COLLEEN BRIANT: Hi, I'm Colleen.
DANA HOFFMAN: Hey, I'm Dana.
Colleen and I are software engineers at Google.
We work on Google Cloud Platform.
And today, we're going to show you
how to use the Cloud Foundry service broker for Google Cloud
Platform that we built in collaboration
with the engineers at Pivotal.
So Colleen, you took the lead building the service broker.
Can you give us an overview of what a service broker is?
COLLEEN BRIANT: Sure.
A service broker is a special kind of Cloud Foundry app
that developers can use to quickly and easily spin up
instances of different services, and then get credentials
for their applications to use.
It's integrated into the Cloud Foundry CLI,
so developers can stay focused.
And Cloud Foundry operators can manage
the kinds of services and plans that their developers
have access to.
DANA HOFFMAN: Cool.
So what's the quickest, easiest way to actually get
a service broker installed?
COLLEEN BRIANT: So the service broker
is available as a tile on network.Pivotal.io.
So if you're using Pivotal Ops Manager, the easiest way
to get up and running is just to go that route.
And normally this takes about half an hour.
But for the purposes of this video,
I'm going to cut out some of the waiting time.
And all this is documented on docs.Pivotal.io.
But if you want to follow along with me,
here are the steps you would need to run through.
To get started with the service broker,
you need to create a new GCP project
if you don't already have one.
Then you'll need to create a new service account for the broker
to use for all of its calls, and give it owner level
access to your project.
You'll need to enable the IAM and cloud resource manager
APIs, as well as the APIs for any other services you
want to enable.
Then you'll need to set up a database
to back the service broker.
You can use any MySQL database you want.
But if you'd like to use Cloud SQL,
you can set up your database in the console
using default settings.
Except that you'll want to enable network access
for Many IP, restrict access to SSL connections,
and create a set of SSL certs for the service broker
to connect with.
After setting up your project and database and enabling APIs,
you'll download the tile from [INAUDIBLE].
Add it to your Ops Manager installation.
When you first add it, you'll need
to go through some configuration steps.
First, you'll need to add the credentials
for the service account you gave owner access to your project.
And then you'll need to configure
access and credentials for the database that
backs the service broker.
Lastly, if you as an operator want
to expose Cloud SQL to your developers,
you'll need to configure some custom
plans based on machine type, disk size, and pricing plan.
Once you're all done with configuration,
the tile will turn green, and you'll
be able to apply your changes.
When Ops Manager finishes updating--
finishes updating-- finishes updating--
all of these services will be available in the marketplace.
Documentation for this installation process,
as well as for using the service broker,
is available on docs.Pivotal.io.
But if you're not using Ops Manager,
and you just wanted to deploy the service
broker as an app to your Cloud Foundry installation,
it's publicly available on GitHub.
And instructions for installing an app as a service broker
are available on docs.CloudFoundry.org.
COLLEEN BRIANT: And Dana, we walked through this together
recently, and you were able to build a super cool app that
uses the service broker.
Can you show us what you built?
COLLEEN BRIANT: Sure.
And thank you, I think it's pretty cool too.
I built a [INAUDIBLE] application
which scrapes Reddit for cute animal photos,
classifies them using the Google Cloud Vision API,
stores them in Google Cloud Storage,
and displays the results.
At this point, I've uploaded my application to Cloud Foundry.
But it won't run since it has no valid credentials.
To generate credentials and create my Cloud Storage Bucket,
I used the service broker.
The first step is to create a storage service.
I've named the storage bucket [INAUDIBLE] Vision Bucket.
And I'll refer to it with that name from within the code.
You can also let the service broker generate a bucket name,
and have your code pull that name from the environment.
Next, I'll bind it to my application,
and give the service account admin permissions for my cloud
storage bucket.
Now we have everything we need to parse the credentials
from within our application.
Restaging the app takes a few minutes.
So in the meantime, let's take a look at the code.
The credentials are stored in the vCAB Services Environment
Variable.
So our application parses that variable as JSON
and stores it in a Google credential
object, which can then be used to access the APIs we need.
Now that it's running, let's take a look.
There's nothing in our storage bucket yet.
So the app is pretty empty.
Let's run the scrape.
And there we have it, cute animal pictures with labels
generated from the Google Cloud Vision API,
all served out of Google Cloud Storage.
COLLEEN BRIANT: Ah.
That's really cool.
How long did it take you to build that?
DANA HOFFMAN: So when I first started working on the app,
I was brand-new to the service broker.
But it still took me just a few hours
to get it working within my app, and to feel like I actually
understood what I was doing and how the whole thing worked.
Once I had it working here, I was
able to use it in another app later.
And whole integration took under an hour.
COLLEEN BRIANT: Awesome.
So do you have any tips or best practices
for anybody else looking to build an application
with a service broker?
DANA HOFFMAN: Sure.
One best practice tip that I'd like to mention
is using curated IM roles for your bindings.
These are rules that restrict access to a single GCP service.
As you saw earlier, when I bound to my service instance created
through the service broker, I passed a custom parameter,
which is the IM role that controls what resources
the application has access to.
For the sake of security, we advise
using curated roles so your application has
as few privileges as possible.
You can see examples of this in the service broker
documentation on docs.Pivotal.io.
And you can find out more about curated roles
in the IM documentation on cloud.Google.com.
This is awesome.
Service broker's really great, right?
COLLEEN BRIANT: Yeah.
Service broker, best broker.
DANA HOFFMAN: Best broker.
COLLEEN BRIANT: Thanks for watching.
Check out our playlist and more videos on Cloud Foundry,
and make sure to subscribe to the Google Cloud channel.