tonglil/auth-gcloud

auth-gcloud

镜像概述

auth-gcloud是一个基于https://hub.docker.com/r/google/cloud-sdk/%E7%9A%84Docker%E9%95%9C%E5%83%8F%EF%BC%8C%E7%94%A8%E4%BA%8E%E9%80%9A%E8%BF%87GCP%E6%9C%8D%E5%8A%A1%E8%B4%A6%E6%88%B7JSON%E5%87%AD%E8%AF%81%E6%BF%80%E6%B4%BBgcloud%E6%9C%8D%E5%8A%A1%E8%B4%A6%E6%88%B7%E3%80%82%E8%AF%A5%E9%95%9C%E5%83%8F%E4%B8%BB%E8%A6%81%E7%94%A8%E4%BA%8ECI/CD%E7%8E%AF%E5%A2%83%E4%B8%AD%EF%BC%8C%E7%AE%80%E5%8C%96gcloud%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%B7%A5%E5%85%B7%E7%9A%84%E8%AE%A4%E8%AF%81%E6%B5%81%E7%A8%8B%EF%BC%8C%E6%94%AF%E6%8C%81%E5%A4%9A%E7%A7%8D%E7%89%88%E6%9C%AC%E7%9A%84Drone CI/CD平台。

核心功能

• 使用GCP服务账户JSON凭证自动激活gcloud服务账户
• 与Drone CI/CD平台深度集成，支持Drone 1+、0.5+及0.4版本
• 基于官方google/cloud-sdk镜像构建，确保gcloud工具版本一致性
• 提供多种GCP资源操作的常见使用示例，如GCR镜像管理

使用场景

适用于需要在CI/CD流程中执行gcloud命令的场景，例如：

• 管理Google Container Registry (GCR) 镜像（清理、标记、复制等）
• 部署应用到Google Cloud Platform (GCP) 服务
• 执行GCP资源的自动化运维操作
• 在Drone流水线中集成GCP相关任务

使用方法

基本用法

通过docker run命令直接使用：

sh
docker run \
  -e TOKEN="$(cat service-account.json)" \
  tonglil/auth-gcloud

Drone CI/CD 集成

Drone 1+

yml
steps:
- name: gcp-actions
  image: tonglil/auth-gcloud
  environment:
    TOKEN:
      from_secret: google_credentials
  commands:
    - auth-gcloud
    - gcloud ...

Drone 0.5+

yml
pipeline:
  gcp-actions:
    image: tonglil/auth-gcloud
    commands:
      - auth-gcloud
      - gcloud ...
    secrets: [google_credentials]

Drone 0.4

yml
build:
  image: google/cloud-sdk
  environment:
    TOKEN_B64: $GOOGLE_CREDENTIALS_B64
    GOOGLE_APPLICATION_CREDENTIALS: /tmp/gcloud.json
  commands:
    # 传入base64编码的凭证并解码用于gcloud登录
    - echo $TOKEN_B64 | base64 -d > $GOOGLE_APPLICATION_CREDENTIALS
    - gcloud auth activate-service-account --key-file "$GOOGLE_APPLICATION_CREDENTIALS"
    - gcloud ...

发布说明

使用基础镜像的gcloud版本号作为标签，发布步骤如下：

sh
make pull
make version

常见用途

清理GCR镜像

yml
- name: gcr-cleanup
  image: tonglil/auth-gcloud:alpine
  environment:
    REGISTRY: us.gcr.io
    REPO: project/image
    TOKEN:
      from_secret: google_credentials
  commands:
    - auth-gcloud
      # 删除未标记的镜像
    - gcloud container images list-tags "$REGISTRY/$REPO" --filter='-tags:*' --format='get(digest)' --limit=unlimited | xargs -I {arg} gcloud container images delete "$REGISTRY/$REPO@{arg}" --quiet
      # 仅保留最近50个镜像
    - gcloud container images list-tags "$REGISTRY/$REPO" --format='get(digest)' --limit=unlimited | tail -n +51 | xargs -I {arg} gcloud container images delete "$REGISTRY/$REPO@{arg}" --quiet --force-delete-tags

发布时标记现有GCR镜像

yml
- name: gcr-tag
  image: tonglil/auth-gcloud:alpine
  environment:
    REGISTRY: us.gcr.io
    REPO: project/image
    TOKEN:
      from_secret: google_credentials
  commands:
    - auth-gcloud
    - gcloud container images add-tag "$REGISTRY/$REPO:${DRONE_COMMIT}" "$REGISTRY/$REPO:${DRONE_TAG}" "$REGISTRY/$REPO:stable" --quiet
  when:
    event: tag

发布时复制现有GCR镜像

yml
- name: gcr-tag
  image: tonglil/auth-gcloud:alpine
  environment:
    SRC_REGISTRY: us.gcr.io
    SRC_REPO: project/image1
    DST_REGISTRY: us.gcr.io
    DST_REPO: project/image2
    TOKEN:
      from_secret: google_credentials
  commands:
    - auth-gcloud
    # 可同时标记/复制到多个目标
    - gcloud container images add-tag "$SRC_REGISTRY/$SRC_REPO:${DRONE_COMMIT}" "$DST_REGISTRY/$DST_REPO:${DRONE_TAG}" --quiet
  when:
    event: tag