Cloud Run に Next.js アプリケーションの自動デプロイする – ①

FROM node:lts-alpine AS base

# ビルド時の引数として環境変数を定義
ARG NEXT_PUBLIC_API_URL
ARG NEXT_PUBLIC_FIREBASE_KEY

# 定義した引数を環境変数として設定
ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
ENV NEXT_PUBLIC_FIREBASE_KEY=$NEXT_PUBLIC_FIREBASE_KEY

RUN npm install -g yarn

WORKDIR /app

COPY package.json yarn.lock ./

RUN yarn install --frozen-lockfile

COPY . .

RUN yarn build

FROM node:lts-alpine AS runner

WORKDIR /app

RUN npm install -g yarn

COPY --from=base /app/package.json ./
COPY --from=base /app/yarn.lock ./
COPY --from=base /app/.next ./.next
COPY --from=base /app/public ./public

# 本番環境用の依存関係のみをインストール
RUN yarn install --production --frozen-lockfile

EXPOSE 3000

ENV NODE_ENV production
ENV HOSTNAME "0.0.0.0"

CMD ["yarn", "start"]

steps:
  # ビルドステップ
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        docker build \
        --build-arg NEXT_PUBLIC_API_URL=$$NEXT_PUBLIC_API_URL \
        --build-arg NEXT_PUBLIC_FIREBASE_KEY=$$NEXT_PUBLIC_FIREBASE_KEY \
        -t asia-northeast1-docker.pkg.dev/demo-proj/proj/frontend:${COMMIT_SHA} .
    secretEnv: ['NEXT_PUBLIC_API_URL', 'NEXT_PUBLIC_FIREBASE_KEY']

  # プッシュステップ
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'asia-northeast1-docker.pkg.dev/demo-proj/proj/frontend:${COMMIT_SHA}']

  # デプロイステップ
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: gcloud
    args:
    - 'run'
    - 'deploy'
    - 'demo-proj-frontend-prod'
    - '--image'
    - 'asia-northeast1-docker.pkg.dev/demo-proj/proj/frontend:${COMMIT_SHA}'
    - '--platform'
    - 'managed'
    - '--project'
    - 'demo-proj'
    - '--allow-unauthenticated'
    - '--port'
    - '3000'
    - '--region'
    - 'asia-northeast1'

# シークレットの設定
availableSecrets:
  secretManager:
  - versionName: projects/demo-proj/secrets/NEXT_PUBLIC_API_URL/versions/latest
    env: 'NEXT_PUBLIC_API_URL'
  - versionName: projects/demo-proj/secrets/NEXT_PUBLIC_FIREBASE_API_KEY/versions/latest
    env: 'NEXT_PUBLIC_FIREBASE_API_KEY'

denied: Unauthenticated request. Unauthenticated requests do not have permission "artifactregistry.repositories.uploadArtifacts" on resource "projects/demo-proj/locations/us/repositories/gcr.io" (or it may not exist)

gcloud auth configure-docker
Adding credentials for all GCR repositories.
WARNING: A long list of credential helpers may cause delays running 'docker build'. We recommend passing the registry name to configure only the registry you are using.
After update, the following will be written to your Docker config file located at [/Users/***/.docker/config.json]:
 {
  "credHelpers": {
    "gcr.io": "gcloud",
    "us.gcr.io": "gcloud",
    "eu.gcr.io": "gcloud",
    "asia.gcr.io": "gcloud",
    "staging-k8s.gcr.io": "gcloud",
    "marketplace.gcr.io": "gcloud"
  }
}

Do you want to continue (Y/n)?  Y

Docker configuration file updated.

To make this the default region, run `gcloud config set run/region asia-northeast1`.

Deploying container to Cloud Run service [demo-proj-frontend-prod] in project [demo-proj] region [asia-northeast1]
X Deploying...
  - Creating Revision...
  . Routing traffic...
  ✓ Setting IAM Policy...
Deployment failed
ERROR: (gcloud.run.deploy) Revision 'demo-proj-frontend-prod-00004-htl' is not ready and cannot serve traffic. The user-provided container failed to start and listen on the port defined provided by the PORT=3000 environment variable. Logs for this revision might contain more information.

Logs URL: https://console.cloud.google.com/logs/viewer?project=***
For more troubleshooting guidance, see https://cloud.google.com/run/docs/troubleshooting#container-failed-to-start

$ docker build --platform linux/amd64 -t gcr.io/demo-proj/frontend ./
$ docker push gcr.io/demo-proj/frontend
$ gcloud run deploy demo-proj-frontend-prod --image gcr.io/demo-proj/frontend --platform managed --project=demo-proj --port 3000 --allow-unauthenticated

docker push gcr.io/demo-proj/frontend
Using default tag: latest
The push refers to repository [gcr.io/demo-proj/frontend]
2e689bcbeaa0: Preparing
27c67c19f257: Preparing
c2be8294c58c: Preparing
bd16d5a43914: Preparing
69280f02369e: Preparing
14b8bef233e8: Waiting
2776de19f60c: Waiting
9d6598bb2c09: Waiting
ea02d285a3e0: Waiting
87eaf97051ac: Waiting
9c63a4679e00: Waiting
94e5f06ff8e3: Waiting
unauthorized: authentication failed

gcloud builds submit --project=demo-proj
Creating temporary archive of 87 file(s) totalling 1.2 MiB before compression.
Some files were not included in the source upload.

Check the gcloud log [/Users/***/.config/gcloud/logs/2024.07.17/12.53.38.672180.log] to see which files and the contents of the
default gcloudignore file used (see `$ gcloud topic gcloudignore` to learn
more).

Uploading tarball of [.] to [gs://demo-proj_cloudbuild/source/1721188419.070311-8a6648814d9d48bfa938f65b3f0a2c90.tgz]
ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: default Cloud Build service account "*********@cloudbuild.gserviceaccount.com" does not have secretmanager.versions.access permissions for secret "projects/demo-proj/secrets/NEXT_PUBLIC_API_URL"

steps:
- name: 'gcr.io/cloud-builders/docker'
  args:
    - 'build'
    - '--build-arg'
    - 'NEXT_PUBLIC_API_URL=$$NEXT_PUBLIC_API_URL'
# 略

steps:
- name: 'gcr.io/cloud-builders/docker'
  entrypoint: 'bash'
  args:
    - '-c'
    - |
      docker build \
      --build-arg NEXT_PUBLIC_API_URL=$$NEXT_PUBLIC_API_URL \

gcloud artifacts repositories list --location=asia-northeast1
ERROR: (gcloud.artifacts.repositories.list) The required property [project] is not currently set.
It can be set on a per-command basis by re-running your command with the [--project] flag.

You may set it for your current workspace by running:

  $ gcloud config set project VALUE

or it can be set temporarily by the environment variable [CLOUDSDK_CORE_PROJECT]

gcloud artifacts repositories list --location=asia-northeast1
Listing items under project demo-proj, location asia-northeast1.

                                                                     ARTIFACT_REGISTRY
REPOSITORY       FORMAT  MODE                 DESCRIPTION  LOCATION         LABELS  ENCRYPTION          CREATE_TIME          UPDATE_TIME          SIZE (MB)
proj  DOCKER  STANDARD_REPOSITORY               asia-northeast1          Google-managed key  2024-07-17T16:47:49  2024-07-17T16:47:49  0

ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.get' denied on resource 'namespaces/demo-proj/services/demo-proj-frontend-prod' (or resource may not exist). This command is authenticated as *******@cloudbuild.gserviceaccount.com which is the active account specified by the [core/account] property.
ERROR
ERROR: build step 0 "gcr.io/google.com/cloudsdktool/cloud-sdk" failed: step exited with non-zero status: 1
--------------------------------------------------------------------

BUILD FAILURE: Build step failure: build step 0 "gcr.io/google.com/cloudsdktool/cloud-sdk" failed: step exited with non-zero status: 1
ERROR: (gcloud.builds.submit) build 136d4bb1-624f-4094-80ba-64a5ab5ae99a completed with status "FAILURE"