@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/cicd/google-cloud/references/project.md

@@ -0,0 +1,349 @@
+# Project Management
+
+Project metadata, quotas, billing, and resource management for $YOUR_ORG GCP infrastructure.
+
+## Project Configuration
+
+| Field | Value |
+|-------|-------|
+| Project ID | `$PROJECT_ID` |
+| Project Number | `$PROJECT_NUMBER` |
+| Display Name | `$YOUR_ORG Dev` |
+| Region | `us-central1` |
+| Organization | `$YOUR_ORG (if applicable)` |
+
+---
+
+## Project Information
+
+### Describe Project
+
+```bash
+gcloud projects describe $PROJECT_NUMBER
+```
+
+### Get Project Details (specific fields)
+
+```bash
+# Project ID
+gcloud projects describe $PROJECT_NUMBER --format="value(projectId)"
+
+# Project number
+gcloud projects describe $PROJECT_NUMBER --format="value(projectNumber)"
+
+# Lifecycle state
+gcloud projects describe $PROJECT_NUMBER --format="value(lifecycleState)"
+
+# Creation time
+gcloud projects describe $PROJECT_NUMBER --format="value(createTime)"
+```
+
+### Set Default Project
+
+```bash
+gcloud config set project $PROJECT_ID
+```
+
+---
+
+## Enabled APIs
+
+### List Enabled APIs
+
+```bash
+# All enabled
+gcloud services list --enabled
+
+# Filter by name
+gcloud services list --enabled --filter="name:cloudrun"
+gcloud services list --enabled --filter="name:sql"
+gcloud services list --enabled --filter="name:secretmanager"
+```
+
+### Check if API is Enabled
+
+```bash
+gcloud services list --enabled --filter="name:run.googleapis.com"
+```
+
+### Enable API
+
+```bash
+gcloud services enable run.googleapis.com --project=$PROJECT_ID
+gcloud services enable secretmanager.googleapis.com --project=$PROJECT_ID
+gcloud services enable cloudsql.googleapis.com --project=$PROJECT_ID
+```
+
+### Disable API
+
+```bash
+gcloud services disable run.googleapis.com --project=$PROJECT_ID
+```
+
+---
+
+## Quotas
+
+### List Quotas
+
+```bash
+# All quotas for a service
+gcloud compute project-info describe --project=$PROJECT_ID
+
+# Filter for specific quota
+gcloud compute project-info describe \
+  --project=$PROJECT_ID \
+  --flatten="quotas[]" \
+  --filter="quotas.metric:cpus"
+```
+
+### Request Quota Increase
+
+```bash
+gcloud compute regions describe us-central1 \
+  --project=$PROJECT_ID \
+  --format="table(quotas:format='table(metric,limit,usage)')"
+
+# Request via console or:
+# https://console.cloud.google.com/iam-admin/quotas
+```
+
+---
+
+## Billing
+
+### Get Billing Info
+
+```bash
+# Billing account linked to project
+gcloud projects describe $PROJECT_NUMBER \
+  --format="value(labels[goog-cb-org-id],labels[goog-cc-org-name])"
+```
+
+### Set Billing Account
+
+```bash
+gcloud beta billing projects link $PROJECT_ID \
+  --billing-account=$BILLING_ACCOUNT_ID
+```
+
+---
+
+## Service Accounts
+
+### List All Service Accounts
+
+```bash
+gcloud iam service-accounts list --project=$PROJECT_ID
+
+# Format as table
+gcloud iam service-accounts list \
+  --project=$PROJECT_ID \
+  --format="table(displayName,email)"
+```
+
+### Get Default SA Emails
+
+```bash
+# Compute SA
+COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
+
+# Cloud Build SA
+CLOUDBUILD_SA="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"
+
+# Cloud Run SA
+CLOUDRUN_SA="${PROJECT_NUMBER}-run@developer.gserviceaccount.com"
+```
+
+---
+
+## Resource Inventory
+
+### List Cloud Run Services
+
+```bash
+gcloud run services list --region=us-central1
+```
+
+### List Cloud Run Jobs
+
+```bash
+gcloud run jobs list --region=us-central1
+```
+
+### List Cloud SQL Instances
+
+```bash
+gcloud sql instances list
+```
+
+### List Cloud Build Triggers
+
+```bash
+gcloud builds triggers list --region=us-central1
+```
+
+### List Cloud Deploy Pipelines
+
+```bash
+gcloud deploy delivery-pipelines list --region=us-central1
+```
+
+### List Cloud Functions
+
+```bash
+gcloud functions list --region=us-central1
+```
+
+### List GCS Buckets
+
+```bash
+gcloud storage ls
+```
+
+---
+
+## Labels Management
+
+### Project-Level Labels
+
+```bash
+# Add/Update label
+gcloud projects update $PROJECT_ID \
+  --update-labels=env=dev,team=platform
+
+# Remove label
+gcloud projects update $PROJECT_ID \
+  --remove-labels=old-label
+
+# List labels
+gcloud projects describe $PROJECT_ID --format="value(labels)"
+```
+
+### Filter by Label
+
+```bash
+# Cloud Run services with env=dev
+gcloud run services list --region=us-central1 \
+  --filter="metadata.labels.env:dev"
+
+# Cloud SQL instances with team=platform
+gcloud sql instances list \
+  --filter="labels.team:platform"
+```
+
+---
+
+## Organization Policies
+
+### Describe Organization Policies
+
+```bash
+# List constraints
+gcloud org-policies list --project=$PROJECT_ID
+
+# Describe specific policy
+gcloud org-policies describe constraints/iam.allowedPolicyMemberDomains \
+  --project=$PROJECT_ID
+```
+
+### Reset Policy
+
+```bash
+gcloud org-policies reset constraints/iam.allowedPolicyMemberDomains \
+  --project=$PROJECT_ID
+```
+
+---
+
+## Cost and Usage
+
+### View Cost Breakdown
+
+```bash
+# Using gcloud (limited)
+gcloud billing budgets list --billing-account=$ACCOUNT_ID
+
+# View in console:
+# https://console.cloud.google.com/billing/budgets
+```
+
+### Export Billing to BigQuery
+
+```bash
+# Set up billing export (one-time, via console)
+# https://console.cloud.google.com/billing/export
+```
+
+---
+
+## Useful Queries
+
+### Count Resources by Type
+
+```bash
+# Cloud Run services
+gcloud run services list --region=us-central1 --format="value(name)" | wc -l
+
+# Cloud Run jobs
+gcloud run jobs list --region=us-central1 --format="value(name)" | wc -l
+
+# Cloud SQL instances
+gcloud sql instances list --format="value(name)" | wc -l
+
+# GCS buckets
+gcloud storage ls | wc -l
+```
+
+### Find Old Resources
+
+```bash
+# Cloud Run services older than 90 days
+gcloud run services list --region=us-central1 \
+  --sort-by=metadata.name
+```
+
+### Find Large Resources
+
+```bash
+# Cloud SQL instances by tier
+gcloud sql instances list \
+  --format="table(name,settings.tier,region)"
+```
+
+---
+
+## Project Cleanup
+
+### Find Unused Resources
+
+```bash
+# Cloud Run services with 0 revisions
+gcloud run services list --region=us-central1 \
+  --filter="spec.revisionSpec.revisionTemplate.spec.containerConcurrency=0"
+
+# GCS buckets not modified in 30 days
+gcloud storage ls --format="json(buckets)" | \
+  jq '.[] | select(.timeCreated < (now - 2592000 | strftime("%Y-%m-%d")))'
+```
+
+### Delete Old Snapshots
+
+```bash
+gcloud compute snapshots list --filter="creationTimestamp<$(date -d '90 days ago' +%Y-%m-%d)"
+```
+
+---
+
+## Quick Reference
+
+### Common Service Endpoints
+
+| Service | Endpoint |
+|---------|----------|
+| Cloud Run | `https://console.cloud.google.com/run` |
+| Cloud SQL | `https://console.cloud.google.com/sql` |
+| Secret Manager | `https://console.cloud.google.com/security/secret-manager` |
+| IAM | `https://console.cloud.google.com/iam-admin/iam` |
+| Billing | `https://console.cloud.google.com/billing` |
+| Resource Manager | `https://console.cloud.google.com/resource-manager` |

package/skills/cicd/google-cloud/references/secrets.md

@@ -0,0 +1,336 @@
+# Secret Manager
+
+Securely store and access secrets, API keys, and sensitive configuration.
+
+## Project Configuration
+
+| Field | Value |
+|-------|-------|
+| Project ID | `$PROJECT_ID` |
+| Project Number | `$PROJECT_NUMBER` |
+
+## Secret Operations
+
+### List Secrets
+
+```bash
+# All secrets
+gcloud secrets list --project=$PROJECT_ID
+
+# With labels
+gcloud secrets list \
+  --filter="labels.env:dev" \
+  --project=$PROJECT_ID
+```
+
+### Create Secret
+
+```bash
+# Create with automatic replication
+gcloud secrets create $SECRET_NAME \
+  --replication-policy="automatic" \
+  --project=$PROJECT_ID
+
+# Create with user-managed replication
+gcloud secrets create $SECRET_NAME \
+  --replication-policy="user-managed" \
+  --locations="us-central1" \
+  --project=$PROJECT_ID
+```
+
+### Describe Secret
+
+```bash
+gcloud secrets describe $SECRET_NAME --project=$PROJECT_ID
+```
+
+### Delete Secret
+
+```bash
+gcloud secrets delete $SECRET_NAME --project=$PROJECT_ID
+```
+
+---
+
+## Version Operations
+
+### Add Version (from string)
+
+```bash
+echo -n "$SECRET_VALUE" | \
+  gcloud secrets versions add $SECRET_NAME \
+    --data-file=- \
+    --project=$PROJECT_ID
+```
+
+### Add Version (from file)
+
+```bash
+gcloud secrets versions add $SECRET_NAME \
+  --data-file=/path/to/file \
+  --project=$PROJECT_ID
+```
+
+### List Versions
+
+```bash
+gcloud secrets versions list $SECRET_NAME --project=$PROJECT_ID
+```
+
+### Access Latest Version
+
+```bash
+gcloud secrets versions access latest \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID
+```
+
+### Access Specific Version
+
+```bash
+gcloud secrets versions access $VERSION \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID
+```
+
+### Disable Version
+
+```bash
+gcloud secrets versions disable $VERSION \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID
+```
+
+### Destroy Version
+
+```bash
+gcloud secrets versions destroy $VERSION \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID
+```
+
+---
+
+## IAM Access
+
+### Grant SA Access to Secret
+
+```bash
+gcloud secrets add-iam-policy-binding $SECRET_NAME \
+  --member="serviceAccount:$SA_EMAIL" \
+  --role="roles/secretmanager.secretAccessor" \
+  --project=$PROJECT_ID
+```
+
+### Grant User Access to Secret
+
+```bash
+gcloud secrets add-iam-policy-binding $SECRET_NAME \
+  --member="user:$EMAIL" \
+  --role="roles/secretmanager.secretAccessor" \
+  --project=$PROJECT_ID
+```
+
+### Grant Admin Access
+
+```bash
+gcloud secrets add-iam-policy-binding $SECRET_NAME \
+  --member="serviceAccount:$SA_EMAIL" \
+  --role="roles/secretmanager.admin" \
+  --project=$PROJECT_ID
+```
+
+### Check IAM Policy
+
+```bash
+gcloud secrets get-iam-policy $SECRET_NAME --project=$PROJECT_ID
+```
+
+---
+
+## Common Patterns
+
+### Database Connection String (per environment)
+
+```bash
+# Dev
+echo -n "postgresql://user:pass@host/dev-db" | \
+  gcloud secrets versions add database-url-dev --data-file=-
+
+# Staging
+echo -n "postgresql://user:pass@host/staging-db" | \
+  gcloud secrets versions add database-url-staging --data-file=-
+
+# Production
+echo -n "postgresql://user:pass@host/prod-db" | \
+  gcloud secrets versions add database-url-prod --data-file=-
+```
+
+### API Key
+
+```bash
+gcloud secrets create api-key-$SERVICE --replication-policy="automatic"
+echo -n "$API_KEY" | gcloud secrets versions add api-key-$SERVICE --data-file=-
+```
+
+### Generate Random Secret
+
+```bash
+# Generate 32-byte hex key
+openssl rand -hex 32 | \
+  gcloud secrets versions add $SECRET_NAME --data-file=-
+
+# Generate base64 key
+openssl rand -base64 32 | \
+  gcloud secrets versions add $SECRET_NAME --data-file=-
+```
+
+### Environment-Specific Secrets Setup Script
+
+```bash
+#!/bin/bash
+set -e
+PROJECT=$PROJECT_ID
+SERVICE=my-service
+
+for ENV in dev staging prod; do
+  echo "Creating secrets for $ENV..."
+  
+  # Database URL
+  gcloud secrets create ${SERVICE}-database-url-${ENV} \
+    --replication-policy="automatic" \
+    --project=$PROJECT 2>/dev/null || true
+  echo -n "$DB_URL" | \
+    gcloud secrets versions add ${SERVICE}-database-url-${ENV} \
+      --data-file=- \
+      --project=$PROJECT
+  
+  # API Key
+  gcloud secrets create ${SERVICE}-api-key-${ENV} \
+    --replication-policy="automatic" \
+    --project=$PROJECT 2>/dev/null || true
+  echo -n "$API_KEY" | \
+    gcloud secrets versions add ${SERVICE}-api-key-${ENV} \
+      --data-file=- \
+      --project=$PROJECT
+done
+```
+
+---
+
+## Cloud Run Integration
+
+### Deploy with Secrets
+
+```bash
+gcloud run deploy $SERVICE \
+  --image=$IMAGE \
+  --region=us-central1 \
+  --set-secrets=DATABASE_URL=database-url:latest,API_KEY=api-key:latest
+```
+
+### Update Secrets on Service
+
+```bash
+gcloud run services update $SERVICE \
+  --region=us-central1 \
+  --set-secrets=DATABASE_URL=database-url:latest
+```
+
+### Mount Secret as Volume
+
+```bash
+gcloud run services update $SERVICE \
+  --region=us-central1 \
+  --set-volumes=secret-volume=secret-name:latest,/mnt/secrets
+```
+
+---
+
+## Cloud Run Job Integration
+
+```bash
+# Create job with secrets
+gcloud run jobs create $JOB \
+  --image=$IMAGE \
+  --region=us-central1 \
+  --set-secrets=ENV_VAR=secret-name:latest
+
+# Execute with secrets
+gcloud run jobs execute $JOB \
+  --region=us-central1 \
+  --set-env-vars=ENV_VAR=secret-name:latest
+```
+
+---
+
+## Local Development
+
+### Access Secret Locally
+
+```bash
+# Using gcloud
+SECRET_VALUE=$(gcloud secrets versions access latest \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID)
+
+# Export to file (secure)
+gcloud secrets versions access latest \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID > .env.local
+```
+
+### Secret Manager Auth (local)
+
+```bash
+# Use application default credentials
+gcloud auth application-default login
+
+# Or use service account key
+export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
+```
+
+---
+
+## Debugging
+
+### Check Secret Exists
+
+```bash
+gcloud secrets list --filter="name:$SECRET_NAME" --project=$PROJECT_ID
+```
+
+### Check SA Has Access
+
+```bash
+gcloud secrets get-iam-policy $SECRET_NAME --project=$PROJECT_ID | grep $SA_EMAIL
+```
+
+### Verify Secret Value
+
+```bash
+# Check if secret is accessible
+gcloud secrets versions access latest \
+  --secret=$SECRET_NAME \
+  --project=$PROJECT_ID | head -c 100
+```
+
+---
+
+## Labels and Annotations
+
+### Add Label to Secret
+
+```bash
+gcloud secrets update $SECRET_NAME \
+  --project=$PROJECT_ID \
+  --update-labels=env=dev,team=platform
+```
+
+### Add Annotation
+
+```bash
+gcloud secrets update $SECRET_NAME \
+  --project=$PROJECT_ID \
+  --update-annotations=owner=platform-team@company.com
+```