<a id="usm-agent"></a>

# Deploy the USM Agent

Deploying the USM Agent is a two-part process:

1. Generate and download a configuration file from the Confluent Cloud wizard.
2. Use that file and your own tools — Confluent for Kubernetes or Ansible Playbooks for Confluent Platform — to deploy the agent in your Confluent Platform environment.

#### NOTE
No data from your Confluent Platform cluster appears in Confluent Cloud until you successfully deploy the agent in your Confluent Platform environment.

## Generate and download the configuration file

Confluent Cloud generates a configuration file containing the secure
credentials and endpoint URLs the agent needs to connect from your
Confluent Platform environment. Generation provisions resources such as API keys
and endpoints, and can take up to 20 minutes. The wizard displays
the status.

To generate the configuration file, follow these steps:

1. On the **Deploy USM agent** page, click **Generate configuration file**.
2. Wait for the status to update to **Configuration file ready**.
3. Click **Download file** and save it to your local machine.

The downloaded file is a JSON file containing credentials and endpoint URLs for the
agent. The format of the `FRONTDOOR_URL` and `SCHEMA_REGISTRY_URL` fields depends
on the cloud provider and the access point provisioned by Confluent Cloud.

### AWS

* **New access points** use a new domain format:
  ```json
  {
    "ENVIRONMENT_ID": "<environment-id>",
    "SERVICE_ACCOUNT_API_KEY": "<api-key>",
    "SERVICE_ACCOUNT_API_SECRET": "<api-secret>",
    "SCHEMA_REGISTRY_API_KEY": "<sr-api-key>",
    "SCHEMA_REGISTRY_API_SECRET": "<sr-api-secret>",
    "FRONTDOOR_URL": "https://api-<accessPointId>.<region>.aws.accesspoint.glb.confluent.cloud:443",
    "SCHEMA_REGISTRY_URL": "https://<lsrc-id>-<accessPointId>.<region>.aws.accesspoint.glb.confluent.cloud"
  }
  ```
* **Legacy access points** use the private domain format:
  ```json
  {
    "ENVIRONMENT_ID": "<environment-id>",
    "SERVICE_ACCOUNT_API_KEY": "<api-key>",
    "SERVICE_ACCOUNT_API_SECRET": "<api-secret>",
    "SCHEMA_REGISTRY_API_KEY": "<sr-api-key>",
    "SCHEMA_REGISTRY_API_SECRET": "<sr-api-secret>",
    "FRONTDOOR_URL": "https://api.<region>.aws.private.confluent.cloud",
    "SCHEMA_REGISTRY_URL": "https://<lsrc-id>.<region>.aws.private.confluent.cloud"
  }
  ```

Ensure that your Route 53 DNS configuration matches the access point type in your
configuration file. For details, see [Set up DNS resolution](usm-network.md#usm-dns).

### Azure

Azure access points always use the new domain format:

```json
{
  "ENVIRONMENT_ID": "<environment-id>",
  "SERVICE_ACCOUNT_API_KEY": "<api-key>",
  "SERVICE_ACCOUNT_API_SECRET": "<api-secret>",
  "SCHEMA_REGISTRY_API_KEY": "<sr-api-key>",
  "SCHEMA_REGISTRY_API_SECRET": "<sr-api-secret>",
  "FRONTDOOR_URL": "https://api-<accessPointId>.<region>.azure.accesspoint.glb.confluent.cloud:443",
  "SCHEMA_REGISTRY_URL": "https://<lsrc-id>-<accessPointId>.<region>.azure.accesspoint.glb.confluent.cloud"
}
```

Ensure that your Azure Private DNS Zone configuration matches your
configuration file. For details, see [Set up DNS resolution](usm-network-azure.md#usm-azure-dns).

## Deploy the agent in your Confluent Platform environment

After you download the file, use it to deploy the agent in your Confluent Platform environment.
This deployment happens outside the Confluent Cloud wizard, using your own tools, such as Confluent for Kubernetes or Ansible Playbooks for Confluent Platform.

1. Choose the deployment method that matches your environment.
   * If you use Confluent for Kubernetes, follow the instructions in [Confluent for Kubernetes](https://docs.confluent.io/operator/current/co-configure-usm.html).
   * If you use Ansible Playbooks for Confluent Platform, follow the instructions in [Ansible Playbooks](https://docs.confluent.io/ansible/current/ansible-usm.html).
2. Verify that the USM Agent connects to Confluent Cloud.

   For Confluent for Kubernetes, run:
   ```bash
   kubectl confluent cluster usmagent usm-agent-validz
   ```

   For Ansible Playbooks for Confluent Platform, run:
   ```bash
   usm-agent-validz
   ```

   If the command reports a connectivity or configuration issue, see
   [Diagnostic tools](../troubleshoot.md#usm-diagnostic-tools) before continuing.
3. After you complete the deployment in your environment, return to the wizard and click **Next**.

## What’s next

* [Complete the Cluster Registration](complete-registration.md#complete-registration)

## Related content

* [Unified Stream Manager in Confluent Cloud](../overview.md#cloud-usm-overview)
* [Register Your Confluent Platform Cluster](overview.md#cloud-usm-register)
* [Set Up a Payment Method](payment-method.md#usm-payment)
* [Configure AWS Private Networking for USM Agents](usm-network.md#usm-network)
* [Configure Azure Private Networking for USM Agents](usm-network-azure.md#usm-network-azure)
* [Configure a Service Account for the USM Agent](usm-service-account.md#usm-sa)
* [Complete the Cluster Registration](complete-registration.md#complete-registration)
* [Remove the USM Agent](../remove-agent.md#usm-remove-agent)