Google Cloud
lnk-gcp is the Google Cloud adapter: accounts, buckets, boxes and
images on Google Cloud, through gcloud. lnk cloud, lnk box and lnk bucket run it by the cloud contract
(Cloud Adapters);
nobody types it.
What it answers
connect and tunnel, and on stdin every command of the contract but
delete-objects: storage, forget, defaults, sizes, launch,
wait, start, stop, state, describe, remove, hostkeys,
cleanup, save-hostkeys, add-key, remove-keys, tag, list, label,
buckets, upload-once, object-read, bucket-key, revoke-key,
image-save, image-list and image-remove (main.rs's COMMANDS).
An account
lnk-gcp connect connects a Google Cloud account as one credential
file that gcloud, rclone and Google's libraries all act as (connect.rs).
The credential file
A service account's key (--credential-file), or your own login's application
default credentials (gcloud auth application-default login, once).
The file is kept in Link's settings (gcp/credentials/<name>.json,
only yours), so every part of Link using the account is the same
identity.
Its flags
lnk cloud connect gcp passes its flags on: one type, read from flags
or a file alike (flags.rs, link_plugin::spec).
Its CLI
When boxes need gcloud and it's missing, it installs it for you from
Google's own archive at dl.google.com, unpacked into Link's settings
folder (~/.lnk/gcp), for you only: no administrator rights, and its
installer runs without touching your shell's settings (install.rs).
Boxes
Each box is a Compute Engine instance of Ubuntu LTS in the default
network, named lnk-<box id> and labelled with its name, ID and owner
(boxes.rs).
Its keys
It's reached over SSH with Link's certificates, which its first boot
trusts, and is made with no key in its ssh-keys metadata. Another
computer's key is merged in there while the box is made to trust that
computer's certificates, and remove-keys takes Link's out again. The
host keys its first boot pinned are kept in its metadata too,
lnk-host-keys.
Its firewall rules
Link makes two firewall rules per project for machines tagged
lnk-box, shared by its boxes and deleted with the last one:
lnk-box-ssh lets SSH in, and lnk-box-deny refuses everything else,
ahead of the default network's own rules, which let in every port from
inside the network, RDP and ping.
A box that ends itself
It gets its own job identity, granted only on its VM, and its cloud
deadline in its first boot; the identities are reclaimed once their VM
is gone (boxes/ending.rs).
What it attaches
Resources a box uses that it doesn't own are looked up and attached
only, never created or deleted (attachments.rs).
Images
An image is lnk-<name> in the account's project, labelled
lnk-image=<name> and lnk-owner=<owner>, and lnk-hash=<hash> when
it's saved with a hash (images.rs).
Where an image lives
An image is the whole project's, so a box from it can be in any zone. Only the project's own images are ever used or deleted.
Buckets
Bucket labels are Link's labels, and a key reaching only one bucket is
a service account of its own (lnk-<...>) given
roles/storage.objectAdmin on that bucket and nothing else
(buckets.rs).
Prices
What Google charges in a region, from its Cloud Billing Catalog API
(services/<Compute Engine>/skus, reached with the account's own
gcloud sign-in, as the API has no gcloud command): each machine
type's on-demand price an hour, from its family's core and memory
rates, a GB-month of a balanced and an SSD persistent disk, and an
external address an hour (prices.rs).
How often
Read once a while (link_cloud_contract::prices::cached); a machine
type whose family's rates aren't there, or with GPUs, gives none, never
a guess.