107 lines
3.7 KiB
Bash
107 lines
3.7 KiB
Bash
#!/bin/bash
|
||
# 05-cloudrun-deploy.sh — Deploy OSVauco agent to Cloud Run via Docker + gcloud
|
||
# Run in: Cloud Shell or local terminal
|
||
# Requires: gcloud CLI (no ADK CLI needed)
|
||
|
||
set -euo pipefail
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||
ENV_FILE="${SCRIPT_DIR}/../.env"
|
||
if [ -f "${ENV_FILE}" ]; then
|
||
set -a; source "${ENV_FILE}"; set +a
|
||
fi
|
||
|
||
: "${PROJECT_ID:?Set PROJECT_ID in .env}"
|
||
: "${REGION:?Set REGION in .env}"
|
||
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE in .env}"
|
||
: "${AGENT_SA:?Set AGENT_SA in .env}"
|
||
|
||
REPO="${REGION}-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
|
||
IMAGE="${REPO}/osvauco-agent:latest"
|
||
AGENT_PATH="${SCRIPT_DIR}/../agents/core-logic"
|
||
|
||
echo "=== 05: Cloud Run Deploy ==="
|
||
|
||
bash "${SCRIPT_DIR}/00-authcheck.sh"
|
||
|
||
# Enable required APIs
|
||
gcloud services enable \
|
||
run.googleapis.com \
|
||
artifactregistry.googleapis.com \
|
||
cloudbuild.googleapis.com \
|
||
--project="${PROJECT_ID}" --quiet
|
||
|
||
# Resolve caller identity
|
||
CALLER=$(gcloud config get-value account 2>/dev/null)
|
||
echo "ℹ️ Deploying as: ${CALLER}"
|
||
|
||
# Grant caller permission to act as the agent service account
|
||
# (required for gcloud run deploy --service-account=...)
|
||
gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \
|
||
--member="user:${CALLER}" \
|
||
--role="roles/iam.serviceAccountUser" \
|
||
--project="${PROJECT_ID}" --quiet
|
||
echo "✓ iam.serviceAccountUser granted to ${CALLER} on ${AGENT_SA}"
|
||
|
||
# Create Artifact Registry repo if it doesn't exist
|
||
gcloud artifacts repositories describe osvauco-repo \
|
||
--location="${REGION}" --project="${PROJECT_ID}" &>/dev/null || \
|
||
gcloud artifacts repositories create osvauco-repo \
|
||
--repository-format=docker \
|
||
--location="${REGION}" \
|
||
--project="${PROJECT_ID}" --quiet
|
||
echo "✓ Artifact Registry repo ready"
|
||
|
||
# IAM for Cloud Build compute SA
|
||
PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
|
||
COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
|
||
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
||
--member="serviceAccount:${COMPUTE_SA}" \
|
||
--role="roles/cloudbuild.builds.builder" --quiet
|
||
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
||
--member="serviceAccount:${COMPUTE_SA}" \
|
||
--role="roles/secretmanager.secretAccessor" --quiet
|
||
echo "✓ IAM bindings applied"
|
||
|
||
# Configure Docker for Artifact Registry
|
||
gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
|
||
|
||
# Build image via Cloud Build (no local Docker needed)
|
||
echo "Building image via Cloud Build..."
|
||
gcloud builds submit "${AGENT_PATH}" \
|
||
--tag="${IMAGE}" \
|
||
--project="${PROJECT_ID}" \
|
||
--region="${REGION}"
|
||
echo "✓ Image built: ${IMAGE}"
|
||
|
||
# Deploy to Cloud Run
|
||
echo "Deploying to Cloud Run..."
|
||
gcloud run deploy "${CLOUD_RUN_SERVICE}" \
|
||
--image="${IMAGE}" \
|
||
--region="${REGION}" \
|
||
--project="${PROJECT_ID}" \
|
||
--service-account="${AGENT_SA}" \
|
||
--set-env-vars="GOOGLE_CLOUD_PROJECT=${PROJECT_ID},GOOGLE_CLOUD_LOCATION=${REGION},GOOGLE_GENAI_USE_VERTEXAI=True" \
|
||
--no-allow-unauthenticated \
|
||
--port=8080 \
|
||
--memory=1Gi \
|
||
--cpu=1 \
|
||
--min-instances=0 \
|
||
--max-instances=3 \
|
||
--quiet
|
||
|
||
echo ""
|
||
echo "=== 05: Cloud Run Deploy COMPLETE ==="
|
||
SERVICE_URL=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
|
||
--region="${REGION}" --project="${PROJECT_ID}" \
|
||
--format="value(status.url)" 2>/dev/null || echo "(pending)")
|
||
echo " Service URL: ${SERVICE_URL}"
|
||
echo ""
|
||
echo " To call (authenticated):"
|
||
echo " TOKEN=\$(gcloud auth print-identity-token)"
|
||
echo " curl -H \"Authorization: Bearer \$TOKEN\" -H 'Content-Type: application/json' \\"
|
||
echo " -d '{\"message\": \"Hello\"}' \${SERVICE_URL}/run"
|
||
echo ""
|
||
echo " COST NOTE: Cloud Run scales to 0. No idle cost."
|
||
echo " Delete with: gcloud run services delete ${CLOUD_RUN_SERVICE} --region=${REGION} --quiet"
|