Project: Opstrace (Observability and Analysis / Observability)
File: gcp-setup.md

This is a detailed walk-through showing how to set up a fresh GCP project for Opstrace. Start by creating a fresh project with the . In addition to using a good project name (which you can change later), be sure to choose an expressive project ID on that screen (as the UI says: the project ID cannot be changed later). Note: to prevent confusion, maybe first pick the project ID and then make the name match the ID. Take note of that project ID. We will use it down below. Next up, enable billing for that new project: link a GCP billing account to it, via the . Some of the next steps will not work if you don't link a billing account. Note: If you are using a new GCP account, please keep in mind the . Every new account has a limited quota for resources like vCPU per region among others. New accounts, receives a quota of 8vCPUs, less than the minimum required for this quickstart. The `gcloud` command-line tool is a part of the Google Cloud SDK. You have to on your system and initialize it before you can use the `gcloud` CLI. After installing `gcloud`, start the login process with `gcloud auth login`. Log in using the same GCP account that you created the project with above. Review `gcloud`'s authentication state: ```bash gcloud auth list ``` The remaining steps assume that `gcloud` is now in fact logged in to a GCP account that has admin privileges for the newly created project. In the current terminal, set these two environment variables: ```text export GCPPROJECTID="<your-new-project-id>" export GCPSVCACC="${GCPPROJECTID}-svc-acc@${GCPPROJECTID}.iam.gserviceaccount.com" ``` Throughout all following steps, it is assumed that these two environment variables are set in the current terminal. Note: be sure that `GCPPROJECTID` is set to the ID of the project, not to the name. The ID is all lowercase and does not contain whitespace. Issue this command to create a new service account in the new project: ```text $ gcloud iam service-accounts create "${GCPPROJECTID}-svc-acc" "--project=${GCPPROJECTID}" Created service account

``` With the following command you can confirm that this service account does not yet have any security roles assigned in the current project: ```text gcloud projects get-iam-policy ${GCPPROJECTID} \ --flatten="bindings[].members" \ --format='table(bindings.role)' \ --filter="bindings.members:${GCPSVCACC}" ``` Expected: no output Next up, grant privileges to the newly created service account: ```text gcloud projects add-iam-policy-binding ${GCPPROJECTID} "--member=serviceAccount:${GCPSVCACC}" \ --role=roles/container.admin gcloud projects add-iam-policy-binding ${GCPPROJECTID} "--member=serviceAccount:${GCPSVCACC}" \ --role=roles/compute.networkAdmin gcloud projects add-iam-policy-binding ${GCPPROJECTID} "--member=serviceAccount:${GCPSVCACC}" \ --role=roles/editor gcloud projects add-iam-policy-binding ${GCPPROJECTID} "--member=serviceAccount:${GCPSVCACC}" \ --role=roles/iam.securityAdmin ``` Repeat the command from above, listing the security roles assigned to the service account in the current project: ```text $ gcloud projects get-iam-policy ${GCPPROJECTID} \ --flatten="bindings[].members" \ --format='table(bindings.role)' \ --filter="bindings.members:${GCPSVCACC}" ROLE roles/compute.networkAdmin roles/container.admin roles/editor roles/iam.securityAdmin ``` Cloud DNS API: ```text $ gcloud services enable dns.googleapis.com "--project=${GCPPROJECTID}" Operation "operations/<snip>" finished successfully. ``` Compute Engine API: ```text $ gcloud services enable compute.googleapis.com "--project=${GCPPROJECTID}" Operation "operations/<snip>" finished successfully. ``` Kubernetes Engine API: ```text $ gcloud services enable container.googleapis.com "--project=${GCPPROJECTID}" Operation "operations/<snip>" finished successfully. ``` Cloud SQL Admin API: ```text $ gcloud services enable sqladmin.googleapis.com "--project=${GCPPROJECTID}" Operation "operations/<snip>" finished successfully. ``` Service Networking API: ```text $ gcloud services enable servicenetworking.googleapis.com "--project=${GCPPROJECTID}" Operation "operations/<snip>" finished successfully. ``` Cloud Resource Manager API: ```text $ gcloud services enable cloudresourcemanager.googleapis.com "--project=${GCPPROJECTID}" Operation "operations/<snip>" finished successfully. ``` Issue the following command to generate a private key for the service account, and to store it together with credential metadata in a JSON file (in your current working directory): ```text $ gcloud iam service-accounts keys create \ --iam-account "${GCPSVCACC}" \ "${GCPPROJECTID}-svc-acc.json" created key [<snip>] of type [json] as [<project>-svc-acc.json] for [<project>-svc-acc@<project>.iam.gserviceaccount.com] ``` Lock the file permissions down: ```text chmod 600 "${GCPPROJECTID}-svc-acc.json" ``` Now, move this credential file wherever you need it to be and remember to always treat it securely: for a production workflow, you may want to submit it to a system designed for storing secrets, and then wipe it from your local machine. For creating an Opstrace cluster using this project and service account, all you need to do is to set the environment variable `GOOGLEAPPLICATIONCREDENTIALS` (to point to the credentials file created in step 7) before invoking `opstrace create gcp ...`. For further information, please have a look at the .