gcloud compute networks peerings create peer-ab \
    --network=network-a \
    --peer-network=network-b

gcloud compute routers nats create my-nat \
    --router=my-router \
    --region=us-central1 \
    --nat-all-subnet-ip-ranges

gcloud compute security-policies create my-policy
gcloud compute security-policies rules create 1000 \
    --security-policy=my-policy \
    --expression="origin.region_code == 'US'" \
    --action=allow

title: "Custom Storage Admin"
description: "Custom role for storage"
stage: "GA"
includedPermissions:
- storage.buckets.create
- storage.buckets.delete
- storage.objects.create

gcloud iam roles create customStorageAdmin \
    --project=PROJECT_ID \
    --file=role.yaml

# Create
gcloud iam service-accounts create my-sa

# Grant role
gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:my-sa@PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/storage.admin"

# Create key
gcloud iam service-accounts keys create key.json \
    --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com

gcloud sql instances create my-instance \
    --database-version=POSTGRES_14 \
    --tier=db-n1-standard-2 \
    --region=us-central1 \
    --availability-type=REGIONAL

CREATE TABLE Users (
    UserId INT64 NOT NULL,
    Name STRING(100),
) PRIMARY KEY (UserId);

CREATE TABLE dataset.table
PARTITION BY DATE(timestamp)
AS SELECT * FROM source_table;

-- Query specific partition
SELECT * FROM dataset.table
WHERE DATE(timestamp) = '2024-01-01';

CREATE TABLE dataset.table
PARTITION BY DATE(timestamp)
CLUSTER BY user_id, country
AS SELECT * FROM source_table;

// HTTP trigger
exports.helloHttp = (req, res) => {
    res.send('Hello World!');
};

// Pub/Sub trigger
exports.helloPubSub = (message, context) => {
    const data = Buffer.from(message.data, 'base64').toString();
    console.log(data);
};

// Cloud Storage trigger
exports.helloGCS = (file, context) => {
    console.log(`File: ${file.name}`);
};

gcloud run deploy my-service \
    --image=gcr.io/PROJECT_ID/image \
    --min-instances=0 \
    --max-instances=100 \
    --concurrency=80

# Autopilot
gcloud container clusters create-auto my-cluster

# Standard
gcloud container clusters create my-cluster \
    --num-nodes=3 \
    --machine-type=n1-standard-2

# Enable on cluster
gcloud container clusters update CLUSTER \
    --workload-pool=PROJECT_ID.svc.id.goog

# Bind accounts
gcloud iam service-accounts add-iam-policy-binding \
    GSA_NAME@PROJECT_ID.iam.gserviceaccount.com \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"

displayName: "High CPU Alert"
conditions:
  - displayName: "CPU > 80%"
    conditionThreshold:
      filter: 'resource.type="gce_instance"'
      comparison: COMPARISON_GT
      thresholdValue: 0.8
      duration: 300s
notificationChannels:
  - projects/PROJECT_ID/notificationChannels/CHANNEL_ID

gcloud logging sinks create my-sink \
    bigquery.googleapis.com/projects/PROJECT_ID/datasets/DATASET \
    --log-filter='resource.type="gce_instance"'

gcloud compute backend-services update my-backend \
    --enable-cdn \
    --cache-mode=CACHE_ALL_STATIC

gcloud compute instance-groups managed create my-mig \
    --template=my-template \
    --size=3 \
    --zone=us-central1-a

# Autoscaling
gcloud compute instance-groups managed set-autoscaling my-mig \
    --max-num-replicas=10 \
    --target-cpu-utilization=0.6

gcloud scheduler jobs create http my-job \
    --schedule="0 */2 * * *" \
    --uri="https://example.com/api" \
    --http-method=POST

# Create secret
echo -n "my-secret-value" | gcloud secrets create my-secret \
    --data-file=-

# Access in code
from google.cloud import secretmanager
client = secretmanager.SecretManagerServiceClient()
name = "projects/PROJECT_ID/secrets/my-secret/versions/latest"
response = client.access_secret_version(request={"name": name})
secret = response.payload.data.decode("UTF-8")

# Enable in host project
gcloud compute shared-vpc enable HOST_PROJECT

# Attach service project
gcloud compute shared-vpc associated-projects add SERVICE_PROJECT \
    --host-project=HOST_PROJECT

gcloud access-context-manager perimeters create my-perimeter \
    --title="Production Perimeter" \
    --resources=projects/PROJECT_ID \
    --restricted-services=storage.googleapis.com,bigquery.googleapis.com

# Disable serial port access
constraint: compute.disableSerialPortAccess
listPolicy:
  allValues: DENY

gcloud resource-manager org-policies set-policy policy.yaml \
    --organization=ORG_ID

gcloud compute routers create my-router \
    --network=my-network \
    --region=us-central1 \
    --asn=65001

gcloud container binauthz policy import policy.yaml

# Attestation
gcloud beta container binauthz attestations create \
    --artifact-url=gcr.io/PROJECT_ID/image@sha256:DIGEST \
    --attestor=my-attestor

apiVersion: networking.gke.io/v1
kind: MultiClusterIngress
metadata:
  name: my-mci
spec:
  template:
    spec:
      backend:
        serviceName: my-service
        servicePort: 80

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: my-vpa
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-deployment
  updatePolicy:
    updateMode: "Auto"

from airflow import DAG
from airflow.operators.bash import BashOperator

dag = DAG('my_dag', schedule_interval='@daily')

task = BashOperator(
    task_id='my_task',
    bash_command='echo "Hello"',
    dag=dag
)

import apache_beam as beam

with beam.Pipeline() as p:
    (p
     | beam.io.ReadFromText('gs://bucket/input.txt')
     | beam.Map(lambda x: x.upper())
     | beam.io.WriteToText('gs://bucket/output.txt'))

from google.cloud import pubsub_v1

publisher = pubsub_v1.PublisherClient()
topic_path = publisher.topic_path('PROJECT_ID', 'TOPIC')

future = publisher.publish(
    topic_path,
    b'Message data',
    ordering_key='user-123'
)

gcloud pubsub subscriptions create my-subscription \
    --topic=my-topic \
    --dead-letter-topic=dead-letter-topic \
    --max-delivery-attempts=5

from google.cloud import tasks_v2

client = tasks_v2.CloudTasksClient()
parent = client.queue_path('PROJECT_ID', 'LOCATION', 'QUEUE')

task = {
    'http_request': {
        'http_method': tasks_v2.HttpMethod.POST,
        'url': 'https://example.com/api',
    }
}

client.create_task(request={'parent': parent, 'task': task})

# cloudbuild.yaml
steps:
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', 'gcr.io/$PROJECT_ID/image', '.']
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'gcr.io/$PROJECT_ID/image']
  - name: 'gcr.io/cloud-builders/gcloud'
    args: ['run', 'deploy', 'my-service', '--image', 'gcr.io/$PROJECT_ID/image']

# Create repository
gcloud artifacts repositories create my-repo \
    --repository-format=docker \
    --location=us-central1

# Push image
docker tag my-image us-central1-docker.pkg.dev/PROJECT_ID/my-repo/my-image
docker push us-central1-docker.pkg.dev/PROJECT_ID/my-repo/my-image

import googlecloudprofiler

googlecloudprofiler.start(
    service='my-service',
    service_version='1.0.0',
    verbose=3
)

from google.cloud import trace_v1

client = trace_v1.TraceServiceClient()
project_id = 'PROJECT_ID'

trace = {
    'project_id': project_id,
    'spans': [...]
}
client.patch_traces(project_id=project_id, traces={'traces': [trace]})

gcloud compute commitments create my-commitment \
    --region=us-central1 \
    --plan=12-month \
    --resources=vcpu=100,memory=400GB

gcloud compute instances create my-instance \
    --preemptible \
    --maintenance-policy=TERMINATE

# Traffic Director for global load balancing
apiVersion: networking.gke.io/v1
kind: MultiClusterService
metadata:
  name: my-service
spec:
  template:
    spec:
      selector:
        app: my-app
      ports:
      - port: 80
  clusters:
  - link: "us-central1/my-cluster"
  - link: "europe-west1/my-cluster"