Google Cloud Build - CICD

 

Overview of Cloud Build

Cloud Build is a service that executes your builds on Google Cloud.

Cloud Build can import source code from a variety of repositories or cloud storage spaces, execute a build to your specifications, and produce artifacts such as Docker containers or Java archives.

You can also use Cloud Build to help protect your software supply chain. Cloud Build features meet the requirements of Supply chain Levels for Software Artifacts (SLSA) level 3. For guidance on protecting your build processes, see Safeguard builds.

You can write a build config to provide instructions to Cloud Build on what tasks to perform. You can configure builds to fetch dependencies, run unit tests, static analyses, and integration tests, and create artifacts with build tools such as docker, gradle, maven, bazel, and gulp.

Cloud Build executes your build as a series of build steps, where each build step is run in a Docker container. Executing build steps is analogous to executing commands in a script.

You can either use the build steps provided by Cloud Build and the Cloud Build community, or write your own custom build steps:

Each build step is run with its container attached to a local Docker network named cloudbuild. This allows build steps to communicate with each other and share data. For more information on the cloudbuild network, see Cloud Build network.

You can use standard Docker Hub images in Cloud Build, such as Ubuntu and Gradle.

You can manually start builds in Cloud Build using the Google Cloud CLI or the Cloud Build API, or use Cloud Build's build triggers to create an automated continuous integration/continuous delivery (CI/CD) workflow that starts new builds in response to code changes.

You can integrate build triggers with many code repositories, including Cloud Source Repositories, GitHub, and Bitbucket.

You can view your build results using the gcloud CLI, the Cloud Build API or use the Build History page in the Cloud Build section in Google Cloud console, which displays details and logs for every build Cloud Build executes. For instructions see Viewing Build Results.

The following steps describe, in general, the lifecycle of a Cloud Build build:

  1. Prepare your application code and any needed assets.
  2. Create a build config file in YAML or JSON format, which contains instructions for Cloud Build.
  3. Submit the build to Cloud Build.
  4. Cloud Build executes your build based on the build config you provided.
  5. If applicable, any built artifacts are pushed to Artifact Registry.

Cloud Build uses Docker to execute builds. For each build step, Cloud Build executes a Docker container as an instance of docker run. Currently, Cloud Build is running Docker engine version 20.10.17.

You can use Cloud Build with the Google Cloud console, gcloud command-line tool, or Cloud Build's REST API.

In the Google Cloud console, you can view the Cloud Build build results in the Build History page, and automate builds in Build Triggers.

You can use the gcloud CLI to create and manage builds. You can run commands to perform tasks such as submitting a build, listing builds, and canceling a build.

You can request builds using the Cloud Build REST API.

As with other Cloud Platform APIs, you must authorize access using OAuth2. After you have authorized access, you can then use the API to start new builds, view build status and details, list builds per project, and cancel builds that are currently in process.

For more information, see the API documentation.

By default, when you run a build on Cloud Build, the build runs in a secure, hosted environment with access to the public internet. Each build runs on its own worker and is isolated from other workloads. You can customize your build in multiple ways including increasing the size of the machine type or allocating more disk space. The default pool has limits on how much you can customize the environment, particularly around private network access.

Private pools are private, dedicated pools of workers that offer greater customization over the build environment, including the ability to access resources in a private network. Private pools, similar to default pools, are hosted and fully-managed by Cloud Build and scale up and down to zero, with no infrastructure to set up, upgrade, or scale. Because private pools are customer-specific resources, you can configure them in more ways.

To learn more about private pools and the feature difference between default pool and private pool, see Private pool overview.

Cloud Build provides several features to secure your builds including:

  • Automated Builds

    An automated build or scripted build defines all build steps in build script or build configuration, including steps to retrieve source code and steps to build the code. The only manual command, if any, is the command to run the build. Cloud Build uses a build config file to provide build steps to Cloud Build.

    Automated builds provide consistency in the build steps. However, it's also important to run builds in a consistent, trusted environment.

    Although local builds can be useful for debugging purposes, releasing software from local builds can introduce a lot of security concerns, inconsistencies and inefficiencies into the build process.

    • Allowing local builds provides a way for an attacker with malicious intent to modify the build process.
    • Inconsistencies in developer local environments and developer practices make it difficult to reproduce builds and diagnose build issues.

    In the requirements for the SLSA framework, automated builds are a requirement for SLSA level 1, and using a build service instead of developer environments for builds is a requirement for SLSA level 2.

  • Build provenance

    Build provenance is a collection of verifiable data about a build.

    Provenance metadata includes details such as the digests of the built images, the input source locations, the build toolchain, and the build duration.

    Generating build provenance helps you to:

    • Verify that a built artifact was created from trusted source location and by a trusted build system.
    • Identify code injected from an untrusted source location or build system.

    You can use alerting and policy mechanisms to proactively use build provenance data. For example, you can create policies that only allow deployments of code built from verified sources.

    Cloud Build can generate build provenance for container images that provide SLSA level 3 assurance. For more information, see Viewing build provenance.

  • Ephemeral build environment

    Ephemeral environments are temporary environments that are meant to last for a a single build invocation. After the build, the environment is wiped or deleted. Ephemeral builds ensure that the build service and build steps run in an ephemeral environment, such as a container or VM. Instead of reusing an existing build environment, the build service provisions a new environment for each build and then destroys it after the build process is complete.

    Ephemeral environments ensure clean builds since there are no residual files or environment settings from previous builds that can interfere with the build process. A non-ephemeral environment provides an opportunity for attackers to inject malicious files and content. An ephemeral environment also reduces maintenance overhead and reduces inconsistencies in the build environment.

    Cloud Build sets up a new virtual machine environment for every build and destroys it after the build.

  • Deployment policies

    You can integrate Cloud Build with Binary Authorization to check for build attestations and block deployments of images that are not generated by Cloud Build. This process can reduce the risk of deploying unauthorized software.

  • Customer-managed encryption keys

    Cloud Build provides customer-managed encryption keys (CMEK) compliance by default. Users do not need to configure anything specifically. Cloud Build provides CMEK compliance by encrypting the build-time persistent disk (PD) with an ephemeral key that is generated for each build. The key is uniquely generated for each build.

    As soon as the build completes, the key is wiped from memory and destroyed. It is not stored anywhere, is not accessible to Google engineers or support staff, and cannot be restored. The data that was protected using such a key is permanently inaccessible. For more information, see CMEK compliance in Cloud Build.

  • Security insights panel

    Cloud Build includes a Security insights panel in the Google Cloud console that displays a high-level overview of multiple security metrics. You can use this panel to identify and mitigate risks in your build process.

    This panel displays the following information:

    • Supply-chain Levels for Software Artifacts (SLSA) Level: Identifies the maturity level of your software build process in accordance with the SLSA specification).

    • Vulnerabilities: An overview of any vulnerabilities found in your artifacts, and the name of the image that Artifact Analysis has scanned. You can click the image name to view vulnerability details. For example, in the screenshot, you can click on java-guestbook-backend.

    • Build details: Details of the build such as the builder and the link to view logs.

    • Build provenance: Provenance for the build.

  • Software Delivery Shield

    Cloud Build is part of the Software Delivery Shield solution. Software Delivery Shield is a fully-managed, end-to-end software supply chain security solution that helps you to improve the security posture of developer workflows and tools, software dependencies, CI/CD systems used to build and deploy your software, and runtime environments such as Google Kubernetes Engine and Cloud Run. To learn how you can use Cloud Build with other components of Software Delivery Shield to improve the security posture of your software supply chain, see Software Delivery Shield overview.


We can deep dive here on some important Topics:








Comments

Post a Comment

Popular posts from this blog

Terraform

Image
  Terraform is an infrastructure as code tool that lets you build, change, and version cloud and on-prem resources safely and efficiently. HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share. You can then use a consistent workflow to provision and manage all of your infrastructure throughout its lifecycle. Terraform can manage low-level components like compute, storage, and networking resources, as well as high-level components like DNS entries and SaaS features. How does Terraform work? Terraform creates and manages resources on cloud platforms and other services through their application programming interfaces (APIs). Providers enable Terraform to work with virtually any platform or service with an accessible API. HashiCorp and the Terraform community have already written  thousands of providers  to manage many different types of resources and services.
Read more

Scrum Master Interview help - Bootcamp

Understanding the MoSCoW prioritization | How to implement it into your project Projects, irrespective of their size or complexity, often juggle numerous tasks and requirements. In such a scenario,  MoSCoW prioritization  becomes essential to ensure the successful completion of the project.  Besides, it is also a very effective way to manage project priorities. With a straightforward and adaptable approach, the MoSCoW method helps manage stakeholder expectations and improve project outcomes. What is the MoSCoW prioritization technique?  The MoSCoW method is a prioritization matrix widely used in project management and software development. The term MoSCoW is an acronym that stands for  Must have ,  Should have ,  Could have , and  Won’t have , each denoting a level of priority. Here is the breakdown of the MoSCoW method:  Must have:  These are critical requirements that the project cannot be completed without them. If these are not fulfilled, the project is con
Read more

Kubernetes

  Using containers to host applications and other processes has gone mainstream. As more and more workload is moved into containers, management systems are needed to handle the demands of containerized applications at scale. One of the most popular options for managing  container-based workload is Kubernetes . Kubernetes combines container management automation with an extensible API to create a cloud-native application management powerhouse. At its core, Kubernetes manages the placement of pods, which can consist of one or more containers, on a Kubernetes cluster node. Additionally, if one of these pods crashes, Kubernetes can create a new instance of it. If a cluster node is removed, Kubernetes can move any affected workload to a different node in the cluster. On top of that, Kubernetes pods can be scaled to provide more or less throughput to meet scale demands and these scale operations can be triggered manually or automatically using Kuberentes horizontal pod auto-scaling. Finally,
Read more