Add Cloud Run instance for biometric public facing app

[obriensystems]

see GJE ingress version #10

requirements

• Cloud Build Instance
• DockerHub image migrated to Artifact Registry
• VPC where Cloud SQL DB will reside
• Cloud SQL Proxy with optional PSC for local DB connections

michaelobrien@mbp8 magellan % dig security-converter.obrienlabs.dev

; <<>> DiG 9.10.6 <<>> security-converter.obrienlabs.dev
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6523
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;security-converter.obrienlabs.dev. IN A

;; ANSWER SECTION:
security-converter.obrienlabs.dev. 4502 IN A 35.234.246.192

;; Query time: 86 msec
;; SERVER: fe80::dc9e:8fff:fe96:6d64%14#53(fe80::dc9e:8fff:fe96:6d64%14)

links

• https://docs.cloud.google.com/run/docs/deploying
• https://cloud.google.com/sql/docs/mysql/connect-build
• for public default url https://docs.cloud.google.com/run/docs/authenticating/public
• https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/tree/v43.0.0/blueprints/serverless

prereq

• using developer account with minimal permissions on the dev folder hierarchy
• folderAdmin, projectCreator, Cloud Build Viewer, Service Account Token Creator
• roles/serviceusage.serviceUsageAdmin
• project biometric-backend-cr-man-old moved under dev folder - visible to developer account 

On the develper/service-account

• Cloud Run Admin
• Service

$ gcloud services list
NAME                                 TITLE
analyticshub.googleapis.com          Analytics Hub API
bigquery.googleapis.com              BigQuery API
bigqueryconnection.googleapis.com    BigQuery Connection API
bigquerydatapolicy.googleapis.com    BigQuery Data Policy API
bigquerydatatransfer.googleapis.com  BigQuery Data Transfer API
bigquerymigration.googleapis.com     BigQuery Migration API
bigqueryreservation.googleapis.com   BigQuery Reservation API
bigquerystorage.googleapis.com       BigQuery Storage API
cloudapis.googleapis.com             Google Cloud APIs
cloudtrace.googleapis.com            Cloud Trace API
dataform.googleapis.com              Dataform API
dataplex.googleapis.com              Cloud Dataplex API
datastore.googleapis.com             Cloud Datastore API
logging.googleapis.com               Cloud Logging API
monitoring.googleapis.com            Cloud Monitoring API
servicemanagement.googleapis.com     Service Management API
serviceusage.googleapis.com          Service Usage API
sql-component.googleapis.com         Cloud SQL
storage-api.googleapis.com           Google Cloud Storage JSON API
storage-component.googleapis.com     Cloud Storage
storage.googleapis.com               Cloud Storage API

micha@p1gen6 MINGW64 /c/wse_github/ObrienlabsDev/gcp-infrastructure-as-code/m1-gke-ingress/kubernetes-gke (main)
$ gcloud config get project
Your active configuration is: [obrienlabsdev]
biometric-backend-cr-man-old

[obriensystems]

Create app, docker container based artifact registry repository, cloud build yaml, CB service account, connection to mysql

create AR

https://docs.cloud.google.com/artifact-registry/docs/repositories/create-repos

configure AR

$ gcloud auth configure-docker us-central1-docker.pkg.dev
WARNING: Your config file at [C:\Users\micha\.docker\config.json] contains these credential helper entries:

{
  "credHelpers": {
    "us-east4-docker.pkg.dev": "gcloud"
  }
}
Adding credentials for: us-central1-docker.pkg.dev
After update, the following will be written to your Docker config file located at [C:\Users\micha\.docker\config.json]:
 {
  "credHelpers": {
    "us-east4-docker.pkg.dev": "gcloud",
    "us-central1-docker.pkg.dev": "gcloud"
  }
}

Do you want to continue (Y/n)?  y
Docker configuration file updated.

Tag and push existing local image

1325
$ docker tag obrienlabs/magellan-nbi:0.0.4-ia64 us-central1-docker.pkg.dev/biometric-backend-cr-man-old/magellan/magellan-nbi:0.0.4-ia64

micha@p1gen6 MINGW64 /c/wse_github/ObrienlabsDev/gcp-infrastructure-as-code/m1-gke-ingress/kubernetes-gke (main)
$ docker push us-central1-docker.pkg.dev/biometric-backend-cr-man-old/magellan/magellan-nbi:0.0.4-ia64
The push refers to repository [us-central1-docker.pkg.dev/biometric-backend-cr-man-old/magellan/magellan-nbi]

Cloud run service

gcloud alpha run deploy magellan-nbi \
--image=us-central1-docker.pkg.dev/biometric-backend-cr-man-old/magellan/magellan-nbi@sha256:e3d09b1f25156525dd1446a56dafae88a65012a48f95012235b938f032275d35 \
--no-invoker-iam-check \
--port=8080 \
--service-account=1089117545661-compute@developer.gserviceaccount.com \
--region=us-central1 \
--project=biometric-backend-cr-man-old

micha@p1gen6 MINGW64 /c/wse_github/ObrienlabsDev/gcp-infrastructure-as-code/m1-gke-ingress/kubernetes-gke (main)
$ gcloud alpha run deploy magellan-nbi --image=us-central1-docker.pkg.dev/biometric-backend-cr-man-old/magellan/magellan-nbi@sha256:e3d09b1f25156525dd1446a56dafae88a65012a48f95012235b938f032275d35 --no-invoker-iam-check --port=8080 --service-account=1089117545661-compute@developer.gserviceaccount.com --region=us-central1 --project=biometric-backend-cr-man-old
Deploying container to Cloud Run service [magellan-nbi] in project [biometric-backend-cr-man-old] region [us-central1]
Deploying new service...
Creating Revision.

Routing traffic..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................done
Done.
Service [magellan-nbi] revision [magellan-nbi-00001-p2h] has been deployed and is serving 100 percent of traffic.
Service URL: https://magellan-nbi-1089117545661.us-central1.run.app

https://docs.cloud.google.com/run/docs/authenticating/public#assign-allusers-iam-invoker

$   gcloud run services add-iam-policy-binding magellan-nbi --member="allUsers" --role="roles/run.invoker" --region us-central1
Updated IAM policy for service [magellan-nbi].
bindings:
- members:
  - allUsers
  role: roles/run.invoker
etag: BwZCtQ9UymM=
version: 1

redeploy with --allow-unauthenticated

$ gcloud alpha run deploy magellan-nbi --image=us-central1-docker.pkg.dev/biometric-backend-cr-man-old/magellan/magellan-nbi@sha256:e3d09b1f25156525dd1446a56dafae88a65012a48f95012235b938f032275d35 --no-invoker-iam-check --port=8080 --service-account=1089117545661-compute@developer.gserviceaccount.com --region=us-central1 --project=biometric-backend-cr-man-old --allow-unauthenticated
Deploying container to Cloud Run service [magellan-nbi] in project [biometric-backend-cr-man-old] region [us-central1]
Deploying...
Setting IAM Policy..............done
Creating Revision...................................................................................................done
Routing traffic.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................done
Done.
Service [magellan-nbi] revision [magellan-nbi-00002-nfv] has been deployed and is serving 100 percent of traffic.
Service URL: https://magellan-nbi-1089117545661.us-central1.run.app

up
https://magellan-nbi-1089117545661.us-central1.run.app/nbi/swagger-ui.html

[fmichaelobrien]

Move on to the biometric-backend container and associated mysql cloud sql instance