|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Set up the GCS bucket used by the Vertex Files adapter (Stage 2). |
| 3 | +# |
| 4 | +# Idempotent: safe to re-run. Creates the bucket if missing, grants the SA |
| 5 | +# storage.objectUser on it, and applies a lifecycle rule that auto-deletes |
| 6 | +# objects after GCS_LIFECYCLE_DAYS days. |
| 7 | +# |
| 8 | +# Required env: |
| 9 | +# GCP_PROJECT_ID e.g. my-project-123 |
| 10 | +# GCS_BUCKET must be globally unique, e.g. amc-webui-files-<rand> |
| 11 | +# VERTEX_SA_EMAIL the SA used by the api server, e.g. |
| 12 | +# amc-vertex@my-project-123.iam.gserviceaccount.com |
| 13 | +# |
| 14 | +# Optional env: |
| 15 | +# GCS_LOCATION default us-central1 (choose a valid GCS bucket location) |
| 16 | +# GCS_LIFECYCLE_DAYS default 30 (set to 0 to skip the lifecycle rule) |
| 17 | +# |
| 18 | +# Usage: |
| 19 | +# GCP_PROJECT_ID=... GCS_BUCKET=... VERTEX_SA_EMAIL=... \ |
| 20 | +# bash scripts/setup-gcs-bucket.sh |
| 21 | + |
| 22 | +set -euo pipefail |
| 23 | + |
| 24 | +: "${GCP_PROJECT_ID:?GCP_PROJECT_ID is required}" |
| 25 | +: "${GCS_BUCKET:?GCS_BUCKET is required}" |
| 26 | +: "${VERTEX_SA_EMAIL:?VERTEX_SA_EMAIL is required}" |
| 27 | +GCS_LOCATION="${GCS_LOCATION:-us-central1}" |
| 28 | +GCS_LIFECYCLE_DAYS="${GCS_LIFECYCLE_DAYS:-30}" |
| 29 | + |
| 30 | +if ! command -v gcloud >/dev/null 2>&1; then |
| 31 | + echo "gcloud CLI is not installed or not on PATH." >&2 |
| 32 | + exit 2 |
| 33 | +fi |
| 34 | + |
| 35 | +echo "Project: ${GCP_PROJECT_ID}" |
| 36 | +echo "Bucket: gs://${GCS_BUCKET}" |
| 37 | +echo "Location: ${GCS_LOCATION}" |
| 38 | +echo "SA: ${VERTEX_SA_EMAIL}" |
| 39 | +echo "Lifecycle: ${GCS_LIFECYCLE_DAYS} days (0=skip)" |
| 40 | +echo |
| 41 | + |
| 42 | +# Step 1 — create bucket (idempotent) |
| 43 | +if gcloud storage buckets describe "gs://${GCS_BUCKET}" --project="${GCP_PROJECT_ID}" >/dev/null 2>&1; then |
| 44 | + echo "[1/3] bucket already exists, skipping create" |
| 45 | +else |
| 46 | + echo "[1/3] creating bucket gs://${GCS_BUCKET} in ${GCS_LOCATION}" |
| 47 | + gcloud storage buckets create "gs://${GCS_BUCKET}" \ |
| 48 | + --project="${GCP_PROJECT_ID}" \ |
| 49 | + --location="${GCS_LOCATION}" \ |
| 50 | + --uniform-bucket-level-access |
| 51 | +fi |
| 52 | + |
| 53 | +# Step 2 — grant SA objectUser (idempotent; gcloud is a no-op if already bound) |
| 54 | +echo "[2/3] granting roles/storage.objectUser to ${VERTEX_SA_EMAIL}" |
| 55 | +gcloud storage buckets add-iam-policy-binding "gs://${GCS_BUCKET}" \ |
| 56 | + --project="${GCP_PROJECT_ID}" \ |
| 57 | + --member="serviceAccount:${VERTEX_SA_EMAIL}" \ |
| 58 | + --role="roles/storage.objectUser" \ |
| 59 | + --condition=None \ |
| 60 | + >/dev/null |
| 61 | + |
| 62 | +# Step 3 — lifecycle (optional) |
| 63 | +if [ "${GCS_LIFECYCLE_DAYS}" -gt 0 ]; then |
| 64 | + echo "[3/3] applying ${GCS_LIFECYCLE_DAYS}-day delete lifecycle" |
| 65 | + lifecycle_file="$(mktemp -t gcs-lifecycle.XXXXXX.json)" |
| 66 | + trap 'rm -f "${lifecycle_file}"' EXIT |
| 67 | + cat >"${lifecycle_file}" <<EOF |
| 68 | +{ |
| 69 | + "lifecycle": { |
| 70 | + "rule": [ |
| 71 | + { "action": { "type": "Delete" }, "condition": { "age": ${GCS_LIFECYCLE_DAYS} } } |
| 72 | + ] |
| 73 | + } |
| 74 | +} |
| 75 | +EOF |
| 76 | + gcloud storage buckets update "gs://${GCS_BUCKET}" \ |
| 77 | + --project="${GCP_PROJECT_ID}" \ |
| 78 | + --lifecycle-file="${lifecycle_file}" \ |
| 79 | + >/dev/null |
| 80 | +else |
| 81 | + echo "[3/3] lifecycle rule skipped (GCS_LIFECYCLE_DAYS=0)" |
| 82 | +fi |
| 83 | + |
| 84 | +echo |
| 85 | +echo "Done. Set GCS_BUCKET=${GCS_BUCKET} in .env and restart the api container." |
0 commit comments