Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, mostramos como implantar o Cloud Service Broker do Kf para Google Cloud e usá-lo para provisionar ou desprovisionar recursos de backup. Leia sobre os conceitos e a arquitetura para saber mais sobre o Cloud Service Broker do Kf.
Configurar uma conta de serviço do Google para o Cloud Service Broker do Kf
Crie uma conta de serviço do Google.
gcloud iam service-accounts create csb-${CLUSTER_NAME}-sa \
--project=${CLUSTER_PROJECT_ID} \
--description="GSA for CSB at ${CLUSTER_NAME}" \
--display-name="csb-${CLUSTER_NAME}"
Conceda as permissões de roles/cloudsql.client à conta de serviço. Isso é necessário para conectar o pod do Cloud Service Broker do Kf à instância do Cloud SQL para MySQL pelo proxy de autenticação do Cloud SQL.
Se tudo estiver instalado e configurado corretamente, isto vai aparecer:
$ kf marketplace
Broker Name Namespace Description
cloud-service-broker csb-google-bigquery A fast, economical and fully managed data warehouse for large-scale data analytics.
cloud-service-broker csb-google-dataproc Dataproc is a fully-managed service for running Apache Spark and Apache Hadoop clusters in a simpler, more cost-efficient way.
cloud-service-broker csb-google-mysql Mysql is a fully managed service for the Google Cloud Platform.
cloud-service-broker csb-google-postgres PostgreSQL is a fully managed service for the Google Cloud Platform.
cloud-service-broker csb-google-redis Cloud Memorystore for Redis is a fully managed Redis service for the Google Cloud Platform.
cloud-service-broker csb-google-spanner Fully managed, scalable, relational database service for regional and global application data.
cloud-service-broker csb-google-stackdriver-trace Distributed tracing service
cloud-service-broker csb-google-storage-bucket Google Cloud Storage that uses the Terraform back-end and grants service accounts IAM permissions directly on the bucket.
Limpar
Exclua cloud-service-broker.
kfdelete-service-brokercloud-service-broker
Exclua os componentes do CSB.
kubectldeletenskf-csb
Exclua a instância do Cloud SQL para MySQL do Cloud Service Broker do Kf.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[],[],null,["# Deploy Kf Cloud Service Broker\n\nThis page shows you how to deploy Kf Cloud Service Broker for Google Cloud and use it to provision or deprovision backing resources. Read about the [concepts and architecture](/migrate/kf/docs/2.11/concepts/cloud-sb-overview) to learn more about the Kf Cloud Service Broker.\n\nCreate environment variables\n----------------------------\n\n### Linux\n\n```\nexport PROJECT_ID=YOUR_PROJECT_ID\nexport CLUSTER_PROJECT_ID=YOUR_PROJECT_ID\nexport CLUSTER_NAME=kf-cluster\nexport INSTANCE_NAME=cloud-service-broker\nexport COMPUTE_REGION=us-central1\n```\n\n### Windows PowerShell\n\n```\nSet-Variable -Name PROJECT_ID -Value YOUR_PROJECT_ID\nSet-Variable -Name CLUSTER_PROJECT_ID -Value YOUR_PROJECT_ID\nSet-Variable -Name CLUSTER_NAME -Value kf-cluster\nSet-Variable -Name INSTANCE_NAME -Value cloud-service-broker\nSet-Variable -Name COMPUTE_REGION -Value us-central1\n```\n\nSet up the Kf Cloud Service Broker database\n-------------------------------------------\n\n1. Create a Cloud SQL for MySQL instance.\n\n **Note:** Read [Creating and managing MySQL users](/sql/docs/mysql/create-manage-users) for Cloud SQL for MySQL and set a secure password for the default `root` user. \n\n gcloud sql instances create ${INSTANCE_NAME} --cpu=2 --memory=7680MB --require-ssl --region=${COMPUTE_REGION}\n\n2. Create a database named `servicebroker` in the Cloud SQL for MySQL instance.\n\n **Note:** Document the database name since it is used in later steps. \n\n ```\n gcloud sql databases create servicebroker -i ${INSTANCE_NAME}\n ```\n3. Create a username and password to be used by Kf Cloud Service Broker.\n\n **Note:** Document these values since they will be used in later steps. \n\n ```\n gcloud sql users create csbuser -i ${INSTANCE_NAME} --password=csbpassword\n ```\n\nSet up a Google Service Account for Kf Cloud Service Broker\n-----------------------------------------------------------\n\n1. Create a Google Service Account.\n\n ```\n gcloud iam service-accounts create csb-${CLUSTER_NAME}-sa \\\n --project=${CLUSTER_PROJECT_ID} \\\n --description=\"GSA for CSB at ${CLUSTER_NAME}\" \\\n --display-name=\"csb-${CLUSTER_NAME}\"\n ```\n2. Grant `roles/cloudsql.client` permissions to the Service Account. This is required to connect the Kf Cloud Service Broker pod to the Cloud SQL for MySQL instance through Cloud SQL Auth proxy.\n\n ```\n gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member=\"serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com\" \\\n --role=\"roles/cloudsql.client\"\n ```\n3. Grant additional Google Cloud permissions to the Service Account.\n\n **Note:** In the example below, we grant IAM roles required to provision an instance of Cloud SQL for MySQL and [Memorystore](/memorystore). You must grant this service account the appropriate roles to provision instances of other Google Cloud managed services listed in `kf marketplace`. \n\n ```\n gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member=\"serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com\" \\\n --role=\"roles/compute.networkUser\"\n ``` \n\n ```\n gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member=\"serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com\" \\\n --role=\"roles/cloudsql.admin\"\n ``` \n\n ```\n gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member=\"serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com\" \\\n --role=\"roles/redis.admin\"\n ```\n4. Verify the permissions.\n\n **Warning:** Replace the `CSB_SERVICE_ACCOUNT_NAME` variable in the YAML below with the full service account resolved from `csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com` \n\n ```\n gcloud projects get-iam-policy ${CLUSTER_PROJECT_ID} \\\n --filter='bindings.members:serviceAccount:\"CSB_SERVICE_ACCOUNT_NAME\"' \\\n --flatten=\"bindings[].members\"\n ```\n\nSet up Workload Identity for Kf Cloud Service Broker\n----------------------------------------------------\n\n1. Bind the Google Service Account with the Kubernetes Service Account.\n\n ```\n gcloud iam service-accounts add-iam-policy-binding \"csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com\" \\\n --project=${CLUSTER_PROJECT_ID} \\\n --role=\"roles/iam.workloadIdentityUser\" \\\n --member=\"serviceAccount:${CLUSTER_PROJECT_ID}.svc.id.goog[kf-csb/csb-user]\"\n ```\n2. Verify the binding.\n\n ```\n gcloud iam service-accounts get-iam-policy \"csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com\" \\\n --project=${CLUSTER_PROJECT_ID}\n ```\n\nSet up a Kubernetes Secret to share configuration with Kf Cloud Service Broker\n------------------------------------------------------------------------------\n\n1. Create a config.yml file.\n\n **Note:** Replace the default user/password if desired. Ensure you have set the `CLUSTER_PROJECT_ID` in the [Create environment variables](#create_env_variables) step. \n\n cat \u003c\u003c EOF \u003e\u003e ./config.yml\n gcp:\n credentials: \"\"\n project: ${CLUSTER_PROJECT_ID}\n db:\n host: 127.0.0.1\n password: \u003cvar translate=\"no\"\u003ecsbpassword\u003c/var\u003e\n user: \u003cvar translate=\"no\"\u003ecsbuser\u003c/var\u003e\n tls: false\n api:\n user: \u003cvar translate=\"no\"\u003eservicebroker\u003c/var\u003e\n password: \u003cvar translate=\"no\"\u003epassword\u003c/var\u003e\n EOF\n\n2. Create the `kf-csb` namespace.\n\n kubectl create ns kf-csb\n\n3. Create the Kubernetes Secret.\n\n kubectl create secret generic csb-secret --from-file=config.yml -n kf-csb\n\nInstall Kf Cloud Service Broker\n-------------------------------\n\n1. Download the `kf-csb.yml`.\n\n gcloud storage cp gs://kf-releases/csb/v1.1.0/kf-csb.yaml /tmp/kf-csb.yaml\n\n2. Edit `/tmp/kf-csb.yaml` and replace placeholders with final values. In the example below, `sed` is used.\n\n sed -i \"s|\u003cGSA_NAME\u003e|csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com|g\" /tmp/kf-csb.yaml\n sed -i \"s|\u003cINSTANCE_CONNECTION_NAME\u003e|${CLUSTER_PROJECT_ID}:${COMPUTE_REGION}:${INSTANCE_NAME}|g\" /tmp/kf-csb.yaml\n sed -i \"s|\u003cDB_PORT\u003e|3306|g\" /tmp/kf-csb.yaml\n\n3. Apply yaml for Kf Cloud Service Broker.\n\n kubectl apply -f /tmp/kf-csb.yaml\n\n4. Verify the Kf Cloud Service Broker installation status.\n\n kubectl get pods -n kf-csb\n\nCreate a service broker\n-----------------------\n\n**Note:** The user/password must match what you entered in the [Kubernetes secret](#kubernetes_secret) step earlier. \n\n kf create-service-broker cloud-service-broker \u003cvar translate=\"no\"\u003eservicebroker\u003c/var\u003e \u003cvar translate=\"no\"\u003epassword\u003c/var\u003e http://csb-controller.kf-csb/\n\nValidate installation\n---------------------\n\nCheck for available services in the marketplace. \n\n kf marketplace\n\nIf everything is installed and configured correctly, you should see the following: \n\n $ kf marketplace\n\n Broker Name Namespace Description\n cloud-service-broker csb-google-bigquery A fast, economical and fully managed data warehouse for large-scale data analytics.\n cloud-service-broker csb-google-dataproc Dataproc is a fully-managed service for running Apache Spark and Apache Hadoop clusters in a simpler, more cost-efficient way.\n cloud-service-broker csb-google-mysql Mysql is a fully managed service for the Google Cloud Platform.\n cloud-service-broker csb-google-postgres PostgreSQL is a fully managed service for the Google Cloud Platform.\n cloud-service-broker csb-google-redis Cloud Memorystore for Redis is a fully managed Redis service for the Google Cloud Platform.\n cloud-service-broker csb-google-spanner Fully managed, scalable, relational database service for regional and global application data.\n cloud-service-broker csb-google-stackdriver-trace Distributed tracing service\n cloud-service-broker csb-google-storage-bucket Google Cloud Storage that uses the Terraform back-end and grants service accounts IAM permissions directly on the bucket.\n\nClean up\n--------\n\n1. Delete cloud-service-broker.\n\n kf delete-service-broker cloud-service-broker\n\n2. Delete CSB components.\n\n kubectl delete ns kf-csb\n\n3. Delete the Kf Cloud Service Broker Cloud SQL for MySQL instance.\n\n ```\n gcloud sql instances delete ${INSTANCE_NAME} --project=${CLUSTER_PROJECT_ID}\n ```\n4. Remove the IAM policy bindings.\n\n ```\n gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \\\n --role=roles/cloudsql.client\n ``` \n\n ```\n gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \\\n --role=roles/compute.networkUser\n ``` \n\n ```\n gcloud projects remove-iam-policy-binding ${CLUSTER_PROJECT_ID} \\\n --member='serviceAccount:csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com' \\\n --role=roles/redis.admin\n ```\n5. Remove the GSA.\n\n ```\n gcloud iam service-accounts delete csb-${CLUSTER_NAME}-sa@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com \\\n --project=${CLUSTER_PROJECT_ID}\n ```\n\nWhat's next?\n------------\n\n- Test Kf Cloud Service Broker with our [Spring Music guide](/migrate/kf/docs/2.11/how-to/spring-music)."]]
