This article provide a guidance to complete GSP328 Serverless Cloud Run Development: Challenge Lab. It won’t provide steps directly, only tips to finish the lab.
The challenge contains 7 tasks. As it has staging and production environment, so actually is 3 different sets of tasks.
Provision the Qwiklabs environment
run those commands to set config and checkout files
Task 1:
Assessment
Build an image using Cloud Build
Deploy a Cloud Run service as an unauthenticated service
Test service responds when the endpoint is accessed
+-----------------+-----------------------------------+ | FIELD | VALUE | +-----------------+-----------------------------------+ | Billing Image | billing-staging-api:0.1 | | Billing Service | public-billing-service | | Authentication | unauthenticated | | Code | pet-theory/lab07/unit-api-billing | +-----------------+-----------------------------------+
- gCloud build command reference: https://cloud.google.com/sdk/gcloud/reference/beta/builds/submit
cd ~/<CODE> gcloud builds submit \ --tag gcr.io/$GOOGLE_CLOUD_PROJECT/<BILLING_IMAGE>
2. gCloud deploy command reference:
- https://cloud.google.com/sdk/gcloud/reference/run/deploy
- https://cloud.google.com/sdk/gcloud/reference/run/deploy#–[no-]allow-unauthenticated
gcloud run deploy <SERVICE> \ --image gcr.io/$GOOGLE_CLOUD_PROJECT/<BILLING_IMAGE> \ --<AUTHENTICATED>
3. optional: click on the Service URL in cloud shell, or curl manually. e.g.curl https://public-billing-service-XXXXXXX.a.run.app
Task 2:
Same as task 1, with different values.
+----------------+-------------------------------------------+ | FIELD | VALUE | +----------------+-------------------------------------------+ | Image Name | frontend-staging:0.1 | | Service Name | frontend-staging-service | | Authentication | unauthenticated | | Code | pet-theory/lab07/staging-frontend-billing | +----------------+-------------------------------------------+
Task 3:
+----------------+--------------------------------------+ | FIELD | VALUE | +----------------+--------------------------------------+ | Image Name | billing-staging-api:0.2 | | Service Name | private-billing-service | | Authentication | authenticated | | Code | pet-theory/lab07/staging-api-billing | +----------------+--------------------------------------+
- Delete the existing Billing Service
cd ~/<CODE> gcloud beta run services delete public-billing-service
2. Build an image using Cloud Build: similar to task 1
3. Deploy the image to Cloud Run requiring authentication: similar to above, just be aware this time is authenticated. –no-allow-unauthenticated
4. Test service:
BILLING_SERVICE=private-billing-service BILLING_URL=$(gcloud run services describe $BILLING_SERVICE \ --format "value(status.URL)") curl -X get -H "Authorization: Bearer $(gcloud auth print-identity-token)" $BILLING_URL
Task 4:
+-----------------+---------------------------+ | FIELD | VALUE | +-----------------+---------------------------+ | Service Account | billing-service-sa | | Display Name | Billing Service Cloud Run | +-----------------+---------------------------+
- create service account reference: https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating
gcloud iam service-accounts create <SERVICE_ACOUNT> --display-name "<DISPLAY_NAME>"
Task 5:
+-----------------+-----------------------------------+ | FIELD | VALUE | +-----------------+-----------------------------------+ | Image Name | billing-prod-api:0.1 | | Service Name | billing-prod-service | | Authentication | authenticated | | Code | pet-theory/lab07/prod-api-billing | | Service Account | billing-service-sa | +-----------------+-----------------------------------+
- Deploy the image to Cloud Run & Enable Authentication
cd ~/<CODE> ## similar to task 3 build and deploy command above
2. Enable Service Account
https://cloud.google.com/sdk/gcloud/reference/run/services/add-iam-policy-binding
gcloud run services add-iam-policy-binding <SERVICE_NAME> \ --member=serviceAccount:<SERVICE_ACCOUNT>@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com \ --role=roles/run.invoker
3. optional: Test service url: lab instructions URL is case sensitive.
PROD_BILLING_SERVICE=private-billing-servicePROD_BILLING_URL=$(gcloud run services \
describe $PROD_BILLING_SERVICE \
--format "value(status.URL)")
curl -X get -H "Authorization: Bearer \
$(gcloud auth print-identity-token)" \
$PROD_BILLING_URL
Task 6:
+-----------------+-----------------------------------+ | FIELD | VALUE | +-----------------+-----------------------------------+ | Service Account | frontend-service-sa | | Display Name | Billing Service Cloud Run Invoker | +-----------------+-----------------------------------+
- same command as Task 4
Task 7:
+-----------------+----------------------------------------+ | FIELD | VALUE | +-----------------+----------------------------------------+ | Image Name | frontend-prod:0.1 | | Service Name | frontend-prod-service | | Authentication | unauthenticated | | Code | pet-theory/lab07/prod-frontend-billing | | Service Account | frontend-service-sa | +-----------------+----------------------------------------+
- Deploy the image to Cloud Run & Enable Authentication: refer to Task 5
cd ~/<CODE> ## similar to task 5 build and deploy command above
2. Enable Service Account: similar to task 5
gcloud run services add-iam-policy-binding <SERVICE_NAME> \ --member=serviceAccount:<SERVICE_ACCOUNT>@$GOOGLE_CLOUD_PROJECT.iam.gserviceaccount.com \ --role=roles/run.invoker
3. optional: click on URL printed in cloud shell to verify endpoint access
Congratulations
After that you should be able to finish this challenge lab and obtain a skill badge:
