wehub-resource-sync
174 lines
7.5 KiB
Bash
Executable File
174 lines
7.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
###
|
|
### Deploys the genwealth database to AlloyDB
|
|
###
|
|
|
|
# Load env variables
|
|
source ./env.sh
|
|
|
|
# Install necessary packages
|
|
sudo apt-get -y install jq
|
|
|
|
# Create VPC
|
|
echo "Creating VPC"
|
|
gcloud compute networks create "${VPC_NAME}" --project="${PROJECT_ID}" --subnet-mode=auto --mtu=1460 --bgp-routing-mode=regional
|
|
|
|
# Create an IP Allocation for Private Services Access
|
|
echo "Creating IP Allocation for PSA"
|
|
gcloud compute addresses create demo-psa-range \
|
|
--global \
|
|
--purpose=VPC_PEERING \
|
|
--prefix-length=16 \
|
|
--network="${VPC_NAME}"
|
|
|
|
# Create the Private Services Access Connection
|
|
echo "Creating PSA connection"
|
|
gcloud services vpc-peerings connect \
|
|
--service=servicenetworking.googleapis.com \
|
|
--ranges="demo-psa-range" \
|
|
--network="${VPC_NAME}"
|
|
|
|
# Create AlloyDB Cluster
|
|
echo "Creating AlloyDB Cluster"
|
|
gcloud alloydb clusters create "${ALLOYDB_CLUSTER}" \
|
|
--database-version="POSTGRES_14" \
|
|
--password="${ALLOYDB_PASSWORD}" \
|
|
--network="${VPC_NAME}" \
|
|
--region="${REGION}" \
|
|
--project="${PROJECT_ID}" \
|
|
--allocated-ip-range-name="demo-psa-range"
|
|
|
|
# Create AlloyDB Primary Instance
|
|
echo "Creating AlloyDB Primary Instance"
|
|
gcloud alloydb instances create "${ALLOYDB_INSTANCE}" \
|
|
--instance-type=PRIMARY \
|
|
--cpu-count=2 \
|
|
--availability-type=ZONAL \
|
|
--region="${REGION}" \
|
|
--cluster="${ALLOYDB_CLUSTER}" \
|
|
--project="${PROJECT_ID}" \
|
|
--ssl-mode="ALLOW_UNENCRYPTED_AND_ENCRYPTED" \
|
|
--database-flags=google_ml_integration.enable_model_support=on
|
|
|
|
# Create GCE Instance for pgadmin
|
|
echo "Creating GCE instance for pgAdmin"
|
|
gcloud compute instances create "${GCE_INSTANCE}" \
|
|
--project="${PROJECT_ID}" \
|
|
--zone="${ZONE}" \
|
|
--machine-type=e2-standard-2 \
|
|
--network-interface=network-tier=PREMIUM,stack-type=IPV4_ONLY,subnet="${VPC_NAME}" \
|
|
--metadata=enable-oslogin=true \
|
|
--provisioning-model=STANDARD \
|
|
--service-account="${PROJECT_NUMBER}"-compute@developer.gserviceaccount.com \
|
|
--scopes=https://www.googleapis.com/auth/devstorage.read_only,https://www.googleapis.com/auth/logging.write,https://www.googleapis.com/auth/monitoring.write,https://www.googleapis.com/auth/servicecontrol,https://www.googleapis.com/auth/service.management.readonly,https://www.googleapis.com/auth/trace.append,https://www.googleapis.com/auth/cloud-platform \
|
|
--tags="${GCE_INSTANCE}" \
|
|
--create-disk=auto-delete=yes,boot=yes,device-name="${GCE_INSTANCE}",image=projects/debian-cloud/global/images/debian-12-bookworm-v20240213,mode=rw,size=100,type=projects/"${PROJECT_ID}"/zones/${ZONE}/diskTypes/pd-ssd \
|
|
--shielded-secure-boot \
|
|
--shielded-vtpm \
|
|
--shielded-integrity-monitoring
|
|
|
|
# Add necessary permissions for GCE instance
|
|
echo "Adding permissions"
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/aiplatform.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/storage.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/alloydb.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:service-${PROJECT_NUMBER}@gcp-sa-alloydb.iam.gserviceaccount.com" \
|
|
--role="roles/aiplatform.user"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/aiplatform.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/alloydb.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/alloydb.client"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/alloydb.databaseUser"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/discoveryengine.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/documentai.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/eventarc.eventReceiver"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/eventarc.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/ml.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/pubsub.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/run.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/serviceusage.serviceUsageConsumer"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/storage.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/secretmanager.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/logging.logWriter"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/artifactregistry.admin"
|
|
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
|
|
--role="roles/cloudbuild.builds.builder"
|
|
|
|
# Create Firewall Rule
|
|
echo "Creating firewall rule for pgAdmin instance"
|
|
gcloud compute firewall-rules create pgadmin-firewall --project="${PROJECT_ID}" --direction=INGRESS --priority=1000 --network="${VPC_NAME}" --action=ALLOW --rules=tcp:80,tcp:22 --source-ranges="${LOCAL_IPV4}/32",35.235.240.0/20 --target-tags="${GCE_INSTANCE}"
|
|
|
|
# Allow ssh from cloud shell
|
|
gcloud compute firewall-rules create --network="$VPC_NAME" "default-allow-ssh-${PROJECT_ID}" --allow=tcp:22
|
|
echo "Waiting for firewall rules to take effect"
|
|
sleep 30
|
|
|
|
# Run script against pgadmin instance
|
|
gcloud compute ssh "$GCE_INSTANCE" --zone="$ZONE" --command="rm -f /tmp/install-pgadmin.sh"
|
|
gcloud compute ssh "$GCE_INSTANCE" --zone="$ZONE" --command="rm -f /tmp/env.sh"
|
|
gcloud compute copy-files ./deployment/install-pgadmin.sh "$GCE_INSTANCE":/tmp/install-pgadmin.sh --zone="$ZONE"
|
|
gcloud compute copy-files ./env.sh "$GCE_INSTANCE":/tmp/env.sh --zone="$ZONE"
|
|
gcloud compute ssh "$GCE_INSTANCE" --zone="$ZONE" --command="chmod +x /tmp/install-pgadmin.sh"
|
|
gcloud compute ssh "$GCE_INSTANCE" --zone="$ZONE" --command="chmod +x /tmp/env.sh"
|
|
gcloud compute ssh "$GCE_INSTANCE" --zone="$ZONE" --command="/tmp/install-pgadmin.sh"
|