在 Cloud Deploy 中自动执行版本提升和发布推进

准备工作

1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Roles required to select or create a project

   • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
   • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

   Go to project selector

2. Verify that billing is enabled for your Google Cloud project.

3. Enable the Cloud Deploy, Cloud Build, GKE, Cloud Run, and Cloud Storage APIs, if any are not already enabled.

   Roles required to enable APIs

   To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

   Enable the APIs

4. 安装 Google Cloud CLI。

5. 配置 gcloud CLI 以使用您的联合身份。

   如需了解详情，请参阅使用联合身份登录 gcloud CLI。

6. 如需初始化 gcloud CLI，请运行以下命令：

   gcloud init

如果您已安装 CLI，请确保您运行的是最新版本：

gcloud components update

7. 确保 默认 Compute Engine 服务账号 具有足够的权限。

   服务帐号可能已经拥有必要的权限。针对默认服务账号停用自动角色授予的项目包含这些步骤。

   1. 首先添加 clouddeploy.jobRunner 角色：

      gcloud projects add-iam-policy-binding PROJECT_ID \
          --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
          --format="value(projectNumber)")-compute@ \
          --role="roles/clouddeploy.jobRunner"
      

   2. 添加 clouddeploy.releaser 角色：

      gcloud projects add-iam-policy-binding PROJECT_ID \
          --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
          --format="value(projectNumber)")-compute@ \
          --role="roles/clouddeploy.releaser"
      

   3. 为您的特定运行时添加开发者角色。
   • 对于 GKE：

     gcloud projects add-iam-policy-binding PROJECT_ID \
         --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
         --format="value(projectNumber)")-compute@ \
         --role="roles/container.developer"
     

   • 对于 Cloud Run：

     gcloud projects add-iam-policy-binding PROJECT_ID \
         --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
         --format="value(projectNumber)")-compute@ \
         --role="roles/run.developer"
     

   4. 添加 iam.serviceAccountUser 角色，其中包括默认服务帐号向运行时部署的 actAs 权限：

      gcloud iam service-accounts add-iam-policy-binding $(gcloud projects describe PROJECT_ID \
          --format="value(projectNumber)")-compute@ \
          --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
          --format="value(projectNumber)")-compute@ \
          --role="roles/iam.serviceAccountUser" \
          --project=PROJECT_ID
      

   5. 添加 iam.serviceAccountUser 角色，其中包括您自己使用默认服务帐号的 actAs 权限：

      gcloud iam service-accounts add-iam-policy-binding $(gcloud projects describe PROJECT_ID \
          --format="value(projectNumber)")-compute@ \
          --member=user:YOUR_EMAIL_ADDRESS \
          --role="roles/iam.serviceAccountUser" \
          --project=PROJECT_ID
      

      在本例中，YOUR_EMAIL_ADDRESS 是您用于访问 Google Cloud 的电子邮件地址。

创建运行时环境

如果您要部署到 Cloud Run，则可以跳过此命令。

对于 GKE，请使用默认设置创建两个集群：automation-quickstart-cluster-dev 和 automation-quickstart-cluster-staging。集群的 Kubernetes API 端点必须可通过公共互联网访问。默认情况下，GKE 集群可从外部访问。

gcloud container clusters create-auto automation-quickstart-cluster-dev \
                 --project=PROJECT_ID \
                 --region=us-central1 \
                 && gcloud container clusters create-auto automation-quickstart-cluster-staging \
                 --project=PROJECT_ID \
                 --region=us-central1