Verify your application after deploying it

This quickstart shows you how to use Cloud Deploy to verify your deployed application, as part of the delivery pipeline.

In this quickstart, you'll do the following:

  1. Create one GKE cluster or one Cloud Run service.

    You can use deploy verification on GKE attached clusters too, but this quickstart uses GKE and Cloud Run only.

  2. Define your Cloud Deploy delivery pipeline and deployment target.

    The delivery pipeline includes only one stage and uses only one target. You define the configuration for the deploy verification in the stage stanza.

  3. Create a Skaffold configuration which is needed by the release, and either a Kubernetes manifest or a Cloud Run service definition.

  4. Create a release, which automatically deploys to the target.

    After the application is deployed, the verification is run as a phase of the rollout.

  5. View the results of the verification in the Cloud Build logs, using the Cloud Deploy Rollout details page in Google Cloud console.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Cloud Deploy, Cloud Build, GKE, Cloud Run, and Cloud Storage APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  5. Install the Google Cloud CLI.

  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  7. To initialize the gcloud CLI, run the following command: 

    gcloud init

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Cloud Deploy, Cloud Build, GKE, Cloud Run, and Cloud Storage APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  11. Install the Google Cloud CLI.

  12. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  13. To initialize the gcloud CLI, run the following command: 

    gcloud init

    14. If you already have the CLI installed, make sure you're running the latest version: 

    gcloud components update

  14. Make sure the default Compute Engine service account has sufficient permissions.

    The service account might already have the necessary permissions. These steps are included for projects that disable automatic role grants for default service accounts.

    1. First add the clouddeploy.jobRunner role: 

      gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
    --format="value(projectNumber)")-compute@developer.gserviceaccount.com \
    --role="roles/clouddeploy.jobRunner"

    2. Add the developer role for your specific runtime.
      • For GKE: 

        gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
    --format="value(projectNumber)")-compute@developer.gserviceaccount.com \
    --role="roles/container.developer"

      • For Cloud Run: 

        gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
    --format="value(projectNumber)")-compute@developer.gserviceaccount.com \
    --role="roles/run.developer"

    3. Add the iam.serviceAccountUser role, which includes the actAspermission to deploy to the runtime:

      gcloud iam service-accounts add-iam-policy-binding $(gcloud projects describe PROJECT_ID \
    --format="value(projectNumber)")-compute@developer.gserviceaccount.com \
    --member=serviceAccount:$(gcloud projects describe PROJECT_ID \
    --format="value(projectNumber)")-compute@developer.gserviceaccount.com \
    --role="roles/iam.serviceAccountUser" \
    --project=PROJECT_ID

Create your runtime environment

If you're deploying to Cloud Run, you can skip this command.

For GKE, create one cluster: deploy-verification-cluster, with default settings. The cluster's Kubernetes API endpoint must be network-reachable from the public internet. GKE clusters are externally accessible by default.

gcloud container clusters create-auto deploy-verification-cluster \
                 --project=PROJECT_ID \
                 --region=us-central1

Create your delivery pipeline and targets

You can define your pipeline and targets in one file or in separate files. In this quickstart, you create a single file.

  1. Open a terminal window.

  2. Create a new directory and navigate into it.

    GKE 

    mkdir deploy-verification-gke-quickstart
cd deploy-verification-gke-quickstart

    Cloud Run 

    mkdir deploy-verification-run-quickstart
cd deploy-verification-run-quickstart

  3. Create your delivery pipeline and target definition:

    GKE

    In the deploy-verification-gke-quickstart directory, create a new file: clouddeploy.yaml, with the following contents:

    apiVersion: deploy.cloud.google.com/v1
kind: DeliveryPipeline
metadata:
  name: deploy-verification-demo-app-gke-1
description: main application pipeline
serialPipeline:
  stages:
  - targetId: verify-staging
    profiles: []
    strategy:
      standard:
        verify:
          tasks:
          - type: container
            image: ubuntu
            command: ["/bin/sh"]
            args: ["-c", 'echo "Your test or tests would go here."' ]
---

apiVersion: deploy.cloud.google