Google PCA Manage and provision cloud infrastructure — All Questions With Answers

Refer to the exhibit.

gcloud compute instances create my-instance \
    --zone=us-central1-a \
    --machine-type=n1-standard-2 \
    --image-family=debian-10 \
    --image-project=debian-cloud \
    --boot-disk-size=50GB \
    --boot-disk-type=pd-standard \
    --tags=http-server,https-server

Refer to the exhibit.

gcloud container clusters create my-cluster \
    --zone us-central1-a \
    --num-nodes 3 \
    --machine-type e2-medium \
    --disk-size 100 \
    --image-type cos_containerd \
    --enable-autoscaling \
    --min-nodes 1 \
    --max-nodes 5 \
    --node-locations us-central1-a,us-central1-b,us-central1-f

resources:
- name: my-firewall
  type: compute.v1.firewall
  properties:
    network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/default
    allowed:
    - IPProtocol: tcp
      ports: ['80','443']
    sourceRanges: ['0.0.0.0/0']
- name: my-instance
  type: compute.v1.instance
  properties:
    zone: us-central1-a
    machineType: https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/machineTypes/n1-standard-1
    networkInterfaces:
    - network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/default
      accessConfigs:
      - name: External NAT
        type: ONE_TO_ONE_NAT

{
  "bindings": [
    {
      "role": "roles/compute.viewer",
      "members": [
        "user:ops@example.com"
      ]
    }
  ]
}

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "domain:example.com"
      ]
    }
  ]
}

NAME       ZONE        MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP   EXTERNAL_IP
instance-1 us-central1-a n1-standard-4 true        10.128.0.2    35.184.0.1
instance-2 us-central1-b n1-standard-4 false       10.128.0.3    35.184.0.2

resources:
- name: my-vm
  type: compute.v1.instance
  properties:
    zone: us-central1-a
    machineType: zones/us-central1-a/machineTypes/n1-standard-4
    disks:
    - deviceName: boot
      type: PERSISTENT
      boot: true
      autoDelete: true
      initializeParams:
        sourceImage: projects/debian-cloud/global/images/family/debian-10
    networkInterfaces:
    - network: global/networks/default
      accessConfigs:
      - name: External NAT
        type: ONE_TO_ONE_NAT

Refer to the exhibit.
```
$ gcloud compute instances list
NAME: web-server-1
ZONE: us-central1-a
MACHINE_TYPE: n1-standard-2
PREEMPTIBLE: true
INTERNAL_IP: 10.128.0.2
EXTERNAL_IP: 35.184.12.34
STATUS: RUNNING

NAME: web-server-2
ZONE: us-central1-b
MACHINE_TYPE: n1-standard-2
PREEMPTIBLE: false
INTERNAL_IP: 10.128.0.3
EXTERNAL_IP: 35.184.12.35
STATUS: RUNNING
```

Refer to the exhibit.
```json
{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:admin@example.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:admin@example.com"
      ]
    },
    {
      "role": "roles/resourcemanager.projectCreator",
      "members": [
        "group:pm-team@example.com"
      ]
    }
  ],
  "etag": "BwWU7a9h"
}
```

Refer to the exhibit.
```
$ gsutil cp myfile.txt gs://my-bucket/
Copying file://myfile.txt [Content-Type=text/plain]...
AccessDeniedException: 403 Anonymous caller does not have storage.objects.create access to the Google Cloud Storage bucket.
```

Refer to the exhibit.

gcloud compute instances describe my-instance
...
scheduling:
  automaticRestart: true
  onHostMaintenance: TERMINATE
  preemptible: false
...

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:alice@example.com"],
      "condition": {
        "title": "restrict_to_bucket_x",
        "expression": "resource.name.startsWith('projects/_/buckets/bucket-x/')"
      }
    }
  ]
}

Refer to the exhibit.

gcloud container clusters describe my-cluster
...
network: default
clusterIpv4Cidr: /14
servicesIpv4Cidr: /20
enableIpAliases: true
privateCluster: false
...