gcr-cleaner-setup

gcr-cleaner-setup.sh

PROJECT_ID="<YOUR_PROJECT_ID>"
REPO_NAME="<YOUR_REPO_ID>"
CLOUD_RUN_REGION='europe-west1' #us-central1
APP_REGION='europe-west' #us-central
ARTIFACTS_REGION='eu' #leave empty for us
IMAGE_NAMES=("YOUR_IMAGE_1" "YOUR_IMAGE_2") # a list of image names

echo "Step 1: Enable Services"
gcloud services enable --project "${PROJECT_ID}" \
  appengine.googleapis.com \
  cloudscheduler.googleapis.com \
  run.googleapis.com

sleep 5s

echo "Step 2: Add gcr cleaner service account"
gcloud iam service-accounts create "gcr-cleaner" \
  --project "${PROJECT_ID}" \
  --display-name "gcr-cleaner"

sleep 5s

echo "Step 3: Deploy Cloud Run instance"
gcloud --quiet run deploy "gcr-cleaner" \
  --async \
  --project ${PROJECT_ID} \
  --platform "managed" \
  --service-account "gcr-cleaner@${PROJECT_ID}.iam.gserviceaccount.com" \
  --image "us-docker.pkg.dev/gcr-cleaner/gcr-cleaner/gcr-cleaner" \
  --region "${CLOUD_RUN_REGION}" \
  --timeout "60s"

sleep 5s

echo "Step 4: Update artifacts ACL"
gsutil acl ch -u gcr-cleaner@${PROJECT_ID}.iam.gserviceaccount.com:W gs://${ARTIFACTS_REGION}.artifacts.${PROJECT_ID}.appspot.com

sleep 5s

echo "Step 5: Add gcr-cleaner-invoker service account"
gcloud iam service-accounts create "gcr-cleaner-invoker" \
  --project "${PROJECT_ID}" \
  --display-name "gcr-cleaner-invoker"

sleep 5s

echo "Step 6: Set permissions on gcr-cleaner-invoker"
gcloud run services add-iam-policy-binding "gcr-cleaner" \
  --project "${PROJECT_ID}" \
  --platform "managed" \
  --region "${CLOUD_RUN_REGION}" \
  --member "serviceAccount:gcr-cleaner-invoker@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role "roles/run.invoker"

sleep 5s

echo "Step 7: Create App"
gcloud app create \
  --project "${PROJECT_ID}" \
  --region "${APP_REGION}" \
  --quiet

sleep 30s

echo "Step 8: Creating Scheduler Jobs ${SCHEDULER_NAME}"
SERVICE_URL=$(gcloud run services describe gcr-cleaner --project "${PROJECT_ID}" --platform "managed" --region "${CLOUD_RUN_REGION}" --format 'value(status.url)')
for IMAGE_NAME in ${IMAGE_NAMES[@]}; do
  REGISTRY_PATH="${ARTIFACTS_REGION}.gcr.io/${PROJECT_ID}/${REPO_NAME}/${IMAGE_NAME}"
  SCHEDULER_NAME="gcrclean-${IMAGE_NAME}"
  
  echo "Creating Scheduler Job ${SCHEDULER_NAME}"

  gcloud scheduler jobs create http "${SCHEDULER_NAME}" \
    --project ${PROJECT_ID} \
    --description "Cleanup ${REGISTRY_PATH}" \
    --uri "${SERVICE_URL}/http" \
    --message-body "{\"repo\":\"${REGISTRY_PATH}\"}" \
    --oidc-service-account-email "gcr-cleaner-invoker@${PROJECT_ID}.iam.gserviceaccount.com" \
    --schedule "0 8 * * 2" \
    --time-zone="GMT"
done

sleep 30s

# Run Job
echo "Step 9: Running Jobs"
for IMAGE_NAME in ${IMAGE_NAMES[@]}; do
  SCHEDULER_NAME="gcrclean-${IMAGE_NAME}"
  gcloud scheduler jobs run "${SCHEDULER_NAME}" \
    --project "${PROJECT_ID}"
done