From 012fb5b4e358790c6d13f5b8941725f8fac21230 Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Wed, 29 Jul 2026 15:37:12 -0400 Subject: [PATCH 1/8] Fix image replacement in cd (#3186) --- release/cloudbuild-nomulus.yaml | 1 + release/cloudbuild-release.yaml | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/release/cloudbuild-nomulus.yaml b/release/cloudbuild-nomulus.yaml index dc38dbc3941..7c3bae94f86 100644 --- a/release/cloudbuild-nomulus.yaml +++ b/release/cloudbuild-nomulus.yaml @@ -204,6 +204,7 @@ steps: --source=. \ --skaffold-file=release/clouddeploy/skaffold.yaml \ --deploy-parameters="deployed_image=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest},base_image=us-docker.pkg.dev/${PROJECT_ID}/gcr.io/nomulus" + # The tarballs and jars to upload to GCS. artifacts: objects: diff --git a/release/cloudbuild-release.yaml b/release/cloudbuild-release.yaml index 19da2c0cd7b..425351292f8 100644 --- a/release/cloudbuild-release.yaml +++ b/release/cloudbuild-release.yaml @@ -292,6 +292,27 @@ steps: if [[ "${TAG_NAME}" =~ ^nomulus-20[0-9]{2}[0-1][0-9][0-3][0-9]-RC[0-9]{2}$ ]]; then echo "Tag format matches a nomulus release. Triggering nomulus build..." gcloud builds submit . --config=release/cloudbuild-nomulus.yaml --substitutions=TAG_NAME=$TAG_NAME + echo "=============================================" + echo "Triggering Google Cloud Deploy Release" + echo "=============================================" + echo "Tag Name: ${TAG_NAME}" + echo "Project ID: ${PROJECT_ID}" + pipeline="deploy-nomulus" + region="us-central1" + # Release names must consist of lowercase letters, numbers, and hyphens. + release_name=$(echo "${TAG_NAME}" | tr '[:upper:]' '[:lower:]' | tr '_' '-') + echo "Release Name: $release_name" + echo "=============================================" + nomulus_digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/nomulus \ + --format="get(digest)" --filter="tags = ${TAG_NAME}") + gcloud deploy releases create "$release_name" \ + --delivery-pipeline="$pipeline" \ + --region="$region" \ + --project=${PROJECT_ID} \ + --images="gcr.io/${PROJECT_ID}/nomulus=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest}" \ + --source=. \ + --skaffold-file=release/clouddeploy/skaffold.yaml \ + --deploy-parameters="deployed_image=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest},base_image=us-docker.pkg.dev/${PROJECT_ID}/gcr.io/nomulus" # Check for a proxy release tag (e.g., "proxy-v1.2.3") elif [[ "${TAG_NAME}" =~ ^proxy-20[0-9]{2}[0-1][0-9][0-3][0-9]-RC[0-9]{2}$ ]]; then echo "Tag format matches a proxy release. Triggering proxy build..." From e832a0273f2b936cb22296940fb49f2e8abaf5f2 Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Thu, 30 Jul 2026 12:02:58 -0400 Subject: [PATCH 2/8] read sql jobs from ar --- release/cloudbuild-nomulus.yaml | 3 +-- release/clouddeploy/delivery-pipeline.yaml | 20 ++++++++++++++++---- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/release/cloudbuild-nomulus.yaml b/release/cloudbuild-nomulus.yaml index 7c3bae94f86..54e748030fe 100644 --- a/release/cloudbuild-nomulus.yaml +++ b/release/cloudbuild-nomulus.yaml @@ -203,8 +203,7 @@ steps: --images="gcr.io/${PROJECT_ID}/nomulus=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest}" \ --source=. \ --skaffold-file=release/clouddeploy/skaffold.yaml \ - --deploy-parameters="deployed_image=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest},base_image=us-docker.pkg.dev/${PROJECT_ID}/gcr.io/nomulus" - + --deploy-parameters="deployed_image=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest},base_image=us-docker.pkg.dev/${PROJECT_ID}/gcr.io/nomulus,tag_name=${TAG_NAME},project_id=${PROJECT_ID}" # The tarballs and jars to upload to GCS. artifacts: objects: diff --git a/release/clouddeploy/delivery-pipeline.yaml b/release/clouddeploy/delivery-pipeline.yaml index b899be95dfd..0d30feefee3 100644 --- a/release/clouddeploy/delivery-pipeline.yaml +++ b/release/clouddeploy/delivery-pipeline.yaml @@ -20,11 +20,14 @@ serialPipeline: image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable env: TARGET_ID: ${{ target.id }} + TAG_NAME: ${{ deploy_params['tag_name'] }} + PROJECT_ID: ${{ deploy_params['project_id'] }} command: ["/bin/bash"] args: - "-c" - | - gcloud builds submit --config=release/cloudbuild-schema-verify-${TARGET_ID}.yaml + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-verify-${TARGET_ID}.yaml . + gcloud builds submit --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -61,11 +64,14 @@ serialPipeline: image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable env: TARGET_ID: ${{ target.id }} + TAG_NAME: ${{ deploy_params['tag_name'] }} + PROJECT_ID: ${{ deploy_params['project_id'] }} command: ["/bin/bash"] args: - "-c" - | - gcloud builds submit --config=release/cloudbuild-schema-deploy-${TARGET_ID}.yaml + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-deploy-${TARGET_ID}.yaml . + gcloud builds submit --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -86,11 +92,14 @@ serialPipeline: image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable env: TARGET_ID: ${{ target.id }} + TAG_NAME: ${{ deploy_params['tag_name'] }} + PROJECT_ID: ${{ deploy_params['project_id'] }} command: ["/bin/bash"] args: - "-c" - | - gcloud builds submit --config=release/cloudbuild-schema-verify-${TARGET_ID}.yaml + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-verify-${TARGET_ID}.yaml . + gcloud builds submit --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -127,11 +136,14 @@ serialPipeline: image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable env: TARGET_ID: ${{ target.id }} + TAG_NAME: ${{ deploy_params['tag_name'] }} + PROJECT_ID: ${{ deploy_params['project_id'] }} command: ["/bin/bash"] args: - "-c" - | - gcloud builds submit --config=release/cloudbuild-schema-deploy-${TARGET_ID}.yaml + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-deploy-${TARGET_ID}.yaml . + gcloud builds submit --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s From 5db6a0f7b7d205216c44bf84ce6f4d59382e5cfa Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Thu, 30 Jul 2026 12:09:20 -0400 Subject: [PATCH 3/8] revert release change --- release/cloudbuild-release.yaml | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/release/cloudbuild-release.yaml b/release/cloudbuild-release.yaml index 425351292f8..19da2c0cd7b 100644 --- a/release/cloudbuild-release.yaml +++ b/release/cloudbuild-release.yaml @@ -292,27 +292,6 @@ steps: if [[ "${TAG_NAME}" =~ ^nomulus-20[0-9]{2}[0-1][0-9][0-3][0-9]-RC[0-9]{2}$ ]]; then echo "Tag format matches a nomulus release. Triggering nomulus build..." gcloud builds submit . --config=release/cloudbuild-nomulus.yaml --substitutions=TAG_NAME=$TAG_NAME - echo "=============================================" - echo "Triggering Google Cloud Deploy Release" - echo "=============================================" - echo "Tag Name: ${TAG_NAME}" - echo "Project ID: ${PROJECT_ID}" - pipeline="deploy-nomulus" - region="us-central1" - # Release names must consist of lowercase letters, numbers, and hyphens. - release_name=$(echo "${TAG_NAME}" | tr '[:upper:]' '[:lower:]' | tr '_' '-') - echo "Release Name: $release_name" - echo "=============================================" - nomulus_digest=$(gcloud container images list-tags gcr.io/${PROJECT_ID}/nomulus \ - --format="get(digest)" --filter="tags = ${TAG_NAME}") - gcloud deploy releases create "$release_name" \ - --delivery-pipeline="$pipeline" \ - --region="$region" \ - --project=${PROJECT_ID} \ - --images="gcr.io/${PROJECT_ID}/nomulus=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest}" \ - --source=. \ - --skaffold-file=release/clouddeploy/skaffold.yaml \ - --deploy-parameters="deployed_image=gcr.io/${PROJECT_ID}/nomulus@${nomulus_digest},base_image=us-docker.pkg.dev/${PROJECT_ID}/gcr.io/nomulus" # Check for a proxy release tag (e.g., "proxy-v1.2.3") elif [[ "${TAG_NAME}" =~ ^proxy-20[0-9]{2}[0-1][0-9][0-3][0-9]-RC[0-9]{2}$ ]]; then echo "Tag format matches a proxy release. Triggering proxy build..." From 6a7901f899149fb28fb5e66584bf88612df749aa Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Thu, 30 Jul 2026 13:58:18 -0400 Subject: [PATCH 4/8] flatten file path for sql jobs --- release/clouddeploy/delivery-pipeline.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/release/clouddeploy/delivery-pipeline.yaml b/release/clouddeploy/delivery-pipeline.yaml index 0d30feefee3..ac43201e5d7 100644 --- a/release/clouddeploy/delivery-pipeline.yaml +++ b/release/clouddeploy/delivery-pipeline.yaml @@ -26,7 +26,7 @@ serialPipeline: args: - "-c" - | - gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-verify-${TARGET_ID}.yaml . + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-verify-${TARGET_ID}.yaml . gcloud builds submit --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. @@ -70,7 +70,7 @@ serialPipeline: args: - "-c" - | - gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-deploy-${TARGET_ID}.yaml . + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-deploy-${TARGET_ID}.yaml . gcloud builds submit --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml analysis: # 10 minutes. @@ -98,7 +98,7 @@ serialPipeline: args: - "-c" - | - gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-verify-${TARGET_ID}.yaml . + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-verify-${TARGET_ID}.yaml . gcloud builds submit --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. @@ -142,7 +142,7 @@ serialPipeline: args: - "-c" - | - gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/release/cloudbuild-schema-deploy-${TARGET_ID}.yaml . + gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-deploy-${TARGET_ID}.yaml . gcloud builds submit --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml analysis: # 10 minutes. From f0b030ddd5143e6314bd256091a11ceffe4666f6 Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Thu, 30 Jul 2026 14:47:28 -0400 Subject: [PATCH 5/8] no source to sql command --- release/clouddeploy/delivery-pipeline.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/release/clouddeploy/delivery-pipeline.yaml b/release/clouddeploy/delivery-pipeline.yaml index ac43201e5d7..b4b698aee94 100644 --- a/release/clouddeploy/delivery-pipeline.yaml +++ b/release/clouddeploy/delivery-pipeline.yaml @@ -27,7 +27,7 @@ serialPipeline: - "-c" - | gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-verify-${TARGET_ID}.yaml . - gcloud builds submit --config=cloudbuild-schema-verify-${TARGET_ID}.yaml + gcloud builds submit --no-source --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -71,7 +71,7 @@ serialPipeline: - "-c" - | gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-deploy-${TARGET_ID}.yaml . - gcloud builds submit --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml + gcloud builds submit --no-source --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -99,7 +99,7 @@ serialPipeline: - "-c" - | gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-verify-${TARGET_ID}.yaml . - gcloud builds submit --config=cloudbuild-schema-verify-${TARGET_ID}.yaml + gcloud builds submit --no-source --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -143,7 +143,7 @@ serialPipeline: - "-c" - | gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-deploy-${TARGET_ID}.yaml . - gcloud builds submit --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml + gcloud builds submit --no-source --config=cloudbuild-schema-deploy-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s From b26fcb885ad0a6fe01d10e4181b564a704e859b8 Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Mon, 3 Aug 2026 11:34:59 -0400 Subject: [PATCH 6/8] add automation to pipeline --- release/clouddeploy/delivery-pipeline.yaml | 38 ++++++++++++---------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/release/clouddeploy/delivery-pipeline.yaml b/release/clouddeploy/delivery-pipeline.yaml index b4b698aee94..f7879e3fc30 100644 --- a/release/clouddeploy/delivery-pipeline.yaml +++ b/release/clouddeploy/delivery-pipeline.yaml @@ -14,20 +14,6 @@ serialPipeline: - phaseId: "canary-1" profiles: ["crash-partial-phase-1"] percentage: 10 - predeploy: - tasks: - - type: container - image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable - env: - TARGET_ID: ${{ target.id }} - TAG_NAME: ${{ deploy_params['tag_name'] }} - PROJECT_ID: ${{ deploy_params['project_id'] }} - command: ["/bin/bash"] - args: - - "-c" - - | - gcloud storage cp gs://${PROJECT_ID}-deploy/${TAG_NAME}/cloudbuild-schema-verify-${TARGET_ID}.yaml . - gcloud builds submit --no-source --config=cloudbuild-schema-verify-${TARGET_ID}.yaml analysis: # 10 minutes. duration: 600s @@ -58,8 +44,8 @@ serialPipeline: args: - "-c" - | - gcloud artifacts docker tags add $DEPLOYED_IMAGE \ - ${BASE_IMAGE}:live-cd-${TARGET_ID} + gcloud container images add-tag $DEPLOYED_IMAGE \ + ${BASE_IMAGE}:live-cd-${TARGET_ID} --quiet - type: container image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable env: @@ -130,8 +116,8 @@ serialPipeline: args: - "-c" - | - gcloud artifacts docker tags add $DEPLOYED_IMAGE \ - ${BASE_IMAGE}:live-cd-${TARGET_ID} + gcloud container images add-tag $DEPLOYED_IMAGE \ + ${BASE_IMAGE}:live-cd-${TARGET_ID} --quiet - type: container image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable env: @@ -150,3 +136,19 @@ serialPipeline: googleCloud: alertPolicyChecks: sandboxStableDeploymentAlertPolicyChecks +--- +apiVersion: deploy.cloud.google.com/v1 +kind: Automation +metadata: + name: auto-advance-canary +description: Automatically advances rollouts through canary-1 phase after successful deployment and analysis. +selector: + targets: + - id: crash + - id: sandbox +rules: +- advanceRolloutRule: + id: advance-canary-phases + sourcePhases: + - "canary-1" + wait: 0s From 695bf54280699591f1e35deb01193643957bf2b4 Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Mon, 3 Aug 2026 12:09:03 -0400 Subject: [PATCH 7/8] fix automation --- release/cloudbuild-clouddeploy.yaml | 1 + release/clouddeploy/README.md | 2 +- release/clouddeploy/delivery-pipeline.yaml | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/release/cloudbuild-clouddeploy.yaml b/release/cloudbuild-clouddeploy.yaml index 4d1fdb1ff0a..27b40f5b44f 100644 --- a/release/cloudbuild-clouddeploy.yaml +++ b/release/cloudbuild-clouddeploy.yaml @@ -84,6 +84,7 @@ steps: sed -i "s|artifactStorage: artifactStorage|artifactStorage: $artifact_storage|" "$target_file" sed -i "s|serviceAccount: serviceAccount|serviceAccount: $service_account|" "$target_file" + sed -i "s|serviceAccount: serviceAccount|serviceAccount: $service_account|" release/clouddeploy/delivery-pipeline.yaml sed -i "s|cluster: cluster|cluster: $cluster_val|" "$target_file" sed -i "s|workerPool: workerPool|workerPool: $worker_pool|" "$target_file" fi diff --git a/release/clouddeploy/README.md b/release/clouddeploy/README.md index b3c7dca92fa..75d5aa78069 100644 --- a/release/clouddeploy/README.md +++ b/release/clouddeploy/README.md @@ -5,7 +5,7 @@ This directory contains the Google Cloud Deploy configuration files for the Nomu ## Files ### `delivery-pipeline.yaml` -Defines the `DeliveryPipeline` resource named `deploy-nomulus`. It sets up the serial pipeline for rolling out changes to different targets. +Defines the `DeliveryPipeline` resource named `deploy-nomulus` and its associated `Automation` resource (`deploy-nomulus/auto-advance-canary`). It sets up the serial pipeline for rolling out changes to different targets and automatically advancing canary rollouts. ### Target Configurations (e.g., `crash-target.yaml`) Files matching this format define the `Target` resources for Cloud Deploy. They specify the GKE cluster and other environment-specific settings for deployment. diff --git a/release/clouddeploy/delivery-pipeline.yaml b/release/clouddeploy/delivery-pipeline.yaml index f7879e3fc30..3c57c2f14fa 100644 --- a/release/clouddeploy/delivery-pipeline.yaml +++ b/release/clouddeploy/delivery-pipeline.yaml @@ -140,8 +140,10 @@ serialPipeline: apiVersion: deploy.cloud.google.com/v1 kind: Automation metadata: - name: auto-advance-canary + name: deploy-nomulus/auto-advance-canary description: Automatically advances rollouts through canary-1 phase after successful deployment and analysis. +# Placeholder: Replace with project service account. +serviceAccount: serviceAccount selector: targets: - id: crash @@ -151,4 +153,5 @@ rules: id: advance-canary-phases sourcePhases: - "canary-1" - wait: 0s + wait: 0m + From 26fd6b6b124e73a5c8ed0f367f268bbe0fc7d2b0 Mon Sep 17 00:00:00 2001 From: Juan Celhay Date: Mon, 3 Aug 2026 13:35:05 -0400 Subject: [PATCH 8/8] fix replica seize for backend and console in partial phases --- release/cloudbuild-release.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/release/cloudbuild-release.yaml b/release/cloudbuild-release.yaml index 7c840582504..2955c23eb87 100644 --- a/release/cloudbuild-release.yaml +++ b/release/cloudbuild-release.yaml @@ -236,11 +236,17 @@ steps: # partial phase manifests for stage in 1 5 do + if [ ${service} == backend ] || [ ${service} == console ] + then + replicas=1 + else + replicas=${stage} + fi awk 'NR==1,/^---$/ {if ($0 != "---") print}' ./jetty/kubernetes/nomulus-${env}-${service}.yaml | \ sed s/name:\ ${service}/name:\ ${service}-partial-phase/g | \ sed s/service:\ ${service}/deployment:\ ${service}-partial-phase/g | \ sed s/value:\ ${service}/value:\ ${service}-partial-phase/g | \ - sed "/^spec:$/a\ replicas: ${stage}" \ + sed "/^spec:$/a\ replicas: ${replicas}" \ > ./jetty/kubernetes/nomulus-${env}-${service}-partial-phase-${stage}.yaml done # gateway