How to deploy from CircleCI to Google Compute Engine?

3
votes

I want to deploy CircleCi's artifacts to Google Compute Engine after CI test, but I got stuck in SSH key issues.
When gcloud compute copy-files ran, gcloud will ask for ssh key generating during CircleCI's deployment process, which I don't know how to handle.

WARNING: The public SSH key file for gcloud does not exist.
WARNING: The private SSH key file for gcloud does not exist.
WARNING: You do not have an SSH key for gcloud.
WARNING: SSH keygen will be executed to generate a key.
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):

I've looked into document here and here, but none of them mentioned SSH related topics. So what SSH key should I use and how can I pass it to gcloud securely?

[UPDATED] Here's my commands in the deployment step.

  - echo $GCLOUD_SERVICE_KEY | base64 --decode --ignore-garbage > ${HOME}/gcloud-service-key.json
  - sudo /opt/google-cloud-sdk/bin/gcloud --quiet components update
  - sudo /opt/google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json
  - sudo /opt/google-cloud-sdk/bin/gcloud config set project $GCLOUD_PROJECT_ID
  - sudo /opt/google-cloud-sdk/bin/gcloud compute copy-files ./dist instance-1:/tmp/ --zone $GCLOUD_INSTANCE_ZONE
2
sshgoogle-cloud-platformgoogle-compute-enginecircleci

2 Answers

4
votes

First error:

Enter passphrase (empty for no passphrase):

  • You have to add the --quiet flag.

gcloud compute copy-files

This command ensures that the user's public SSH key is present in the project's metadata. If the user does not have a public SSH key, one is generated using ssh-keygen(1) (if the --quiet flag is given, the generated key will have an empty passphrase).

https://cloud.google.com/sdk/gcloud/reference/compute/copy-files

Second error:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

  • add a user before the instance name 338234243-compute@instance-1:/tmp
  • remove the last / of the instance path instance-1:/tmp
  • Check the owner of the tmp directory (user you choose should have a R&W right)

It seems that the user by default of my generated ssh key was root, and GCC sshd is not allowing root connection...

1
votes

I had the same issue, and upon tinkering more and reading the google cloud docs, I realized I needed to generate an ssh key.

I use CircleCI (this also works with TravisCI) and this was the command I added to my circle.yml file to generate the ssh key: - ssh-keygen -q -N "" -f ~/.ssh/google_compute_engine