Demo: Script: Automated minimal landing zone with a (hub-env and core-landing-zone, client-setup, client-landing-zone, client-project-setup) GitOps/OCI based deployment on a clean GCP organization - walkthrough

see
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps

## Base architecture with GCP native firewalls
Cluster with 4 packages clz + 4 client

## Extended version with Fortigate NGFW
including projects/hub-env package

```mermaid
graph LR;
style LZV2 fill:#44f,stroke:#f66,stroke-width:2px,color:#fff,stroke-dasharray: 5 5
%% mapped and documented
project/hub-env-->core-landing-zone;
client-setup;
client-setup-->dns-project;
client-setup-->kcc-management-project;
client-landing-zone-->client-setup;
client-project-setup-->client-landing-zone;
client-project-setup-->client-management-project;
gatekeeper-policies;

kcc-management-project;
core-landing-zone-->kcc-management-project;
dns-project-->core-landing-zone;
logging-project-->core-landing-zone;
client-management-project-->client-setup;
host-project-->client-landing-zone;

```
[mermaid - diagrams as code](https://mermaid-js.github.io/mermaid/#/flowchart?id=graph)

## Issues
- 20240220: investigate policy based routing for the hub-env package VPC - https://cloud.google.com/vpc/docs/policy-based-routes
- - refer to https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/494
- https://github.com/fortinet/fortigate-tutorial-gcp/issues/5
- #799
- #801
- #802
- #823
- #824
- https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/842
- #847

## Infrastructure
- admin-root nuage-cloud or = cloud foundation checklist
- root landing.systems = hub-env 446 (cluster deleted - infra up including 3 fortigate VMs in hub-env)
- mic obrienlabs.eng = manual lz coding
- mic cloud-setup or = automated lz coding - 4 core/client packages up
- mic obr.ind - previous hub-env, lz only - (cluster deleted 20240217) manual
- branch https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/gh766-script
- wiki https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps
- review alternative approach using https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-firewall-plus-with-intrusion-prevention

Follow docs starting at https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/docs/landing-zone-v2#3-deploy-the-infrastructure-using-gitops
Follow wiki - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps#landing-zone-install
Follow triage - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps#workaroundstriage

Update https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps#monorepo-lz
Follow monorepo instructions from SSC around the hydration script (wraps kpt fn render)
- https://github.com/ssc-spc-ccoe-cei/gcp-documentation/blob/main/Landing%20Zone%20Operations/Building.md
- Tier1 https://github.com/ssc-spc-ccoe-cei/gcp-documentation/blob/main/Landing%20Zone%20Operations/Changing.md#step-3---hydrate
- Tier2 https://github.com/ssc-spc-ccoe-cei/gcp-documentation/blob/main/Onboarding/Client.md
- Tier34 https://github.com/ssc-spc-ccoe-cei/gcp-documentation/blob/main/Onboarding/Application.md

This is the OCI (repo tracking) version of deployment - not the minimal KPT based deployment in #611

## Architecture
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Architecture
###

## Inventory
### Package: core-landing-zone

### Package: client-setup

### Package: client-landing-zone

### Package: client-project-setup

### Package: projects/hub-env
- IaaS security - not serverless Firewall Plus

### Package: gatekeeper-policies

## Minimal Landing Zone from a clean GCP organization using a single script - use for development or CI/CD

**FinOps:** PAYG + GKE + GCE costs will be $80/day above the normal $10/day for the GKE cluster alone.

This jira will document standing up a subset of the full landing zone consisting of the following 2 packages in a clean org
References
- #446
- #258
- repo diff https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/pull/612

See ongoing documentation in
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps#landing-zone-user-procedures

- see https://cloud.google.com/architecture/managing-cloud-infrastructure-using-kpt#delete_the_resources
- see https://cloud.google.com/config-connector/docs/how-to/managing-deleting-resources
- see https://cloud.google.com/anthos-config-management/docs/tutorials/manage-resources-config-controller#delete_the_individual_resources
-
# Clean Organization
- see onboarding at https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Onboarding
# Clean super admin

The super admin account will have the organization administrator role and be able to create projects through the project creator role on the organization (all users inherit this and we will lock it down later)

## Launch shell.cloud.google.com
navigate to https://shell.cloud.google.com

By default the user is an Organization Administrator
We will add required roles to get the point of creating a bootstrap project and then let the landing zone setup script take over adding roles required for LZ bootstrap.

For those customers on direct billing - activate your credits

## 5 billing projects required
Prepare for increasing billing quota above 5 projects by paying early $50 and asking for a billing quota increase 2 days later - for how use shared billing to go past 5. For the purposes of the core-landing-zone and hub-env you need 1 bootstrap project, 1 config controller project, a logging and dns project and a hub project. Therefore disable billing on "My first project" to have all 5 for now.

follow instructions to increase your billing account quota to above 10 (I asked for 10 in addition to the default 5) using our instructions below

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Onboarding#billing-quota
fill out
https://support.google.com/code/contact/billing_quota_increase

Usually you are approved within 60 seconds

license key config
https://github.com/fortinetsolutions/terraform-modules/blob/master/GCP/modules/fortigate_byol/main.tf#L33

see also
https://cloud.google.com/architecture/managing-cloud-infrastructure-using-kpt