Skip to content

Commit 8fb954d

Browse files
cstangercstanger
authored
feat: declarative Cloud Run workflow (#3)
* feat: declarative Cloud Run workflow * fix: pr comments * update readme by script
1 parent bbe764a commit 8fb954d

File tree

5 files changed

+153
-0
lines changed

5 files changed

+153
-0
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ This repository holds several references to example workflows and demonstrates h
1010

1111
| Name | Starter | Description |
1212
| ------------------------------------------------------------ | ------------------------- | ---------------- |
13+
|[cloudrun-declarative](workflows/deploy-cloudrun/cloudrun-declarative.yml) | | Build a Docker container, publish it to Google Artifact Registry, and deploy to Google Cloud Run using a declarative YAML Service specification (KRM). |
1314
|[cloudrun-docker](workflows/deploy-cloudrun/cloudrun-docker.yml) | ✅ | Build a Docker container, publish it to Google Artifact Registry, and deploy to Google Cloud Run. |
1415
|[cloudrun-source](workflows/deploy-cloudrun/cloudrun-source.yml) | ✅ | Deploy to Google Cloud Run directly from source. |
1516

‎properties/cloudrun-declarative.properties.json

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"name": "Build and Deploy to Cloud Run with KRM",
3+
"description": "Build a Docker container, publish it to Google Artifact Registry, and deploy to Google Cloud Run using a declarative YAML Service specification (KRM).",
4+
"creator": "Google Cloud",
5+
"iconName": "google-cloud",
6+
"categories": ["Deployment", "Containers", "Cloud Run", "Serverless", "KRM", "Service Definition", "declarative"]
7+
}

‎workflow.config.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
{
2+
"cloudrun-declarative": {
3+
"starter": false,
4+
"type": "deployments",
5+
"workflowPath": "workflows/deploy-cloudrun/cloudrun-declarative.yml",
6+
"propertiesPath": "properties/cloudrun-declarative.properties.json"
7+
},
28
"cloudrun-docker": {
39
"starter": true,
410
"type": "deployments",

‎workflows/deploy-cloudrun/cloudrun-declarative.yml

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Cloud Run by using a declarative YAML Service specification (service.yaml) when a commit is pushed to the $default-branch branch
2+
#
3+
# Overview:
4+
#
5+
# 1. Authenticate to Google Cloud
6+
# 2. Authenticate Docker to Artifact Registry
7+
# 3. Build a docker container
8+
# 4. Publish it to Google Artifact Registry
9+
# 5. Create a YAML Service specification from the template
10+
# 5. Deploy it to Cloud Run
11+
#
12+
# To configure this workflow:
13+
#
14+
# 1. Ensure the required Google Cloud APIs are enabled:
15+
#
16+
# Cloud Run run.googleapis.com
17+
# Artifact Registry artifactregistry.googleapis.com
18+
#
19+
# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
20+
#
21+
# 3. Ensure the required IAM permissions are granted
22+
#
23+
# Cloud Run
24+
# roles/run.admin
25+
# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account)
26+
#
27+
# Artifact Registry
28+
# roles/artifactregistry.admin (project or repository level)
29+
#
30+
# NOTE: You should always follow the principle of least privilege when assigning IAM roles
31+
#
32+
# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT
33+
#
34+
# 5. Change the values for the GAR_LOCATION, SERVICE and REGION environment variables (below).
35+
#
36+
# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io
37+
#
38+
# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run
39+
#
40+
# Further reading:
41+
# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying
42+
# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles
43+
# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry
44+
# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege
45+
46+
name: Build and Deploy to Cloud Run with KRM
47+
48+
on:
49+
push:
50+
branches:
51+
- $default-branch
52+
53+
env:
54+
PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id
55+
GAR_LOCATION: YOUR_GAR_LOCATION # TODO: update Artifact Registry location
56+
SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name
57+
REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region
58+
59+
jobs:
60+
deploy:
61+
# Add 'id-token' with the intended permissions for workload identity federation
62+
permissions:
63+
contents: 'read'
64+
id-token: 'write'
65+
66+
runs-on: ubuntu-latest
67+
steps:
68+
- name: Checkout
69+
uses: actions/checkout@v3
70+
71+
- name: Google Auth
72+
id: auth
73+
uses: 'google-github-actions/auth@v0'
74+
with:
75+
token_format: 'access_token'
76+
workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider
77+
service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - [email protected]
78+
79+
# NOTE: Alternative option - authentication via credentials json
80+
# - name: Google Auth
81+
# id: auth
82+
# uses: 'google-github-actions/auth@v0'
83+
# with:
84+
# credentials_json: '${{ secrets.GCP_CREDENTIALS }}''
85+
86+
# BEGIN - Docker auth and build (NOTE: If you already have a container image, these Docker steps can be omitted)
87+
88+
# Authenticate Docker to Google Cloud Artifact Registry
89+
- name: Docker Auth
90+
id: docker-auth
91+
uses: 'docker/login-action@v2'
92+
with:
93+
username: 'oauth2accesstoken'
94+
password: '${{ steps.auth.outputs.access_token }}'
95+
registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev'
96+
97+
- name: Build and Push Container
98+
run: |-
99+
docker build -t "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" ./
100+
docker push "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}"
101+
102+
# END - Docker auth and build
103+
104+
# Create Cloud Run YAML Service specification from template
105+
# envsubst is replacing template variables and creating a YAML Service specification with the new image tag
106+
- name: Create Service declearation
107+
run: |-
108+
export IMAGE="${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}"
109+
export SERVICE="${{ env.SERVICE }}"
110+
envsubst < service.template.yaml > service.yaml
111+
112+
# Deploy Cloud Run Service from the YAML Service specification
113+
- name: Deploy to Cloud Run
114+
id: deploy
115+
uses: google-github-actions/deploy-cloudrun@v0
116+
with:
117+
service: ${{ env.SERVICE }}
118+
region: ${{ env.REGION }}
119+
metadata: service.yaml
120+
121+
# If required, use the Cloud Run url output in later steps
122+
- name: Show Output
123+
run: echo ${{ steps.deploy.outputs.url }}

‎workflows/deploy-cloudrun/service.template.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: serving.knative.dev/v1
2+
kind: Service
3+
metadata:
4+
name: ${SERVICE}
5+
spec:
6+
template:
7+
metadata:
8+
annotations:
9+
autoscaling.knative.dev/maxScale: '100'
10+
spec:
11+
containerConcurrency: 80
12+
containers:
13+
- image: ${IMAGE}
14+
traffic:
15+
- percent: 100
16+
latestRevision: true

0 commit comments

Comments
 (0)