Skip to content

setup.md

Latest commit

 

History

History
134 lines (102 loc) · 4.92 KB

setup.md

File metadata and controls

134 lines (102 loc) · 4.92 KB
Raw

Setup

Run commands from the repository root in Bash or zsh. Use a project with billing and permission to enable APIs, create service accounts/secrets, grant IAM roles, deploy Cloud Run, and create BigQuery connections and tables. Follow the Cloud Run source-build prerequisites for deployer permissions and the roles/run.builder grant to your build service account. Build and runtime identities are separate.

This example uses BigQuery US and Cloud Run us-west1. Creation commands assume new resources; skip creation for resources you intentionally reuse. The table scripts replace only this example's named tables/views.

1. Configure the key and runtime

export PROJECT_ID='YOUR_PROJECT_ID'
export REGION='us-west1'
export SERVICE_NAME='jev-support-demo'
export RUNTIME_SA="jev-support-demo@${PROJECT_ID}.iam.gserviceaccount.com"

gcloud auth login

gcloud services enable \
  run.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com \
  secretmanager.googleapis.com iam.googleapis.com \
  bigquery.googleapis.com bigqueryconnection.googleapis.com \
  --project="$PROJECT_ID"

gcloud iam service-accounts create jev-support-demo \
  --project="$PROJECT_ID" --display-name='Jev support demo runtime'

gcloud secrets create typesafe-api-key \
  --project="$PROJECT_ID" --replication-policy=automatic

In Secret Manager → typesafe-api-key → New version, add your TypeSafe API key. Then grant the runtime access to that secret:

gcloud secrets add-iam-policy-binding typesafe-api-key \
  --project="$PROJECT_ID" \
  --member="serviceAccount:${RUNTIME_SA}" --role=roles/secretmanager.secretAccessor

2. Deploy and test Cloud Run

gcloud run deploy "$SERVICE_NAME" \
  --project="$PROJECT_ID" --region="$REGION" \
  --source=. --service-account="$RUNTIME_SA" \
  --no-allow-unauthenticated \
  --set-secrets=TYPESAFE_API_KEY=typesafe-api-key:latest \
  --set-env-vars=JEV_MODEL=jev-latest \
  --memory=512Mi --cpu=1 --concurrency=4 \
  --min-instances=0 --max-instances=2 --timeout=60

For the direct test, your signed-in user needs roles/run.invoker on the service. An IAM administrator can grant it with your account email:

gcloud run services add-iam-policy-binding "$SERVICE_NAME" \
  --project="$PROJECT_ID" --region="$REGION" \
  --member='user:YOUR_EMAIL' --role=roles/run.invoker

gcloud run services proxy "$SERVICE_NAME" \
  --project="$PROJECT_ID" --region="$REGION" --port=8787

Leave the proxy running. In another terminal, from the repository root:

curl --fail-with-body --silent --show-error \
  http://127.0.0.1:8787/tickets \
  -H 'Content-Type: application/json' \
  --data-binary @examples/two-tickets.json

The request contains an import failure with usable stale data and an SSO lockout. Inspect route, urgent_probability, and blocked_probability. Stop the local proxy with Ctrl+C; BigQuery does not use it.

3. Connect BigQuery

Back in the terminal with your exported variables:

bq query --project_id="$PROJECT_ID" --location=US \
  --use_legacy_sql=false < sql/01_create_tickets.sql

bq mk --project_id="$PROJECT_ID" --location=US \
  --connection --connection_type=CLOUD_RESOURCE jev_cloud_run

bq show --project_id="$PROJECT_ID" --location=US \
  --connection --format=prettyjson "${PROJECT_ID}.US.jev_cloud_run"

Copy cloudResource.serviceAccountId from that output into CONNECTION_SA:

export CONNECTION_SA='REPLACE_WITH_CONNECTION_SERVICE_ACCOUNT'

gcloud run services add-iam-policy-binding "$SERVICE_NAME" \
  --project="$PROJECT_ID" --region="$REGION" \
  --member="serviceAccount:${CONNECTION_SA}" --role=roles/run.invoker

gcloud run services describe "$SERVICE_NAME" \
  --project="$PROJECT_ID" --region="$REGION" --format='value(status.url)'

In 02_create_functions.sql, replace YOUR_PROJECT_ID and CLOUD_RUN_SERVICE_URL with your values. Keep the /bigquery-tickets suffix. Register the function:

bq query --project_id="$PROJECT_ID" --location=US \
  --use_legacy_sql=false < sql/02_create_functions.sql

Continue with the two scoring/query commands in the README. Run scoring again after editing tickets. The function batches up to five rows per request; any increase must respect the adapter's 10-row and input-size limits.

Troubleshooting

  • Build permission denied: check the source-build prerequisites above, especially the build service account's roles/run.builder grant.
  • Cloud Run 403: grant Invoker on this service to the proxy user or BigQuery connection service account, depending on which path failed.
  • Upstream 401/403: check the TypeSafe key stored in the configured secret.
  • 503: retryable timeout, rate limit, or upstream failure. BigQuery may retry; repeated inference can incur charges.
  • 400/422: invalid or oversized input. Correct the ticket or reduce its size.