croguerrero / apppython

Deploy a Python App with Cloud Run and GitActions.

Objectives

1. Create a simple REST API with Python.
2. Write a unit test for your code.
3. Create a Dockerfile.
4. Create a GitHub Action workflow file to deploy your code on Cloud Run.
5. Make the code acessible for anyone

Cloud Run

To make your life easier, export these environment variables so that you can copy and paste the commands used here. Choose whatever name you want, but the $PROJECT_ID has to be a unique name, because project IDs can't be reused in Google Cloud.

export PROJECT_ID=
export ACCOUNT_NAME=

For example, your commands should look something like this:

export PROJECT_ID=project-example
export ACCOUNT_NAME=account-example

Log in with your Google account:

gcloud auth login

Create a project and select that project:

gcloud projects create $PROJECT_ID
gcloud config set project $PROJECT_ID

Enable billing for your project, and create a billing profile if you don’t have one:

open "https://console.cloud.google.com/billing/linkedaccount?project=$PROJECT_ID"

Enable the necessary services:

gcloud services enable cloudbuild.googleapis.com run.googleapis.com containerregistry.googleapis.com

Create a service account:

gcloud iam service-accounts create $ACCOUNT_NAME \
  --description="Cloud Run deploy account" \
  --display-name="Cloud-Run-Deploy"

Give the service account Cloud Run Admin, Storage Admin, and Service Account User roles. You can’t set all of them at once, so you have to run separate commands:

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member=serviceAccount:$ACCOUNT_NAME@$PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/run.admin

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member=serviceAccount:$ACCOUNT_NAME@$PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/storage.admin

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member=serviceAccount:$ACCOUNT_NAME@$PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/iam.serviceAccountUser

Generate a key.json file with your credentials, so your GitHub workflow can authenticate with Google Cloud:

gcloud iam service-accounts keys create key.json \
    --iam-account $ACCOUNT_NAME@$PROJECT_ID.iam.gserviceaccount.com