- Add `Cloud Functions Developer` role (and/or any other relevant resource that will be deployed) and the `Service Account User` role to the Cloud Build's service account. You can do this by navigating to the IAM tab in the Google Cloud Console.
- If you do not grant the necessary permissions to the Cloud Build service account, you may see an error like this while deploying Cloud Functions (or whichever resource you are deploying.)
error: Plan apply failed: googleapi: Error 403: Missing necessary permission iam.serviceAccounts.actAs for on resource cloud-build-samples@appspot.gserviceaccount.com. Please grant the roles/iam.serviceAccountUser role. You can do that by running 'gcloud iam service-accounts add-iam-policy-binding cloud-build-samples@appspot.gserviceaccount.com --member= --role=roles/iam.serviceAccountUser', forbidden
- The choice of example has no bearing on the information presented on this page. You may choose any example. However, the Cloud Functions example is the easiest and quickest to get up and running with Cloud Build.
Don't have a repo on Cloud Source yet? See this page for a [quickstart](https://cloud.google.com/source-repositories/docs/quickstart) tutorial.
### External repos
Have an existing repo already? Cloud Source supports [mirroring repositories](https://cloud.google.com/source-repositories/docs/mirroring-a-github-repository) that are on GitHub or Bitbucket.
Set the appropriate `gcp:project` and `gcp:region` values. For example, if your Google Cloud project ID is `awesome-project` and you would like to deploy resources to `us-central1`, then you should run:
**Note**: Not all resources are available in all regions. Check that Google Cloud supports [the region and resource combination](https://cloud.google.com/about/locations/).
The Cloud Build configuration file below is a sample, to show you how to install the Pulumi CLI and run pulumi commands such as `pulumi preview` or `pulumi up` as part of your CI/CD workflow.
**Note:** The `_INSECURE_SUBSTITUTION_PULUMI_ACCESS_TOKEN` substitution is a simple way to specify the token, but you should consider using encrypted variables.
```yaml
steps:
- name: 'gcr.io/cloud-builders/yarn'
entrypoint: /bin/sh
args:
- '-c'
- 'chmod +x *.sh && ./pulumi.sh'
env:
# We use substitution for an example. Your Pulumi access token is sensitive and as such should be encrypted.
# See the Encrypted Variables section below on how to do that.
In the above configuration, both `_BUILD_TYPE` and `_INSECURE_SUBSTITUTION_PULUMI_ACCESS_TOKEN` are substitutions configured in Cloud Build Triggers. More about [triggers](https://cloud.google.com/cloud-build/docs/running-builds/automate-builds).
-`_BUILD_TYPE` is used to indicate to the build environment about the type of build it is running. This allows us to run a `preview` or an `update` based on the build type. To configure the substitution, you need to setup build triggers for each type of branch builds you intend to support for your project.
For example, if you only want to support PR and merge builds, setup two triggers with the filter pattern `master` for all merge builds and `^master` for all other builds.
To setup a build trigger, navigate to the [Cloud Build service](https://console.cloud.google.com/cloud-build/triggers) in your Google Cloud Console, making sure that you have the correct project selected.
Click on **Add Trigger** and follow the prompts to setup a trigger for your repo. In the final step **Trigger settings**, select the following settings:
We have created a builder image that will install the Pulumi CLI for you in a Node-based image. Since the builder is part of Google Cloud Build's community builders, you will need to make the builder available to your project by cloning the community builders' Git repo. See [Google Cloud Cloud Builders Community Repository](https://github.com/GoogleCloudPlatform/cloud-builders-community/tree/master/pulumi) for more information and an example for how to use the builder in your project.
If you have sensitive variables that may require encryption, you should create an encryption on Google KMS, then use that to encrypt your sensitive values. You may then use the encrypted strings in your cloud build configuration safely. Cloud Build can automatically decrypt sensitive strings at build time. See [this](https://cloud.google.com/cloud-build/docs/securing-builds/use-encrypted-secrets-credentials#using_the_encrypted_variable_in_build_requests) page to learn more.
### Substitutions
In the configuration above, we used custom substitutions. Cloud Build also has [default substitutions](https://cloud.google.com/cloud-build/docs/configuring-builds/substitute-variable-values). Using the default substitutions, you can make decisions in your CI or CD workflow.
