Deploying Google Cloud Function Application as GKE Workload to Listen for Pub/Sub Messages

[Sudharshan_D]

Hello Google Cloud Community,

I am exploring the possibility of deploying a Google Cloud Function application as a workload in Google Kubernetes Engine (GKE) and configuring it to automatically listen for Pub/Sub messages. Specifically, I would like the deployed application in GKE to trigger the function whenever a message is published to a Pub/Sub topic.

Could you please provide guidance or best practices on how to achieve this setup? I am interested in understanding the steps involved in deploying the Cloud Function as a GKE workload and configuring it to listen to Pub/Sub messages for automatic triggering.

Thank you for your help.

Best regards, 
Sudharshan_D

[RonEtch]

Hi @Sudharshan_D 

Welcome to Google Cloud Community!

As part of adopting automation and quick deployment, you can design your pipeline and app base on CI/CD (continuous integration and continuous delivery/continuous deployment).

Continuous Integration

• You can use offer cloud repository or Github to store your codes that presumably an API or simple app since you are referring on a Cloud Function App.
• Automate the build of your application using Cloud Build wherein you can push the created image on the Artifact registry and call Cloud Deploy to deploy the revisions on the GKE.

Continuous Delivery/Deployment

• Use Cloud Deploy to automatically deploy revision/new images deployed on the Artifact Registry to the GKE.
• Create GKE Cluster (preferably standard mode for production level app) to deploy your created app and create an ingress (internal load balancer) that shall be called every time a pub/sub message is created.
• Create Pub/Sub Subscription that will trigger the application inside the GKE Cluster.

Note:

• The app that does a pull message on the pub/sub should be able to do a POST on the ingress to trigger the application inside.
• Use Service accounts on the apps/service that will communicate, assign proper role/permissions needed.
  Alternatively, you can also utilize GKE Workload Identity with proper service account per workload.
• This way, the services can utilize Private Google Access for security purposes

You can read more regarding DevOps CI/CD through this article.

I hope this information is helpful.

If you need further assistance, you can always file a ticket on our support team.