google-cloud-platform - Cloud Build Trigger for FTP or SSH deployment

Question

How can I deploy a directory to a FTP or SSH server, with a trigger and cloudbuild.yaml?

So far I can already generate a listing of the files which I'd like to upload:

steps:
  - name: 'ubuntu'
    entrypoint: 'bash'
    args:
      - '-c'
      - |-
        find $_UPLOAD_DIRNAME -exec echo {} >> batch.txt \;
        cat ./batch.txt
    env:
      ...

Answer 1

I've managed to deploy to FTP with ncftp:

• first patch /etc/apt/sources.list.
• then install ncftp with apt-get.
• create the file ~/.ncftp with variable substitutions.
• optional step: replace text in files with sed.
• recursively upload the directory with ncftpput.

---

Here's my cloudbuild.yaml (it is working, but the next answer might offer a better solution):

steps:
  - name: 'ubuntu'
    entrypoint: 'bash'
    args:
      - '-c'
      - |-
        echo Deploying ${_UPLOAD_DIRNAME} @ ${SHORT_SHA} 
        echo to ftp://${_REMOTE_ADDRESS}${_REMOTE_PATH}
        echo "deb http://archive.ubuntu.com/ubuntu/ focal universe" > /etc/apt/sources.list
        apt-get update -y && apt-get install -y ncftp
        cat << EOF > ~/.ncftp
        host $_REMOTE_ADDRESS
        user $_FTP_USERNAME
        pass $_FTP_PASSWORD
        EOF
        # sed -i "s/##_GIT_COMMIT_##/${SHORT_SHA}/g" ./${_UPLOAD_DIRNAME}/plugin.php 
        ncftpput -f ~/.ncftp -R $_REMOTE_PATH $_UPLOAD_DIRNAME
    env:
      - '_UPLOAD_DIRNAME=$_UPLOAD_DIRNAME'
      - '_REMOTE_ADDRESS=$_REMOTE_ADDRESS'
      - '_REMOTE_PATH=$_REMOTE_PATH'
      - '_FTP_USERNAME=$_FTP_USERNAME'
      - '_FTP_PASSWORD=$_FTP_PASSWORD'
      - 'SHORT_SHA=$SHORT_SHA'

Where _REMOTE_PATH is eg. /wp-content/plugins (the variable requires at least one slash) and the _UPLOAD_DIRNAME is the name of the directory within the local Git repository, with no slashes.

Answer 2

I've came to the conclusion, that I don't want the FTP anti-pattern
and have therefore written an alternate SSH cloudbuild.yaml:

• generate a new pair of RSA keys.
• use the private key for SSH login.
• recursively upload the directory with scp.
• run remote commands with ssh.

It logs in as user root, therefore remote /etc/ssh/sshd_config needs PermitRootLogin yes.

---

My variable substitutions meanwhile look alike this:

And this would be the cloudbuild.yaml, which generally demonstrates how to set up SSH keys:

steps:
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:latest'
    entrypoint: 'bash'
    args:
      - '-c'
      - |-
        echo Deploying $_UPLOAD_DIRNAME @ $SHORT_SHA
        gcloud config set compute/zone $_COMPUTE_ZONE
        gcloud config set project $PROJECT_ID
        mkdir -p /builder/home/.ssh
        gcloud compute config-ssh
        gcloud compute scp --ssh-key-expire-after=$_SSH_KEY_EXPIRE_AFTER --scp-flag="${_SSH_FLAG}" --recurse ./$_UPLOAD_DIRNAME $_COMPUTE_INSTANCE:$_REMOTE_PATH
        gcloud compute ssh $_COMPUTE_INSTANCE --ssh-key-expire-after=$_SSH_KEY_EXPIRE_AFTER --ssh-flag="${_SSH_FLAG}" --command="${_SSH_COMMAND}"
    env:
      - '_COMPUTE_ZONE=$_COMPUTE_ZONE'
      - '_COMPUTE_INSTANCE=$_COMPUTE_INSTANCE'
      - '_UPLOAD_DIRNAME=$_UPLOAD_DIRNAME'
      - '_REMOTE_PATH=$_REMOTE_PATH'
      - '_SSH_FLAG=$_SSH_FLAG'
      - '_SSH_COMMAND=$_SSH_COMMAND'
      - '_SSH_KEY_EXPIRE_AFTER=$_SSH_KEY_EXPIRE_AFTER'
      - 'PROJECT_ID=$PROJECT_ID'
      - 'SHORT_SHA=$SHORT_SHA'