GoogleCloudPlatform/pubsec-declarative-toolkit

View on GitHub

The GCP PubSec Declarative Toolkit is a collection of declarative solutions to help you on your Journey to Google Cloud. Solutions are designed using Config Connector and deployed using Config Controller.

Stars: 36
Forks: 26
Open beginner issues: 0
Indexed issues: 259

Dominant language: Shell
License: Apache-2.0
Last GitHub push: Jan 5, 2026
Latest indexed: Sep 16, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue
PR merge metrics: No merged PRs in 30d

Open All

259 open issues indexed

Add Billing Export to GCS bucket Solution Open

Solution

GoogleCloudPlatform/pubsec-declarative-toolkit#6 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
GCP User Analysis Dashboard Solution Open

Solution

GoogleCloudPlatform/pubsec-declarative-toolkit#11 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Multi-Cluster Solution with Anthos Open

Solution

GoogleCloudPlatform/pubsec-declarative-toolkit#22 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Enhance error handling Open

arete enhancement

GoogleCloudPlatform/pubsec-declarative-toolkit#46 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Unit tests for CLI Open

arete enhancement

GoogleCloudPlatform/pubsec-declarative-toolkit#51 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Add More Enforcement Policies Open

policy Solution

GoogleCloudPlatform/pubsec-declarative-toolkit#62 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Flip perimeter prod firewall deny rule for ssh:22 to allow - during dev - or flip name to deny to block Open

Landing Zone Solution

GoogleCloudPlatform/pubsec-declarative-toolkit#75 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Compliance: ITSG-22 Network Security Zones and ITSG-38 Network Security Zoning - Design Considerations for Placement of Services Open

documentation enhancement Networking Solution

GoogleCloudPlatform/pubsec-declarative-toolkit#78 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
As a org admin i need to onboard a new L1 client via either profile: shared VPC or peered VPC under the 3 workload folders Open

documentation enhancement Networking

GoogleCloudPlatform/pubsec-declarative-toolkit#79 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
[BUG]: selective failure applying to the cc via kpt live apply - for those that fail add --inventory-policy adopt Open

bug Landing Zone

GoogleCloudPlatform/pubsec-declarative-toolkit#112 · 6 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
[ENHANCEMENT] avoid billing quota failure when deploying new (CC or Solution) Projects - for default/new organizations that have the quota of 5 per billing id - optionally add 1:1 billing/project KPT config Open

documentation enhancement Landing Zone

GoogleCloudPlatform/pubsec-declarative-toolkit#113 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
[ENHANCEMENT] full workaround for #103 where we .krmignore the policy folders that block the landing-zone solution Open

enhancement Landing Zone validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#114 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
[DOC] Iterate architecture docs in the landing-zone solution Open

compliance enhancement Landing Zone Networking

GoogleCloudPlatform/pubsec-declarative-toolkit#120 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
[ENHANCEMENT]: Expand and define the naming standard across all the GCP components in use in the LZ Open

compliance documentation Landing Zone Networking security-controls

GoogleCloudPlatform/pubsec-declarative-toolkit#130 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
[BUG] Re-creating the CC GKE cluster after deploying the landing-zone solution requires removal of the requireShieldedVM org policy - kubernetes intent engine will replace it back post-create Open

automation bug developer-experience documentation Landing Zone validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#132 · 20 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Doc: align SA roles in advanced install and landing-zone install - post cc creation Open

documentation validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#135 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
ITSG-33 Security Controls coverage/mapping/workload Open

documentation enhancement

GoogleCloudPlatform/pubsec-declarative-toolkit#145 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
ITSG-33 Security controls - Implement yaml tagging/labelling for automatic reporting/generation of compliance Open

compliance Networking security-controls tag_label

GoogleCloudPlatform/pubsec-declarative-toolkit#151 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
minor: DOC: add group creation instructions to LZ and Guardrails docs - for users new to GCP Open

documentation

GoogleCloudPlatform/pubsec-declarative-toolkit#153 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Align TF Guardrails and KCC (embedded GR in LZ) and KCC GR log sinks Open

compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#154 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Verify/transition WIP status of ACM enablement Open

arete documentation validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#157 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Validate fortigate GC-CAP/GC-TIP architecture - dual LB sandwich or VDOM config Open

compliance documentation fortinet Landing Zone Networking

GoogleCloudPlatform/pubsec-declarative-toolkit#158 · 6 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Prototype firewall policy sets for workload flow ids - at the fortigate, armor or VPC firewall level Open

compliance documentation enhancement Networking validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#162 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Traffic Generation: Add stub https/L7 external Load Balancer with attached Cloud Armor in perimeter to serve up static or cloud run site Open

canary

GoogleCloudPlatform/pubsec-declarative-toolkit#163 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
look at checking if there is a way to get workload Artifact Registry vulnerability checks alongside the infrastructure vulnerability tab results already in SCC-P Open

automation developer-experience

GoogleCloudPlatform/pubsec-declarative-toolkit#165 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Fortigate configuration: VM in mgmt vpc/subnet can have internet access without using a NAT? The reconfigured fortigate 4th mgmt NIC can not be used for firewall policies Open

fortinet Networking scrum validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#166 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Add KCC port of fortigate-tutorial-gcp example - backport collaboration - while we integrate into the KCC Landing zone Open

compliance Networking security-controls validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#168 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
GR12 - add disable public marketplace resource policy constraints/commerceorggovernance.disablePublicMarketplace for compliance Open

compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#170 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Cover off/validate service account key rotation automation - if public/private key pairs are added Open

automation compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#171 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Investigate GCP console and rest API lockdown for non-GC devices (no BYOD) - via ACM and BeyondCorp Open

compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#172 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Investigate PSA - Private Service Access - specified CIDR range over defaults - for values.yaml reporting - merge with 178 Open

automation developer-experience

GoogleCloudPlatform/pubsec-declarative-toolkit#173 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Document LZ reconcile from upstream and applying local changes using KPT to a running LZ KCC cluster Open

developer-experience documentation

GoogleCloudPlatform/pubsec-declarative-toolkit#176 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Investigate L7 packet inspection via packet mirroring all or filtered - to IDS, PaloAlto or Fortigate NGFW appliances Open

compliance Landing Zone Networking security-controls

GoogleCloudPlatform/pubsec-declarative-toolkit#177 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Implement/Verify PSA private services access between VMs and services remain privately routed via internal IPs Open

compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#178 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Document/POC zero trust infrastructure and end-end L7 encryption workflows Open

compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#179 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Design Issue: Config controller (managed) over config connector CRDs - pros/cons Open

automation validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#180 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
DI-38: Document AAD specific IdP SSO only federation creation a GCP Identity stub account pair post sync Open

automation azure validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#182 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Add 4th/5th group for logwriter/logreader - or change docs to use the audit group Open

developer-experience

GoogleCloudPlatform/pubsec-declarative-toolkit#186 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Add dev deployment.sh for KCC cluster CD create/delete and LZ initial deployment/delete with canary Open

arete automation delete developer-experience

GoogleCloudPlatform/pubsec-declarative-toolkit#192 · 10 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Add lz git section - part iii second part after CSR service - CSR itself - apply instructions Open

automation bug developer-experience documentation

GoogleCloudPlatform/pubsec-declarative-toolkit#195 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Handle Asset Inventory caching up to 12h deleted services like the anthos KCC cluster Open

GoogleCloudPlatform/pubsec-declarative-toolkit#197 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Validate access context manager scoped policies for folders/projects is also CC/CRM supported as it is in the GCP API Open

automation bug validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#205 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Add KCC yakima service account as Billing Account User for shared billing account in deployment.sh with 60 sec sleep - to avoid project/billing association error on 5 projects Open

arete automation validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#207 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Org Policy: constraints/gcp.resourceLocations and constraints/storage.publicAccessPrevention fails to set when already set as Google Managed Default Open

arete automation validate_with_v2

GoogleCloudPlatform/pubsec-declarative-toolkit#208 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Document landing-zone deletion via kpt live destroy landing-zone Open

arete automation delete

GoogleCloudPlatform/pubsec-declarative-toolkit#209 · 5 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Disable 5 projects before attempting delete via "kpt live destroy" to remove liens - or delete the liens Open

arete automation delete

GoogleCloudPlatform/pubsec-declarative-toolkit#211 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
kpt live destroy landing-zone - leaves deleted project/billing intact - eventually filling shared billing quota - disassociate billing before deleting the projects Open

arete automation

GoogleCloudPlatform/pubsec-declarative-toolkit#212 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Canary onboarding: SaaS use case: Add KCC/Gcloud deployment options limited roles around BigQuery/AutoML/DocumentAI Open

developer-experience

GoogleCloudPlatform/pubsec-declarative-toolkit#220 · 7 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Automate GCP Cloud Identity account creation/provisioning as part of the Guardrails and Landing Zone for non IdP federation - like we do in www.cloudskillsboost.google Open

enhancement

GoogleCloudPlatform/pubsec-declarative-toolkit#225 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Compliance: verify GCS bucket to bucket private transfer across organizations without using shared org admin role or VPC peering Open

compliance

GoogleCloudPlatform/pubsec-declarative-toolkit#231 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 16, 2026

GoogleCloudPlatform/pubsec-declarative-toolkit

Get new issues in your inbox