docs: IAP-SETUP kartlegging av Cloud Run-tjenester 2026-05-25
This commit is contained in:
parent
74f9e3c06f
commit
6866cff1a2
|
|
@ -1,97 +1,138 @@
|
|||
> **STATUS (2026-05-25):** Ikke startet — Phase 5 scope.
|
||||
> `opax.vauco.no` svarer `{"status":"ok"}` på `/health` uten IAP.
|
||||
> IAP-oppsett starter når Phase 4 docs hardening er fullført.
|
||||
> Neste ansvarlig: OPS · Gate: ingen (Phase 5 er neste roadmap-steg)
|
||||
> **STATUS (2026-05-25):** IAP API aktivert (`iap.googleapis.com` ✅). Kartlegging av Cloud Run-tjenester fullført.
|
||||
> OAuth-klient `Vauco OS Web App` (`357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`) identifisert og klar for IAP-bruk.
|
||||
> Beslutning: Fokuserer IAP-beskyttelse på `osvauco-agent` (OPAX-hub). `vauco-tui-bridge` vurderes separat.
|
||||
> Neste steg: Opprett serverless NEG + backend service for valgt tjeneste.
|
||||
|
||||
# Google Cloud IAP Setup Guide
|
||||
|
||||
This guide provides the `gcloud` commands to configure Identity-Aware Proxy (IAP) for the Vauco TUI Bridge, securing it so that only `user:chris.christiansen@vauco.no` can access it.
|
||||
This guide configures Identity-Aware Proxy (IAP) for `opax.vauco.no`, restricting access to `user:chris.christiansen@vauco.no`.
|
||||
|
||||
## 1. Enable Required APIs
|
||||
---
|
||||
|
||||
First, enable the IAP API for your project.
|
||||
## Kartlegging — Cloud Run-tjenester (2026-05-25)
|
||||
|
||||
Live output fra `gcloud run services list --platform=managed --project=propane-will-491900-m5`:
|
||||
|
||||
| Service | Region | URL | Sist deployet |
|
||||
|---|---|---|---|
|
||||
| `billing-auto-teardown` | us-central1 | https://billing-auto-teardown-357036551735.us-central1.run.app | 2026-05-23 |
|
||||
| `jason-bot` | europe-north1 | https://jason-bot-357036551735.europe-north1.run.app | 2026-04-10 |
|
||||
| `osvauco-agent` | us-central1 | https://osvauco-agent-357036551735.us-central1.run.app | 2026-05-24 |
|
||||
| `vauco-tui-bridge` | europe-west1 | https://vauco-tui-bridge-357036551735.europe-west1.run.app | 2026-05-17 |
|
||||
|
||||
**IAP-mål:** `osvauco-agent` (us-central1) — OPAX-hub, sist deployet, mest aktiv.
|
||||
|
||||
**OAuth-klient klar:**
|
||||
- Navn: `Vauco OS Web App`
|
||||
- Client ID: `357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com`
|
||||
- Client secret: lagret lokalt (ikke i repo)
|
||||
|
||||
---
|
||||
|
||||
## Steg 1 — Aktiver IAP API
|
||||
|
||||
```bash
|
||||
gcloud services enable iap.googleapis.com
|
||||
gcloud services enable iap.googleapis.com --project=propane-will-491900-m5
|
||||
```
|
||||
✅ Fullført 2026-05-25.
|
||||
|
||||
---
|
||||
|
||||
## Steg 2 — Opprett Serverless NEG for osvauco-agent
|
||||
|
||||
```bash
|
||||
gcloud compute network-endpoint-groups create opax-neg \
|
||||
--region=us-central1 \
|
||||
--network-endpoint-type=serverless \
|
||||
--cloud-run-service=osvauco-agent \
|
||||
--project=propane-will-491900-m5
|
||||
```
|
||||
|
||||
## 2. Deploy the Service and Create a Load Balancer
|
||||
---
|
||||
|
||||
Deploy your Cloud Run service (if you haven't already using the `deploy_cloudrun.sh` script) and then set up a global external HTTPS load balancer that points to it.
|
||||
## Steg 3 — Opprett Backend Service
|
||||
|
||||
### Create a Serverless NEG
|
||||
```bash
|
||||
gcloud compute network-endpoint-groups create vauco-tui-bridge-neg
|
||||
--region=europe-west1
|
||||
--network-endpoint-type=serverless
|
||||
--cloud-run-service=vauco-tui-bridge
|
||||
gcloud compute backend-services create opax-backend \
|
||||
--global \
|
||||
--project=propane-will-491900-m5
|
||||
|
||||
gcloud compute backend-services add-backend opax-backend \
|
||||
--global \
|
||||
--network-endpoint-group=opax-neg \
|
||||
--network-endpoint-group-region=us-central1 \
|
||||
--project=propane-will-491900-m5
|
||||
```
|
||||
|
||||
### Create a Backend Service
|
||||
---
|
||||
|
||||
## Steg 4 — URL Map + HTTPS Proxy + SSL-sertifikat
|
||||
|
||||
```bash
|
||||
gcloud compute backend-services create vauco-tui-bridge-backend
|
||||
--global
|
||||
gcloud compute url-maps create opax-url-map \
|
||||
--default-service opax-backend \
|
||||
--project=propane-will-491900-m5
|
||||
|
||||
gcloud compute ssl-certificates create opax-cert \
|
||||
--domains=opax.vauco.no \
|
||||
--project=propane-will-491900-m5
|
||||
|
||||
gcloud compute target-https-proxies create opax-https-proxy \
|
||||
--url-map=opax-url-map \
|
||||
--ssl-certificates=opax-cert \
|
||||
--project=propane-will-491900-m5
|
||||
|
||||
gcloud compute forwarding-rules create opax-forwarding-rule \
|
||||
--global \
|
||||
--target-https-proxy=opax-https-proxy \
|
||||
--ports=443 \
|
||||
--project=propane-will-491900-m5
|
||||
```
|
||||
|
||||
### Add the NEG to the Backend Service
|
||||
---
|
||||
|
||||
## Steg 5 — Aktiver IAP på Backend Service
|
||||
|
||||
```bash
|
||||
gcloud compute backend-services add-backend vauco-tui-bridge-backend
|
||||
--global
|
||||
--network-endpoint-group=vauco-tui-bridge-neg
|
||||
--network-endpoint-group-region=europe-west1
|
||||
gcloud iap web enable \
|
||||
--resource-type=backend-service \
|
||||
--service=opax-backend \
|
||||
--oauth2-client-id=357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com \
|
||||
--oauth2-client-secret=DIN_CLIENT_SECRET \
|
||||
--project=propane-will-491900-m5
|
||||
```
|
||||
|
||||
### Create a URL Map
|
||||
```bash
|
||||
gcloud compute url-maps create vauco-tui-bridge-url-map
|
||||
--default-service vauco-tui-bridge-backend
|
||||
```
|
||||
> ⚠️ Erstatt `DIN_CLIENT_SECRET` med secret lagret lokalt. Aldri commit denne verdien.
|
||||
|
||||
### Create a Target HTTPS Proxy
|
||||
```bash
|
||||
# You will need a managed SSL certificate for this step
|
||||
gcloud compute ssl-certificates create vauco-tui-bridge-cert
|
||||
--domains=your-domain.com # Replace with your actual domain
|
||||
---
|
||||
|
||||
gcloud compute target-https-proxies create vauco-tui-bridge-https-proxy
|
||||
--url-map=vauco-tui-bridge-url-map
|
||||
--ssl-certificates=vauco-tui-bridge-cert
|
||||
```
|
||||
|
||||
### Create a Global Forwarding Rule (This creates the Load Balancer)
|
||||
```bash
|
||||
gcloud compute forwarding-rules create vauco-tui-bridge-forwarding-rule
|
||||
--global
|
||||
--target-https-proxy=vauco-tui-bridge-https-proxy
|
||||
--ports=443
|
||||
```
|
||||
|
||||
## 3. Enable IAP on the Backend Service
|
||||
|
||||
Now, enable IAP for the backend service you created. You will need your OAuth2 client ID and secret, which can be created in the Google Cloud Console under "APIs & Services" -> "Credentials".
|
||||
|
||||
### Get the Backend Service ID
|
||||
```bash
|
||||
BACKEND_SERVICE_ID=$(gcloud compute backend-services describe vauco-tui-bridge-backend --global --format="value(id)")
|
||||
```
|
||||
|
||||
### Enable IAP
|
||||
```bash
|
||||
gcloud iap web enable --resource-type=backend-service --service=vauco-tui-bridge-backend
|
||||
```
|
||||
|
||||
## 4. Grant Access to the User
|
||||
|
||||
Grant the `IAP-secured Web App User` role to `chris.christiansen@vauco.no`.
|
||||
## Steg 6 — Gi tilgang til chris.christiansen@vauco.no
|
||||
|
||||
```bash
|
||||
gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID>
|
||||
--member="user:chris.christiansen@vauco.no"
|
||||
gcloud projects add-iam-policy-binding propane-will-491900-m5 \
|
||||
--member="user:chris.christiansen@vauco.no" \
|
||||
--role="roles/iap.httpsResourceAccessor"
|
||||
```
|
||||
|
||||
## 5. Verify Access
|
||||
---
|
||||
|
||||
- **Verify access for `chris.christiansen@vauco.no`**: Open a browser where you are logged in as `chris.christiansen@vauco.no` and navigate to the HTTPS URL of the load balancer. You should be able to access the bridge's root endpoint.
|
||||
## Steg 7 — Verifiser
|
||||
|
||||
- **Verify access is denied for other accounts**: Open an incognito browser window or a browser where you are logged in with a different Google account. Navigate to the same URL. You should see a "You don't have access" message from Google, not the application.
|
||||
```bash
|
||||
# Sjekk at IAP er aktivert
|
||||
gcloud iap web get-iam-policy \
|
||||
--resource-type=backend-service \
|
||||
--service=opax-backend \
|
||||
--project=propane-will-491900-m5
|
||||
|
||||
# Sjekk at opax.vauco.no svarer med IAP-redirect (ikke direkte JSON)
|
||||
curl -I https://opax.vauco.no/health
|
||||
# Forventet: HTTP 302 redirect til accounts.google.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## vauco-tui-bridge — parkert til separat vurdering
|
||||
|
||||
`vauco-tui-bridge` (europe-west1) har eksisterende NEG-referanser i tidligere versjoner av dette dokumentet.
|
||||
IAP for denne tjenesten aktiveres i egen fase etter at `osvauco-agent`-IAP er verifisert.
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user