Securing Your Code with Cloud Workstations

Cloud workstations are fully managed developer workstations hosted on Google Cloud. Cloud engineers or administrators can centrally create, manage, and update these workstations and make them accessible to developers from any device.

In this chapter, we describe how an administrator can preconfigure Cloud workstations, and how developers can use them to work on their code using their preferred IDE.

This chapter includes the following sections:

• Introduction to Cloud Workstations
• Configuring workstations for developers
• Customizing Cloud workstations
• Coding in Cloud Workstations

Technical requirements

To perform the tasks in this chapter, you need a Google Cloud project with billing or a free trial enabled. You can reuse the project you created in Chapter 2. In this case, you need to enable the Cloud Workstations API, in addition to the APIs you already enabled.

Your Google account needs the Cloud Workstations Admin or Project Editor role in that project, which you should have from following the instructions in the previous chapters.

The code used in this chapter is available in the ch4 folder of the book repository: https://github.com/PacktPublishing/Secure-Continuous-Delivery-on-Google-Cloud/tree/main/ch4.

Introduction to Cloud Workstations

Administrators create and configure Cloud workstations using the Google Cloud console, Google Cloud SDK, or Cloud Workstations API. Developers access their workstations remotely through a web browser or other means, as described in this chapter. With this approach, developers can be productive quickly, access pre-assembled environments for their language of choice, and have enough horsepower when they need it, while at the same time, operators can provide secure and consistent environments.

To start, let’s take a look at the components of the Cloud Workstations service.

Cloud Workstations architecture

The main architectural components of Cloud Workstations are as follows:

• Workstations are backed by Compute Engine VM instances running in your project and your VPC.

  The creation, life cycle, and software deployment for these VMs are managed by a component called a controller. Software inside Cloud Workstation VMs is deployed in...

Configuring workstations for developers

In this section, you’ll learn how to create and configure workstations for developers. There are three main steps:

1. Create a workstation cluster.
2. Create two workstation configurations, with common settings for two different developer teams.
3. Create one or more workstations.

Let’s start with the first step, which is creating the workstation cluster.

Creating a workstation cluster

In this section, you will see how to create a workstation cluster:

1. To start creating a cluster, go to the Google Cloud Console menu, and select Cloud Workstations | Cluster management and click on + CREATE.
2. Type a cluster name in the Name field. For the name selection, consider that clusters define a group of workstations in a particular region, the VPC network they’re attached to, and whether they’re accessible from the internet (public gateway) or only from the VPC network they are attached to (private...

Customizing Cloud Workstations

Because software in Cloud Workstations is deployed in container images, an effective way to customize workstations, while centrally managing, updating, and protecting them from vulnerabilities, is to create custom container images with the software and configurations that the users need, using one of the preconfigured images as the base image.

Creating a custom image and workstation configuration

In this section, you’ll create a custom container image for Java developers, starting from the base editor preconfigured image, and then create another workstation configuration to use it. The configuration will include Maven and some Java extensions for VS Code.

To do this, you need a machine that can build container images, such as Docker, and that can push images to the Artifact Registry. For convenience, you can use Cloud Code for Cloud Shell, as described in Chapter 3, which has Docker already configured to authenticate to your existing Artifact...

Coding on Cloud Workstations

You now have several workstation configurations and workstations, including one with a custom container image for Java development. Now, let’s find out how to use them.

In this section, you’ll learn how a developer connects to and uses Cloud Workstations. We include instructions for accessing a workstation that uses the base editor and instructions for accessing a workstation that uses the JetBrains IntelliJ IDE.

The following sections describe how to access a workstation that uses the base editor and a workstation that uses the JetBrains IntelliJ IDE.

Accessing a Cloud workstation configured with the base editor

The following steps describe how to launch a workstation configured to use the base editor:

1. In the Google Cloud console, select Cloud Workstations | Workstations.
2. Under My workstations, click Launch in the java-tools-wks workstation. This is the workstation you customized before, still based on the Code-OSS...

Cleaning up

The workstations you created will shut down automatically after the idle time passes (2 hours). To avoid incurring additional costs, you can delete your workstations, workstation configurations, and workstation clusters following the instructions on this documentation page: https://cloud.google.com/workstations/docs/delete-resources.

Summary

You’ve seen how you can configure Cloud Workstations centrally, using Google-provided base images or customizing it for specific developers’ needs. You’ve also learned how developers can access and use Cloud Workstations using a web browser or the JetBrains Gateway. You’re now ready to use a Cloud workstation for yourself or create and centrally configure and manage a fleet of workstations for your development team or teams.

In the next chapter, you will see how to automate continuous integration tasks with Cloud Build.