<commit_before><commit_msg>Script for setting up a new GCP environment<commit_after>#!/bin/sh

#Script to set up a new GCP environment based on the passed in name
#Usage: ./setup_gcp_environment <ENV_NAME>

#Constants
GOOGLE_BILLING_ACCOUNT=0072FE-A63213-1B46B7
GOOGLE_ORGANIZATION=433637338589 #ID for google.com organization in GCP project
GCE_ENFORCER_REASON=pre-launch

if [ -z $1 ]; then
	echo ERROR: Must provide an environment, e.g. 'qa' or 'prod'
	exit 1
fi
ENV=$1
PROJECT_ID="dataliberation-portability-$ENV"
gcloud=$(which gcloud)|| { echo "Google Cloud SDK (gcloud) not found." >&2; exit 1; }

read -p "1/9. Creating project $PROJECT_ID. Continue (y/N)? " response
response=${response,,} # to lower
if [[ $response =~ ^(yes|y| ) ]]; then
  echo "Continuing"
else
  echo "Aborting"
  exit 0
fi
gcloud projects create $PROJECT_ID --name=$PROJECT_ID --organization=$GOOGLE_ORGANIZATION

read -p "2/9. Changing your default project for gcloud. Continue (y/N)? " response
response=${response,,} # to lower
if [[ $response =~ ^(yes|y| ) ]]; then
#Need to set default project or you can't make a GCS bucket using gsutil later on. gsutil goes off
#of gcloud's default project and doesn't accept a project flag.
gcloud config set project $PROJECT_ID
else
  echo "Aborting"
  exit 0
fi

echo $'\n3/9. Enabling GCE Enforcer'
gcloud alpha projects update $PROJECT_ID  --update-labels="gce-enforcer-fw-opt-in=$GCE_ENFORCER_REASON"

echo $'\n4/9. Enabling billing'
gcloud alpha billing projects link $PROJECT_ID --billing-account=$GOOGLE_BILLING_ACCOUNT

echo $'\n5/9. Creating a service account for IAM'
echo $'\nService accounts before (should be empty):'
EXISTING_SERVICE_ACCOUNTS=$(gcloud iam --project $PROJECT_ID service-accounts list)
echo $EXISTING_SERVICE_ACCOUNTS
if [[ -n $EXISTING_SERVICE_ACCOUNTS ]]; then
  echo "Found unexpected existing service account(s): $EXISTING_SERVICE_ACCOUNTS"
  exit 1
fi
gcloud iam --project $PROJECT_ID service-accounts create $PROJECT_ID --display-name "$PROJECT_ID service account"
SERVICE_ACCOUNT="$PROJECT_ID@$PROJECT_ID.<EMAIL>"
echo $'\nCreated service account:'
gcloud iam --project $PROJECT_ID service-accounts describe $SERVICE_ACCOUNT

echo $'\n6/9. Granting permissions to service account and team members'
# Note: Don't see an easy way to pass multiple members in one command. Can use a json file but
# would have to do some manipulation to get variables in it.
gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:$SERVICE_ACCOUNT --role roles/editor
gcloud projects add-iam-policy-binding $PROJECT_ID --member user:<EMAIL> --role roles/owner
gcloud projects add-iam-policy-binding $PROJECT_ID --member user:<EMAIL> --role roles/owner
gcloud projects add-iam-policy-binding $PROJECT_ID --member user:<EMAIL> --role roles/owner
gcloud projects add-iam-policy-binding $PROJECT_ID --member user:<EMAIL> --role roles/owner

echo $'\n7/9. Enabling APIs'.
gcloud services --project $PROJECT_ID enable compute.googleapis.com #Needed for step 9
# TODO: Uncomment these as needed, and add a comment about what uses each API. Remove any that
# aren't needed in the end. This list was generated by looking at the APIs used by our test project
#gcloud services --project $PROJECT_ID enable pubsub.googleapis.com
#gcloud services --project $PROJECT_ID enable container.googleapis.com
#gcloud services --project $PROJECT_ID enable resourceviews.googleapis.com
#gcloud services --project $PROJECT_ID enable replicapool.googleapis.com
#gcloud services --project $PROJECT_ID enable deploymentmanager.googleapis.com
#gcloud services --project $PROJECT_ID enable containerregistry.googleapis.com
#gcloud services --project $PROJECT_ID enable replicapoolupdater.googleapis.com

echo $'\n8/9. Creating GCS bucket'
echo $'\nGCS buckets before (should be empty):'
EXISTING_GCS_BUCKETS=$(gsutil ls -p $PROJECT_ID)
echo $EXISTING_GCS_BUCKETS
if [[ -n $EXISTING_GCS_BUCKETS ]]; then
  echo "Found unexpected existing bucket(s): $EXISTING_GCS_BUCKETS"
  exit 1
fi
BUCKET_NAME="static-$PROJECT_ID"
GCS_BUCKET_NAME="gs://$BUCKET_NAME/"
gsutil mb $GCS_BUCKET_NAME
echo "Created GCS bucket $GCS_BUCKET_NAME"

echo $'\n9/9. Creating backend bucket'
gcloud compute --project $PROJECT_ID backend-buckets create static-bucket --gcs-bucket-name=$BUCKET_NAME
#TODO use --enable-cdn flag when we are ready to use CDN

#TODO:
#- VMs (including zone us-central-1a)
#- GKE cluster
#- backend service
#- HTTPS LB
#- external IP
#- IAP (whitelist select users)

{'fraction_non_alphanumeric': 0.10416202982417093, 'fraction_numerical': 0.0120186957489428, 'mean_word_length': 5.097693351424695, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 10, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6781263', 'n_tokens_mistral': 1531, 'n_tokens_neox': 1475, 'n_words': 492}