gke - deploying adk agent

To deploy ADK agent to a gke cluster, first we need to create the requirement resources. 

Setup the variables

gcloud config set project PROJECT_ID

export GOOGLE_CLOUD_LOCATION=REGION

export PROJECT_ID=PROJECT_ID

export GOOGLE_CLOUD_PROJECT=$PROJECT_ID

export WORKLOAD_POOL=$PROJECT_ID.svc.id.goog

export PROJECT_NUMBER=$(gcloud projects describe --format json $PROJECT_ID | jq -r ".projectNumber")

And then clone this repository

git clone https://github.com/GoogleCloudPlatform/kubernetes-engine-samples.git

cd kubernetes-engine-samples/ai-ml/adk-vertex

Next we setup our cluster

gcloud container clusters create-auto CLUSTER_NAME \ --location=$GOOGLE_CLOUD_LOCATION \ --project=$PROJECT_ID

And then create artifact repository container registry

gcloud artifacts repositories create adk-repo \ --repository-format=docker \ --location=$GOOGLE_CLOUD_LOCATION \ --project=$PROJECT_ID

Next permission and role assignment - please ensure you provided the right project number (not id)

ROLES_TO_ASSIGN=( "roles/artifactregistry.writer" "roles/storage.objectViewer" "roles/logging.viewer" ) for ROLE in "${ROLES_TO_ASSIGN[@]}"; do gcloud projects add-iam-policy-binding "${PROJECT_ID}" \ --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \ --role="${ROLE}" done

Next we will build and push our image using gcp cloud  build.

export IMAGE_URL="${GOOGLE_CLOUD_LOCATION}-docker.pkg.dev/${PROJECT_ID}/adk-repo/adk-agent:latest"

gcloud builds submit \

    --tag "$IMAGE_URL" \

    --project="$PROJECT_ID" \

    app

And you can see the image here:-

Let's connect to the cluster 

gcloud container clusters get-credentials CLUSTER_NAME \

    --location=${GOOGLE_CLOUD_LOCATION}

And we will configure workload identity. As with all workload identity configuration we create standard service account then we create KSA (kubernete service account).

gcloud iam service-accounts create vertex-sa \

    --project=$PROJECT_ID

gcloud projects add-iam-policy-binding $PROJECT_ID \

    --member "serviceAccount:vertex-sa@$PROJECT_ID.iam.gserviceaccount.com" \

    --role "roles/aiplatform.user"

Creating our KSA

kubectl create serviceaccount vertex-sa

kubectl annotate serviceaccount vertex-sa \
    iam.gke.io/gcp-service-account=vertex-sa@$PROJECT_ID.iam.gserviceaccount.com

And finally granting permission

gcloud iam service-accounts add-iam-policy-binding vertex-sa@$PROJECT_ID.iam.gserviceaccount.com \

    --role roles/iam.workloadIdentityUser \

    --member "serviceAccount:$PROJECT_ID.svc.id.goog[default/vertex-sa]"

Let's deploy our image to gke.

apiVersion: apps/v1

kind: Deployment

metadata:

  name: adk-agent-deployment

  labels:

    app: adk-agent

spec:

  replicas: 1

  selector:

    matchLabels:

      app: adk-agent

  template:

    metadata:

      labels:

        app: adk-agent

    spec:

      serviceAccountName: vertex-sa

      containers:

      - name: adk-agent

        image: australia-southeast2-docker.pkg.dev/your-project-id/adk-repo/adk-agent

        ports:

        - containerPort: 8000

        env:

        - name: GOOGLE_CLOUD_PROJECT_ID

          value: your-project-id

        - name: GOOGLE_CLOUD_LOCATION

          value: australia-southeast2

        - name: GOOGLE_GENAI_USE_VERTEXAI

          value: "1"

        - name: PORT

          value: "8000"

        resources:

          requests:

            memory: "512Mi"

            cpu: "500m"

          limits:

            memory: "1Gi"

            cpu: "1"

And deploy the following service too

apiVersion: v1

kind: Service

metadata:

  name: adk-agent-service

spec:

  selector:

    app: adk-agent

  type: LoadBalancer # Creates an external IP address for access

  ports:

  -   protocol: TCP

      port: 80

      targetPort: 8000 # Matches the containerPort exposed in the Deployment

And this is what our agent looks like