Google Cloud: Projects, Compute, Networking and Containers with gcloud
Exit

Lesson 1 of 9 · Fundamentals

Google Cloud: projects, organization, billing, console and gcloud

40 min Debian 12

Objective

Understand how Google Cloud organizes resources (organization, folders, projects) and how money flows (billing account). Choose a region for a Moroccan customer. Then manage everything with the console, Cloud Shell and gcloud.

General cloud concepts (service models, shared responsibility, elasticity, costs) are covered in the "Cloud" (fundamentals) course. If you already know AWS or Azure, the big difference in Google Cloud is the central role of the project.

Key points

  • The project is the basic unit: every resource (VM, bucket, Cloud Run service) belongs to one project. It has a globally unique ID (boutique-atlas-prod), a display name and a number.
  • Above it: folders and the organization (linked to a Google Workspace or Cloud Identity domain, for example boutiqueatlas.ma). IAM permissions and organization policies are inherited downwards.
  • A billing account pays for one or more projects. A project without a billing account can only use free services.
  • Before you use a service, you must enable its API in the project (gcloud services enable).
  • There is no Google Cloud region in Morocco at the moment. The closest are europe-southwest1 (Madrid) and europe-west9 (Paris).

1. The resource hierarchy

Organisation : boutiqueatlas.ma
├── Dossier « Production »
│   ├── Projet boutique-atlas-prod       ← site web, base, stockage
│   └── Projet reseau-partage-prod       ← VPC partagé, VPN
└── Dossier « Hors-production »
    └── Projet boutique-atlas-dev

(Organisation = organization, Dossier = folder, Projet = project; the production project hosts the website, database and storage; the shared network project hosts the shared VPC and the VPN.)

Level Role Note
Organization root, linked to the company's domain created with Google Workspace or Cloud Identity (a free edition is available)
Folder groups projects (by department, by environment, by customer) can contain other folders
Project container for resources, enabled APIs and quotas the ID is permanent and globally unique
Resource VM, bucket, Pub/Sub topic… belongs to a single project

Without an organization (personal Gmail account), your projects are "without organization". This is fine for learning, but a company needs the organization to centralize permissions, policies and billing.

ID, name and number

ID du projet     : boutique-atlas-prod     (choisi par vous, 6 à 30 caractères, définitif)
Nom du projet    : Boutique Atlas Prod     (libre, modifiable)
Numéro du projet : 412345678901            (attribué par Google)

(Project ID: chosen by you, 6 to 30 characters, permanent. Project name: free text, can be changed. Project number: assigned by Google.)

The ID appears in URLs, in service account names (…@boutique-atlas-prod.iam.gserviceaccount.com) and in commands. Choose it carefully: you cannot rename it.

2. Billing

  • A Cloud Billing account holds the payment method (international bank card, or monthly invoicing for eligible companies). Its ID looks like 01A2B3-C4D5E6-F7A8B9.
  • One billing account can pay for several projects. A project is linked to only one account at a time.
  • New accounts usually get a free trial credit and a free tier (a small e2-micro VM in some US regions, a few GB of storage…). The terms change: check them on the official page.
  • Create budgets with alerts from day one (lesson 3.1).
gcloud billing accounts list
gcloud billing projects link boutique-atlas-prod --billing-account=01A2B3-C4D5E6-F7A8B9
gcloud billing projects describe boutique-atlas-prod   # billingEnabled: true

3. Regions and zones

A region (europe-southwest1, Madrid) contains several zones (europe-southwest1-a, -b, -c). Some resources are zonal (VMs, zonal persistent disks), others are regional (subnets, Cloud Run, regional disks), and others are global (VPC networks, images, firewall rules).

Criterion What to check
latency to Morocco Madrid and Paris are the closest
availability of services and machine types not all of them are available everywhere
price it varies by region
legal requirements law 09-08 on personal data; CNDP opinion for some transfers
carbon footprint Google flags low-emission regions 
gcloud compute regions list
gcloud compute zones list --filter="region:europe-southwest1"

4. The console and Cloud Shell

The console (console.cloud.google.com) lets you do everything with clicks. Useful landmarks:

  • the project selector at the top: always check it before you act;
  • APIs & Services: enable an API;
  • IAM & Admin: permissions, service accounts, quotas;
  • Billing: reports, budgets;
  • the Activate Cloud Shell icon opens a terminal.

Cloud Shell is a small, free Debian VM that is already authenticated. It includes gcloud, kubectl, terraform, docker, git and a code editor. Your home directory (5 GB) is kept between sessions. It is the ideal tool to follow this course from any computer.

5. gcloud on your computer

The Google Cloud CLI contains gcloud, gsutil (the legacy storage tool, replaced by gcloud storage) and bq (BigQuery).

gcloud init                       # wizard: sign-in, project, default region
gcloud auth login                 # sign in (opens the browser)
gcloud auth list                  # signed-in accounts
gcloud config list                # active configuration
gcloud projects list
gcloud components update          # update (archive-based installation)

Default values

gcloud config set project boutique-atlas-prod
gcloud config set compute/region europe-southwest1
gcloud config set compute/zone europe-southwest1-a
gcloud config get-value project
gcloud config unset compute/zone

Several configurations

A consultant at an IT services company in Rabat works for three customers. One named configuration per customer prevents mistakes.

gcloud config configurations create client-boutique
gcloud config set account consultant@esn.ma
gcloud config set project boutique-atlas-prod
gcloud config configurations list
gcloud config configurations activate client-ecole
gcloud compute instances list --project=autre-projet   # force a project for ONE command

Command structure

gcloud [GROUPE ...] RESSOURCE  ACTION  [NOM]  --options
gcloud compute      instances  create  web-01 --machine-type=e2-medium
gcloud storage      buckets    list
gcloud run          services   describe site

(GROUPE = group, RESSOURCE = resource, NOM = name.)

gcloud help compute instances create or --help shows the help. gcloud beta … and gcloud alpha … give access to preview features.

Formats and filters

gcloud compute instances list --format="table(name, zone.basename(), status)"
gcloud compute instances list --filter="status=RUNNING AND labels.env=prod"
gcloud projects describe boutique-atlas-prod --format="value(projectNumber)"   # raw value
gcloud compute instances list --format=json | jq '.[].name'

--format=value(...) is the equivalent of Azure's --output tsv: ideal for a shell variable.

6. APIs and quotas

Each service is an API that you enable per project. An error such as "API has not been used in project … or it is disabled" simply means you must enable it.

gcloud services list --enabled
gcloud services enable compute.googleapis.com run.googleapis.com
gcloud services disable bigquery.googleapis.com

Quotas (number of vCPUs per region, IP addresses…) protect your bill and the platform. You request an increase from the console (IAM & Admin → Quotas).

7. Labels

gcloud compute instances update web-01 --update-labels=env=prod,projet=boutique

Labels (lowercase letters, digits, _ and -) appear in the billing export. They help you answer "how much does the shop cost in production?". Do not confuse them with network tags (lesson 1.4) or with resource tags managed at the organization level.

8. Shutting down a project

gcloud projects delete boutique-atlas-dev

The project is shut down: all its resources stop running and stop costing money, and it is permanently deleted after 30 days. During this period, gcloud projects undelete restores it. Deleting a test project is the best way to be sure you have not forgotten anything.

Common pitfalls

  • Working in the wrong project: check gcloud config get-value project (or the console selector) before every important operation.
  • Choosing a project ID that is too generic, or that contains the name of a customer you might lose: it is permanent.
  • Forgetting to link billing: VM creation fails with a billing error.
  • Thinking a deleted project disappears immediately: it remains for 30 days, and its ID cannot be reused.

Lab

You write the bootstrap script for the Boutique Atlas production project: project creation, billing link, default values (Madrid), API activation, then a small file that summarizes the resource hierarchy. The lab has no network and no gcloud: the script is the one you would run in Cloud Shell.

cat /root/gcp/01-projet.sh
sh -n /root/gcp/01-projet.sh     # check the syntax without running it

Quiz

  1. What is the basic unit that contains resources in Google Cloud?
  2. Can you rename a project ID?
  3. What must you do before you use Compute Engine in a new project?
  4. Which gcloud option returns a raw value, without a table?
  5. What happens to a deleted project during the first 30 days?
Answers
  1. The project.
  2. No: the ID is permanent (only the display name can be changed).
  3. Link it to a billing account and enable the API compute.googleapis.com.
  4. --format="value(field)".
  5. It is shut down (no more service, no more costs) and can be restored with gcloud projects undelete; after that, it is permanently deleted.

Reference sources: Google Cloud documentation (CC BY 4.0) — Compute Engine, gcloud, IAM, locations. Original MasterLinux text.

Practical exercises

To do on Debian 12

The online terminal is coming soon. Meanwhile, do these tasks on your own Linux machine, a virtual machine or WSL.

  1. Create /root/gcp/01-projet.sh. First line #!/bin/sh; second line: the command that creates the project with ID boutique-atlas-prod and display name "Boutique Atlas Prod".
    Show a hintgcloud projects create ID --name="Display name"
    Show the solution
    mkdir -p /root/gcp && printf "%s\n" "#!/bin/sh" "gcloud projects create boutique-atlas-prod --name=\"Boutique Atlas Prod\"" > /root/gcp/01-projet.sh

    Check : f=/root/gcp/01-projet.sh; [ "$(head -n1 $f)" = "#!/bin/sh" ] && grep -E "^gcloud projects create boutique-atlas-prod" $f | grep -Eq -- "--name[= ]\"?Boutique Atlas Prod\"?"

  2. Add the command that links the project to the billing account 01A2B3-C4D5E6-F7A8B9.
    Show a hintgcloud billing projects link PROJECT --billing-account=…
    Show the solution
    echo "gcloud billing projects link boutique-atlas-prod --billing-account=01A2B3-C4D5E6-F7A8B9" >> /root/gcp/01-projet.sh

    Check : grep -E "^gcloud billing projects link boutique-atlas-prod" /root/gcp/01-projet.sh | grep -Eq -- "--billing-account[= ]01A2B3-C4D5E6-F7A8B9"

  3. Add three gcloud config set lines: the default project boutique-atlas-prod, the region europe-southwest1 (Madrid) and the zone europe-southwest1-a.
    Show a hintgcloud config set project … ; gcloud config set compute/region … ; gcloud config set compute/zone …
    Show the solution
    printf "%s\n" "gcloud config set project boutique-atlas-prod" "gcloud config set compute/region europe-southwest1" "gcloud config set compute/zone europe-southwest1-a" >> /root/gcp/01-projet.sh

    Check : f=/root/gcp/01-projet.sh; grep -Eq "^gcloud config set (core/)?project boutique-atlas-prod$" $f && grep -Eq "^gcloud config set compute/region europe-southwest1$" $f && grep -Eq "^gcloud config set compute/zone europe-southwest1-a$" $f

  4. Enable the Compute Engine and Cloud Run APIs (compute.googleapis.com and run.googleapis.com) in a single gcloud services enable command.
    Show a hintgcloud services enable API1 API2
    Show the solution
    echo "gcloud services enable compute.googleapis.com run.googleapis.com" >> /root/gcp/01-projet.sh

    Check : l=$(grep -E "^gcloud services enable" /root/gcp/01-projet.sh) && echo "$l" | grep -q "compute.googleapis.com" && echo "$l" | grep -q "run.googleapis.com"

  5. Write /root/gcp/hierarchie.txt: the levels of the resource hierarchy, from highest to lowest, one per line, using exactly these (French) words: organisation, dossier, projet, ressource.
    Show a hintThe organization (organisation) contains folders (dossier), which contain projects (projet).
    Show the solution
    printf "%s\n" organisation dossier projet ressource > /root/gcp/hierarchie.txt

    Check : printf "organisation\ndossier\nprojet\nressource\n" | cmp -s - /root/gcp/hierarchie.txt

Official references consulted: Présentation de Compute Engine — https://docs.cloud.google.com/compute/docs/overview ; Utiliser gcloud compute — https://docs.cloud.google.com/compute/docs/gcloud-compute ; Noms de ressources complets (IAM) — https://docs.cloud.google.com/iam/docs/full-resource-names ; Emplacements des buckets Cloud Storage — https://docs.cloud.google.com/storage/docs/locations. Original MasterLinux text.