<commit_before>#!/usr/bin/env bash
#
# Copyright 2019 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This script creates & configures the "main" GCP project for Kubernetes.

set -o errexit
set -o nounset
set -o pipefail

SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
. "${SCRIPT_DIR}/lib.sh"

function usage() {
    echo "usage: $0" > /dev/stderr
    echo > /dev/stderr
}

if [ $# != 0 ]; then
    usage
    exit 1
fi

# The GCP project name.
PROJECT="kubernetes-public"

# The BigQuery dataset for billing data.
BQ_BILLING_DATASET="kubernetes_public_billing"

# The BigQuery admins group.
BQ_ADMINS_GROUP="<EMAIL>"

# The service account for GKE nodes.
NODES_SVCACCT="k8s-nodes"

# The cluster admins group.
CLUSTER_ADMINS_GROUP="<EMAIL>"

# The accounting group.
ACCOUNTING_GROUP="<EMAIL>"

color 6 "Ensuring project exists: ${PROJECT}"
ensure_project "${PROJECT}"

# Enable APIs we know we need
color 6 "Enabling the GCE API"
enable_api "${PROJECT}" compute.googleapis.com
color 6 "Enabling the StackDriver logging API"
enable_api "${PROJECT}" logging.googleapis.com
color 6 "Enabling the StackDriver monitoring API"
enable_api "${PROJECT}" monitoring.googleapis.com
color 6 "Enabling the BigQuery API"
enable_api "${PROJECT}" bigquery-json.googleapis.com
color 6 "Enabling the GKE API"
enable_api "${PROJECT}" container.googleapis.com
color 6 "Enabling the GCS API"
enable_api "${PROJECT}" storage-component.googleapis.com
color 6 "Enabling the OSLogin API"
enable_api "${PROJECT}" oslogin.googleapis.com

# Make an account for GKE nodes to run as
color 6 "Creating service account for ${NODES_SVCACCT}"
ensure_service_account "${PROJECT}" "${NODES_SVCACCT}" "Least-privilege SA for k8s nodes"

color 6 "Empowering ${NODES_SVCACCT} with min permissions"
acct=$(svc_acct_email "${PROJECT}" "${NODES_SVCACCT}")
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "serviceAccount:${acct}" \
    --role roles/logging.logWriter
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "serviceAccount:${acct}" \
    --role roles/monitoring.viewer
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "serviceAccount:${acct}" \
    --role roles/monitoring.metricWriter

color 6 "Empowering BigQuery admins"
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "group:${BQ_ADMINS_GROUP}" \
    --role roles/bigquery.admin

color 6 "Empowering cluster admins"
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "group:${CLUSTER_ADMINS_GROUP}" \<commit_msg>Don't create a gke-nodes svcacct in bash<commit_after>#!/usr/bin/env bash
#
# Copyright 2019 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This script creates & configures the "main" GCP project for Kubernetes.

set -o errexit
set -o nounset
set -o pipefail

SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
. "${SCRIPT_DIR}/lib.sh"

function usage() {
    echo "usage: $0" > /dev/stderr
    echo > /dev/stderr
}

if [ $# != 0 ]; then
    usage
    exit 1
fi

# The GCP project name.
PROJECT="kubernetes-public"

# The BigQuery dataset for billing data.
BQ_BILLING_DATASET="kubernetes_public_billing"

# The BigQuery admins group.
BQ_ADMINS_GROUP="<EMAIL>"

# The cluster admins group.
CLUSTER_ADMINS_GROUP="<EMAIL>"

# The accounting group.
ACCOUNTING_GROUP="<EMAIL>"

color 6 "Ensuring project exists: ${PROJECT}"
ensure_project "${PROJECT}"

# Enable APIs we know we need
color 6 "Enabling the GCE API"
enable_api "${PROJECT}" compute.googleapis.com
color 6 "Enabling the StackDriver logging API"
enable_api "${PROJECT}" logging.googleapis.com
color 6 "Enabling the StackDriver monitoring API"
enable_api "${PROJECT}" monitoring.googleapis.com
color 6 "Enabling the BigQuery API"
enable_api "${PROJECT}" bigquery-json.googleapis.com
color 6 "Enabling the GKE API"
enable_api "${PROJECT}" container.googleapis.com
color 6 "Enabling the GCS API"
enable_api "${PROJECT}" storage-component.googleapis.com
color 6 "Enabling the OSLogin API"
enable_api "${PROJECT}" oslogin.googleapis.com

color 6 "Empowering BigQuery admins"
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "group:${BQ_ADMINS_GROUP}" \
    --role roles/bigquery.admin

color 6 "Empowering cluster admins"
gcloud projects add-iam-policy-binding "${PROJECT}" \
    --member "group:${CLUSTER_ADMINS_GROUP}" \
{'fraction_non_alphanumeric': 0.11360239162929746, 'fraction_numerical': 0.008968609865470852, 'mean_word_length': 4.69468085106383, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3200459', 'n_tokens_mistral': 1736, 'n_tokens_neox': 1669, 'n_words': 573}