Skip to main content

Cloud Build

1 - Overview​

Cloud Build is a serverless CI/CD service that runs builds on Google Cloud infrastructure.

2 - cloudbuild.yaml​

2.1 Basic structure​

# cloudbuild.yaml
steps:
  - name: 'gcr.io/cloud-builders/npm'
    args: ['install']
  
  - name: 'gcr.io/cloud-builders/npm'
    args: ['test']
  
  - name: 'gcr.io/cloud-builders/npm'
    args: ['run', 'build']

images:
  - 'gcr.io/$PROJECT_ID/mon-app:$COMMIT_SHA'

options:
  logging: CLOUD_LOGGING_ONLY
  machineType: 'E2_HIGHCPU_8'

timeout: '1200s'

2.2 Build steps​

steps:
  # Use an official builder
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', 'gcr.io/$PROJECT_ID/app', '.']
  
  # Use any Docker image
  - name: 'node:18'
    entrypoint: 'npm'
    args: ['test']
  
  # Shell script
  - name: 'ubuntu'
    script: |
      #!/bin/bash
      echo "Running script"
      ls -la
  
  # With a working directory
  - name: 'gcr.io/cloud-builders/npm'
    args: ['install']
    dir: 'frontend'

3 - Variables and substitutions​

3.1 Default variables​

VariableDescription
$PROJECT_IDProject ID
$BUILD_IDUnique build ID
$COMMIT_SHACommit SHA
$SHORT_SHAShort SHA (7 characters)
$BRANCH_NAMEBranch name
$TAG_NAMETag name
$REPO_NAMERepository name

3.2 Custom substitutions​

substitutions:
  _ENVIRONMENT: 'production'
  _REGION: 'europe-west1'

steps:
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'run'
      - 'deploy'
      - 'mon-service'
      - '--region=${_REGION}'
      - '--image=gcr.io/$PROJECT_ID/app:$COMMIT_SHA'
# Pass substitutions to the build
gcloud builds submit --substitutions=_ENVIRONMENT=staging

4 - Official builders​

4.1 Available builders​

BuilderUsage
gcr.io/cloud-builders/dockerDocker build
gcr.io/cloud-builders/gcloudgcloud CLI
gcr.io/cloud-builders/kubectlKubernetes
gcr.io/cloud-builders/npmNode.js
gcr.io/cloud-builders/goGo
gcr.io/cloud-builders/gradleJava/Gradle
gcr.io/cloud-builders/mavenJava/Maven
gcr.io/cloud-builders/gitGit operations

4.2 Examples​

# Docker build and push
steps:
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '-t'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:$COMMIT_SHA'
      - '-t'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:latest'
      - '.'
  
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', '--all-tags', 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app']

5 - Docker build​

5.1 Simple build​

steps:
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '-t'
      - 'gcr.io/$PROJECT_ID/app:$COMMIT_SHA'
      - '.'

images:
  - 'gcr.io/$PROJECT_ID/app:$COMMIT_SHA'

5.2 Multi-stage with cache​

steps:
  # Pull the cache image (if it exists)
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
      - '-c'
      - 'docker pull gcr.io/$PROJECT_ID/app:latest || exit 0'
  
  # Build with cache
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '--cache-from'
      - 'gcr.io/$PROJECT_ID/app:latest'
      - '-t'
      - 'gcr.io/$PROJECT_ID/app:$COMMIT_SHA'
      - '-t'
      - 'gcr.io/$PROJECT_ID/app:latest'
      - '.'

images:
  - 'gcr.io/$PROJECT_ID/app:$COMMIT_SHA'
  - 'gcr.io/$PROJECT_ID/app:latest'

5.3 Kaniko (rootless builds)​

steps:
  - name: 'gcr.io/kaniko-project/executor:latest'
    args:
      - '--destination=gcr.io/$PROJECT_ID/app:$COMMIT_SHA'
      - '--cache=true'
      - '--cache-ttl=168h'

6 - Secrets and environment variables​

6.1 Secret Manager​

steps:
  - name: 'gcr.io/cloud-builders/gcloud'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        gcloud secrets versions access latest --secret=api-key > /workspace/api-key.txt
  
  - name: 'node:18'
    entrypoint: 'npm'
    args: ['run', 'deploy']
    secretEnv: ['API_KEY']

availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/api-key/versions/latest
      env: 'API_KEY'

6.2 Environment variables​

steps:
  - name: 'node:18'
    env:
      - 'NODE_ENV=production'
      - 'LOG_LEVEL=info'
    args: ['npm', 'run', 'build']

7 - Artifacts and storage​

7.1 Publish to Artifact Registry​

steps:
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '-t'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:$COMMIT_SHA'
      - '.'
  
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'push'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/app:$COMMIT_SHA'

7.2 Upload to Cloud Storage​

artifacts:
  objects:
    location: 'gs://mon-bucket/builds/$BUILD_ID/'
    paths:
      - 'dist/**'
      - 'coverage/**'

8 - Advanced options​

8.1 Machine types​

options:
  machineType: 'E2_HIGHCPU_32'
  diskSizeGb: 100
TypevCPURAM
E2_MEDIUM14 GB
E2_HIGHCPU_888 GB
E2_HIGHCPU_323232 GB
N1_HIGHCPU_323228.8 GB

8.2 Private pools​

options:
  pool:
    name: 'projects/$PROJECT_ID/locations/europe-west1/workerPools/my-pool'

8.3 Timeout and logs​

timeout: '3600s'  # 1 hour max

options:
  logging: CLOUD_LOGGING_ONLY  # or GCS_ONLY, NONE
  logStreamingOption: STREAM_ON

9 - Run a build​

# From the local directory
gcloud builds submit --config=cloudbuild.yaml .

# With substitutions
gcloud builds submit \
    --config=cloudbuild.yaml \
    --substitutions=_ENV=prod,_VERSION=1.0.0 \
    .

# View builds
gcloud builds list

# View a build's logs
gcloud builds log BUILD_ID

Summary​

In this chapter, we learned:

  • The cloudbuild.yaml structure
  • Build steps and builders
  • Variables and substitutions
  • Secret management
  • Artifacts and storage
  • Advanced options

Next step​

In the next chapter, we will look at Artifact Registry.

→ Next chapter: Artifact Registry

← Back to table of contents