CODEWITHSUNDEEP
bashgoogle-cloud-platformgcloud
Mathew Weiss
Mathew Weiss

Reputation: 11

Executing gcloud commands in bash

I've spent 3 days beating my head against this before coming here in desperation.

So long story short I thought I'd fire up a simple PHP site to allow moderators of a gaming group I'm in the ability to start GCP servers on demand. I'm no developer so I'm looking at this from a Systems perspective to find the simplest solution to do the job.

I fired up an Ubuntu 18.04 machine on GCP and set it up with the Google SDK, authorised it for access to the project and was able to simply run gcloud commands which worked fine. Had some issues with the PHP file calling the shell script to run the same commands but with some testing I can see it's now calling the shell script no worries (it broadcasts wall "test") to console everytime I click the button on the PHP page.

However what does not happen is the execution of the gcloud command. If I manually run this shell script it starts up the instance no worries and broadcasts wall, if I click the button it broadcasts but that's it. I've set the files to have execution rights and I've even added the user nginx runs as to have sudo rights, putting sudo sh in front of the command in the PHP file also made no difference. Please find the bash script below:

    #!/bin/bash

    /usr/lib/google-cloud-sdk/bin/gcloud compute instances start arma3s1-prod --zone=australia-southeast1-b

    wall "test"

Any help would be greatly appreciated, this coupled with an automated shut down would allow our gaming group to save money by only running the servers people want to play on.

Any more detail you want about the underlying system please let me know.

Upvotes: 0

Views: 812

Answers (2)

Mathew Weiss
Mathew Weiss

Reputation: 11

So I asked a PHP dev at work about this and in two seconds flat she pointed out the issue and now I feel stupid. In /etc/passwd the www-data user had /usr/sbin/nologin and after I fixed that running the script gcloud wanted permissions to write a log file to /var/www. Fixed those and it works fine. I'm not terribly worried about the page or even server being hacked and destroyed, I can recreate them pretty easily.

Thanks for the help though! Sometimes I think I just need to take a step back and get a set fresh of eyes on the problem.

Upvotes: 1

night-gold
night-gold

Reputation: 2441

When you launch a command while logged in, you have your account access rights to the Google cloud API but the PHP account doesn't have those.

Even if you add the www-data user to root, that won't fix the problem, maybe create some security issues but nothing more.

If you really want to do this you should create a service account and giving the json to the env variable, GOOGLE_APPLICATION_CREDENTIALS, which only have the rights on the compute instance inside your project this way your PHP should have enough rights to do what you are asking him.

Note that the issue with this method is that if you are hacked there is a change the instance hosting your PHP could be deleted too.

You could also try to make a call to prepared cloud function which will create the instance, this way, even if your instance is deleted the cloud function would still be there.

Upvotes: 0

Related Questions