<commit_before>#!/usr/bin/env bash

# Copyright 2019 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This script creates & configures the "main" GCP project for Kubernetes.

set -o errexit
set -o nounset
set -o pipefail

SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
. "${SCRIPT_DIR}/lib.sh"

function usage() {
    echo "usage: $0" > /dev/stderr
    echo > /dev/stderr
}

if [ $# != 0 ]; then
    usage
    exit 1
fi

# The GCP project name.
PROJECT=$(k8s_infra_project "public" "kubernetes-public")
readonly PROJECT

# The BigQuery dataset for billing data.
readonly BQ_BILLING_DATASET="kubernetes_public_billing"

# The BigQuery admins group.
readonly BQ_ADMINS_GROUP="<EMAIL>"

# The cluster admins group.
readonly CLUSTER_ADMINS_GROUP="<EMAIL>"

# The accounting group.
readonly ACCOUNTING_GROUP="<EMAIL>"

# The GCS bucket which hold terraform state for clusters
readonly LEGACY_CLUSTER_TERRAFORM_BUCKET="k8s-infra-clusters-terraform"

# The GKE security groups group
readonly CLUSTER_USERS_GROUP="<EMAIL>"

# The DNS admins group.
readonly DNS_GROUP="<EMAIL>"

# GCS buckets to hold terraform state
#
# - since we are using uniform bucket level access (ubla), each bucket should
#   represent a logical group of access, with org admins given storage.admin
#   for break-glass purposes
# - the legacy bucket (k8s-infra-clusters-terraform) assumed the same set of
#   users should have access to all gke clusters (~all terraform-based infra)
# - new bucket schema is "k8s-infra-tf-{folder}[-{suffix}]" where:
#   - folder: intended GCP folder for GCP projects managed by this terraform,
#             access level is ~owners of folder
#   - suffix: some subset of resources contained somewhere underneath folder,
#             access level is ~editors of those resources
# - entry syntax is "bucket_name:owners_group" (: is invalid bucket name char)
readonly TERRAFORM_STATE_BUCKET_ENTRIES=(
    "${LEGACY_CLUSTER_TERRAFORM_BUCKET}:${CLUSTER_ADMINS_GROUP}"
    k8s-infra-tf-aws:<EMAIL>
    k8s-infra-tf-prow-clusters:<EMAIL>
    k8s-infra-tf-public-clusters:"${CLUSTER_ADMINS_GROUP}"
    k8s-infra-tf-public-pii:"${CLUSTER_ADMINS_GROUP}"
    k8s-infra-tf-sandbox-ii:<EMAIL>
)

# The services we explicitly want enabled for the main project
#
# NOTE: Expected services include dependencies of these services, which may be
#       more than direct dependencies. Do we care to statically encode the
#       graph here? ensure_only_services dynamically computes the set of
#       expected services
readonly MAIN_PROJECT_SERVICES=(
    # We export billing data to bigquery
    bigquery.googleapis.com
    # We use cloud asset inventory from this project to audit all projects
    cloudasset.googleapis.com
    # We require use of cloud shell to access clusters in this project
    cloudshell.googleapis.com
    # We host GKE clusters in this project
    container.googleapis.com
    # We manage kubernetes DNS zones in this project
    dns.googleapis.com
    # We look at logs in this project (e.g. from GKE)
    logging.googleapis.com
    # We look at monitoring dashboards in this project
    monitoring.googleapis.com
    # We host secrets in this project for use by prow and other apps
    secretmanager.googleapis.com
    # We host public-facing and private GCS buckets in this project
    storage-api.googleapis.com
    # TODO: do we really need the legacy XML API enabled for them though?
    storage-component.googleapis.com

    ## Dependencies
    # container.googleapis.com depends on compute
    compute.googleapis.com
    # container.googleapis.com depends on containerregistry<commit_msg>kubernetes-public: Enable billing service<commit_after>#!/usr/bin/env bash

# Copyright 2019 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This script creates & configures the "main" GCP project for Kubernetes.

set -o errexit
set -o nounset
set -o pipefail

SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
. "${SCRIPT_DIR}/lib.sh"

function usage() {
    echo "usage: $0" > /dev/stderr
    echo > /dev/stderr
}

if [ $# != 0 ]; then
    usage
    exit 1
fi

# The GCP project name.
PROJECT=$(k8s_infra_project "public" "kubernetes-public")
readonly PROJECT

# The BigQuery dataset for billing data.
readonly BQ_BILLING_DATASET="kubernetes_public_billing"

# The BigQuery admins group.
readonly BQ_ADMINS_GROUP="k8s-infra-bigquery-<EMAIL>"

# The cluster admins group.
readonly CLUSTER_ADMINS_GROUP="<EMAIL>"

# The accounting group.
readonly ACCOUNTING_GROUP="<EMAIL>"

# The GCS bucket which hold terraform state for clusters
readonly LEGACY_CLUSTER_TERRAFORM_BUCKET="k8s-infra-clusters-terraform"

# The GKE security groups group
readonly CLUSTER_USERS_GROUP="<EMAIL>"

# The DNS admins group.
readonly DNS_GROUP="<EMAIL>"

# GCS buckets to hold terraform state
#
# - since we are using uniform bucket level access (ubla), each bucket should
#   represent a logical group of access, with org admins given storage.admin
#   for break-glass purposes
# - the legacy bucket (k8s-infra-clusters-terraform) assumed the same set of
#   users should have access to all gke clusters (~all terraform-based infra)
# - new bucket schema is "k8s-infra-tf-{folder}[-{suffix}]" where:
#   - folder: intended GCP folder for GCP projects managed by this terraform,
#             access level is ~owners of folder
#   - suffix: some subset of resources contained somewhere underneath folder,
#             access level is ~editors of those resources
# - entry syntax is "bucket_name:owners_group" (: is invalid bucket name char)
readonly TERRAFORM_STATE_BUCKET_ENTRIES=(
    "${LEGACY_CLUSTER_TERRAFORM_BUCKET}:${CLUSTER_ADMINS_GROUP}"
    k8s-infra-tf-aws:<EMAIL>
    k8s-infra-tf-prow-clusters:<EMAIL>
    k8s-infra-tf-public-clusters:"${CLUSTER_ADMINS_GROUP}"
    k8s-infra-tf-public-pii:"${CLUSTER_ADMINS_GROUP}"
    k8s-infra-tf-sandbox-ii:k8s-infra-ii-<EMAIL>
)

# The services we explicitly want enabled for the main project
#
# NOTE: Expected services include dependencies of these services, which may be
#       more than direct dependencies. Do we care to statically encode the
#       graph here? ensure_only_services dynamically computes the set of
#       expected services
readonly MAIN_PROJECT_SERVICES=(
    # We store budgets applied to projects of the kubernetes.io org
    billingbudgets.googleapis.com
    # We export billing data to bigquery
    bigquery.googleapis.com
    # We use cloud asset inventory from this project to audit all projects
    cloudasset.googleapis.com
    # We require use of cloud shell to access clusters in this project
    cloudshell.googleapis.com
    # We host GKE clusters in this project
    container.googleapis.com
    # We manage kubernetes DNS zones in this project
    dns.googleapis.com
    # We look at logs in this project (e.g. from GKE)
    logging.googleapis.com
    # We look at monitoring dashboards in this project
    monitoring.googleapis.com
    # We host secrets in this project for use by prow and other apps
    secretmanager.googleapis.com
    # We host public-facing and private GCS buckets in this project
    storage-api.googleapis.com
    # TODO: do we really need the legacy XML API enabled for them though?
    storage-component.googleapis.com

    ## Dependencies
    # container.googleapis.com depends on compute
    compute.googleapis.com
    # container.googleapis.com depends on containerregistry
{'fraction_non_alphanumeric': 0.07824019024970273, 'fraction_numerical': 0.005231866825208086, 'mean_word_length': 3.9360328638497655, 'pattern_counts': {'":': 0, '<': 19, '<?xml version=': 0, '>': 23, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1770795', 'n_tokens_mistral': 2568, 'n_tokens_neox': 2445, 'n_words': 915}