hashicorp-vault-with-cloud-run/cloudbuild.yaml at master · Neutrollized/hashicorp-vault-with-cloud-run · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
---
steps:
- id: 'Lint Dockerfile'
  name: 'ghcr.io/hadolint/hadolint'
  entrypoint: '/bin/hadolint'
  args: ['cloud-run/Dockerfile']
- id: 'Build container image'
  name: 'gcr.io/cloud-builders/docker'
  args: ['build', '-t', '${_GAR_REGION}-docker.pkg.dev/${PROJECT_ID}/${_GAR_REPO_NAME}/vault-server:${COMMIT_SHA}', '-f', 'Dockerfile', '.']
  dir: 'cloud-run'
#- id: 'Image security scan'
#  name: 'aquasec/trivy:latest'
#  args: ['image', '--severity', 'CRITICAL', '--exit-code', '1', '${_GAR_REGION}-docker.pkg.dev/${PROJECT_ID}/${_GAR_REPO_NAME}/vault-server:${COMMIT_SHA}']
- id: 'Image efficiency scan'
  name: 'quay.io/wagoodman/dive'
  args: ['--ci', '${_GAR_REGION}-docker.pkg.dev/$PROJECT_ID/${_GAR_REPO_NAME}/vault-server:$COMMIT_SHA']
- id: 'Push container image to GAR'
  name: 'gcr.io/cloud-builders/docker'
  args: ['push', '${_GAR_REGION}-docker.pkg.dev/${PROJECT_ID}/${_GAR_REPO_NAME}/vault-server:${COMMIT_SHA}']
- id: 'Deploy to Cloud Run'
  name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
  entrypoint: gcloud
  args:
  - 'beta'
  - 'run'
  - 'deploy'
  - '${_SERVICE_NAME}'
  - '--allow-unauthenticated'
  - '--ingress'
  - '${_INGRESS}'
  - '--execution-environment'
  - '${_EXECUTION_ENVIRONMENT}'
  - '--concurrency'
  - '20'
  - '--cpu'
  - '1'
  - '--memory'
  - '512Mi'
  - '--cpu-boost'
  - '--image'
  - '${_GAR_REGION}-docker.pkg.dev/${PROJECT_ID}/${_GAR_REPO_NAME}/vault-server:${COMMIT_SHA}'
  - '--region'
  - '${_REGION}'
  - '--min-instances'
  - '1'
  - '--max-instances'
  - '1'
  - '--platform'
  - 'managed'
  - '--port'
  - '8200'
  - '--service-account'
  - '${_SERVICE_ACCOUNT_EMAIL}'
  - '--set-env-vars'
  - 'GOOGLE_PROJECT=${PROJECT_ID},GOOGLE_STORAGE_BUCKET=${_GCS_BUCKET_NAME},VAULT_GCPCKMS_SEAL_KEY_RING=${_KMS_KEY_RING}'
  - '--set-secrets'
  - '/etc/vault/config.hcl=vault-server-config:latest'
  - '--timeout'
  - '300'
# Cloud Build service account
serviceAccount: '${PROJECT_NUMBER}-compute@developer.gserviceaccount.com'
images:
- '${_GAR_REGION}-docker.pkg.dev/${PROJECT_ID}/${_GAR_REPO_NAME}/vault-server:${COMMIT_SHA}'
options:
  defaultLogsBucketBehavior: REGIONAL_USER_OWNED_BUCKET