add pomerium cloud run tutorial #1397

desimone · 2020-08-14T19:46:10Z

This is a slightly modified version of the Pomerium Cloud Run recipe by @travisgroth

\cc @ahmetb

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

ToddKopriva · 2020-08-14T21:27:47Z

Thanks for the contribution, @desimone .

Since this is based on a document by @travisgroth , it would be good to acknowledge that in the document body.

There are a few items in the queue before this, so I'll get to the editorial and production review next week.

ahmetb

preliminary review

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

ToddKopriva · 2020-08-18T18:32:59Z

Thanks, @ahmetb .

google-cla · 2020-08-19T21:49:06Z

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

google-cla · 2020-08-19T21:52:11Z

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

Signed-off-by: Travis Groth <tgroth@pomerium.com>

google-cla · 2020-08-19T21:53:25Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

travisgroth · 2020-08-19T21:54:11Z

@googlebot I consent.

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

Signed-off-by: Travis Groth <tgroth@pomerium.com>

Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>

travisgroth · 2020-08-19T22:14:57Z

@ahmetb @ToddKopriva I've done a pass on addressing comments with one outstanding suggestion. Please review.

ToddKopriva · 2020-08-19T23:01:26Z

Thanks, @travisgroth .

There are a couple of items ahead of this in the queue, so I'll probably begin my review late tomorrow or early Friday.

ToddKopriva · 2020-08-24T20:00:37Z

@ahmetb and @travisgroth , I did an edit pass, and I think that all of the review comments are suitably addressed. Let me know whether you agree that this is ready to be merged and published.

ahmetb · 2020-08-24T20:08:29Z

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

+
+## Setup
+
+To deploy Pomerium to Cloud Run, a [special image](https://console.cloud.google.com/gcr/images/pomerium-io/GLOBAL/pomerium) is available at


@travisgroth is this still the case? maybe we should change this as soon as Cloud Run integration is available in the main image?

The bootstrap to provide secrets from Secret Manager is not going to be in the main image for the time being.

Almost forgot - we have to publish an image for Cloud Run, as our regular image is not hosted in gcr. Cloud Run managed seems to only allows deployments from gcr.

Ack. For the purposes of the tutorial it's not a bad idea to circumvent the secrets manager entirely, and store the config.yaml in env vars as well.
(assuming that lets you use the main image, sans the gcr limitation)

Since environment variables in Cloud Run are considered insecure, I'm hesitant to encourage storing IdP credentials and other sensitive values that way in broadly consumed documentation. We added the Secret Manager wrapper specifically to avoid setting a bad example.

The builds are the same and maintained with our CI, so this isn't a second class image. The wrapper isn't worth putting into the normal image since most of our other container users have additional options for pulling in secrets. In Cloud Run we recommend using the Secrets Manager wrapper until there is an alternative.

ack. BTW you can recommend usage of https://github.com/GoogleCloudPlatform/berglas which is a supported tool that wraps a process and has its on Secret Manager reference syntax. It retrieves secrets and sets them as env on runtime.

ahmetb · 2020-08-24T20:11:08Z

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

+### DNS in `zonefile.txt`
+
+Substitute `cloudrun.pomerium.com` for your own subdomain (`zonefile.txt`):
+
+    ; zonefile.txt
+    *.cloudrun.pomerium.com. 18000 IN CNAME ghs.googlehosted.com.
+
+Alternatively, you can set an equivalent CNAME in your DNS provider.


I think all the user needs to do is:

Create a Custom Domain Mapping for your hello.cloudrun.pomerium.com domain and update your domain’s DNS records to the records provided while creating this mapping.

I wouldn't

give the CNAME here, sometimes (e.g. bare/non-sub domains) we actually give A/AAAA records

explain zonefile format, most of our user base aren't DNS experts, so they wouldn't know where to put this :)

Hm. I hadn't considered a bare domain might be used.

We would have to provide a table of the mappings that the user is to perform; the demo relies on several. It does make the setup much more manual, which is unfortunate.

Changed this to have a service<>name list, but also provided some commands that can easily be followed on the command line. Thoughts?

ahmetb · 2020-08-24T20:11:52Z

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

+
+Run the following commands to configure and deploy Pomerium:
+
+    #!/bin/bash


the shebang doesn't make a lot of sense here (since we don't tell user to put this into a file)

we can probably split these into separate code blocks like:

``` cmd1 ``` ``` cmd2 ```

ahmetb · 2020-08-24T20:12:29Z

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

+    # Deploy Pomerium with policy and configuration references
+    gcloud run deploy pomerium --region us-central1 --platform managed --allow-unauthenticated --max-instances 1 \
+        --image=gcr.io/pomerium-io/pomerium:v0.10.0-rc2-cloudrun \
+        --set-env-vars VALS_FILES="/pomerium/config.yaml:ref+gcpsecrets://${PROJECT}/pomerium-config",POLICY=$(base64 policy.yaml)


fwiw you can separate different envs into different args (you can repeat this arg)

ahmetb · 2020-08-24T20:13:00Z

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

+
+![Hello](https://storage.googleapis.com/gcp-community/tutorials/cloud-run-with-pomerium-for-end-user-access/headers.png)
+
+See [getting user's identity](https://www.pomerium.com/docs/topics/getting-users-identity.html) for details on using this header.


maybe at the end, add a What's Next section linking to

pomerium website/config docs

pomerium's own Cloud Run recipe page.

ahmetb

I think it's mostly good, left some comments, once addressed this is good to go. cc: @ToddKopriva

- update dns config

travisgroth · 2020-08-25T18:39:40Z

@ToddKopriva @ahmetb edits done. Please review.

ahmetb · 2020-08-28T19:40:42Z

cc: @ToddKopriva PTAL

ToddKopriva · 2020-08-28T20:05:41Z

cc: @ToddKopriva PTAL

Will do. This is next in my queue.

ToddKopriva · 2020-08-31T20:34:01Z

Thanks for all of the work on this. I'll publish it with a batch of other changes this week.

ToddKopriva · 2020-09-08T22:26:44Z

https://cloud.google.com/community/tutorials/cloud-run-with-pomerium-for-end-user-access

ahmetb · 2020-09-09T03:24:21Z

Thanks a lot for your reviews @ToddKopriva.

* add pomerium cloud run tutorial Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com> * title lint Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com> * link Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com> * fmt Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com> * ahmet feedback Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com> * PR feedback Signed-off-by: Travis Groth <tgroth@pomerium.com> * Add gcp secrets info Signed-off-by: Travis Groth <tgroth@pomerium.com> * Update tutorials/cloud-run-with-pomerium-for-end-user-access/index.md Co-authored-by: bobby <1544881+desimone@users.noreply.github.com> * first quick edit pass during read-through * second edit pass * final edit, I think * - break up shell script - update dns config * add links * edit pass * Update index.md Co-authored-by: Todd Kopriva <43478937+ToddKopriva@users.noreply.github.com> Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>

add pomerium cloud run tutorial

2cb7aa2

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

google-cla bot added the cla: yes label Aug 14, 2020

ToddKopriva self-requested a review August 14, 2020 19:54

ToddKopriva self-assigned this Aug 14, 2020

desimone added 4 commits August 14, 2020 12:57

title lint

50f8695

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

link

3ab4b87

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

fmt

abc31a7

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

ahmet feedback

d507f99

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

Merge branch 'master' into add-pomerium

47f5f63

ahmetb suggested changes Aug 18, 2020

View reviewed changes

Merge branch 'master' into add-pomerium

760b709

google-cla bot added cla: no and removed cla: yes labels Aug 19, 2020

travisgroth force-pushed the add-pomerium branch from fc7c10f to 612de48 Compare August 19, 2020 21:52

PR feedback

faf32b5

Signed-off-by: Travis Groth <tgroth@pomerium.com>

travisgroth force-pushed the add-pomerium branch from 612de48 to faf32b5 Compare August 19, 2020 21:53

google-cla bot added cla: yes and removed cla: no labels Aug 19, 2020

desimone commented Aug 19, 2020

View reviewed changes

tutorials/cloud-run-with-pomerium-for-end-user-access/index.md Outdated Show resolved Hide resolved

travisgroth and others added 2 commits August 19, 2020 18:13

Add gcp secrets info

a9ef439

Signed-off-by: Travis Groth <tgroth@pomerium.com>

Update tutorials/cloud-run-with-pomerium-for-end-user-access/index.md

111fe5b

Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>

Merge branch 'master' into add-pomerium

ccc875a

ToddKopriva added 3 commits August 24, 2020 11:42

first quick edit pass during read-through

e155270

second edit pass

9988234

final edit, I think

11b7e36

ToddKopriva approved these changes Aug 24, 2020

View reviewed changes

ahmetb reviewed Aug 24, 2020

View reviewed changes

ahmetb approved these changes Aug 24, 2020

View reviewed changes

ToddKopriva assigned travisgroth and desimone Aug 24, 2020

travisgroth added 2 commits August 25, 2020 14:33

- break up shell script

c0c70e8

- update dns config

add links

df18508

Merge branch 'master' into add-pomerium

e1d27d6

ToddKopriva added 3 commits August 31, 2020 13:06

Merge branch 'master' into add-pomerium

0ff3484

edit pass

a2b00f6

Update index.md

85b57fc

ToddKopriva approved these changes Aug 31, 2020

View reviewed changes

ToddKopriva merged commit 7d5e120 into GoogleCloudPlatform:master Aug 31, 2020

snyk-bot mentioned this pull request Jan 16, 2022

[Snyk] Upgrade @google-cloud/pubsub from 0.18.0 to 2.18.4 majacQ/community-2#8

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add pomerium cloud run tutorial #1397

add pomerium cloud run tutorial #1397

desimone commented Aug 14, 2020 •

edited

Loading

ToddKopriva commented Aug 14, 2020

ahmetb left a comment

ToddKopriva commented Aug 18, 2020

google-cla bot commented Aug 19, 2020

google-cla bot commented Aug 19, 2020

google-cla bot commented Aug 19, 2020

travisgroth commented Aug 19, 2020

travisgroth commented Aug 19, 2020

ToddKopriva commented Aug 19, 2020

ToddKopriva commented Aug 24, 2020

ahmetb Aug 24, 2020

travisgroth Aug 24, 2020

travisgroth Aug 24, 2020

ahmetb Aug 24, 2020 •

edited

Loading

travisgroth Aug 25, 2020

ahmetb Aug 25, 2020

ahmetb Aug 24, 2020

travisgroth Aug 24, 2020

travisgroth Aug 25, 2020

ahmetb Aug 24, 2020

travisgroth Aug 25, 2020

ahmetb Aug 24, 2020

travisgroth Aug 25, 2020

ahmetb Aug 24, 2020

travisgroth Aug 25, 2020

ahmetb left a comment

travisgroth commented Aug 25, 2020

ahmetb commented Aug 28, 2020

ToddKopriva commented Aug 28, 2020

ToddKopriva commented Aug 31, 2020

ToddKopriva commented Sep 8, 2020

ahmetb commented Sep 9, 2020


		## Setup

		To deploy Pomerium to Cloud Run, a [special image](https://console.cloud.google.com/gcr/images/pomerium-io/GLOBAL/pomerium) is available at


		Run the following commands to configure and deploy Pomerium:

		#!/bin/bash


		![Hello](https://storage.googleapis.com/gcp-community/tutorials/cloud-run-with-pomerium-for-end-user-access/headers.png)

		See [getting user's identity](https://www.pomerium.com/docs/topics/getting-users-identity.html) for details on using this header.

add pomerium cloud run tutorial #1397

add pomerium cloud run tutorial #1397

Conversation

desimone commented Aug 14, 2020 • edited Loading

ToddKopriva commented Aug 14, 2020

ahmetb left a comment

Choose a reason for hiding this comment

ToddKopriva commented Aug 18, 2020

google-cla bot commented Aug 19, 2020

google-cla bot commented Aug 19, 2020

google-cla bot commented Aug 19, 2020

travisgroth commented Aug 19, 2020

travisgroth commented Aug 19, 2020

ToddKopriva commented Aug 19, 2020

ToddKopriva commented Aug 24, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ahmetb Aug 24, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ahmetb left a comment

Choose a reason for hiding this comment

travisgroth commented Aug 25, 2020

ahmetb commented Aug 28, 2020

ToddKopriva commented Aug 28, 2020

ToddKopriva commented Aug 31, 2020

ToddKopriva commented Sep 8, 2020

ahmetb commented Sep 9, 2020

desimone commented Aug 14, 2020 •

edited

Loading

ahmetb Aug 24, 2020 •

edited

Loading