0

I'm trying to deploy a website for my friend to gcloud. I can deploy it from my local machine with following commands:

gcloud artifacts repositories create <repo_name> \
 --repository-format=docker \
 --location=us-central1 \
 --description="Docker repo"

gcloud builds submit \
  --region=us-central1 \
  --tag us-central1-docker.pkg.dev/<project_id>/<service_id>/website:<tag>

gcloud run deploy --image=us-central1-docker.pkg.dev/<project_id>/<service_id>/website:<tag>

and it works.

I tried to use github actions to not do it manually. I added a new workflow from github website and picked preset.

Build and Deploy to Cloud Run. Build a Docker container, publish it to Google Artifact Registry, and deploy to Google Cloud Run.

It gave me a file .github/workflows/google-cloudrun-docker.yml With following content

# This workflow build and push a Docker container to Google Artifact Registry
# and deploy it on Cloud Run when a commit is pushed to the "main"
# branch.
#
# To configure this workflow:
#
# 1. Enable the following Google Cloud APIs:
#
#    - Artifact Registry (artifactregistry.googleapis.com)
#    - Cloud Run (run.googleapis.com)
#    - IAM Credentials API (iamcredentials.googleapis.com)
#
#    You can learn more about enabling APIs at
#    https://support.google.com/googleapi/answer/6158841.
#
# 2. Create and configure a Workload Identity Provider for GitHub:
#    https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation.
#
#    Depending on how you authenticate, you will need to grant an IAM principal
#    permissions on Google Cloud:
#
#    - Artifact Registry Administrator (roles/artifactregistry.admin)
#    - Cloud Run Developer (roles/run.developer)
#
#    You can learn more about setting IAM permissions at
#    https://cloud.google.com/iam/docs/manage-access-other-resources
#
# 3. Change the values in the "env" block to match your values.

name: 'Build and Deploy to Cloud Run'

on:
  push:
    branches:
      - main

env:
  PROJECT_ID: <project_id> # TODO: update to your Google Cloud project ID
  REGION: 'us-central1' # TODO: update to your region
  SERVICE: 'my-service' # TODO: update to your service name
  WORKLOAD_IDENTITY_PROVIDER: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: update to your workload identity provider

jobs:
  deploy:
    runs-on: 'ubuntu-latest'

    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4

      # Configure Workload Identity Federation and generate an access token.
      #
      # See https://github.com/google-github-actions/auth for more options,
      # including authenticating via a JSON credentials file.
      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2
        with:
          workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}'

      # BEGIN - Docker auth and build
      #
      # If you already have a container image, you can omit these steps.
      - name: 'Docker Auth'
        uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # docker/login-action@v3
        with:
          username: 'oauth2accesstoken'
          password: '${{ steps.auth.outputs.auth_token }}'
          registry: '${{ env.REGION }}-docker.pkg.dev'

      - name: 'Build and Push Container'
        run: |-
          DOCKER_TAG="$${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}"
          docker build --tag "${DOCKER_TAG}" .
          docker push "${DOCKER_TAG}"
      - name: 'Deploy to Cloud Run'

        # END - Docker auth and build

        uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2
        with:
          service: '${{ env.SERVICE }}'
          region: '${{ env.REGION }}'
          # NOTE: If using a pre-built image, update the image name below:

          image: '${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}'
      # If required, use the Cloud Run URL output in later steps
      - name: 'Show output'
        run: |2-

          echo ${{ steps.deploy.outputs.url }}

I followed all instructions from comments and obtained missing info. When I push to main the action was triggered but it couldn't push.

When I compared the configurations I found out that when I deploy manually I use this for docker tag us-central1-docker.pkg.dev/<project_id>/<service_id>/website:<tag> where github uses us-central1-docker.pkg.dev/<project_id>/<service_id>:<tag> and it just couldn't push until I added website.

I somehow got to deploy step, but it fails. I fixed few issues with deploy but I stuck on last one.

 ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Cloud Run Admin API has not been used in project developer before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/run.googleapis.com/overview?project=developer then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

The problem that is my project id is not developer. And I don't get from where it's coming from.

I still can deploy manually. I assume the github action setup should be done in one minute and not so complex.

Please help.

3
  • It's unclear to me how the workflow was generated but it looks reasonably good except some typos and, as you've found, the incorrect Artifact Registry repository reference (you're correct that you need ${PROJECT}/${REPOSITORY}/${IMAGE}:${TAG}). For the deploy step, you should (!?) be able to reference PROJECT_ID, add project_id: '${{ env.PROJECT_ID }} to the with block (see project_id).
    – DazWilkin
    Commented Dec 10 at 17:31
  • Thanks, it worked. However, I traced the issue further and believe it stems from using the wrong service account. I used the default one, which includes @developer, and I assume this is where it derives the project ID. When I created a new service account with my project ID, I started encountering permission issues. I suspect this is because workload identity federation doesn't support this service account. I’m continuing to investigate and will provide an update as soon as I find origin of my issues. Anyway, thanks a lot Commented 2 days ago
  • Yes, your diagnosis is reasonable. The default Compute Engine Service Account is Google-owned (not Project-scoped). When you create a user-managed Service Account, it must be associated with a Project.
    – DazWilkin
    Commented 2 days ago

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.