Ensure Access & Identity in Google Cloud: Challenge Lab

#Set a zone
gcloud config set compute/zone us-east1-b

#Create custom security role

title: "orca_storage_creator_993"
description: "Orca Custom Securiy Role"
stage: "ALPHA"
includedPermissions:
- storage.buckets.get
- storage.objects.get
- storage.objects.list
- storage.objects.update
- storage.objects.create

gcloud iam roles create orca_storage_creator_993 --project $DEVSHELL_PROJECT_ID \
--file role-definition.yaml

#Create service account
gcloud iam service-accounts create orca-private-cluster-856-sa --display-name "Orca private-cluster-856 service account"

#Bind a custom security role to a service account
gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
    --member serviceAccount:orca-private-cluster-856-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com \
	--role "projects/$DEVSHELL_PROJECT_ID/roles/orca_storage_creator_993"

gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
    --member serviceAccount:orca-private-cluster-856-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com \
	--role "roles/monitoring.viewer"

gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
    --member serviceAccount:orca-private-cluster-856-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com \
	--role "roles/monitoring.metricWriter"

gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
    --member serviceAccount:orca-private-cluster-856-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com \
	--role "roles/logging.logWriter"

#Kubernetes Cluster
gcloud container clusters create orca-cluster-160 \
--num-nodes 1 \
--master-ipv4-cidr=172.16.0.64/28 \
--network orca-build-vpc \
--subnetwork orca-build-subnet \
--enable-master-authorized-networks \
--master-authorized-networks 192.168.10.2/32 \
--enable-ip-alias \
--enable-private-nodes \
--enable-private-endpoint \
--service-account orca-private-cluster-856-sa@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com \
--zone us-east1-b


gcloud container clusters get-credentials orca-cluster-160 --internal-ip --zone us-east1-b

kubectl create deployment hello-server --image=gcr.io/google-samples/hello-app:1.0