App in a Box is a series of applications that are prebuilt and architected to demonstrate common application architectures and share projects that can repurposed to support your needs. Each one just requires one command to run and when the process is done, a fully function version of the app is available and running, ready to use or modify.
Todo is a simple todo application architected as a vanilla 3 tier application:
Click on the link below to a copy of the source code in Cloud Shell. Once there, a single command will spin up a workng copy of the application in your project.
Also feel free to review the source code directly in github.
View source code
Use the links below to get more information on the piece we used in this Application. Choose how you learn best: video, product documentation, or interactive walkthrough.
Cloud SQL provides the backend for the application, the database layer. This app uses MySQL.
Cloud Memorystore provides the caching layer for the application. This app uses Redis.
Cloud Run allows you to run application in a container, but in a serverless way, no having to configure number of instances, processors, or memory. Upload a container, get a url. This app uses two Cloud Run services backed by containers: a container running Nginx to provide the webserver for a static front end, and a container running an API layer providing access to the backend, written in golang.
Cloud Build is the tool that packages up the containers and deploys them to be available as Cloud Run services.
Cloud Secret Manager stores sensitive particulars about the application for the build process.
The install script uses the gcloud and gsutil CLI tools to take an empty project and
install the application in it. The output should be a working application and a url to the
Cloud Run service for the front end.
./installGoogle Cloud Services are disabled in a project by default. In order to use any of the solutions here we have to activate the following:
gcloud services enable vpcaccess.googleapis.com
gcloud services enable servicenetworking.googleapis.com
gcloud services enable cloudbuild.googleapis.com
gcloud services enable redis.googleapis.com
gcloud services enable run.googleapis.com
gcloud services enable sql-component.googleapis.com
gcloud services enable sqladmin.googleapis.com
gcloud services enable storage.googleapis.com
gcloud services enable secretmanager.googleapis.com
gcloud services enable artifactregistry.googleapis.com
Connects Cloud Run to Database and Caching
gcloud compute networks vpc-access connectors create \
vpc-connector --network default --region $REGION \
--range 10.8.0.0/28 --no-user-output-enabled
Allows Cloud SQL to be Accessible from Cloud Run
gcloud compute addresses create google-managed-services-vpn-connector \
--global --purpose=VPC_PEERING --prefix-length=16 --network=default \
--no-user-output-enabled
gcloud services vpc-peerings connect \
--service=servicenetworking.googleapis.com \
--ranges=google-managed-services-vpn-connector \
--network=default
Configures and initializes a Redis server instance.
gcloud redis instances create $REDISNAME --size=1 \
--region=$REGION --no-user-output-enabled
Configures and initializes a SQL server instance.
gcloud beta sql instances create $SQLNAME --database-version=MYSQL_5_7 \
--tier=db-g1-small --region=$REGION --root-password=$ROOTPASSWORD \
--no-assign-ip --network=default
Sets IAM Roles and Permissions that will allow Cloud Build to deploy all of the services.
gcloud projects add-iam-policy-binding $PROJECT \
--member serviceAccount:$SABUILD \
--role roles/run.developer --no-user-output-enabled
gcloud projects add-iam-policy-binding $PROJECT \
--member serviceAccount:$SABUILD \
--role roles/vpaccess.user --no-user-output-enabled
gcloud projects add-iam-policy-binding $PROJECT \
--member serviceAccount:$SABUILD \
--role roles/iam.serviceAccountUser --no-user-output-enabled
gcloud iam service-accounts add-iam-policy-binding $SACOMPUTE \
--member=serviceAccount:$SABUILD \
--role roles/iam.serviceAccountUser --no-user-output-enabled
gcloud projects add-iam-policy-binding $PROJECT \
--member=serviceAccount:$SABUILD \
--role=roles/run.admin --no-user-output-enabled
gcloud projects add-iam-policy-binding $PROJECT \
--member serviceAccount:$SABUILD \
--role roles/secretmanager.secretAccessor --no-user-output-enabled
gcloud projects add-iam-policy-binding $PROJECT \
--member=serviceAccount:$SABUILD \
--role=roles/artifactregistry.admin --no-user-output-enabled
Stores Docker Images for use with Cloud Run.
gcloud artifacts repositories create todo-app --location=$REGION \
--repository-format=docker
Stores Redis and SQL host data to Cloud Secrets.
REDISHOST=$(gcloud redis instances describe $REDISNAME --region $REGION --format="value(host)" | xargs)
SQLHOST=$(gcloud sql instances describe $SQLNAME --format="value(ipAddresses[0].ipAddress)" | xargs)
gcloud secrets create sqlhost --replication-policy="automatic" --no-user-output-enabled
echo ${SQLHOST} | tr -d '\n' | gcloud secrets versions add sqlhost --data-file=-
gcloud secrets create redishost --replication-policy="automatic" --no-user-output-enabled
echo ${REDISHOST} | tr -d '\n' | gcloud secrets versions add redishost --data-file=-
Makes a temporary Cloud Storage bucket to upload the schema to Cloud SQL
SQLSERVICEACCOUNT=$(gcloud sql instances describe $SQLNAME --format="value(serviceAccountEmailAddress)" | xargs)
gsutil mb gs://$PROJECT-temp
gsutil cp code/database/schema.sql gs://$PROJECT-temp/schema.sql
gsutil iam ch serviceAccount:$SQLSERVICEACCOUNT:objectViewer gs://$PROJECT-temp/
gcloud sql import sql $SQLNAME gs://$PROJECT-temp/schema.sql -q
gsutil rm gs://$PROJECT-temp/schema.sql
gsutil rb gs://$PROJECT-temp
Uses Cloud Build to deploy to Cloud Run
gcloud builds submit --substitutions=_REGION=$REGION .
./cloudbuild.yamlWe need to make a Docker image for the middleware layer.
- name: 'gcr.io/cloud-builders/docker'
args: [ 'build', '-t', '$_REGION-docker.pkg.dev/$PROJECT_ID/todo-app/api', '.' ]
dir: "code/middleware"
Pushing the container to Artifcat Registry makes it possible for Cloud Run to get the image and serve it.
- name: 'gcr.io/cloud-builders/docker'
args: ['push', '$_REGION-docker.pkg.dev/$PROJECT_ID/todo-app/api']
dir: "code/middleware"
Pushing the container to Artifact Registry makes it possible for Cloud Run to get the image and serve it.
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
entrypoint: bash
args: ['-c', 'gcloud run deploy todo-api --image $_REGION-docker.pkg.dev/$PROJECT_ID/todo-app/api --region $_REGION --allow-unauthenticated --vpc-connector vpc-connector --add-cloudsql-instances todo-db --set-env-vars todo_user=todo_user,todo_pass=todo_pass,todo_host=$$SQLHOST,todo_name=todo,REDISPORT=6379,REDISHOST=$$REDISHOST']
secretEnv: ["REDISHOST","SQLHOST"]
The front end is completly static HTML/JS/CSS. The app needs to point to the URL for the API service we just created. But Cloud Run services are assigned a url with a randomized string. This 'massage script' captures that randomized URL and injects it in to the code of the static JS in this container.
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
entrypoint: bash
args: [ './massage.sh', '$_REGION' ]
We need to make a Docker image for the middleware layer.
- name: 'gcr.io/cloud-builders/docker'
args: [ 'build', '-t', '$_REGION-docker.pkg.dev/$PROJECT_ID/todo-app/fe', '.' ]
dir: "code/frontend"
Pushing the container to Artifcat Registry makes it possible for Cloud Run to get the image and serve it.
- name: 'gcr.io/cloud-builders/docker'
args: ['push', '$_REGION-docker.pkg.dev/$PROJECT_ID/todo-app/fe']
dir: "code/frontend"
Pushing the container to Artifact Registry makes it possible for Cloud Run to get the image and serve it.
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
entrypoint: gcloud
args: [ 'run',
'deploy',
'todo-fe',
'--image', '$_REGION-docker.pkg.dev/$PROJECT_ID/todo-app/fe',
'--region', '$_REGION',
'--allow-unauthenticated',
'--port', '80']
Define Secrets so that they can be used in other steps.
availableSecrets:
secretManager:
- versionName: projects/$PROJECT_ID/secrets/sqlhost/versions/latest
env: 'SQLHOST'
- versionName: projects/$PROJECT_ID/secrets/redishost/versions/latest
env: 'REDISHOST'
Create a variable with a default so that these values can be changed a deploy time.
substitutions:
_REGION: us-central1