Skip to content

Commit 4f0d3cd

Browse files
jackwotherspoonjackwotherspoon
authored
chore: update build-and-deploy.sh (#65)
1 parent 5e5edcc commit 4f0d3cd

File tree

2 files changed

+123
-19
lines changed

2 files changed

+123
-19
lines changed

‎scripts/README.md‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ GroupSync is a self-deployed service that provides support for managing [Cloud S
77
Below outlines the steps to automate the majority of a GroupSync deployment, allowing for faster and more scalable deployments.
88
This deployment uses a script to build the appropriate GroupSync resources:
99
- Service Account with required permissions
10-
- Serverless VPC Access Connector
10+
- Serverless VPC Access Connector (if using private IP Cloud SQL connections)
1111
- Cloud Run service
1212
- Cloud Scheduler Job
1313

@@ -41,8 +41,10 @@ Scheduler Job between the desired IAM Groups and Cloud SQL Instances.
4141
```
4242

4343
### Set Required Variables within Deployment Script
44-
The script used to facilitate the deployment of GroupSync is
45-
[build-and-deploy-private-ip.sh](build-and-deploy-private-ip.sh).
44+
The script used to facilitate the deployment of GroupSync is either
45+
[build-and-deploy.sh](build-and-deploy.sh) for Public IP connections or
46+
[build-and-deploy-private-ip.sh](build-and-deploy-private-ip.sh) for
47+
Private IP connections.
4648

4749
Edit the following variables at the top of the script with the
4850
proper values for your deployment.
@@ -53,18 +55,25 @@ export REGION="" # Google Cloud region to deploy GroupSync in
5355
export SERVICE_ACCOUNT_NAME="" # name of service account to create and use with GroupSync
5456
export SERVICE_ACCOUNT_EMAIL="$SERVICE_ACCOUNT_NAME@$PROJECT_ID.iam.gserviceaccount.com" # email of service account to deploy Cloud Run with
5557

58+
export PATH_TO_JSON="" # relative file path to JSON file containing instance-to-group mappings for Cloud Scheduler
59+
export SCHEDULE="*/10 * * * *" # schedule how often GroupSync Cloud Scheduler is called (defaults to 10 mins)
60+
61+
# ONLY FOR PRIVATE IP (build-and-deploy-private-ip.sh)
5662
export HOST_PROJECT_ID="" # project ID of Shared VPC host project (optional)
5763
export CONNECTOR_NAME="" # name to be given to Serverless VPC Access Connector
5864
export SUBNET="" # the name of an unused /28 subnet for Serverless VPC Access Connector
59-
60-
export PATH_TO_JSON="" # relative file path to JSON file containing instance-to-group mappings for Cloud Scheduler
61-
export SCHEDULE="*/10 * * * *" # schedule how often GroupSync Cloud Scheduler is called (defaults to 10 mins)
6265
```
6366

6467
### Run Script
65-
Now the deployment script can be run by executing the following command:
68+
Now the deployment script can be run by executing one of the following commands:
69+
70+
```bash
71+
# public IP
72+
./scripts/build-and-deploy.sh
73+
```
6674

6775
```bash
76+
# private IP
6877
./scripts/build-and-deploy-private-ip.sh
6978
```
7079

‎scripts/build-and-deploy.sh‎

Lines changed: 107 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,26 +14,121 @@
1414
# See the License for the specific language governing permissions and
1515
# limitations under the License.
1616

17-
# variables required for below commands to properly build and deploy Cloud Run
18-
export PROJECT_ID= # project ID of project in which you want to deploy the service within
19-
export SERVICE_ACCOUNT_EMAIL= # email of service account to deploy Cloud Run with
17+
# variables required for below commands to properly build and deploy GroupSync
18+
echo "Setting environment variables..."
19+
######################## DEPLOYMENT variables ########################
20+
export PROJECT_ID="" # project ID of project in which you want to deploy the service within
21+
export REGION="" # Google Cloud region to deploy GroupSync in
2022

21-
# check if variables are set, otherwise give error and exit
22-
declare -a vars=(PROJECT_ID SERVICE_ACCOUNT_EMAIL)
23+
######################## Service Account variables ########################
24+
export SERVICE_ACCOUNT_NAME="" # name of service account to create and use with GroupSync
25+
export SERVICE_ACCOUNT_EMAIL="$SERVICE_ACCOUNT_NAME@$PROJECT_ID.iam.gserviceaccount.com" # email of service account to deploy Cloud Run with
26+
27+
######################## Cloud Scheduler variables ########################
28+
export PATH_TO_JSON="" # file path to JSON payload containing instance-to-group mappings for Cloud Scheduler
29+
export SCHEDULE="*/10 * * * *" # schedule how often GroupSync Cloud Scheduler is called (defaults to 10 mins)
30+
31+
# load IAM Groups and Cloud SQL Instance names from JSON payload
32+
IAM_GROUPS=$(cat "$PATH_TO_JSON" | jq '.iam_groups' | tr -d '[],"')
33+
SQL_INSTANCES=$(cat "$PATH_TO_JSON" | jq '.sql_instances' | tr -d '[],"')
34+
35+
# check if required variables are set, otherwise give error and exit
36+
declare -a vars=(PROJECT_ID REGION PATH_TO_JSON IAM_GROUPS SQL_INSTANCES)
2337
for var_name in "${vars[@]}"
2438
do
2539
if [ -z "$(eval "echo \$$var_name")" ]; then
26-
echo "Missing environment variable $var_name in build-and-deploy.sh"
40+
echo "Missing environment variable $var_name in deployment.sh"
2741
exit 1
2842
fi
2943
done
3044

45+
echo "Successfully set environment variables..."
46+
47+
######################## GCP PROJECT CONFIGURATION ########################
48+
echo "Configuring GCP project and region..."
49+
# set project
50+
gcloud config set project "$PROJECT_ID"
51+
52+
# set region
53+
gcloud config set compute/region "$REGION"
54+
55+
echo "Enabling required APIs..."
56+
# enable required APIs within project
57+
gcloud services enable run.googleapis.com cloudscheduler.googleapis.com \
58+
cloudbuild.googleapis.com sqladmin.googleapis.com admin.googleapis.com \
59+
iamcredentials.googleapis.com
60+
61+
######################## SERVICE ACCOUNT CONFIGURATION ########################
62+
echo "Creating Service Account $SERVICE_ACCOUNT_EMAIL..."
63+
# create service account for use with GroupSync (REMOVE STEP IF USING PRE-EXISTING SERVICE ACCOUNT)
64+
gcloud iam service-accounts create "$SERVICE_ACCOUNT_NAME" \
65+
--description="IAM Groups Authn Service Account" \
66+
--display-name="IAM Database Groups Authentication"
67+
68+
echo "Adding IAM Policies to service account: $SERVICE_ACCOUNT_EMAIL"
69+
70+
# add Cloud Run Invoke Role to service account
71+
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
72+
--member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
73+
--role="roles/run.invoker"
74+
75+
# create custom IAM role and grant to service account
76+
gcloud iam roles create IamAuthnGroups \
77+
--project="$PROJECT_ID" \
78+
--title="IAM Groups Authn" \
79+
--description="Custom role for IAM DB Authn for Groups Service" \
80+
--permissions=cloudsql.instances.connect,cloudsql.instances.get,cloudsql.instances.login,cloudsql.users.create,cloudsql.users.list,iam.serviceAccounts.signBlob
81+
82+
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
83+
--member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
84+
--role="projects/$PROJECT_ID/roles/IamAuthnGroups"
85+
86+
######################## IAM and DB ROLE CONFIGURATION ########################
87+
echo "Adding Cloud SQL Instance User role to IAM Groups..."
88+
# grant Cloud SQL Instance User role to all IAM group emails (so users of Group can inherit)
89+
for GROUP in $IAM_GROUPS;
90+
do
91+
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
92+
--member="group:$GROUP" \
93+
--role="roles/cloudsql.instanceUser"
94+
done
95+
96+
echo "Adding $SERVICE_ACCOUNT_EMAIL as IAM DB User to Cloud SQL Instances..."
97+
# add service account as Cloud SQL IAM User to all mapped instances
98+
for INSTANCE in $SQL_INSTANCES;
99+
do
100+
IFS=: read -r PROJECT REGION_NAME INSTANCE_NAME <<< $INSTANCE
101+
gcloud sql users create $SERVICE_ACCOUNT_EMAIL \
102+
--instance="$INSTANCE_NAME" \
103+
--type=cloud_iam_service_account
104+
done
105+
106+
############################## CLOUD RUN ################################
107+
echo "Building docker container and deploying GroupSync Cloud Run Service..."
108+
# build container for Cloud Run
31109
gcloud builds submit \
32-
--tag gcr.io/$PROJECT_ID/iam-db-authn-groups \
33-
--project $PROJECT_ID
110+
--tag "gcr.io/$PROJECT_ID/groupsync-run" \
111+
--project "$PROJECT_ID" \
112+
--region "$REGION"
34113

35-
gcloud run deploy iam-db-authn-groups \
36-
--image gcr.io/$PROJECT_ID/iam-db-authn-groups \
114+
# deploy Cloud Run service
115+
gcloud run deploy groupsync-run \
116+
--image "gcr.io/$PROJECT_ID/groupsync-run" \
37117
--no-allow-unauthenticated \
38-
--service-account $SERVICE_ACCOUNT_EMAIL \
39-
--project $PROJECT_ID
118+
--service-account "$SERVICE_ACCOUNT_EMAIL" \
119+
--project "$PROJECT_ID" \
120+
--region "$REGION"
121+
122+
SERVICE_URL=$(gcloud run services describe groupsync-run --platform managed --region "$REGION" --format 'value(status.url)')
123+
echo "Deployed Cloud Run service at URL: $SERVICE_URL"
124+
125+
########################### CLOUD SCHEDULER ############################
126+
echo "Creating GroupSync Cloud Scheduler job..."
127+
# cloud scheduler command (schedules GroupSync to run every 10 minutes)
128+
gcloud scheduler jobs create http groupsync-scheduler \
129+
--schedule="$SCHEDULE" \
130+
--uri="$SERVICE_URL/run" \
131+
--oidc-service-account-email=$SERVICE_ACCOUNT_EMAIL \
132+
--http-method="PUT" \
133+
--headers="Content-Type=application/json" \
134+
--message-body-from-file="$PATH_TO_JSON"

0 commit comments

Comments
 (0)