GKE にデプロイ - Agens

このページでは、GKE 固有のデプロイ設定を扱います。

Artifact Registry

コンテナイメージと chart を Artifact Registry に置く場合は、reader service account と image pull secret を作成します。

PROJECT_ID="<gcp-project-id>"
REGION="asia-northeast1"
SERVICE_ACCOUNT_NAME="agens-artifact-reader"
SERVICE_ACCOUNT_EMAIL="${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

gcloud iam service-accounts create "${SERVICE_ACCOUNT_NAME}" \
  --project "${PROJECT_ID}" \
  --display-name "Agens Artifact Reader"

gcloud artifacts repositories add-iam-policy-binding agens-images \
  --project "${PROJECT_ID}" \
  --location "${REGION}" \
  --member "serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
  --role "roles/artifactregistry.reader"

gcloud iam service-accounts keys create ./agens-artifact-reader.json \
  --project "${PROJECT_ID}" \
  --iam-account "${SERVICE_ACCOUNT_EMAIL}"

Image pull secret

kubectl -n agens create secret docker-registry agens-regcred \
  --docker-server="${REGION}-docker.pkg.dev" \
  --docker-username=_json_key \
  --docker-password="$(cat ./agens-artifact-reader.json)" \
  --dry-run=client -o yaml | kubectl apply -f -

Managed certificate

GKE managed certificate を使う場合は、DNS をロードバランサーに向けたまま、証明書が Active になるまで待ちます。

kubectl -n agens get managedcertificate
kubectl -n agens describe managedcertificate <name>