gcs_cors_domains = ["http://*.DOMAIN_NAME"]
}

provider "google" {}

terraform {
  required_version = ">= 1.13.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "7.15.0"
    }
  }
}

• GCP_PROJECT_NAME with the name of the C3 AI cluster. The cluster name must follow the rules in Naming conventions.
• VERSION_NUMBER with the version of the c3cluster module listed on the C3 AI BOM for the release version.

Copy link to this section

Additional c3cluster configuration options

The following optional variables can be set on the c3cluster module to customize the deployment:

See the main README.md in the Terraform module for the complete list of inputs.

Copy link to this section

1.3.1 Implement CORS policy for C3 AI Ex Machina

If the installation of the C3 Agentic AI Platform includes C3 AI Ex Machina, setting the C3 AI CORS domain is all that is necessary. The CORS policy facilitates file uploads for C3 AI Ex Machina.

See gcs_cors_domains in the main.tf example above.

Also, see the cors_rules.tf template example in the Terraform modules for more configuration details.

Terraform variable: gcs_cors_domains -- a list of domain patterns (for example, ["http://*.example.com"]).

After configuring the main.tf file, run the example below from the same directory as the new main.tf file:

tfswitch
terraform init
terraform plan --out out.plan

Review the plan output before applying. As with the bootstrap module, confirm the resource count, check for unexpected destroys, and verify the target project and region. Then apply:

terraform apply "out.plan"

Copy link to this section

2. Validate and provide access to the cluster

Validate the configuration of the VPC and required GCP services and provide C3 AI Operations access to the cluster.

After the VPC and required cloud services are configured, you are required to execute the C3 AI Cluster Validation Utility and provide the results to C3 AI. If all checks performed by the C3 AI Cluster Validation Utility pass, the VPC is suitable for C3 AI Operations to deploy the C3 Agentic AI Platform on the Kubernetes cluster.

Once the checks are successfully completed, provide C3 AI Operations access to the cluster. Refer to the subsequent section for more information.

Copy link to this section

2.1 C3 AI Cluster Validation Utility

Run the C3 AI Cluster Validation Utility and provide results to C3 AI Operations.

Run the C3 AI Cluster Validation Utility to determine whether the infrastructure requirements are fulfilled to allow the C3 AI Operations to deploy the C3 Agentic AI Platform.

If the C3 AI Cluster Validation Utility indicates the VPC is ready for C3 AI Operations to deploy the C3 Agentic AI Platform on the Kubernetes cluster, provide the output to C3 AI Operations.

If the output indicates the VPC is not ready, remediate all exceptions and rerun the C3 AI Cluster Validation Utility.

Checks performed by the utility

The Cluster Validation Utility verifies the following areas. You can pre-validate many of these checks before running the utility by inspecting your environment directly.

Contact the C3 AI Center of Excellence (CoE) for more information and to obtain the C3 AI Cluster Validation Utility.

Copy link to this section

2.2 Provide C3 AI Operations access to the cluster

In addition to the output of the C3 AI Cluster Validation Utility, you must provide C3 AI Operations with the following.

It is recommended that the sharing of Postgres credential and certificates occur using GCP Vault.

To grant C3 AI Operations GKE cluster administration permissions to the GCP project, run the following code snippet:

gcloud auth login
gcloud projects add-iam-policy-binding PROJECT_ID \
--member=user:USER \
--role=projects/{PROJECT_ID}/roles/{project_name}-c3dopsrole-01

NOTE: Replace:

• PROJECT_ID with the ID of the project or fully qualified identifier for the project
• USER with the principal to add the binding for. Should be of the form user:email.

Copy link to this section

3. Complete installation

C3 AI Operations completes the installation of the C3 Agentic AI Platform. With the infrastructure properly configured and GKE node pool configuration updated, C3 AI Operations will continue with the installation of the C3 Agentic AI Platform.

At the conclusion of the VPC creation and the deployment of the C3 Agentic AI Platform, the Google Cloud Platform (GCP) environment will resemble the following.

GKE Subnet -- C3 AI Application Namespace:

• Cluster Leader
• AI Studio
• Nginx Ingress Controller
• Cassandra Operator
• Application Leader
• Application Task
• Jupyter
• Prometheus

GKE Subnet -- C3 AI Administration Namespace:

• C3 AI Operator
• Grafana

• OpenSearch (x2)
• C3 AI Telemetry
• Prometheus
• Filebeat
• Metric Exporters

Data Subnet:

• Cloud SQL PostgreSQL

External Services:

• Key Vault
• Resource Manager
• Cloud Storage
• Identity & Access Management

Node Subnet:

• Kubernetes Node VMs (6+)

Copy link to this section

4. Environment teardown

If you need to tear down the environment -- for example, to rebuild a development cluster, destroy a test cluster, recover from a corrupt deployment, or decommission a customer-hosted cluster -- follow the order below. Terraform destroy operations must be run in the reverse order of the initial apply: destroy the c3cluster module first, then the bootstrap module.

Before you start:

• Confirm the teardown with your C3 AI account team. Teardown of a production cluster is irreversible.
• Back up any data you must retain -- Cloud SQL exports, GCS object contents, and cluster configuration files.

Copy link to this section

4.1 Disable delete protection

The default c3cluster deployment sets enable_delete_protection = true on GKE clusters, Cloud SQL instances, and GCS buckets. Delete protection must be turned off before terraform destroy can remove these resources. Update the c3cluster module input to enable_delete_protection = false, then run:

terraform plan --out out.plan
terraform apply "out.plan"

Review the plan to confirm that the only changes are the delete-protection flags, then apply.

Copy link to this section

4.2 Destroy the c3cluster module

From the c3cluster module directory:

terraform plan -destroy --out destroy.plan
terraform apply "destroy.plan"

Review the destroy plan carefully before approving. This step removes the GKE cluster and node pools, the Cloud SQL instance, GCS buckets, IAM bindings, and network resources (VPC, subnets, firewall rules, NAT). Any data not backed up in advance is lost.

Copy link to this section

4.3 Destroy the bootstrap module

From the bootstrap module directory:

terraform plan -destroy --out destroy.plan
terraform apply "destroy.plan"

This step removes the IAM roles created by bootstrap (including C3.AdminOps and the delegated operations role) along with any remaining project-level bindings.

Copy link to this section

4.4 Clean up remote state

If you configured a remote state backend (see State management), the GCS state bucket and its objects are not destroyed by the steps above. Delete the state objects and, if no other environments use the bucket, the bucket itself, once you no longer need the state history.