Manage Cloud APIs and Cloud Client Libraries in Cloud Code for Cloud Shell

To access Google Cloud products and services programmatically, you use Cloud APIs. These APIs expose a simple JSON REST interface. The recommended way to access the Cloud APIs is to use the Cloud Client Libraries.

Cloud Code makes it easy to add the Cloud Client Libraries for the Cloud APIs and language you're using to your project. In the same view, you can search for samples for each API and easily incorporate samples into your application.

Browsing Cloud APIs

To explore all available Google Cloud APIs:

  1. To open the Cloud APIs Explorer, click Cloud Code - Cloud Run.

    The Cloud APIs view groups Cloud APIs by category.

  2. To view details of an API, click the API name. Details such as the service name, status, installation instructions for client libraries, documentation, and code samples are displayed.

Enabling Cloud APIs

To enable Cloud APIs for a project using the API details page, follow these steps:

  1. On the Cloud API details page, choose the project to enable the Cloud API for.
  2. Click Enable API. After the API is enabled, a message is displayed to confirm the change.

Adding client libraries to your project

In addition to exploring and enabling Cloud APIs using Cloud Code, you can add a language-specific client library to your project.

To install a client library, follow the instructions on the API details page for your language.

Setting up authentication

After you've enabled the required APIs and added the necessary client libraries, you need to configure your application for it to be successfully authenticated. Your configuration depends on your type of development and the platform you're running on.

After you complete the authentication steps, your application can authenticate and is ready to be deployed.

Local development

The Cloud Shell VM instance uses the Compute Engine default service account (the service account Google Kubernetes Engine uses by default) as its default service account. This means that when developing with Cloud Code on Cloud Shell, you don't need to set up any additional configuration when working with client libraries. Your application is authenticated and ready to run locally.

Remote development

GKE

Depending on the scope of your project, you can choose how you authenticate Google Cloud services on GKE:

  • (Development only)
    1. Create a GKE cluster with the following settings:
      • Make sure that you're using the service account GKE uses by default, the Compute Engine default service account, and that Access scopes is set at Allow full access to all Cloud APIs (both settings are accessible in the Node Pools > Security section). Since the Compute Engine service account is shared by all workloads deployed on your node, this method overprovisions permissions and should only be used for development.
      • Make sure that Workload Identity isn't enabled on your cluster (in the Cluster > Security section).
    2. Assign the necessary roles to your service account:
  • (Recommended for production)
    1. Configure your GKE cluster and application with Workload Identity to authenticate Google Cloud services on GKE. This associates your Kubernetes service account with your Google service account.
    2. Configure your Kubernetes Deployment to reference the Kubernetes service account by setting the .spec.serviceAccountName field in your Kubernetes Deployment YAML file. If you're working on an app created from a Cloud Code sample application, this file is located under the kubernetes-manifests folder.
    3. If the Google Cloud service you're trying to access requires additional roles, grant them for the Google service account you're using to develop your app:

Cloud Run

  1. To create a new unique service account for deploying your Cloud Run application, navigate to the Service Accounts page and then select the project that your secret is stored in.

    Go to the Service Accounts page

  2. Click Create service account.
  3. In the Create service account dialog, enter a descriptive name for the service account.
  4. Change the Service account ID to a unique, recognizable value and then click Create.
  5. If the Google Cloud service you're trying to access requires additional roles, grant the roles, click Continue, and then click Done.
  6. To add your service account to your deploy configuration:
    1. Using the Cloud Code status bar, choose the Cloud Run: Deploy command.
    2. In the Cloud Run Deployment UI, under Revision Settings, in the Service Account field, specify your service account.
    Advanced revision settings section expanded in Cloud Run: Deploy and Service Account field filled in with service account name of the format service-account-name@project-name.iam.gserviceaccount.com

Cloud Run

Depending on the scope of your project, you can choose how you authenticate Google Cloud services on GKE:

  • (Development only)
    1. Create a GKE cluster with the following settings:
      • Make sure that you're using the service account that GKE uses by default, the Compute Engine default service account, and that Access scopes is set at Allow full access to all Cloud APIs (both settings accessible in the Node Pools > Security section). Since the Compute Engine service account is shared by all workloads deployed on your node, this method overprovisions permissions and should only be used for development.
      • Make sure that Workload Identity isn't enabled on your cluster (in the Cluster > Security section).
    2. Assign the necessary roles to your service account:
  • (Recommended for production)
    1. Configure your GKE cluster and application with Workload Identity to authenticate Google Cloud services on GKE. This associates your Kubernetes service account with your Google service account.
    2. To add your service account to your deploy configuration:
      1. Using the Cloud Code status bar, choose the Cloud Run: Deploy command.
      2. In the Cloud Run Deployment UI, under Revision Settings, in the Service Account field, specify your service account.
      Advanced revision settings section expanded in Cloud Run: Deploy and Service Account field filled in with Kubernetes service account name of the format service-account-name@project-name.iam.gserviceaccount.com
    3. If the Google Cloud service you're trying to access requires additional roles, grant them for the Google service account you're using to develop your app:

Remote development with Secret Manager permissions enabled

If you're developing remotely, using a service account for authentication, and your application uses secrets, you need to complete a few more steps in addition to the remote development instructions. These steps assign your Google service account the role required to access a particular Secret Manager secret:

  1. Click Cloud Code icon Cloud Code and then expand the Secret Manager section.

    Secret Manager in Cloud Code open with two secrets listed

  2. Right-click the secret and select Edit Permissions in Cloud console. This launches the Secret Manager configuration page for that secret in your web browser.

    Right-clicked secret in Secret Manager panel

  3. In Google Cloud console, click Permissions and then click Add.

  4. In the New principals field, enter the name of your your service account.

  5. In the Select a role field, choose the Secret Manager Secret Accessor role.

  6. Click Save.

    Your service account now has permission to access this particular secret.