Cloud Run Django Deployment Example

Note - Have moved to CPHO Phase 2 project to determine workflow and patterns. This project is on pause for the moment.

Working towards deploying Django apps to Google Cloud Run, using a Cloud SQL Postgres database and a Cloud Build GitHub Trigger for the continuous deployment. (Also exploring Github actions push deployment as well as AlloyDB as Cloud SQL alternative)

Currently running on

https://hello-world-vlfae7w5dq-nn.a.run.app/ (from GitHub Actions) and https://hello-world-three-vlfae7w5dq-nn.a.run.app (from Cloud Build trigger).

References:

Steps to Deployment

Ready Django App:

Build app with tests
Add requirements.txt to indicate dependencies
Add a Dockerfile for containerization
Add .dockerignore and .gitignore
Modify settings.py (https://docs.djangoproject.com/en/4.2/intro/tutorial01/)
- rename settings.py to basesettings.py
- add settings.py file from here (and link) to include Google Cloud deployment instructions and secrets
- change your app name in installed apps section of settings.py

Set up for GCP Deployment

Authenticate
```
gcloud auth application-default login
```

Set project Variable

gcloud config set project <your project>

Enable APIs and set up service accounts and secrets for Artifact Registry, Cloud Build trigger, Cloud Run and Cloud SQL. Provision database.
- Follow instructions in deploy/gcp-initialization.sh (step by step in terminal or command prompt, or just run). Note: variables need to be modified for your project.

During first run through, when you're prompted with an error indication Cloud Build needs to be connected to the GitHub Repo:
- Log into console to perform manual steps required for deployment set up
  - Cloud build connect to GitHub Repo
  - Artifact Registry - select 'Check for vunerabilities
Then rerun.

Cloud SQL Proxy (Before Cloud Deploy for intial migrations on the first go)

(for initial makemigrations)
1. Download Cloud SQL Proxy This is for connecting to Cloud SQL from your computer for initial set up
Link to curl command to download & install
```
chmod +x cloud-sql-proxy 
```
Run app locally with cloud sql proxy (note this is for non-windows machines)(https://cloud.google.com/sql/docs/sqlserver/connect-instance-auth-proxy) for other devices
```
./cloud-sql-proxy $PROJECT_ID:$REGION:$INSTANCE_NAME
```
Note: This seems to timeout - if you get oauth2: "invalid_grant" "reauth related error (invalid_rapt):
```
gcloud auth application-default revoke
```
```
gcloud auth application-default login
```
run migrations

(note here's an article re migration jobs (https://cloud.google.com/blog/topics/developers-practitioners/running-database-migrations-cloud-run-jobs) we may change the way we start this off. ) Change directories into
```
python manage.py makemigrations
python manage.py makemigrations <app>
python manage.py migrate
python manage.py collectstatic
```

Deploy

Manually Cloud Build with no trigger (remove COMMIT_SHA):
```
gcloud builds submit --config cloudbuild.yaml
```
Otherwise, the project is automatically deployed each time there's a commit to main branch

TODO - waitress and TODO - ci.yaml github actions for pull request

After first deployment

Set Service URL

After first deployment, set SERVICE_URL environment variable (replace 'hello-world' with your Cloud Run service name in both cases.)

Retrieve URL (also displayed in Service Details page in Cloud Run)

SERVICE_URL=$(gcloud run services describe $SERVICE_NAME --platform managed \
--region northamerica-northeast1 --format "value(status.url)")

Set CLOUDRUN_SERVICE_URL used in settings.py for CSRF and allowed hosts (otherwiser will have issues)
```
gcloud run services update $SERVICE_NAME \
--platform managed \
--region northamerica-northeast1 \
--set-env-vars CLOUDRUN_SERVICE_URL=$SERVICE_URL
```
** note this step will change once we have the DNS set up

TO DO

GitHub Actions https://www.hacksoft.io/blog/github-actions-in-action-setting-up-django-and-postgres
Determine when tests should run. Currently, tests run on pull request can we also run these test prior to the Cloud Build (rather than concurently) on push to main? Or should we be locking downthe main branch so pull requests naturally always happen before push to main
Automate/ determine gcloud command for turning on vunerability scanning for Artifact Registry
Connecting GitHub Repo to Cloud Build is also a manual step and requires someone's GitHub account for authorization - Keith is looking into other options/ possibilities
Yakima account (Config Connector for ifrastucture as code set up (IaS) has a misleading name in the IAM console - change this to something more user friendly if we don't know what it is)
Automate approved hosts (Dan got SSL working for DNS so may not need this?)
Docker compose to use context (add deploy folder) & tests!!

Resources:

CICD options (TODO - add in testing and linting steps)

videos

Database

To look at:

AlloyDB Omni (containerized version - for testing)

Migrations:

Options:

run from local computer with Auth proxy
run as part of build process https://cloud.google.com/run/docs/managing/jobs

gcloud run jobs update JOB_NAME --image IMAGE_URL

Logging:

Add structlog to requirement.txt, wsgi.py, add logging_config.py file and import module into settings.py
Add logging statements in code

PHACDataHub / cloudrun-deployment-example

readme