GSP1077

Overview

Cloud Build is a serverless CI/CD platform on Google Cloud that imports source code, executes build steps, runs automated tests, and produces deployable artifacts such as container images.

In this lab, you create a continuous integration and continuous deployment (CI/CD) pipeline that automatically builds a container image from committed code, stores the image in Artifact Registry, updates a Kubernetes manifest in a Git repository, and deploys the application to Google Kubernetes Engine (GKE) using that manifest.

The following diagram illustrates the CI/CD pipeline flow:

For this lab, you use two Git repositories hosted on a dedicated Gitea Git server (git-server):

• app: contains the application source code (hello-cloudbuild-app)
• env: contains the Kubernetes deployment manifests (hello-cloudbuild-env)

When you push a change to the app repository, the Cloud Build pipeline runs tests, builds a container image, and pushes the image to Artifact Registry. After pushing the image, Cloud Build updates the deployment manifest and pushes it to the env repository. Pushing the manifest triggers another Cloud Build pipeline that applies the manifest to the GKE cluster and, if successful, stores the manifest in another branch of the env repository.

Keep the app and env repositories separate because they have different lifecycles and purposes. The app repository is dedicated to a specific application and is managed primarily by application developers. The env repository can be shared across multiple applications and is managed by automated systems such as Cloud Build. The env repository can have several branches, each mapping to a specific environment and referencing a specific container image; the app repository does not.

After you complete this lab, you can:

• Distinguish between failed and successful deployments by reviewing the Cloud Build history.
• Access the manifest currently in production by viewing the production branch of the env repository.
• Roll back to any previous version by re-executing the corresponding Cloud Build build.

The following diagram illustrates the GitOps workflow:

Objectives

In this lab, you learn how to perform the following:

• Create a Google Kubernetes Engine cluster.
• Connect to a dedicated Git server and clone Git repositories.
• Execute Cloud Build pipelines from source code repositories.
• Automate tests and publish a deployable container image with Cloud Build.
• Manage resources deployed in a Kubernetes Engine cluster with Cloud Build.

Setup and requirements

Before you click the Start Lab button

Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.

This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.

To complete this lab, you need:

• Access to a standard internet browser (Chrome browser recommended).

Note: Use an Incognito (recommended) or private browser window to run this lab. This prevents conflicts between your personal account and the student account, which may cause extra charges incurred to your personal account.

• Time to complete the lab—remember, once you start, you cannot pause a lab.

Note: Use only the student account for this lab. If you use a different Google Cloud account, you may incur charges to that account.

How to start your lab and sign in to the Google Cloud console

1. Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the right is the Lab setup and access panel with the following:

   • The Open Google Cloud console button
   • The temporary credentials (username and password) that you must use for this lab
   • Other information, if needed, to step through this lab

   Note that the lab timer is located near the top of the page, showing the remaining time.

2. Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).

   The lab spins up resources, and then opens another tab that shows the Sign in page.

   Tip: Arrange the tabs in separate windows, side-by-side.

   Note: If you see the Choose an account dialog, click Use Another Account.

3. If necessary, copy the Username below and paste it into the Sign in dialog.

   {{{user_0.username | "Username"}}}

   You can also find the Username in the Lab setup and access panel.

4. Click Next.

5. Copy the Password below and paste it into the Welcome dialog.

   {{{user_0.password | "Password"}}}

   You can also find the Password in the Lab setup and access panel.

6. Click Next.

   Important: You must use the credentials the lab provides you. Do not use your Google Cloud account credentials. Note: Using your own Google Cloud account for this lab may incur extra charges.

7. Click through the subsequent pages:

   • Accept the terms and conditions.
   • Do not add recovery options or two-factor authentication (because this is a temporary account).
   • Do not sign up for free trials.

After a few moments, the Google Cloud console opens in this tab.

Note: To access Google Cloud products and services, click the Navigation menu or type the service or product name in the Search field.

Activate Cloud Shell

Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.

1. Click Activate Cloud Shell at the top of the Google Cloud console.

2. Click through the following windows:

   • Continue through the Cloud Shell information window.
   • Authorize Cloud Shell to use your credentials to make Google Cloud API calls.

When you are connected, you are already authenticated, and the project is set to your Project_ID, . The output contains a line that declares the Project_ID for this session:

Your Cloud Platform project in this session is set to {{{project_0.project_id | "PROJECT_ID"}}}

gcloud is the command-line tool for Google Cloud. It comes pre-installed on Cloud Shell and supports tab-completion.

3. (Optional) You can list the active account name with this command:

gcloud auth list

4. Click Authorize.

Output:

ACTIVE: * ACCOUNT: {{{user_0.username | "ACCOUNT"}}} To set the active account, run: $ gcloud config set account `ACCOUNT`

5. (Optional) You can list the project ID with this command:

gcloud config list project

Output:

[core] project = {{{project_0.project_id | "PROJECT_ID"}}} Note: For full documentation of gcloud, in Google Cloud, refer to the gcloud CLI overview guide.

Task 1. Initialize your lab

In this task, you set up your environment:

• Import your project ID, project number, and Git server IP as variables.
• Enable the APIs for GKE, Cloud Build, Secret Manager, and Artifact Analysis.
• Create an Artifact Registry Docker repository.
• Create a GKE cluster to deploy the sample application of this lab.

1. In Cloud Shell, run the following command to set your project ID, project number, and region:

export PROJECT_ID=$(gcloud config get-value project) export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)') export REGION={{{ project_0.default_region }}} gcloud config set compute/region $REGION export GIT_SERVER_IP=$(gcloud compute instances describe git-server --zone={{{ project_0.default_zone }}} --format='get(networkInterfaces[0].accessConfigs[0].natIP)') echo "Git Server IP is: ${GIT_SERVER_IP}"

2. Run the following command to enable the APIs for GKE, Cloud Build, Secret Manager, and Artifact Analysis:

gcloud services enable container.googleapis.com \ cloudbuild.googleapis.com \ secretmanager.googleapis.com \ containeranalysis.googleapis.com

3. Create an Artifact Registry Docker repository named my-repository in the region to store your container images:

gcloud artifacts repositories create my-repository \ --repository-format=docker \ --location=$REGION

4. Create a GKE cluster to deploy the sample application of this lab:

gcloud container clusters create hello-cloudbuild --num-nodes 1 --region $REGION

5. Run the following command to configure Git in Cloud Shell:

git config --global user.name "giteaadmin" git config --global user.email "student@qwiklabs.net"

Click Check my progress to verify the objective. Enable services, create an artifact registry and the GKE cluster

Task 2. Clone the sample application repository

In this task, you clone the sample application repository (hello-cloudbuild-app) from your dedicated Git server (git-server).

1. Clone the hello-cloudbuild-app repository to your Cloud Shell environment:

cd ~ git clone http://${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-app.git

2. Inspect the sample application code in app.py:

The repository contains a simple "Hello World" application:

from flask import Flask app = Flask('hello-cloudbuild') @app.route('/') def hello(): return "Hello World!\n" if __name__ == '__main__': app.run(host = '0.0.0.0', port = 8080)

Task 3. Create a container image with Cloud Build

In this task, you use Cloud Build and an existing Dockerfile to create and store a container image.

The cloned repository contains the following Dockerfile:

FROM python:3.11-slim RUN pip install flask WORKDIR /app COPY app.py /app/app.py ENTRYPOINT ["python"] CMD ["/app/app.py"]

You can use Cloud Build to build a container image with this Dockerfile and store it in Artifact Registry.

1. In Cloud Shell, run the following command to submit a build based on the latest commit and stream the build logs to your terminal:

cd ~/hello-cloudbuild-app COMMIT_ID="$(git rev-parse --short=7 HEAD)" gcloud builds submit --tag="${REGION}-docker.pkg.dev/${PROJECT_ID}/my-repository/hello-cloudbuild:${COMMIT_ID}" .

2. After the build finishes, in the Google Cloud console title bar, enter Artifact Registry in the Search field, and then click Artifact Registry in the search results. Verify that your new container image is available in Artifact Registry. Click my-repository to see the hello-cloudbuild image in the Image list.

Click Check my progress to verify the objective. Create the container image with Cloud Build

Task 4. Create and run the continuous integration (CI) pipeline

In this task, you configure and run Cloud Build to run unit tests automatically, build the container image, and push it to Artifact Registry.

The following architecture diagram illustrates the CI pipeline:

The cloudbuild.yaml file, already included in the code, is the pipeline configuration.

1. Commit your changes and push them to your Git server:

cd ~/hello-cloudbuild-app git add . git commit -m "Trigger CI pipeline" git push http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-app.git main

2. Submit the build to Cloud Build by running the following command:

gcloud builds submit --config=cloudbuild.yaml --substitutions=SHORT_SHA=$(git rev-parse --short=7 HEAD) .

3. In the Google Cloud console, search for Cloud Build and click History in the left pane. You can examine the execution log of your CI build.

Click Check my progress to verify the objective. Create the Continuous Integration (CI) Pipeline

Task 5. Store the SSH key secret in Secret Manager

In this task, you store a private key secret in Secret Manager and grant Cloud Build permissions to access Secret Manager.

Create an SSH key and store it in Secret Manager

1. In Cloud Shell, create an SSH key:

mkdir -p ~/workingdir && cd ~/workingdir ssh-keygen -t rsa -b 4096 -N '' -f id_rsa -C "student@qwiklabs.net"

2. Store the private SSH key in Secret Manager by running the following command in Cloud Shell:

gcloud secrets create ssh_key_secret --data-file=$HOME/workingdir/id_rsa

Alternatively, in the Google Cloud console: a. First download id_rsa to your computer: in Cloud Shell, click More () > Download file, enter workingdir/id_rsa, and click Download. b. Search for Secret Manager and click Secret Manager. c. Click Create Secret. d. Set Name to ssh_key_secret. e. Under Secret value, select Upload and upload the downloaded id_rsa file. f. Click Create secret.

Grant the service account permission to access Secret Manager

Run the following command in Cloud Shell to give the Compute Engine default service account permission to access Secret Manager:

PROJECT_NUMBER=$(gcloud projects describe ${PROJECT_ID} --format='value(projectNumber)') gcloud projects add-iam-policy-binding ${PROJECT_NUMBER} \ --member=serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com \ --role=roles/secretmanager.secretAccessor \ --condition=None

Click Check my progress to verify the objective. Store SSH key secret in Secret Manager

Task 6. Create the test environment and CD pipeline

You can also use Cloud Build for the continuous delivery pipeline. The pipeline runs each time a commit is pushed to the candidate branch of the hello-cloudbuild-env repository. The pipeline applies the new version of the manifest to the Kubernetes cluster and, if successful, copies the manifest over to the production branch. The continuous delivery workflow provides the following properties:

• The candidate branch contains a history of deployment attempts.
• The production branch contains a history of successful deployments.
• You can view both successful and failed deployments in Cloud Build.
• You can roll back to any previous deployment by re-executing the corresponding build in Cloud Build. A rollback also updates the production branch to reflect the history of deployments accurately.

Grant Cloud Build access to GKE

To deploy the application in your Kubernetes cluster, Cloud Build needs the Kubernetes Engine Developer role.

1. In Cloud Shell, grant the role to the Cloud Build service account by running the following command:

PROJECT_NUMBER="$(gcloud projects describe ${PROJECT_ID} --format='get(projectNumber)')" gcloud projects add-iam-policy-binding ${PROJECT_NUMBER} \ --member=serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com \ --role=roles/container.developer \ --condition=None

Configure the deployment repository

2. In Cloud Shell, clone the hello-cloudbuild-env repository:

cd ~ git clone http://${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-env.git

3. In Cloud Shell, replace the contents of cloudbuild.yaml in the hello-cloudbuild-env repository by running the following command:

cd ~/hello-cloudbuild-env cat <<'EOF' > cloudbuild.yaml # Copyright 2018 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. substitutions: _COMMIT_SHA: 'v1.0' steps: # This step deploys the new version of our container image # in the hello-cloudbuild Kubernetes Engine cluster. - name: 'gcr.io/cloud-builders/kubectl' id: Deploy args: - 'apply' - '-f' - 'kubernetes.yaml' env: - 'CLOUDSDK_COMPUTE_REGION={{{ project_0.default_region }}}' - 'CLOUDSDK_CONTAINER_CLUSTER=hello-cloudbuild' # This step copies the applied manifest to the production branch - name: 'gcr.io/cloud-builders/gcloud' id: Copy to production branch entrypoint: /bin/sh args: - '-c' - | set -x && \ git clone -b production http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-env.git prod_repo && \ cd prod_repo && \ git config user.email "student@qwiklabs.net" && \ git config user.name "Cloud Build" && \ cp ../kubernetes.yaml kubernetes.yaml && \ git add kubernetes.yaml && \ git commit -m "Deployed manifest from commit $_COMMIT_SHA" && \ git push origin production options: logging: CLOUD_LOGGING_ONLY EOF sed -i "s/\${GIT_SERVER_IP}/$GIT_SERVER_IP/g" cloudbuild.yaml

4. Commit and push the update to the candidate branch in hello-cloudbuild-env:

cd ~/hello-cloudbuild-env git checkout candidate git add cloudbuild.yaml git commit -m "Create cloudbuild.yaml for deployment" git push http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-env.git candidate

Modify the continuous integration pipeline to trigger the continuous delivery pipeline

Next, update the continuous integration pipeline in hello-cloudbuild-app to generate a new version of the Kubernetes manifest and push it to hello-cloudbuild-env to trigger the CD pipeline.

1. In Cloud Shell, replace cloudbuild.yaml in hello-cloudbuild-app and substitute your Git server IP by running the following commands:

cd ~/hello-cloudbuild-app cat <<'EOF' > cloudbuild.yaml # Copyright 2018 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. substitutions: _SHORT_SHA: 'v1.0' _COMMIT_SHA: 'v1.0' steps: # This step runs the unit tests on the app - name: 'python:3.11-slim' id: Test entrypoint: /bin/sh args: - -c - 'pip install flask && python test_app.py -v' # This step builds the container image. - name: 'gcr.io/cloud-builders/docker' id: Build args: - 'build' - '-t' - '{{{ project_0.default_region }}}-docker.pkg.dev/$PROJECT_ID/my-repository/hello-cloudbuild:$_SHORT_SHA' - '.' # This step pushes the image to Artifact Registry - name: 'gcr.io/cloud-builders/docker' id: Push args: - 'push' - '{{{ project_0.default_region }}}-docker.pkg.dev/$PROJECT_ID/my-repository/hello-cloudbuild:$_SHORT_SHA' # This step clones the hello-cloudbuild-env repository - name: 'gcr.io/cloud-builders/gcloud' id: Clone env repo entrypoint: /bin/sh args: - '-c' - | git clone http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-env.git && \ cd hello-cloudbuild-env && \ git checkout candidate && \ git config user.email "student@qwiklabs.net" && \ git config user.name "Cloud Build" # This step generates the new manifest - name: 'gcr.io/cloud-builders/gcloud' id: Generate manifest entrypoint: /bin/sh args: - '-c' - | sed "s/GOOGLE_CLOUD_PROJECT/${PROJECT_ID}/g" kubernetes.yaml.tpl | \ sed "s/COMMIT_SHA/${_SHORT_SHA}/g" > hello-cloudbuild-env/kubernetes.yaml # This step pushes the manifest back to hello-cloudbuild-env candidate branch - name: 'gcr.io/cloud-builders/gcloud' id: Push manifest entrypoint: /bin/sh args: - '-c' - | set -x && \ cd hello-cloudbuild-env && \ git add kubernetes.yaml && \ git commit -m "Deploying image {{{ project_0.default_region }}}-docker.pkg.dev/$PROJECT_ID/my-repository/hello-cloudbuild:${_SHORT_SHA} Built from commit ${_COMMIT_SHA} of repository hello-cloudbuild-app Author: $(git log --format='%an <%ae>' -n 1 HEAD)" && \ git push origin candidate options: logging: CLOUD_LOGGING_ONLY EOF sed -i "s/\${GIT_SERVER_IP}/$GIT_SERVER_IP/g" cloudbuild.yaml

2. Commit the modifications, push them to the Git server, and submit the pipeline build to trigger the continuous integration pipeline:

cd ~/hello-cloudbuild-app git add cloudbuild.yaml git commit -m "Trigger CD pipeline" git push http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-app.git main gcloud builds submit --config=cloudbuild.yaml --substitutions=_SHORT_SHA=$(git rev-parse --short=7 HEAD),_COMMIT_SHA=$(git rev-parse HEAD) .

Submitting the build builds the application image and pushes a new kubernetes.yaml manifest to your hello-cloudbuild-env repository.

3. Pull the generated manifest in hello-cloudbuild-env and trigger the continuous delivery (CD) deployment build:

cd ~/hello-cloudbuild-env git pull http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-env.git candidate gcloud builds submit --config=cloudbuild.yaml --substitutions=_COMMIT_SHA=$(git rev-parse HEAD) .

Click Check my progress to verify the objective. Create the Test Environment and CD Pipeline

Task 7. Review the Cloud Build pipeline

In this task, you review the Cloud Build pipeline in the Google Cloud console.

1. In the console, navigate to Cloud Build > History.
2. Click the most recent build to follow its execution and examine its logs.
3. Verify that the build pipeline executed all steps successfully.

Task 8. Test the complete pipeline

You have now configured the complete CI/CD pipeline. In this task, you perform an end-to-end test.

1. In the console, in the Navigation menu (), click Kubernetes Engine > Gateways, Services & Ingress > Services.

Verify that the single service hello-cloudbuild appears in the list, created by the continuous delivery build that just ran.

2. Click the endpoint for the hello-cloudbuild service. The browser displays "Hello World!". If there is no endpoint, or if you see a load balancer error, wait a few minutes for the load balancer to completely initialize. If needed, click Refresh to update the page.

The browser displays the initial application response:

3. In Cloud Shell, replace "Hello World" with "Hello Cloud Build", both in the application and in the unit test:

cd ~/hello-cloudbuild-app sed -i 's/Hello World/Hello Cloud Build/g' app.py sed -i 's/Hello World/Hello Cloud Build/g' test_app.py

4. Commit and push the change to the Git server, then submit the CI build:

git add app.py test_app.py git commit -m "Hello Cloud Build" git push http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-app.git main gcloud builds submit --config=cloudbuild.yaml --substitutions=_SHORT_SHA=$(git rev-parse --short=7 HEAD),_COMMIT_SHA=$(git rev-parse HEAD) .

5. Pull the updated manifest into hello-cloudbuild-env and submit the deployment pipeline build to deploy the new application version:

cd ~/hello-cloudbuild-env git pull http://giteaadmin:GiteaPassword123@${GIT_SERVER_IP}:3000/giteaadmin/hello-cloudbuild-env.git candidate gcloud builds submit --config=cloudbuild.yaml --substitutions=_COMMIT_SHA=$(git rev-parse HEAD) .

After a few minutes, reload the application in your browser. The application displays "Hello Cloud Build!".

The browser displays the updated application response:

Task 9. Test the rollback

In this task, you roll back to the version of the application that displayed "Hello World!".

1. In the console title bar, type Cloud Build Dashboard in the Search field, and then click Cloud Build in the search results. Make sure that History is selected in the left pane.
2. Click the second most recent build available in Build History.
3. Click Rebuild.

The Cloud Build console displays the successful build status:

After the build finishes, reload the application in your browser. The application displays "Hello World!" again.

The browser displays the rolled-back application response:

Congratulations!

Now you can use Cloud Build to create and roll back continuous integration pipelines with GKE on Google Cloud!

Google Cloud training and certification

...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.

Manual Last Updated October 16, 2026

Lab Last Tested July 20, 2026

Copyright 2026 Google LLC. All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.