infra: add k8s-infra-sandbox-capg project

[spiffxp]

Related:

• Part of: request: US$5K for the year to fund CAPG development kubernetes-retired/funding#18
• Followup to: Sandbox for CAPG folks testing #2904

[spiffxp]

Created the project with terraform apply

Set a budget on the project via click-ops:

terraform apply doesn't seem to mind, so I've dropped the WIP label

I'd like to try and keep this terraform module scoped such that the people using the project could run terraform to affect changes on it. I'm assuming so long as nobody touches the billing account info on the project, terraform won't try to use a permission we're not going to grant to these folks. e.g. one of the required permissions to update a project's billing info (billing.resourceAssociations.create) is missing from this list:

$ gcloud iam roles describe roles/owner | grep '[Bb]illing'
- billing.resourceCosts.get
- cloudasset.assets.exportCloudbillingBillingAccounts
- firebase.billingPlans.get
- firebase.billingPlans.update
- resourcemanager.projects.createBillingAssignment
- resourcemanager.projects.deleteBillingAssignment

Managing the budget via terraform (or some other client library, looks like gcloud doesn't have it) can be done as a follow up (which I am noodling on now, but unlikely to finish by end of day)

We'll first got notified when 20% of the budget has been spent

[spiffxp]

/cc @dims @ameukam

[dims]

thanks @spiffxp

/approve
/lgtm

/hold please feel free to remove hold when ready

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/OWNERS [dims,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

/hold cancel