Example 258 fortigate perimeter package deploy procedure/verify for core lz unmanaged client #446
Assignees
Comments
|
know oci and gitops are the core - and I agree having the code in github/ado/gitlab/csr is preferred - but some clients have requested the easier kpt option and it should be there as a base deployment option - since mid 2022 To be fair the base case deployment option is actually pure kubernetes krm yaml like in https://cloud.google.com/config-connector/docs/how-to/getting-started see original gitops docs in https://cloud.google.com/anthos-config-management/docs/concepts/config-controller-overview and https://cloud.google.com/anthos-config-management/docs/how-to/unstructured-repo 20230814: revisit kls re-add kpt documentation at the end of section 2 https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/docs/landing-zone-v2#2-create-your-landing-zone kpt rendering ok kpt live apply (20230414:1552) 
coming up just 1 org policy has an issue fixing deploying hub packageforgot to init - do this first render apply getting a depends error on an existing resource - the folder reference - it exists - triaging 
checking it it requires the folder id comment out dependency - rerun returning simpler folder 2233 working through failures/iam issues working out iam permissions issues 
|
|
working additions custom FortigateSdnViewer role is in https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/main/solutions/project/hub-env/fortigate/custom-role.yaml#L27 and todo:
Package Inventory
|
|
add packages |
This was referenced Dec 19, 2022
|
Current status (deploying hub) - move from #445 |
Known Issues Workarounds
|
|
restarting hub-env adjustment
|
|
Restarting clean org fortigate install for monday Deployment change - we will switch to an in-place kpt render (right in the github repo) - so we can track changes see fine tuning of the wiki documentation in https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps#quickstart Install the KCC cluster and minimal set of Landing Zone packages
Scenarios
prereq = billing quota above 5, liens commented in the code, org polices (gatekeeper) omitted create kcc cluster = but use delete lz = (including liens) delete kcc cluster = Plan
gcp-toolsrefresh repo with main 20231019create dev branchadd setters.yaml changesundeploy any lz packages updeploy changes - clz package of 4push to remote repowrite part 2 lz sh scriptsee #567 Delete cluster onlyRecreate KCC cluster
deploy changes - clz package of 4
wait for cnrm workloads to come up - 5 min first triage - folder errorsdelete partial lzadjust setters.yamldelete/recreate cluster Triage pod failuresAdding security Admin to super admin (is in kcc.landing.systems) 2400: got it - should not have commented out the gKE service account - the yakima one raised services coming up now |
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Oct 19, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Oct 19, 2023
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Oct 20, 2023
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Oct 20, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Oct 20, 2023
This was referenced Oct 20, 2023
Open
|
ssc-spc-ccoe-cei/gcp-tools#53 editupdate: found them in the new 2nd script Issue is that the access script assumes rootsync usage - it leaves out the kpt optionI recommend we put the yakima service account role additions back to the generic setup script. |
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Oct 20, 2023
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Oct 20, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Oct 20, 2023
|
automation test target env root at landing.systems skip #296 (comment) need to be done manuallyverify org level sa roles in https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/solutions/core-landing-zone/0.3.0/docs/landing-zone-v2/README.md#1-complete-the-bootstrap-procedure switch to automationpush super admin changes in #570 |
fmichaelobrien
pushed a commit
that referenced
this issue
Nov 23, 2023
* #446 - fix 596 hardcoded hub-env/project * #446 - fix 599 management-namespace * #446 - fix 599 management-namespace * #466 - adjust script * #625 446 - N2_CPUS quota of 8 requires fortigate management vm to use e2-standard instead Testing in #625 and #446 In certain preconfigured environments the N2_CPUS quota may be above the default of 8 Attempting to increase the quota even to 10 will not always get approved * #710 - #446 - add gke enterprise anthos service enablement * #446 - LINT: add export to vars.sh * #446 - LINT: double management-project-id
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Nov 23, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Nov 23, 2023
* #446 - fix 596 hardcoded hub-env/project * #446 - fix 599 management-namespace * #446 - fix 599 management-namespace * #466 - adjust script * #625 446 - N2_CPUS quota of 8 requires fortigate management vm to use e2-standard instead Testing in #625 and #446 In certain preconfigured environments the N2_CPUS quota may be above the default of 8 Attempting to increase the quota even to 10 will not always get approved * #710 - #446 - add gke enterprise anthos service enablement * #446 - LINT: add export to vars.sh * #446 - LINT: double management-project-id * #446 - LINT warning
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Nov 23, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Nov 23, 2023
* #446 - fix 596 hardcoded hub-env/project * #446 - fix 599 management-namespace * #446 - fix 599 management-namespace * #466 - adjust script * #625 446 - N2_CPUS quota of 8 requires fortigate management vm to use e2-standard instead Testing in #625 and #446 In certain preconfigured environments the N2_CPUS quota may be above the default of 8 Attempting to increase the quota even to 10 will not always get approved * #710 - #446 - add gke enterprise anthos service enablement * #446 - LINT: add export to vars.sh * #446 - LINT: double management-project-id * #446 - LINT warning * #446 - LINT remove export
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Nov 23, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Nov 23, 2023
* #446 - fix 596 hardcoded hub-env/project * #446 - fix 599 management-namespace * #446 - fix 599 management-namespace * #466 - adjust script * #625 446 - N2_CPUS quota of 8 requires fortigate management vm to use e2-standard instead Testing in #625 and #446 In certain preconfigured environments the N2_CPUS quota may be above the default of 8 Attempting to increase the quota even to 10 will not always get approved * #710 - #446 - add gke enterprise anthos service enablement * #446 - LINT: add export to vars.sh * #446 - LINT: double management-project-id * #446 - LINT warning * #446 - LINT remove export * #446 - LINT remove unused email
|
merge main |
|
From #654 line 88 |
obriensystems
added a commit
to obriensystems/pubsec-declarative-toolkit
that referenced
this issue
Nov 28, 2023
fmichaelobrien
pushed a commit
that referenced
this issue
Nov 28, 2023
* #446 - fix 596 hardcoded hub-env/project * #446 - fix 599 management-namespace * #446 - fix 599 management-namespace * #466 - adjust script * #625 446 - N2_CPUS quota of 8 requires fortigate management vm to use e2-standard instead Testing in #625 and #446 In certain preconfigured environments the N2_CPUS quota may be above the default of 8 Attempting to increase the quota even to 10 will not always get approved * #710 - #446 - add gke enterprise anthos service enablement * #446 - LINT: add export to vars.sh * #446 - LINT: double management-project-id * #446 - LINT warning * #446 - LINT remove export * #446 - LINT remove unused email * add KCC_PROJECT_ID in case gke up w/o clz - #446
|
State: #446 (comment) in the larger set of issues There is WIP automation going into automating the hub-env setters.yaml in The yakima role associations are in both scripts in addition to the readme at thank you |
|
generated kcc project_id propagation to the end in yakima/sa role additions retested in #654 711 |
|
delete/recreate KCC GKE cluster - then re-acquire resources by id |
move the partially completed kpt version script in 446 that completed the core-landing-zone and was mid way through hub-envto #766
|
|
Restarting hub-env deployment |
|
all 4 core-landing-zone, client-setup, client-landing-zone and client-project-setup done/fixed client-project-setup setters generation 
|
|
Nat issue fixed by adding a restrictCloudNATUsage project level override for hub-env in #837 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
updates
dev = root landing systems
test = nuage
finops dev.. nua.cl.o
FinOps: PAYG + GKE + GCE costs will be $80/day above the normal $10/day for the GKE cluster alone.
The client requires deployment of the #258 perimeter on top of the core lz with additional DNS zones TBD
Document and reuse on top of #420 and and #421
gcloud deployment testing later 2022 - #158
See pre-kcc deployment run in #158
gcloud reference install: fortinet/fortigate-tutorial-gcp#1
see
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps
graph LR; style LZV2 fill:#44f,stroke:#f66,stroke-width:2px,color:#fff,stroke-dasharray: 5 5 %% mapped and documented project/hub-env-->core-landing-zone; client-setup; client-setup-->dns-project; client-setup-->kcc-management-project; client-landing-zone-->client-setup; client-project-setup-->client-landing-zone; client-project-setup-->client-management-project; gatekeeper-policies; kcc-management-project; core-landing-zone-->kcc-management-project; dns-project-->core-landing-zone; logging-project-->core-landing-zone; client-management-project-->client-setup; host-project-->client-landing-zone;mermaid - diagrams as code
See
todo:
Package Inventory
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Architecture
Notes:
The text was updated successfully, but these errors were encountered: