Google Cloud Build connect to VM on premise

GCP Cloud Build is so cool with 120 minutes free per day.

I want to use Cloud Build to execute a script to deploy a NodeJS project on my private VM.

Here is what i have done in my cloudbuild.yaml

steps:
# copy configuration bucket from GCS to cloudbuild
- name: gcr.io/cloud-builders/gsutil
  args: ['cp',
    '-r',
    'gs://${_GCS_CONFIGRATION_BUCKET}',
    '.']
# Set 400 to private key.
- name: 'kroniak/ssh-client'
  args: ['chmod',
    '400',
    '${_GCS_CONFIGRATION_BUCKET}/ssh/cloudbuild_id_rsa']
# ssh into remote instance and run a script.
- name: 'kroniak/ssh-client'
  args: ['ssh',
    '-i',
    '${_GCS_CONFIGRATION_BUCKET}/ssh/cloudbuild_id_rsa',
    '-o',
    'UserKnownHostsFile=/dev/null',
    '-o',
    'StrictHostKeyChecking=no',
    '-p',
    '${_SSH_REMOTE_PORT}',
    '${_SSH_REMOTE_USER_HOST}',
    '${_SSH_REMOTE_COMMAND}']

Because CloudBuild is stateless, you need to create your RSA keypairs and store the keys on a private GCS.


You need to add your RSA public key into ~/.ssh/authorized_keys on your server, tutorial here

And the script to pulling code and restart server.

#!/bin/sh
 
# It is good practice to print the required versions on server. 
# cause the code will execute in SSH non interactively mode.
# https://stackoverflow.com/questions/17089808/how-to-do-remote-ssh-non-interactively
 
echo "NodeJS: "$(node -v)
echo "NPM: "$(npm -v)
 
 
WORKSPACE=/working_directory/public_html
 
echo "Working directory: " $WORKSPACE
 
cd $WORKSPACE
 
git checkout develop
git pull -Xtheirs
 
echo "===================Install dependencies ==========="
npm install
echo "===================Finished install dependencies ========"
 
echo "RELOAD ENV"
pm2 reload $WORKSPACE/ecosystem.config.js production  --update-env

Here are example values of the variable.

_GCS_CONFIGRATION_BUCKET : my-private-bucket-configuration
_SSH_REMOTE_PORT :  2202 // hacker will sad.
_SSH_REMOTE_USER_HOST : aduckdev@8.8.8.8
_SSH_REMOTE_COMMAND :  /home/aduckdev/deployment_script.sh

Setup SSH with RSA keypairs

Firstly, you can easily remote to server with 

ssh your_username@server_address

But you can remove the annoying by being asked typing password many times, using RSA keypairs, it is also more secured than using password.

1. Creating a key pairs on Workstation

ssh-keygen -t rsa - b 4096

Add passphrase is recommended

To read your public key

cat ~/.ssh/id_rsa.pub

2. Uploading public keys to the Server

SSH to the Server

ssh your_username@server_address 

Create a file in .ssh/authorized_keys  and paste the public key into

you can do it from Workstation with one command using 

cat ~/.ssh/id_rsa.pub | ssh your_username@server_address 'cat >> .ssh/authorized_keys'

And change the permission

ssh your_username@server_address ‘chmod 700 .ssh; chmod 640 .ssh/authorized_keys’

From now we can ssh with being asked for password

ssh your_username@server_address

3. Turn off password authentication

On Server Machine

sudo vim /etc/ssh/sshd_config

Uncomment Passwordauthentication , change the value to No

And  restart ssh 

sudo systemctl restart ssh