137 lines
4.9 KiB
Bash
137 lines
4.9 KiB
Bash
#!/bin/bash
|
|
# 01-setupenv.sh — Enable APIs, create staging bucket with lifecycle, SA, billing budgets
|
|
# Run in: local VS Code terminal OR Cloud Shell
|
|
# Source .env before running: source .env
|
|
|
|
set -euo pipefail
|
|
|
|
: "${PROJECT_ID:?Set PROJECT_ID in .env}"
|
|
: "${REGION:?Set REGION in .env}"
|
|
: "${BILLING_ACCOUNT_ID:?Set BILLING_ACCOUNT_ID in .env}"
|
|
: "${AGENT_SA:?Set AGENT_SA in .env}"
|
|
|
|
# ── Region Guard ────────────────────────────────────────────────────────
|
|
source "$(dirname "$0")/99-region-guard.sh"
|
|
log_region_context "Storage-Bucket" "$REGION" "SELECTED"
|
|
|
|
BUCKET_NAME="gs://${PROJECT_ID}-agent-staging"
|
|
BUDGET_PROD_NAME="OSVauco-Agent-Budget-500USD"
|
|
BUDGET_DEV_NAME="OSVauco-Dev-Budget-75USD"
|
|
PUBSUB_TOPIC="billing-alert-auto-teardown"
|
|
|
|
echo "=== 01: Environment Setup for ${PROJECT_ID} ==="
|
|
|
|
# 0. Auth check
|
|
bash "$(dirname "$0")/00-authcheck.sh"
|
|
|
|
# 1. Enable required APIs (idempotent)
|
|
echo "Enabling required APIs..."
|
|
gcloud services enable \
|
|
aiplatform.googleapis.com \
|
|
storage.googleapis.com \
|
|
cloudbilling.googleapis.com \
|
|
cloudresourcemanager.googleapis.com \
|
|
iam.googleapis.com \
|
|
run.googleapis.com \
|
|
artifactregistry.googleapis.com \
|
|
cloudbuild.googleapis.com \
|
|
cloudbuildv2.googleapis.com \
|
|
secretmanager.googleapis.com \
|
|
monitoring.googleapis.com \
|
|
logging.googleapis.com \
|
|
cloudtrace.googleapis.com \
|
|
pubsub.googleapis.com \
|
|
cloudfunctions.googleapis.com \
|
|
--project="$PROJECT_ID" --quiet
|
|
echo "✓ APIs enabled."
|
|
|
|
# 2. Create staging bucket (idempotent)
|
|
if gcloud storage ls "$BUCKET_NAME" >/dev/null 2>&1; then
|
|
echo "✓ Staging bucket $BUCKET_NAME already exists."
|
|
else
|
|
gcloud storage buckets create "$BUCKET_NAME" \
|
|
--location="$REGION" --project="$PROJECT_ID" --quiet
|
|
echo "✓ Bucket created: $BUCKET_NAME"
|
|
fi
|
|
|
|
# 3. Apply lifecycle rule (auto-delete objects >7 days)
|
|
cat > /tmp/lifecycle.json << 'EOF'
|
|
{"rule":[{"action":{"type":"Delete"},"condition":{"age":7}}]}
|
|
EOF
|
|
gcloud storage buckets update "$BUCKET_NAME" --lifecycle-file=/tmp/lifecycle.json --quiet
|
|
echo "✓ Lifecycle rule applied (delete after 7 days)."
|
|
|
|
# 4. Service account (idempotent)
|
|
SA_NAME=$(echo "$AGENT_SA" | cut -d'@' -f1)
|
|
if ! gcloud iam service-accounts describe "$AGENT_SA" --project="$PROJECT_ID" >/dev/null 2>&1; then
|
|
gcloud iam service-accounts create "$SA_NAME" \
|
|
--display-name="OSVauco Agent Runner SA" --project="$PROJECT_ID" --quiet
|
|
echo "✓ Service account created: $AGENT_SA"
|
|
fi
|
|
|
|
for ROLE in \
|
|
roles/aiplatform.user \
|
|
roles/storage.objectAdmin \
|
|
roles/logging.logWriter \
|
|
roles/cloudtrace.agent \
|
|
roles/monitoring.metricWriter \
|
|
roles/secretmanager.secretAccessor \
|
|
roles/run.invoker; do
|
|
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
|
|
--member="serviceAccount:${AGENT_SA}" --role="$ROLE" --quiet
|
|
done
|
|
echo "✓ IAM bindings configured."
|
|
|
|
# 5. Pub/Sub topic for billing auto-teardown (idempotent)
|
|
if ! gcloud pubsub topics describe "${PUBSUB_TOPIC}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
|
|
gcloud pubsub topics create "${PUBSUB_TOPIC}" --project="${PROJECT_ID}" --quiet
|
|
echo "✓ Pub/Sub topic created: ${PUBSUB_TOPIC}"
|
|
else
|
|
echo "✓ Pub/Sub topic already exists: ${PUBSUB_TOPIC}"
|
|
fi
|
|
|
|
# 6. Prod billing budget — $500, varsler på 50% / 80% / 100% + Pub/Sub (idempotent)
|
|
EXISTING_PROD=$(gcloud billing budgets list \
|
|
--billing-account="${BILLING_ACCOUNT_ID}" \
|
|
--filter="displayName=${BUDGET_PROD_NAME}" \
|
|
--format="value(name)" 2>/dev/null | head -1 || true)
|
|
|
|
if [[ -z "${EXISTING_PROD}" ]]; then
|
|
gcloud billing budgets create \
|
|
--billing-account="${BILLING_ACCOUNT_ID}" \
|
|
--display-name="${BUDGET_PROD_NAME}" \
|
|
--budget-amount=500USD \
|
|
--threshold-rule=percent=0.5 \
|
|
--threshold-rule=percent=0.8 \
|
|
--threshold-rule=percent=1.0 \
|
|
--notifications-rule-pubsub-topic="projects/${PROJECT_ID}/topics/${PUBSUB_TOPIC}"
|
|
echo "✓ Prod budget alert created ($500, Pub/Sub koblet)"
|
|
else
|
|
echo "✓ Prod budget alert already exists"
|
|
fi
|
|
|
|
# 7. Dev billing budget — $75, varsler på 70% / 90% + Pub/Sub (idempotent)
|
|
EXISTING_DEV=$(gcloud billing budgets list \
|
|
--billing-account="${BILLING_ACCOUNT_ID}" \
|
|
--filter="displayName=${BUDGET_DEV_NAME}" \
|
|
--format="value(name)" 2>/dev/null | head -1 || true)
|
|
|
|
if [[ -z "${EXISTING_DEV}" ]]; then
|
|
gcloud billing budgets create \
|
|
--billing-account="${BILLING_ACCOUNT_ID}" \
|
|
--display-name="${BUDGET_DEV_NAME}" \
|
|
--budget-amount=75USD \
|
|
--threshold-rule=percent=0.7 \
|
|
--threshold-rule=percent=0.9 \
|
|
--threshold-rule=percent=1.0 \
|
|
--notifications-rule-pubsub-topic="projects/${PROJECT_ID}/topics/${PUBSUB_TOPIC}"
|
|
echo "✓ Dev budget alert created ($75, Pub/Sub koblet)"
|
|
else
|
|
echo "✓ Dev budget alert already exists"
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== 01: Environment setup COMPLETE ==="
|
|
echo " Kjør nå: bash infrastructure/10-cost-guard.sh"
|
|
echo " for å aktivere auto-teardown Cloud Function"
|