Pengelolaan fleet dengan kebijakan organisasi kustom

Anda dapat menggunakan Organization Policy Service dengan batasan kustom untuk menerapkan konfigurasi tertentu di seluruh cluster Managed Service for Apache Spark organisasi Anda. Pendekatan terpusat ini membantu memastikan kepatuhan, mengontrol biaya, dan menstandardisasi fleet Managed Service for Apache Spark Anda.

Panduan ini menunjukkan cara membuat dan menerapkan kebijakan organisasi kustom untuk cluster Managed Service for Apache Spark. Untuk mengetahui informasi selengkapnya, lihat Pengantar Kebijakan Organisasi.

Sebelum memulai

Login ke akun Google Cloud Anda. Jika Anda baru menggunakan Google Cloud, buat akun untuk mengevaluasi performa produk kami dalam skenario dunia nyata. Pelanggan baru juga mendapatkan kredit gratis senilai $300 untuk menjalankan, menguji, dan men-deploy workload.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Resource Manager API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

Make sure that you have the following role or roles on the project: Organization Policy Administrator

Check for the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.

3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.

4. For all rows that specify or include you, check the Role column to see whether the list of roles includes the required roles.

Grant the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.
3. Click Grant access.

4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.

5. Click Select a role, then search for the role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Instal Google Cloud CLI.

Catatan: Jika Anda telah menginstal gcloud CLI sebelumnya, pastikan Anda memiliki versi terbaru dengan menjalankan gcloud components update.

Jika Anda menggunakan penyedia identitas (IdP) eksternal, Anda harus login ke gcloud CLI dengan identitas gabungan Anda terlebih dahulu.

Untuk melakukan inisialisasi gcloud CLI, jalankan perintah berikut:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Resource Manager API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

Make sure that you have the following role or roles on the project: Organization Policy Administrator

Check for the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.

3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.

4. For all rows that specify or include you, check the Role column to see whether the list of roles includes the required roles.

Grant the roles

1. In the Google Cloud console, go to the IAM page.

   Go to IAM
2. Select the project.
3. Click Grant access.

4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.

5. Click Select a role, then search for the role.
6. To grant additional roles, click Add another role and add each additional role.
7. Click Save.

Instal Google Cloud CLI.

Catatan: Jika Anda telah menginstal gcloud CLI sebelumnya, pastikan Anda memiliki versi terbaru dengan menjalankan gcloud components update.

Jika Anda menggunakan penyedia identitas (IdP) eksternal, Anda harus login ke gcloud CLI dengan identitas gabungan Anda terlebih dahulu.

Untuk melakukan inisialisasi gcloud CLI, jalankan perintah berikut:

gcloud init

Menerapkan batasan khusus

Langkah-langkah berikut menunjukkan cara menerapkan persyaratan keamanan umum: memastikan bahwa semua cluster Managed Service for Apache Spark yang baru mengaktifkan Kerberos.

1. Tentukan batasan kustom.

   1. Buat file YAML dengan konten berikut:

   name: organizations/ORGANIZATION_ID/customConstraints/custom.dataprocKerberos
   resourceTypes:
   -   dataproc.googleapis.com/Cluster
   methodTypes:
   -   CREATE
   condition: "resource.config.securityConfig.kerberosConfig.enableKerberos == true"
   actionType: ALLOW
   displayName: Cluster must have Kerberos enabled.
   

   Ganti ORGANIZATION_ID dengan ID organisasi Anda.

2. Tetapkan batasan kustom agar tersedia untuk organisasi Anda.

   gcloud org-policies set-custom-constraint CONSTRAINT_PATH
   

   Ganti CONSTRAINT_PATH dengan jalur ke file batasan YAML Anda.

3. Buat kebijakan organisasi yang menerapkan batasan.

   1. Buat file YAML lain dengan konten berikut:

   name: projects/PROJECT_ID/policies/custom.dataprocKerberos
   spec:
     rules:
       -   enforce: true
   

   Ganti PROJECT_ID dengan ID project untuk menerapkan kebijakan. Anda juga dapat menerapkan kebijakan ini di tingkat folder atau organisasi.

4. Terapkan kebijakan.

   gcloud org-policies set-policy POLICY_PATH
   

   Ganti POLICY_PATH dengan jalur ke file kebijakan YAML.

Setelah Anda menerapkan kebijakan, upaya untuk membuat cluster Managed Service for Apache Spark di resource yang ditentukan tanpa mengaktifkan Kerberos akan gagal.

Catatan: Kebijakan dapat memerlukan waktu hingga 15 menit untuk diterapkan.

Kasus penggunaan untuk batasan kustom

Anda dapat membuat batasan kustom untuk menerapkan berbagai kebijakan untuk fleet Managed Service for Apache Spark Anda. Menerapkan kebijakan fleet membantu mengontrol biaya, melakukan standardisasi, dan meningkatkan keamanan.

Contoh: Anda dapat mewajibkan jenis mesin tertentu atau mencegah alamat IP publik di node cluster.

Langkah berikutnya

• Baca Pengantar Kebijakan Organisasi
• Pelajari lebih lanjut batasan kustom.