Google Cloud Compute Engine Orphaned Persistent Disk Sentinel

id: gcp-compute-orphaned-unattached-disk-sentinel
namespace: company.cloud

inputs:
  - id: project_id
    type: STRING
    description: Google Cloud Project ID to scan.
  - id: max_orphaned_disks_threshold
    type: INT
    defaults: 0
    description: Maximum acceptable count of detached persistent disks before alerting.

tasks:
  - id: scan_unattached_disks
    type: io.kestra.plugin.gcp.cli.GCloudCLI
    projectId: "{{ inputs.project_id }}"
    serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT') }}"
    commands:
      - |
        gcloud compute disks list \
          --filter="-users:*" \
          --format=json > /tmp/unattached_disks.json

        ORPHANED_COUNT=$(jq '. | length // 0' /tmp/unattached_disks.json)
        TOTAL_GB=$(jq '[.[].sizeGb | tonumber] | add // 0' /tmp/unattached_disks.json)

        echo "::set-output name=orphaned_count::$ORPHANED_COUNT::"
        echo "::set-output name=total_gb::$TOTAL_GB::"

  - id: evaluate_orphaned_storage
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.scan_unattached_disks.vars.orphaned_count | int >
      inputs.max_orphaned_disks_threshold }}"
    then:
      - id: notify_finops_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#finops-alerts",
            "attachments": [
              {
                "color": "warning",
                "title": "💰 GCP Orphaned Persistent Disks Detected",
                "text": "Project `{{ inputs.project_id }}` has *{{ outputs.scan_unattached_disks.vars.orphaned_count }}* detached persistent disks consuming *{{ outputs.scan_unattached_disks.vars.total_gb }} GB* of unattached storage! Impact: Detached SSD and standard persistent disks continue incurring full monthly gigabyte billing even when their parent VM instances are terminated.",
                "footer": "Kestra FinOps Sentinel • Google Compute Engine"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#finops-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Google Cloud Compute Engine Orphaned Persistent Disk Sentinel Pipeline Failure",
            "text": "Failed to scan Google Compute Engine disks. Verify IAM permissions.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true