95 lines
3.2 KiB
Bash
95 lines
3.2 KiB
Bash
#!/bin/bash
|
|
# 05-cloudrun-deploy.sh — Deploy OSVauco agent to Cloud Run via Docker + gcloud
|
|
# Run in: Cloud Shell or local terminal
|
|
# Requires: gcloud CLI (no ADK CLI needed)
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
ENV_FILE="${SCRIPT_DIR}/../.env"
|
|
if [ -f "${ENV_FILE}" ]; then
|
|
set -a; source "${ENV_FILE}"; set +a
|
|
fi
|
|
|
|
: "${PROJECT_ID:?Set PROJECT_ID in .env}"
|
|
: "${REGION:?Set REGION in .env}"
|
|
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE in .env}"
|
|
: "${AGENT_SA:?Set AGENT_SA in .env}"
|
|
|
|
REPO="${REGION}-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
|
|
IMAGE="${REPO}/osvauco-agent:latest"
|
|
AGENT_PATH="${SCRIPT_DIR}/../agents/core-logic"
|
|
|
|
echo "=== 05: Cloud Run Deploy ==="
|
|
|
|
bash "${SCRIPT_DIR}/00-authcheck.sh"
|
|
|
|
# Enable required APIs
|
|
gcloud services enable \
|
|
run.googleapis.com \
|
|
artifactregistry.googleapis.com \
|
|
cloudbuild.googleapis.com \
|
|
--project="${PROJECT_ID}" --quiet
|
|
|
|
# Create Artifact Registry repo if it doesn't exist
|
|
gcloud artifacts repositories describe osvauco-repo \
|
|
--location="${REGION}" --project="${PROJECT_ID}" &>/dev/null || \
|
|
gcloud artifacts repositories create osvauco-repo \
|
|
--repository-format=docker \
|
|
--location="${REGION}" \
|
|
--project="${PROJECT_ID}" --quiet
|
|
echo "✓ Artifact Registry repo ready"
|
|
|
|
# IAM for Cloud Build
|
|
PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
|
|
COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${COMPUTE_SA}" \
|
|
--role="roles/cloudbuild.builds.builder" --quiet
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${COMPUTE_SA}" \
|
|
--role="roles/secretmanager.secretAccessor" --quiet
|
|
echo "✓ IAM bindings applied"
|
|
|
|
# Configure Docker for Artifact Registry
|
|
gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
|
|
|
|
# Build image via Cloud Build (no local Docker needed)
|
|
echo "Building image via Cloud Build..."
|
|
gcloud builds submit "${AGENT_PATH}" \
|
|
--tag="${IMAGE}" \
|
|
--project="${PROJECT_ID}" \
|
|
--region="${REGION}"
|
|
echo "✓ Image built: ${IMAGE}"
|
|
|
|
# Deploy to Cloud Run
|
|
echo "Deploying to Cloud Run..."
|
|
gcloud run deploy "${CLOUD_RUN_SERVICE}" \
|
|
--image="${IMAGE}" \
|
|
--region="${REGION}" \
|
|
--project="${PROJECT_ID}" \
|
|
--service-account="${AGENT_SA}" \
|
|
--set-env-vars="GOOGLE_CLOUD_PROJECT=${PROJECT_ID},GOOGLE_CLOUD_LOCATION=${REGION},GOOGLE_GENAI_USE_VERTEXAI=True" \
|
|
--no-allow-unauthenticated \
|
|
--port=8080 \
|
|
--memory=1Gi \
|
|
--cpu=1 \
|
|
--min-instances=0 \
|
|
--max-instances=3 \
|
|
--quiet
|
|
|
|
echo ""
|
|
echo "=== 05: Cloud Run Deploy COMPLETE ==="
|
|
SERVICE_URL=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
|
|
--region="${REGION}" --project="${PROJECT_ID}" \
|
|
--format="value(status.url)" 2>/dev/null || echo "(pending)")
|
|
echo " Service URL: ${SERVICE_URL}"
|
|
echo ""
|
|
echo " To call (authenticated):"
|
|
echo " TOKEN=\$(gcloud auth print-identity-token)"
|
|
echo " curl -H \"Authorization: Bearer \$TOKEN\" -H 'Content-Type: application/json' \\"
|
|
echo " -d '{\"message\": \"Hello\"}' \${SERVICE_URL}/run"
|
|
echo ""
|
|
echo " COST NOTE: Cloud Run scales to 0. No idle cost."
|
|
echo " Delete with: gcloud run services delete ${CLOUD_RUN_SERVICE} --region=${REGION} --quiet"
|