Meta tags:
Headings (most frequently used words):
node, js, python, java, the, with, code, cloud, up, identity, platform, to, pricing, run, tutorial, and, set, integrate, side, server, delete, resources, subject, tier, end, user, authentication, for, stay, organized, collections, save, categorize, content, based, on, your, preferences, objectives, costs, before, you, begin, gcloud, cli, defaults, retrieve, sample, visualize, architecture, understand, core, deploy, service, finishing, touches, try, it, out, clean, what, next, required, roles, locations, client, connect, sql, handle, sensitive, configuration, secret, manager, project, products, support, engage,
Text of the page (most frequently used words):
the (272), cloud (142), and (90), run (78), #project (65), you (65), service (60), with (56), google (49), sql (45), your (45), for (44), from (44), identity (41), that (39), create (39), user (38), services (35), secret (35), using (34), roles (33), delete (29), deploy (29), token (27), overview (27), this (26), platform (23), region (23), server (23), tutorial (22), use (22), code (21), gcloud (21), build (21), instance (20), console (20), firebase (20), resources (19), sample (19), project_id (18), can (18), configure (18), database (18), java (17), manager (17), account (17), iam (17), client (17), samples (16), container (16), idp (16), admin (16), name (15), select (15), environment (15), python (15), low (15), sign (14), config (14), access (14), secrets (14), worker (14), com (13), configuration (13), click (13), end (13), credentials (13), repository (13), error (13), return (13), const (13), storage (13), europe (13), functions (13), other (12), vote (12), new (12), auth (12), node (12), spring (12), application (12), get (12), jobs (12), pools (12), page (11), add (11), function (11), gpu (11), vpc (11), need (10), users (10), created (10), url (10), role (10), string (10), returns (10), authorization (10), uid (10), view (10), asia (10), manage (9), following (9), then (9), data (9), provider (9), connection (9), docker (9), request (9), postgres (9), sdk (9), header (9), volumes (9), execute (9), about (8), all (8), requests (8), has (8), projects (8), when (8), authentication (8), try (8), https (8), note (8), cloudsql (8), cloud_sql_credentials_secret (8), cli (8), uses (8), grant (8), json (8), db_user (8), db_name (8), cloud_sql_connection_name (8), postgresql (8), window (8), enable (8), err (8), development (8), git (8), best (8), practices (8), trigger (8), triggers (8), thumb (7), more (7), artifact (7), registry (7), also (7), dialog (7), limits (7), custom (7), through (7), format (7), signed (7), instances (7), password (7), memory (7), set (7), required (7), jdbctemplate (7), pool (7), connect (7), headers (7), pub (7), sub (7), maximum (7), products (6), are (6), authenticate (6), learn (6), next (6), image (6), browser (6), provided (6), apis (6), variables (6), which (6), tools (6), file (6), db_password (6), not (6), app (6), parse (6), logger (6), catch (6), object (6), retrieve (6), engine (6), creds (6), credconfig (6), authheader (6), verify (6), response (6), alert (6), log (6), docs (6), how (6), security (6), migrate (6), agents (6), metrics (6), github (5), pricing (5), down (5), information (5), under (5), send (5), deployed (5), plan (5), might (5), used (5), existing (5), management (5), sensitive (5), complete (5), after (5), method (5), allow (5), jib (5), containers (5), datasource (5), values (5), web (5), throw (5), secure (5), local (5), extract (5), integrate (5), logging (5), selecting (5), cost (5), usage (5), resourcemanager (5), permission (5), based (5), networking (5), migration (5), gpus (5), network (5), traffic (5), source (5), job (5), eventarc (5), invoke (5), português (4), español (4), status (4), understand (4), content (4), its (4), developers (4), gserviceaccount (4), added (4), setup (4), costs (4), billing (4), deployment (4), copy (4), oauth (4), logs (4), providers (4), version (4), pkg (4), dev (4), credential (4), builds (4), location (4), policy (4), associated (4), gcp (4), cpu (4), infrastructure (4), static (4), make (4), sure (4), def (4), databases (4), private (4), unix (4), sqlalchemy (4), host (4), else (4), decodedtoken (4), properly (4), expired (4), req (4), www (4), their (4), script (4), clone (4), west1 (4), south1 (4), editor (4), selector (4), write (4), checks (4), inference (4), direct (4), scaling (4), health (4), optimize (4), dependencies (4), events (3), started (3), system (3), support (3), contact (3), see (3), otherwise (3), explore (3), tutorials (3), methods (3), into (3), default (3), replace (3), don (3), type (3), want (3), multiple (3), have (3), such (3), instead (3), tasks (3), document (3), any (3), keep (3), these (3), will (3), should (3), button (3), step (3), enter (3), domain (3), authorize (3), variable (3), cloud_sql_instance_name (3), process (3), push (3), images (3), must (3), password_secret (3), username (3), steps (3), supply (3), external (3), unable (3), formatted (3), hashmap (3), null (3), public (3), str (3), been (3), env (3), provides (3), db_config (3), db_socket_dir (3), db_pass (3), args (3), base (3), int (3), decoded (3), correct (3), split (3), func (3), res (3), require (3), side (3), text (3), await (3), team (3), adds (3), result (3), javascript (3), back (3), reference (3), shows (3), contains (3), alternatively (3), zip (3), download (3), googlecloudplatform (3), east1 (3), northamerica (3), specific (3), managed (3), permissions (3), test (3), serviceusage (3), free (3), guides (3), hosting (3), frameworks (3), monitoring (3), solutions (3), distributed (3), introduction (3), mcp (3), connectors (3), optimization (3), autoscale (3), labels (3), ephemeral (3), disk (3), cifs (3), smb (3), nfs (3), volume (3), mounts (3), entrypoint (3), retries (3), firestore (3), concurrent (3), product (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), our (2), terms (2), site (2), youtube (2), architecture (2), last (2), updated (2), 2026 (2), utc (2), except (2), licensed (2), details (2), license (2), feedback (2), connecting (2), unset (2), remove (2), during (2), they (2), list (2), deleting (2), avoid (2), work (2), without (2), additional (2), choose (2), flow (2), previous (2), out (2), firebaseapp (2), save (2), icon (2), edit (2), authorized (2), redirect (2), domains (2), requires (2), finishing (2), touches (2), latest (2), update (2), unauthenticated (2), load (2), begin (2), verifies (2), submit (2), tag (2), binding (2), member (2), serviceaccount (2), secretmanager (2), accounts (2), automatic (2), follow (2), described (2), initialize (2), authdomain (2), apikey (2), client_secret (2), client_id (2), email (2), one (2), api (2), manual (2), loads (2), dictionary (2), dict (2), get_cred_config (2), tostring (2), resource (2), runtime (2), handle (2), jdbc (2), bean (2), allows (2), none (2), pgsql (2), 5432 (2), unix_sock (2), pg8000 (2), socket (2), dbsocketpath (2), knex (2), async (2), httpstatus (2), responsestatusexception (2), idtoken (2), verifyidtoken (2), authenticatejwt (2), decorated_function (2), kwargs (2), decoded_token (2), 401 (2), 403 (2), exception (2), extracts (2), callable (2), sendstatus (2), fetch (2), currentuser (2), reporting (2), displayname (2), them (2), gstatic (2), firebasejs (2), src (2), first (2), core (2), sdks (2), authenticated (2), sends (2), own (2), control (2), redirected (2), votes (2), nodejs (2), already (2), west4 (2), west3 (2), west2 (2), southamerica (2), northeast2 (2), northeast1 (2), central2 (2), central1 (2), australia (2), southeast2 (2), southeast1 (2), india (2), south (2), subject (2), tier (2), available (2), regions (2), latency (2), but (2), across (2), locations (2), within (2), supported (2), defaults (2), basic (2), administrator (2), owner (2), enabled (2), procedure (2), finish (2), removing (2), creator (2), projectcreator (2), doesn (2), granted (2), perform (2), world (2), components (2), least (2), privilege (2), protect (2), processes (2), does (2), documentation (2), languages (2), observability (2), industry (2), hybrid (2), multicloud (2), analytics (2), pipelines (2), compute (2), troubleshoot (2), oci (2), assisted (2), llm (2), execution (2), remote (2), adk (2), a2a (2), prometheus (2), controls (2), shared (2), connector (2), automate (2), workflows (2), description (2), metadata (2), systems (2), capacity (2), rollbacks (2), revisions (2), continuous (2), tags (2), timeout (2), testing (2), workflow (2), runtimes (2), configurations (2), http (2), serving (2), serve (2), results (2), php (2), ruby (2), prepare (2), develop (2), cases (2), cross (2), technology (2), areas (2), close (2), subscribe, newsletter, third, decade, climate, action, join, cookies, privacy, tech, twitter, blog, engage, training, certification, center, getting, release, notes, community, forums, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, noted, registered, trademark, oracle, affiliates, policies, apache, creative, commons, attribution, demos, review, ways, managing, dive, deeper, what, command, incur, until, receive, shut, effects, architectures, quickstarts, reusing, help, exceeding, quota, future, preserve, urls, selected, inside, whole, appspot, ids, lost, done, everything, deleted, caution, easiest, way, eliminate, changes, charges, clean, continue, developing, remember, restricted, rest, given, many, authenticates, securely, manages, success, look, like, navigate, handler, field, paste, bottom, pencil, beside, uri, uris, describe, value, locate, find, anytime, right, panel, clicking, pen, allowed, resolved, startup, time, recommends, pin, particular, rather, than, flags, specify, respectively, manually, authenticating, mvn, compile, dimage, maven, plugin, helper, common, optimizes, dockerfile, having, installed, building, each, names, unique, artifacts, repositories, secretaccessor, replication, versioned, postgres_16, 7680mb, root, cloud_sql_region, provisioning, yet, still, settings, top, obtain, agree, audience, displayed, emails, runtimeexception, jsonsyntaxexception, class, fromjson, gson, illegalstateexception, getenv, getconfig, environ, stored, utf8, secret_id, versions, passed, centralized, injects, integration, interact, libraries, mysql, auto, coupled, operations, querying, modifying, votecontroller, final, vars, uncomment, starter, initialized, info, description_encoding, dialect, query, drivername, socket_path, equivalent, create_engine, initializes, init_unix_connection_engine, establish, db_socket_path, connectwithunixsockets, param, sockets, connects, unauthorized, forbidden, firebaseauthexception, getuid, getinstance, firebaseauth, firebasetoken, map, verify_id_token, firebase_admin, wraps, jwt_authenticated, initializeapp, sent, something, went, wrong, please, again, submitting, reload, body, bearer, form, urlencoded, post, getidtoken, refresh, current, jwt, identify, successfully, signs, mint, capture, route, implementation, example, refer, stackdriver, library, failed, retry, check, message, welcome, logged, along, signinwithpopup, googleapis, userinfo, addscope, googleauthprovider, signin, handles, prompting, redirects, listed, always, api_key, order, holds, imports, necessary, implemented, receives, confirming, appropriately, fetches, login, welcomes, makes, diagram, being, visualize, change, directory, machine, dashboard, las, vegas, salt, lake, city, los, angeles, santiago, chile, sao, paulo, brazil, toronto, montreal, dammam, doha, zurich, switzerland, west6, frankfurt, germany, london, turin, west12, berlin, west10, warsaw, poland, melbourne, sydney, delhi, south2, jakarta, singapore, seoul, korea, northeast3, hong, kong, east2, johannesburg, africa, oregon, dallas, columbus, east5, northern, virginia, east4, carolina, iowa, mexico, tel, aviv, paris, west9, milan, west8, netherlands, belgium, madrid, southwest1, stockholm, north2, finland, north1, bangkok, southeast3, mumbai, osaka, tokyo, taiwan, meeting, availability, durability, requirements, primary, factors, where, generally, nearest, consider, together, affect, well, regional, means, runs, located, redundantly, zones, choice, chosen, contain, shouldn, production, able, predefined, granting, folders, organizations, serviceusageconsumer, consumer, serviceaccountuser, projectiamadmin, oauthconfig, identityplatform, serviceaccountcreator, cloudbuild, artifactregistry, repoadmin, ask, likely, serviceusageadmin, evaluate, real, scenarios, customers, 300, credits, workloads, before, generate, estimate, projected, eligible, trial, calculator, billable, minimal, backend, objectives, minimizes, risks, tool, term, refers, federated, workforce, federation, simplicity, acquire, however, stores, providing, valid, favorite, domestic, animal, voting, consisting, categorize, preferences, stay, organized, collections, home, known, issues, troubleshooting, errors, gke, kubernetes, vmware, tanzu, music, compliant, strategy, foundry, heroku, aws, lambda, 1st, gen, cookbook, vibe, coding, accelerated, video, transcoding, ffmpeg, batch, fine, tune, llms, hugging, face, transformers, opencv, acceleration, gemma, models, ollama, automation, servers, n8n, tracing, audit, opentelemetry, built, monitor, multi, tenant, platforms, running, untrusted, software, chain, insights, constraints, customer, encryption, keys, threat, detection, binary, armor, iap, audiences, design, mesh, restrict, endpoint, ingress, outbound, address, standard, dual, stack, ipv4, ipv6, register, ips, dns, pull, subscriptions, runners, kafka, autoscaler, scale, count, splits, background, checkpoints, stop, executions, task, parallelism, scheduled, completion, event, driven, zonal, redundancy, general, tips, grpc, routed, entries, processing, call, subscription, asynchronous, series, part, schedule, asynchronously, websocket, chat, stream, websockets, webhook, target, updates, language, minimum, autoscaling, sandboxes, port, recommender, per, performance, gradual, rollouts, frontend, proxying, nginx, session, affinity, failover, assets, cdn, mapping, compose, sources, codelabs, spanner, bigquery, net, compare, commands, install, package, containerize, shell, sveltekit, nuxt, angular, ssr, kotlin, agent, kit, streamlit, smolagents, langchain, gradio, fastapi, flask, hello, good, fit, contract, model, discover, start, skip, main,
Text of the page (random words):
one https github com googlecloudplatform python docs samples git alternatively you can download the sample as a zip file and extract it java git clone https github com googlecloudplatform java docs samples git alternatively you can download the sample as a zip file and extract it change to the directory that contains the cloud run sample code node js cd nodejs docs samples run idp sql python cd python docs samples run idp sql java cd java docs samples run idp sql visualize the architecture diagram shows an end user logging in through a google sign in dialog provided by identity platform and then being redirected back to cloud run with the user s identity an end user makes the first request to the cloud run server the client loads in the browser the user provides login credentials through the google sign in dialog from identity platform an alert welcomes the signed in user control is redirected back to the server the end user votes using the client which fetches an id token from identity platform and adds it to the vote request header when the server receives the request it verifies the identity platform id token confirming that the end user is appropriately authenticated then server sends the vote to cloud sql using its own credentials understand the core code the sample is implemented as client and server as described next integrate with identity platform client side code this sample uses firebase sdks to integrate with identity platform in order to sign in and manage users to connect to identity platform the client side javascript holds the reference to the project s credentials as a config object and imports the necessary firebase javascript sdks const config apikey api_key authdomain project_id firebaseapp com firebase app the core firebase sdk is always required and must be listed first script src https www gstatic com firebasejs 7 18 firebase app js script add firebase auth service script src https www gstatic com firebasejs 7 18 firebase auth js script the firebase javascript sdk handles the sign in flow by prompting the end user to sign in to their google account using a dialog window it then redirects them back to the service function signin const provider new firebase auth googleauthprovider provider addscope https www googleapis com auth userinfo email firebase auth signinwithpopup provider then result returns the signed in user along with the provider s credential console log result user displayname logged in window alert welcome result user displayname catch err console log error during sign in err message window alert sign in failed retry or check your browser logs note to capture browser logging you might want to route logs to cloud logging for an implementation example refer to stackdriver error reporting library when a user successfully signs in the client uses firebase methods to mint an id token the client adds the id token to the authorization header of its request to the server async function vote team if firebase auth currentuser retrieve jwt to identify the user to the identity platform service returns the current token if it has not expired otherwise this will refresh the token and return a new one try const token await firebase auth currentuser getidtoken const response await fetch method post headers content type application x www form urlencoded authorization bearer token body team team send application data vote if response ok const text await response text window alert text window location reload catch err console log error when submitting vote err window alert something went wrong please try again else window alert user not signed in integrate with identity platform server side code the server uses the firebase admin sdk to verify the user id token sent from the client if the provided id token has the correct format is not expired and is properly signed the method returns the decoded id token the server extracts the identity platform uid for that user node js const firebase require firebase admin initialize firebase admin sdk firebase initializeapp extract and verify id token from header const authenticatejwt req res next const authheader req headers authorization if authheader const token authheader split 1 if the provided id token has the correct format is not expired and is properly signed the method returns the decoded id token firebase auth verifyidtoken token then decodedtoken const uid decodedtoken uid req uid uid next catch err req logger error error with authentication err return res sendstatus 403 else return res sendstatus 401 python def jwt_authenticated func callable int callable int use the firebase admin sdk to parse authorization header to verify the user id token the server extracts the identity platform uid for that user wraps func def decorated_function args a kwargs a a header request headers get authorization none if header token header split 1 try decoded_token firebase_admin auth verify_id_token token except exception as e logger exception e return response status 403 response f error with authentication e else return response status 401 request uid decoded_token uid return func args kwargs return decorated_function java extract and verify id token from header private string authenticatejwt map string string headers string authheader headers get authorization null headers get authorization headers get authorization if authheader null string idtoken authheader split 1 if the provided id token has the correct format is not expired and is properly signed the method returns the decoded id token try firebasetoken decodedtoken firebaseauth getinstance verifyidtoken idtoken string uid decodedtoken getuid return uid catch firebaseauthexception e logger error error with authentication e tostring throw new responsestatusexception httpstatus forbidden e else logger error error no authorization header throw new responsestatusexception httpstatus unauthorized connect the server to cloud sql the server connects to the cloud sql instance unix domain socket using the format cloudsql cloud_sql_connection_name node js connect to the cloud sql instance through unix sockets param object credconfig the cloud sql connection configuration from secret manager returns object knex s postgresql client const connectwithunixsockets async credconfig const dbsocketpath process env db_socket_path cloudsql establish a connection to the database return knex client pg connection user credconfig db_user e g my user password credconfig db_password e g my user password database credconfig db_name e g my database host dbsocketpath credconfig cloud_sql_connection_name config python def init_unix_connection_engine db_config dict str int sqlalchemy engine base engine initializes a unix socket connection pool for a cloud sql instance of postgresql args db_config a dictionary with connection pool config returns a sqlalchemy engine instance creds credentials get_cred_config db_user creds db_user db_pass creds db_password db_name creds db_name db_socket_dir creds get db_socket_dir cloudsql cloud_sql_connection_name creds cloud_sql_connection_name pool sqlalchemy create_engine equivalent url postgres pg8000 db_user db_pass db_name unix_sock socket_path cloud_sql_instance_name s pgsql 5432 sqlalchemy engine url url create drivername postgresql pg8000 username db_user e g my database user password db_pass e g my database password database db_name e g my database name query unix_sock f db_socket_dir cloud_sql_connection_name s pgsql 5432 e g cloudsql project name instance region instance name db_config pool dialect description_encoding none logger info database engine initialized from unix connection return pool java use the spring cloud google cloud postgresql starter integration to interact with your postgresql databases in cloud sql using spring jdbc libraries set your cloud sql for mysql config to auto configure a datasource bean which coupled with spring jdbc provides a jdbctemplate object bean that allows for operations such as querying and modifying a database uncomment and add env vars for local development spring datasource username db_user spring datasource password db_password spring cloud gcp sql database name db_name spring cloud gcp sql instance connection name cloud_sql_connection_name private final jdbctemplate jdbctemplate public votecontroller jdbctemplate jdbctemplate this jdbctemplate jdbctemplate handle sensitive configuration with secret manager secret manager provides centralized and secure storage of sensitive data such as cloud sql configuration the server injects the cloud sql credentials from secret manager at runtime using an environment variable learn more about using secrets with cloud run node js cloud_sql_credentials_secret is the resource id of the secret passed in by environment variable format projects project_id secrets secret_id versions version const cloud_sql_credentials_secret process env if cloud_sql_credentials_secret try parse the secret that has been added as a json string to retrieve database credentials return json parse cloud_sql_credentials_secret tostring utf8 catch err throw error unable to parse secret from secret manager make sure that the secret is json formatted err python def get_cred_config dict str str retrieve cloud sql credentials stored in secret manager or default to environment variables returns a dictionary with cloud sql credential values secret os environ get cloud_sql_credentials_secret if secret return json loads secret java retrieve config from secret manager public static hashmap string object getconfig string secret system getenv cloud_sql_credentials_secret if secret null throw new illegalstateexception cloud_sql_credentials_secret is required try hashmap string object config new gson fromjson secret hashmap class return config catch jsonsyntaxexception e logger error unable to parse secret from secret manager make sure that it is json formatted e throw new runtimeexception unable to parse secret from secret manager make sure that it is json formatted set up identity platform identity platform requires manual setup in the google cloud console in the google cloud console enable the identity platform api enable the api configure your project in a new window go to the google auth platform overview page go to overview click get started and follow the project configuration setup in the app information dialog supply the application name select one of the displayed user support emails in the audience dialog select external in the contact information dialog enter a contact email agree to the user data policy then click create create and obtain your oauth client id and secret in the google cloud console go to the apis services credentials page go to credentials at the top of the page click create credentials and select oauth client id from application type select web application and supply the name click create the client_id and client_secret values will be used in the next step configure google as a provider in the google cloud console go to the identity providers page go to identity providers click add a provider select google from the list in the web sdk configuration settings enter the client_id and client_secret values from the previous step under configure your application click setup details copy the configuration to your application copy the apikey and authdomain values into the sample s static config js to initialize the identity platform client sdk note this configuration is not yet complete after you deploy your cloud run server you still need to authorize your service domain as described in finishing touches deploy the service follow the steps to complete infrastructure provisioning and deployment create a cloud sql instance with postgresql database using the console or cli gcloud sql instances create cloud_sql_instance_name database version postgres_16 region cloud_sql_region cpu 2 memory 7680mb root password db_password add your cloud sql credential values to postgres secrets json node js cloud_sql_connection_name project_id region instance db_name postgres db_user postgres db_password password_secret python cloud_sql_connection_name project_id region instance db_name postgres db_user postgres db_password password_secret java spring cloud gcp sql instance connection name project_id region instance spring cloud gcp sql database name postgres spring datasource username postgres spring datasource password password_secret create a versioned secret using the console or cli gcloud secrets create idp sql secrets replication policy automatic data file postgres secrets json create a service account for the server using the console or cli gcloud iam service accounts create idp sql identity grant roles for secret manager and cloud sql access using the console or cli allow the service account associated with the server to access the created secret gcloud secrets add iam policy binding idp sql secrets member serviceaccount idp sql identity project_id iam gserviceaccount com role roles secretmanager secretaccessor allow the service account associated with the server to access cloud sql gcloud projects add iam policy binding project_id member serviceaccount idp sql identity project_id iam gserviceaccount com role roles cloudsql client create an artifact registry gcloud artifacts repositories create repository repository format docker location region repository is the name of the repository for each repository location in a project repository names must be unique build the container image using cloud build node js gcloud builds submit tag region docker pkg dev project_id repository idp sql python gcloud builds submit tag region docker pkg dev project_id repository idp sql java this sample uses jib to build docker images using common java tools jib optimizes container builds without the need for a dockerfile or having docker installed learn more about building java containers with jib use the gcloud credential helper to authorize docker to push to your artifact registry gcloud auth configure docker use the jib maven plugin to build and push the container to artifact registry mvn compile jib build dimage region docker pkg dev project_id repository idp sql deploy the container image to cloud run using the console or cli note that the server is deployed to allow unauthenticated access this is so that the user can load the client and begin the process the server verifies the id token added to the vote request manually authenticating the end user gcloud run deploy idp sql image region docker pkg dev project_id repository idp sql allow unauthenticated service account idp sql identity project_id iam gserviceaccount com add cloudsql instances project_id region cloud_sql_instance_name update secrets cloud_sql_credentials_secret idp sql secrets latest also note the flags service account add cloudsql instances and update secrets which specify the service identity the cloud sql instance connection and the secret name with version as an environment variable respe...
|
