Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara membuat project air-gapped Google Distributed Cloud (GDC) untuk
mengelompokkan resource Anda dalam organisasi. Project menyediakan batas kebijakan dan siklus proses untuk resource, sehingga memungkinkan beberapa grup pengguna mengelola resource GDC secara terpisah.
Halaman ini ditujukan bagi audiens seperti administrator IT, engineer keamanan, dan administrator jaringan dalam grup administrator platform, yang bertanggung jawab untuk mengelola resource dalam organisasi mereka. Untuk mengetahui informasi selengkapnya, lihat dokumentasi Audiens untuk GDC yang terisolasi dari internet.
Sebelum memulai
Untuk mendapatkan izin yang diperlukan untuk membuat project, minta Admin IAM Organisasi Anda untuk memberi Anda peran Project Creator (project-creator).
Sebelum membuat project, tinjau informasi yang digunakan Google Distributed Cloud (GDC) air-gapped untuk mengidentifikasi project Anda:
Nama project: Nama project yang dapat dibaca manusia.
Nama project tidak digunakan oleh API GDC mana pun. Anda dapat
mengedit nama project kapan saja selama atau setelah pembuatan project. Nama
project tidak harus unik.
Project memiliki persyaratan nama berikut:
Panjangnya 4 hingga 30 karakter.
Berisi huruf, angka, tanda petik tunggal, tanda hubung, spasi, atau tanda seru.
Project ID: ID unik global untuk project Anda.
Project ID adalah string unik yang digunakan untuk membedakan project Anda dari
project lain di GDC. Anda hanya dapat mengubah project ID
saat membuat project.
ID project memiliki persyaratan berikut:
Terdiri dari 6 hingga 30 karakter.
Berisi huruf kecil, angka, dan tanda hubung.
Dimulai dengan huruf.
Tidak boleh dimulai dengan awalan g-, seperti g-project.
Tidak boleh diakhiri dengan tanda hubung.
Tidak boleh diakhiri dengan string -cluster atau -system. Sufiks -system dicadangkan untuk
project yang dibuat oleh GDC.
Tidak boleh sedang digunakan atau pernah digunakan; hal ini mencakup project yang dihapus.
Jangan sertakan informasi sensitif dalam nama project, project ID, atau nama resource lainnya. ID project digunakan dalam nama banyak resource GDC lainnya, dan setiap referensi ke project atau resource terkait akan mengekspos ID project dan nama resource.
Membuat project baru
Anda dapat membuat project untuk menyediakan pengelompokan logis resource layanan. Misalnya, Anda dapat membuat project terpisah untuk menyimpan resource untuk lingkungan pengembangan, pengujian, dan produksi.
Untuk mendapatkan izin yang Anda perlukan untuk membuat project, minta Admin IAM Organisasi Anda untuk memberi Anda peran Project Creator. Untuk mengetahui informasi selengkapnya tentang pemberian izin, lihat bagian Tetapkan binding peran ke identitas layanan.
Konsol
Untuk membuat project baru menggunakan konsol GDC, selesaikan langkah-langkah berikut:
Di menu navigasi, klik Projects.
Klik Tambahkan project.
Di kolom Project name, masukkan nama project.
Klik Lanjutkan.
Opsional: Konfigurasi kemampuan jaringan project Anda. Hapus centang pada kotak Aktifkan perlindungan dari pencurian data untuk menonaktifkan semua traffic keluar ke project lain di dalam organisasi Anda.
Klik Lanjutkan.
Di bagian Tinjau, tinjau ringkasan, lalu klik Buat.
Untuk memverifikasi bahwa project baru tersedia, pesan akan ditampilkan di
konsol: Project PROJECT_NAME
successfully created.
Tautkan project baru Anda
dengan akun penagihan. Untuk melacak biaya resource project, Anda harus memiliki akun penagihan terkait yang ditautkan ke project Anda.
gdcloud
Untuk membuat project baru menggunakan gdcloud CLI, selesaikan langkah-langkah berikut:
Pastikan Anda telah menginstal gdcloud CLI. Untuk mengetahui informasi selengkapnya, lihat halaman Ringkasan gcloud CLI.
Untuk membuat project, jalankan:
gdcloudprojectscreatePROJECT_ID
Ganti PROJECT_ID dengan ID unik untuk project baru Anda.
Untuk memverifikasi bahwa project baru tersedia, jalankan:
gdcloudprojectslist
Tautkan project baru Anda
dengan akun penagihan. Untuk melacak biaya resource project, Anda harus memiliki akun penagihan terkait yang ditautkan ke project Anda.
API
Untuk membuat project baru menggunakan API secara langsung, selesaikan langkah-langkah berikut:
Tetapkan variabel lingkungan untuk file kubeconfig server API pengelolaan global:
exportKUBECONFIG=GLOBAL_API_SERVER_KUBECONFIG
Jika Anda tidak memiliki file kubeconfig server API pengelolaan global, buat file tersebut.
Ganti PROJECT_ID dengan ID unik untuk project baru Anda.
Pastikan project baru tersedia:
kubectl--kubeconfig=${KUBECONFIG}getnamespaces
Tautkan project baru Anda
dengan akun penagihan. Untuk melacak biaya resource project, Anda harus memiliki akun penagihan terkait yang ditautkan ke project Anda.
Terraform
Untuk membuat project baru menggunakan Terraform, selesaikan langkah-langkah berikut:
Pastikan Anda telah mengonfigurasi Terraform dan menetapkan izin yang sesuai.
Untuk mengetahui informasi selengkapnya, lihat halaman
Mengonfigurasi Terraform.
Di file konfigurasi Terraform, masukkan cuplikan kode berikut:
Ganti GLOBAL_API_SERVER_KUBECONFIG dengan jalur ke
file kubeconfig server API pengelolaan global. Jika Anda tidak memiliki
file kubeconfig ini,
buat file tersebut.
Dalam file konfigurasi Terraform, seperti main.tf, masukkan
cuplikan kode berikut:
Ganti PROJECT_ID dengan ID unik untuk project baru Anda.
Terapkan project baru menggunakan Terraform:
terraformapply
Tautkan project baru Anda
dengan akun penagihan. Untuk melacak biaya resource project, Anda harus memiliki akun penagihan terkait yang ditautkan ke project Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eProjects group resources within an organization, establishing a lifecycle and policy boundary.\u003c/p\u003e\n"],["\u003cp\u003eEach project requires a unique Project ID, which must be 6-30 characters long, contain lowercase letters, numbers, and hyphens, start with a letter, and not end with a hyphen, \u003ccode\u003e-cluster\u003c/code\u003e, or \u003ccode\u003e-system\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eProject names are human-readable, can be edited anytime, do not need to be unique, and must be between 4 to 30 characters in length.\u003c/p\u003e\n"],["\u003cp\u003eYou can create projects using the GDC console, the gdcloud CLI, directly via the API, or with Terraform.\u003c/p\u003e\n"],["\u003cp\u003eAfter creating a project, it is necessary to link it to a billing account to monitor project resource costs.\u003c/p\u003e\n"]]],[],null,["# Create a project\n\nThis page explains how to create a Google Distributed Cloud (GDC) air-gapped project for\ngrouping your resources together within an organization. Projects provide a\nlifecycle and policy boundary for resources, allowing for multiple groups of\nusers to manage GDC resources separately.\n\nThis page is for audiences such as IT administrators, security engineers, and\nnetwork administrators within the platform administrator group, who are\nresponsible for managing resources within their organization. For more information,\nsee [Audiences for GDC air-gapped documentation](/distributed-cloud/hosted/docs/latest/gdch/resources/audiences).\n\nBefore you begin\n----------------\n\nTo get the permissions needed to create a project, ask your Organization\nIAM Admin to grant you the Project Creator role (`project-creator`).\n\nBefore you create a project, review the information Google Distributed Cloud (GDC) air-gapped\nuses to identify your project:\n\n- **Project name**: A human-readable name for your project.\n\n The project name isn't used by any GDC APIs. You can\n edit the project name at any time during or after project creation. Project\n names don't need to be unique.\n\n Projects have the following name requirements:\n - 4 to 30 characters in length.\n - Contains letters, numbers, single quotes, hyphens, spaces, or exclamation points.\n- **Project ID**: A globally unique identifier for your project.\n\n A project ID is a unique string used to differentiate your project from all\n others in GDC. You can only modify the project ID\n when you're creating the project.\n | **Note:** The namespaces propagated by a project are the same as the project ID.\n\n Project IDs have the following requirements:\n - 6 to 30 characters in length.\n - Contains lowercase letters, numbers, and hyphens.\n - Starts with a letter.\n - Must not start with the prefix `g-`, such as `g-project`.\n - Must not end with a hyphen.\n - Must not end with the string `-cluster` or `-system`. The `-system` suffix is reserved for projects created by GDC.\n - Must not be in use or previously used; this includes deleted projects.\n\nDon't include sensitive information in your project name, project ID, or other\nresource names. The project ID is used in the name of many other\nGDC resources, and any reference to the project or\nrelated resources exposes the project ID and resource name.\n\nCreate a new project\n--------------------\n\nYou can create a project to provide logical grouping of service resources. For\nexample, you can create separate projects to hold resources for development,\ntest, and production environments.\n\nTo get the permissions that you need to create a project, ask your Organization\nIAM Admin to grant you the Project Creator role. For more information on\ngranting permissions, see the\n[Assign a role binding to the service identity](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/service-identity#assign_a_role_binding_to_the_service_identity)\nsection. \n\n### Console\n\nTo create a new project using the GDC console, complete the\nfollowing steps:\n\n1. In the navigation menu, click **Projects**.\n2. Click **Add project**.\n3. In the **Project name** field, enter a project name.\n4. Click **Continue**.\n5. Optional: Configure your project's networking capabilities. Clear the **Enable data exfiltration protection** checkbox to disable all egress traffic to other projects inside your organization.\n6. Click **Continue**.\n7. In the **Review** section, review the summary and click **Create**.\n8. To verify the new project is available, a message is displayed in the console: `Project `\u003cvar class=\"readonly\" translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e`\n successfully created`.\n9. [Link your new project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/billing/manage-billing-accounts#link_a_project) with a billing account. To track project resource costs, you must have an associated billing account linked to your project.\n\n### gdcloud\n\nTo create a new project using the gdcloud CLI, complete the\nfollowing steps:\n\n1. Ensure you have the gdcloud CLI installed. For more\n information, see the gdcloud CLI\n [Overview](/distributed-cloud/hosted/docs/latest/gdch/resources/gdcloud-overview#download_and_install_the)\n page.\n\n2. To create a project, run:\n\n gdcloud projects create \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the unique identifier for\n your new project.\n | **Important:** The gdcloud CLI does not support attaching a project to a Kubernetes cluster. You must do this in the GDC console after the project is created by following [Attach project to a cluster](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/cluster#attach-project-to-cluster).\n3. To verify the new project is available, run:\n\n gdcloud projects list\n\n4. [Link your new project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/billing/manage-billing-accounts#link_a_project)\n with a billing account. To track project resource costs, you must have\n an associated billing account linked to your project.\n\n### API\n\nTo create a new project using the API directly, complete the following\nsteps:\n\n1. Set an environment variable for the global management API server\n kubeconfig file:\n\n export KUBECONFIG=\u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER_KUBECONFIG\u003c/var\u003e\n\n If you don't have the global management API server kubeconfig file,\n [generate one](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in).\n2. Create and apply the `Project` custom resource:\n\n kubectl apply -f --kubeconfig=${KUBECONFIG} - \u003c\u003cEOF\n apiVersion: resourcemanager.global.gdc.goog/v1\n kind: Project\n metadata:\n namespace: platform\n name: \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n EOF\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the unique identifier\n for your new project.\n | **Important:** The `Project` custom resource does not directly support attaching a Kubernetes cluster. You must do this in the GDC console after the project is provisioned by following [Attach project to a cluster](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/cluster#attach-project-to-cluster).\n3. Verify the new project is available:\n\n kubectl --kubeconfig=${KUBECONFIG} get namespaces\n\n4. [Link your new project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/billing/manage-billing-accounts#link_a_project)\n with a billing account. To track project resource costs, you must have\n an associated billing account linked to your project.\n\n### Terraform\n\nTo create a new project using Terraform, complete the following\nsteps:\n\n1. Ensure you have Terraform configured and the appropriate permissions set.\n For more information, see the\n [Configure Terraform](/distributed-cloud/hosted/docs/latest/gdch/resources/configure-terraform) page.\n\n2. In a Terraform configuration file, insert the following code snippet:\n\n provider \"kubernetes\" {\n config_path = \"\u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER_KUBECONFIG\u003c/var\u003e\"\n }\n\n Replace \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER_KUBECONFIG\u003c/var\u003e with the path to\n the global management API server's kubeconfig file. If you don't have this\n kubeconfig file,\n [generate one](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in).\n3. In a Terraform configuration file, such as `main.tf`, insert the\n following code snippet:\n\n resource \"kubernetes_manifest\" \"project-create\" {\n manifest = {\n \"apiVersion\" = \"resourcemanager.global.gdc.goog/v1\"\n \"kind\" = \"Project\"\n \"metadata\" = {\n \"name\" = \"\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\"\n \"namespace\" = \"platform\"\n }\n }\n }\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the unique identifier\n for your new project.\n | **Important:** The `Project` Kubernetes manifest does not directly support attaching a Kubernetes cluster. You must do this in the GDC console after the project is provisioned by following [Attach project to a cluster](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/cluster#attach-project-to-cluster).\n4. Apply the new project using Terraform:\n\n terraform apply\n\n5. [Link your new project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/billing/manage-billing-accounts#link_a_project)\n with a billing account. To track project resource costs, you must have\n an associated billing account linked to your project."]]
