Setting up CI/CD for Google Cloud Run with Github Actions

Created February 12, 2023

💡Purpose

Setting up automated CI/CD pipelines can be a great way to minimise human error in the testing and delivery of software components. This short guide will help you get set up with GitHub Actions-powered CI/CD pipeline for a Google Cloud Run service.

🌍 Context

To use this guide, you’ll need to have the following prerequisites satisfied:

• A Google Cloud Platform account, with a project and billing account configured
• The Google Cloud Container Registry API enabled
• The Google Cloud IAM Service Account API enabled
• The gcloud installed and updated

It also assumes you have some basic familiarity with GitHub Actions and Google Cloud. This guide was written to pair with the Google Cloud Run Job and Google Cloud Run Service GitHub template projects.

✅ Procedure

🔑 Generate your credentials

<aside> 💡 This procedure uses Google’s Workload Identity Federation implementation to facilitate keyless authentication. If you haven’t come across this idea, check out the explanation below, or Google’s own docs.

</aside>

<aside> ⚠️ Be aware that if you choose to use separate development and production environments, you will need to generate credentials for each environment (by using two different PROJECT_IDs. The Google Cloud Run Service and Google Cloud Run Job template projects both assume distinct development and production environments.

</aside>

1. Create a Service Account to use with your GitHub Action. This service account will need permission to read and write to Google Cloud Storage, and Deploy Google Cloud Run Jobs and Services. If you already have a Service Account set up with these permissions that you’d like to use, skip this step. Otherwise, head to IAM & Admin in Google Cloud Console, select Service Accounts and ‘Create Service Account’. Give your new Service Account a meaningful name (e.g. cloud-run-github-deployer or similar). Associate your new Service Account with the following roles:

   • Storage Admin
   • Cloud Run Service Agent
   • Cloud Run Developer

   If you prefer, you can create this Service Account directly via the gcloud CLI tool. Note that Storage Admin provides elevated access to your Google Cloud Storage resources. Use with care.

2. Prepare your local environment for generating your Google Credentials.

   • REPO - The name of the repository you are setting the pipeline up for. This must include both the owner of the repo and the repo’s own name (e.g. google/python-fire where google is the ‘owner’ and python-fire is the repo name.
   • PROJECT_ID - This is the name of the Google Cloud project you’d like your Cloud Run Job or Service to be deployed into.
   • SERVICE_ACCOUNT - This is the email address associated with the Service Account you created in step 1, for example cloud-run-github-deployer@{PROJECT_ID}.iam.gserviceaccount.com.
   • SERVICE_NAME - This is the name of the Cloud Run Service or Job as it will appear within Google Cloud Run. It can be whatever you want it to be (though of course: make it usefully descriptive), but must be unique within the given Google Project/environment.
   • POOL_NAME - The name of the Workload Identity Pool that will be associated with your GitHub Action Workload Identity (i.e. the keyless credentials that allow GitHub and Google to communicate). This should be something like github or github-actions. If you’ve already created a pool for another GitHub Action-powered CI/CD pipeline, you can use that.

3. Create a new Workload Identity Pool with the following command:

   gcloud iam workload-identity-pools create ${POOL_NAME} \
     --location=global \
     --project=${PROJECT_ID} \
     --display-name='Github Actions'
   

4. You now need to set WORKLOAD_IDENDITY_POOL_ID in your environment by running the following command:

   export WORKLOAD_IDENTITY_POOL_ID=$(gcloud iam workload-identity-pools describe ${POOL_NAME} \
     --project=${PROJECT_ID} \
     --location="global" \
     --format="value(name)")