-
Notifications
You must be signed in to change notification settings - Fork 7
/
gcp_project_setup.txt
87 lines (65 loc) · 2.98 KB
/
gcp_project_setup.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
GCP_PROJECT=pg-ci-images
gcloud projects create $GCP_PROJECT
# Must enable billing, I only know how to do so in web console
# Also request increases in quota for:
# compute engine: images -> 1000
# compute engine: t2d cpus us-west 1 -> 64
gcloud services enable --project $GCP_PROJECT iam.googleapis.com
gcloud services enable --project $GCP_PROJECT compute.googleapis.com
gcloud services enable --project $GCP_PROJECT cloudresourcemanager.googleapis.com
gcloud services enable --project $GCP_PROJECT artifactregistry.googleapis.com
# Create service account and a *private* key for it
gcloud iam service-accounts create image-builder \
--project $GCP_PROJECT \
--description="CI Image Builder Service Account" \
--display-name="CI Image Builder Service Account"
gcloud iam service-accounts keys create \
image-builder@$GCP_PROJECT.iam.gserviceaccount.com.json \
--iam-account image-builder@$GCP_PROJECT.iam.gserviceaccount.com
# FIXME: It'd be better to create a more restrictive role with just the
# permissions we need, intead of using the pre-defined roles.
# Create bucket for uploading images of openBSD and netBSD, bucket name
# should be unique
gsutil mb -p $GCP_PROJECT -b on gs://$GCP_PROJECT-bucket
# For packer we need:
# https://www.packer.io/docs/builders/googlecompute
gcloud projects add-iam-policy-binding $GCP_PROJECT \
--member=serviceAccount:image-builder@$GCP_PROJECT.iam.gserviceaccount.com \
--role=roles/compute.instanceAdmin.v1
gcloud projects add-iam-policy-binding $GCP_PROJECT \
--member=serviceAccount:image-builder@$GCP_PROJECT.iam.gserviceaccount.com \
--role=roles/iam.serviceAccountUser
gcloud projects add-iam-policy-binding $GCP_PROJECT \
--member=serviceAccount:image-builder@$GCP_PROJECT.iam.gserviceaccount.com \
--role=roles/iap.tunnelResourceAccessor
gcloud projects add-iam-policy-binding $GCP_PROJECT \
--member=serviceAccount:image-builder@$GCP_PROJECT.iam.gserviceaccount.com \
--role=roles/compute.storageAdmin
# For windows image generation winrm needs to work
gcloud compute --project=pg-ci-images firewall-rules create allow-winrm --allow tcp:5986
# docker image repository
gcloud artifacts repositories create ci \
--repository-format=docker \
--project $GCP_PROJECT \
--location=us \
--description="CI images"
gcloud artifacts repositories add-iam-policy-binding \
--project $GCP_PROJECT \
--member=serviceAccount:image-builder@$GCP_PROJECT.iam.gserviceaccount.com \
--role=roles/artifactregistry.writer \
--location us \
ci
gcloud artifacts repositories add-iam-policy-binding \
--project $GCP_PROJECT \
--member=serviceAccount:image-builder@$GCP_PROJECT.iam.gserviceaccount.com \
--role=roles/artifactregistry.repoAdmin \
--location us \
ci
gcloud artifacts repositories add-iam-policy-binding \
--project $GCP_PROJECT \
--member=allUsers \
--role=roles/artifactregistry.reader \
--location us \
ci
# Figure out per-user quota settings
# https://cloud.google.com/artifact-registry/quotas#user-quota