Steps
The main things you need to get are:
- Enable the API for the service you need
- Create a Service Account for use in the deployment
- Give the Service Account a sufficient role related to the API you want to access (You don’t have to do it at this point. This is something you can do later).
- Generate and download the Service Account Private Key in JSON format.
- Copy the contents of that JSON file into a protected environment variable in your CI/CD service of choice.
- n your dev project, add an appropriate CI/CD YAML file depending on the requirements of your third party service.
- An example YAML for Gitlab CI is shown below. But the concepts are universal.
Gitlab CI Example
Google provides a docker image already configured with gcloud. The image is google/cloud-sdk.
In this example, we will be build a docker image, save it to Container Registry and then deploy to Cloud Run.
Variables Needed
Variable | Value |
---|---|
GCP_SERVICE_KEY | { Service Account Private Key } |
GCP_PROJECT_ID | { Project ID } |
Resources/ APIs Needed
- Cloud Build
- Cloud Storage
- Container Registry
Permissions/ Roles Needed by Service Account
Resource | Role | Path To Role |
---|---|---|
Cloud Build | Cloud Build Service Account | Service Agent Roles/ Cloud Build Service Account |
Other Steps Needed
- Create a storage bucket in Cloud Storage.
- Create two folders. Namely:
- source - to store source files you send to Cloud Build
- logs - to store logs from build
The Config File
variables:
APPLICATION_NAME: demo-application
image: google/cloud-sdk
build-image:
scripts:
- echo $GCP_SERVICE_KEY > $HOME/gcloud-service-key.json
- gcloud auth activate-service-account --key-file $HOME/gcloud-service-key.json
- rm $HOME/gcloud-service-key.json
- gcloud --quiet config set project $GCP_PROJECT_ID
- cloud builds submit . --tag gcr.io/$GCP_PROJECT_ID/$APPLICATION_NAME
Reference
- Build a CI/CD Pipeline for Google App Engine Site Using CircleCI [Full Walkthrough] - YouTube
- https://gist.github.com/troyharvey/bae82c86c27a3aa539dea83857ee9ecd/
- password-protected-docs/config.yml at master · sidpalas/password-protected-docs · GitHub
- https://circleci.com/docs/2.0/google-auth/
- gcloud auth activate-service-account | Cloud SDK Documentation