Notification: Build Status Change¶

Overview¶

Receive and handle the Cloud Build build events and notification based on filtered set of build status.

• Notification: Build Status Change
• Overview
• SAD - System architechture design
  • Logical View
  • Physical View
  • The table component
    • Detail on component
    • 1 | Repository inno-notification
    • 2 | Repository inno-infra
    • 3 | CloudBuild
    • 4 | Cloud PubSub [Topic]
    • 5 | Cloud PubSub [Sub]
    • 6 | IAP - Identity Aware Proxy
    • 7 | Notification Service on Cloud Run
    • 8 | Integrate Agent Slack
  • Service Account
    • Method to obtaining an OIDC token
  • Implemented Screenshot
• Appendix
  • Appendix A: Record of Changes
• Source Reference

SAD - System architechture design¶

Logical View¶

Cloud Build publishes messages to a registed portal (currently is a PubSub topic) by itself about build's status changes.

Each message contains a base64 JSON string representation of your Build resource in the message.data attribute. The build's unique ID and the build's status can be found in the message.attributes field.

Then there are 2 phases can applied to the calling service by:

[1] Method 1: Go to rate limit zone with dispatch and routing services

[2] Method 2: Direct message into the notification service

The flow has been described at below

flowchart LR

  %% Component
  notification[Notification Service]

  subgraph gcp[Google Cloud Platform]
    subgraph cloudbuild[CloudBuild]
      build[Build]
    end
    build -- change status --> build
    build -- """publish message
      on change""" --> portal[Portal]
    notification -. registration .- portal
    portal -- [1] dispatch --> rlm[Rate Limit] -- [1] routing --> notification
    portal -- [2] direct message --> notification

    notification -- listen on targeted route --> notification
  end
  subgraph 3pt[Third Party]
    agent[Agent]
  end
  notification --> agent -- notice --> user[User]

The enums of possible status of a build or build step has been defined below:

Reference: API Reference Project Build Status

The messages constructed by below

For the handler

Physical View¶

Based on the instruction CloudBuild Notifier from Google.

Based on use case, the following stack has been choosen:

flowchart LR

  %% Component
  iap[IAP]

  %% Block
  subgraph gcp[Google Cloud Platform]

    subgraph cloudbuild[CloudBuild]
      subgraph trigger[Trigger]
      end
      subgraph build[Build]
      end
      trigger --> build
    end

    subgraph pubsub[PubSub]
      pub[Topic]
      sub[Subcription]
    end

    subgraph run[Cloud Run]
      notification[Notification Service]
    end

    build -- push --> pub -- sink --> sub -- http push --> iap -- authentication --> notification

    notification <-- """
      filter build status,
      construct message,
      annotate metadata""" --> notification
  end

  subgraph notification_agent[Notification Agent]
    agent[Agent]
  end

  notification --> notification_agent

The table component¶

Detail on component¶

1 | Repository inno-notification¶

2 | Repository inno-infra¶

3 | CloudBuild¶

4 | Cloud PubSub [Topic]¶

For the labels, matching following component

Note:

At the May 2024, Cloud Build not supported publish event into custom PubSub topic subscribe-build-notification. So that, do not change this.

5 | Cloud PubSub [Sub]¶

Note:

The audiance has the syntax of $PROJECT_NUMBER-$RANDOM_TEXT.apps.googleusercontent.com

For the labels, matching following component

6 | IAP - Identity Aware Proxy¶

Note: This working on the production only.

Context of IAP:

Targeted into: internal.notification.data.innotech.vn

Type: BINDING method

Required IAM roles of roles/iap.httpsResourceAccessor in the binding of IAP context

7 | Notification Service on Cloud Run¶

Handle the listen on CloudBuild at the route: /event/cloudbuild

Seperated with 2 environment:

Staging:

Production:

8 | Integrate Agent Slack¶

Service Account¶

Default service agent of PubSub:

Identity: serviceAccount:service-${PROJECT_NUMBER}@gcp-sa-pubsub.iam.gserviceaccount.com

Alias: SA_AGENT_PUBSUB

Default service agent of IAP service:

Because the notification go through IAP service for authentication purpose

Identity: serviceAccount:service-${PROJECT_NUMBER}@gcp-sa-iap.iam.gserviceaccount.com

Alias: SA_DEFAULT_IAP

Managed by: Terraform in GitHub::inno-infra

Service account on Subcription:

Identity: serviceAccount:sa-spirit-breaker@${PROJECT_ID}.iam.gserviceaccount.com

Alias: sa_spirit_breaker

Method to obtaining an OIDC token¶

In all other cases, use the IAM credentials API to generate an OIDC token by impersonating a target service account right before accessing an IAP-secured resource.

This process involves the following steps:

Provide the calling service account (the service account associated with the code that is obtaining the ID token) with the Service Account OpenID Connect Identity Token Creator role (roles/iam.serviceAccountOpenIdTokenCreator).

This gives the calling service account the ability to impersonate the target service account.

Use the credentials provided by the calling service account to call the generateIdToken method on the target service account.

Set the audience field to your client ID.

Reference: Programmatic authentication

Implemented Screenshot¶

Appendix¶

Appendix A: Record of Changes¶

Table: Record of changes

Source Reference¶

• Google - Configure Notifications into Slack