Creating Google Cloud Functions

Jul 4, 2024

Creating Google Cloud Functions

Introduction

In this tutorial, we learn how to create Google Cloud Functions using GCP Console, gcloud CLI, and Terraform. We will cover:

  • Creating a function from the UI
  • Setting up authentication and security
  • Using service accounts and Secret Manager
  • Deploying functions from a source repository
  • Setting up CI/CD pipelines
  • Deploying functions using Terraform
  • Triggering functions via Pub/Sub topics and Cloud Storage
  • Integrating functions with API Gateway

Creating a Function from UI

  1. Enable Cloud Functions
    • Go to GCP Console, click on Cloud Functions
    • Enable Cloud Functions for the project
  2. Create Function
    • Click CREATE FUNCTION
    • Name: first-function
    • Region: us-central1 (cost-effective)
  3. Trigger Options
    • Simplest: HTTP trigger
    • URL available for triggering function
    • Choose between public and private (authentication settings)
    • Disable HTTP or HTTPS if needed (keep secure by default)
  4. Settings
    • Runtime, build, connections, security settings
    • Service accounts
    • API key in Secret Manager
  5. Deployment
    • Enable Cloud Build API if warned
    • Language: Node.js and Python
    • Write code in Console or upload as zip
    • Check for third-party modules in package.json
  6. Invoke Function
    • Deploy function
    • Find URL under trigger
    • Use curl to call function (returns Hello World)
  7. Authentication and Permissions
    • Invoke function using ID token
    • Requires cloudfunctions.functions.invoke permission

Secure Function

  1. Create Secure Function
    • Name: secure-function
    • Keep default params, click deploy
    • Invoke requires bearer token in Authorization header
  2. Using gcloud CLI
    • Ensure gcloud CLI is installed
    • Add functionality to specific function relationships
    • Example: function-a calls function-b
    • Use service accounts and roles accordingly
  3. Example Workflow Setting
    • Create function-a with function update: Hello from Function A!
    • Add function-a as Principal with Cloud Functions Invoker role
    • Create function-b, use GoogleAuth module
    • Deploy and invoke with curl returns Hello from Function A

Secret Manager Integration

  1. Create API Key in Secret Manager
    • Name: api-key, Value: devops123
  2. Grant Access via Service Account
    • Create account: secret-function
    • Assign project-level permissions
    • Add service account email to api-key as Principal
    • Role: Secret Manager Secret Accessor
  3. Create and Deploy Function
    • Name: secret-function
    • Disable authentication
    • Under advanced settings, choose service account, map secret
    • Use fs module to read and return the secret
    • Deploy and invoke with curl returns devops123

Source Repository Integration

  1. Setup GitHub Repository
    • Name: functions, create folder: git-function
    • Define function in index.js and package.json
  2. Mirror to Google Cloud Source Repository
    • Connect external repository
    • Authenticate and select repository
    • Initialize and deploy function using gcloud functions deploy
  3. Redeploy on Changes
    • Mirror syncs automatically
    • Manually sync if needed
    • Use gcloud command to redeploy without runtime and trigger
  4. CI/CD Pipelines
    • Create build trigger in Cloud Build
    • Use mirrored repo and define cloudbuild.yaml
    • Assign necessary permissions to Cloud Build service account
    • Commit and push changes to trigger build
    • Deploy function with changes and test

Deploying with Terraform

  1. Setup Terraform
    • Enable Cloud Build and Cloud Functions API
  2. Terraform Code in main.tf
    • Declare project id and timestamp
    • Use Terraform Google provider, specify project and region
    • Create a zip archive and upload to GS bucket
    • Create a Cloud Function with required configurations
    • Optionally make it public
  3. Deploy and Invoke Function
    • Initialize and apply Terraform configurations
    • Obtain URL and invoke function

Event-driven Functions

Pub/Sub Trigger

  1. Create Pub/Sub Topic
    • Name: lesson-106
  2. Create Function
    • Name: pubsub-function
    • Select Pub/Sub trigger, topic: lesson-106
    • Define function (e.g., log message)
    • Deploy and test by publishing a message

Cloud Storage Trigger

  1. Bucket Creation
    • Create bucket lesson-106
  2. Create Function
    • Name: gs-function
    • Trigger on file upload to bucket
    • Define function to log file name
    • Upload file to test and check logs

API Gateway Integration

  1. Enable Services
    • Enable API Gateway API, Service Management API, Service Control API
  2. Create Backend Function and Service Accounts
    • Function name: backend-function
    • Service accounts: backend-function, api-gateway
    • Assign Cloud Functions Invoker role to api-gateway
  3. Create API Gateway
    • Name: my-gateway, create OpenAPI Spec
    • Point to backend function, configure path
    • Use URL to invoke function