Deploy on Cloud Run and view security insights

Set default settings

1. Set an environment variable for project ID:

   export PROJECT_ID=$(gcloud config get project)
   

2. Set the default region for Cloud Deploy:

   gcloud config set deploy/region us-central1
   

Grant access

Grant IAM roles to the default Compute Engine service account. This is required for Cloud Deploy to deploy workloads into Cloud Run.

 gcloud projects add-iam-policy-binding $PROJECT_ID \
     --member=serviceAccount:$(gcloud projects describe $PROJECT_ID \
     --format="value(projectNumber)")[email protected] \
     --role="roles/clouddeploy.jobRunner"
 gcloud iam service-accounts add-iam-policy-binding $(gcloud projects describe $PROJECT_ID \
     --format="value(projectNumber)")[email protected] \
     --member=serviceAccount:$(gcloud projects describe $PROJECT_ID \
     --format="value(projectNumber)")[email protected] \
     --role="roles/iam.serviceAccountUser" \
     --project=$PROJECT_ID
 gcloud projects add-iam-policy-binding $PROJECT_ID \
     --member=serviceAccount:$(gcloud projects describe $PROJECT_ID \
     --format="value(projectNumber)")[email protected] \
     --role="roles/run.developer"

If you have trouble adding either of these roles, contact your project administrator.

Create a Docker repository in Artifact Registry

1. Create a new Docker repository named containers in the location us-central1 with the description "Docker repository":

   gcloud artifacts repositories create containers --repository-format=docker \
       --location=us-central1 --description="Docker repository"
   

2. Verify that your repository was created:

   gcloud artifacts repositories list
   

   You should see containers in the list of displayed repositories.

Prepare sample application

You'll need some sample source code to build and deploy. In this section, you'll clone an existing source repository containing a Java code sample.

1. Clone the repository that contains the Java code sample:

   git clone https://github.com/googlecloudplatform/software-delivery-shield-demo-java.git
   cd software-delivery-shield-demo-java/backend
   

2. Update cloudrun.clouddeploy.yaml to replace PROJECT_ID with your project ID:

   sed -i "s/PROJECT_ID/${PROJECT_ID}/g" cloudrun.clouddeploy.yaml
   

Build the application

1. Build and containerize the Java application using Cloud Build. The following command builds and containerizes the Java application and stores the built container in the Artifact Registry docker repository:

   gcloud builds submit --config=cloudbuild.yaml --region=us-central1
   

   After the build completes, you see a success status message similar to the following:

   DONE
   -----------------------------------------------------------------------------
   ID: 3e08565f-7f57-4449-bc68-51c46cf33d03
   CREATE_TIME: 2022-09-19T15:41:07+00:00
   DURATION: 54S
   SOURCE: gs://sds-docs-project_cloudbuild/source/1663602066.777581-6ebe4b2d6fd741ffa18936d7f78055e9.tgz
   IMAGES: us-central1-docker.pkg.dev/sds-docs-project/containers/java-guestbook-backend:quickstart
   STATUS: SUCCESS
   

Generate SBOM for the built image

An SBOM is a full inventory of an application, identifying the packages your software relies on. The contents can include third-party software from vendors, internal artifacts, and open source libraries.

Generate the SBOM for the image you built in the previous section:

gcloud artifacts sbom export \
    --uri=us-central1-docker.pkg.dev/${PROJECT_ID}/containers/java-guestbook-backend:quickstart

Deploy the container on Cloud Run using Cloud Deploy

1. Register your pipeline and targets with the Cloud Deploy service:

   gcloud deploy apply --file cloudrun.clouddeploy.yaml
   

   You now have a pipeline, with targets, ready to deploy your application to your first target.

2. To verify that your pipeline exists, go to the Delivery pipelines page in the Google Cloud console:

   Open the Delivery pipelines page

   The delivery pipeline you just created, cloudrun-guestbook-backend-delivery is displayed.

3. Click cloudrun-guestbook-backend-delivery to monitor progress. The Delivery pipeline details page opens.

4. In Cloud Shell, create a release in Cloud Deploy:

   gcloud deploy releases create test-release-007 \
       --delivery-pipeline=cloudrun-guestbook-backend-delivery \
       --skaffold-file=cloudrun.skaffold.yaml \
       --images=java-guestbook-backend=us-central1-docker.pkg.dev/${PROJECT_ID}/containers/java-guestbook-backend:quickstart
   

   The new release appears in the Releases section on the Delivery pipeline details page.

5. Monitor the Pipeline visualization view on the Delivery pipeline details page until the Promote button displays for dev-cluster. You might need to refresh the page.

6. On the first target in the delivery pipeline visualization, cloudrun-dev, click Promote.

   The Promote release dialog is shown. It shows the details of the target you're promoting to.

7. Click Promote.

   The release is now queued for deployment into cloudrun-prod. When deployment is complete, the delivery pipeline visualization shows it as deployed:

   

View security insights in Cloud Deploy

1. Open the Cloud Deploy Delivery pipelines page in the Google Cloud console.

   Open the Cloud Deploy page

2. In the Delivery pipelines table, click cloudrun-guestbook-backend-delivery.

3. In the Delivery pipelines details page, click test-release-008.

4. In the Release details page, click the Artifacts tab.

5. In the Build artifacts table, locate the row with the artifact java-guestbook-backend, and under the corresponding Security insights column, click View.

You see the Security tab for deployment.

This tab displays the following information in the Security insights section:

• SLSA Level: This build has achieved SLSA Level 3. Click the Learn more link to learn what this security level means.

• Vulnerabilities: Any vulnerabilities found in your artifacts. Click the image name (java-guestbook-backend) to see the artifacts that have been scanned for vulnerabilities.

• Dependencies for the build artifacts.

• Build details: Details of the build such as the builder and the link to view logs.

View security insights in Cloud Run

1. Open the Cloud Run Services page.

   Open the Cloud Run Services page

2. In the Cloud Run Services table, click guestbook-backend-prod.

3. In the Service details page, click Revisions.

4. In the Revisions panel, click Security.

You see the Security tab for deployment.

This tab displays the following information in the Security insights section:

• Identity and encryption: The email address of the default Compute Engine service account and the encryption key used for the deployment.

• SLSA Level: This build has achieved SLSA Level 3. Click the Learn more link to learn what this security level means.

• Vulnerabilities: Any vulnerabilities found in your artifacts. Click the image name (java-guestbook-backend) to see the artifacts that have been scanned for vulnerabilities.

• Dependencies for the build artifacts.

• Build details: Details of the build such as the builder and the link to view logs.