CHEATSHEET — 7 Agentes ADK en Cloud Run + A2A

CHEATSHEET — 7 Agentes ADK en Cloud Run + A2A

Tener abierto en segunda pantalla durante grabación

---

1. SETUP INICIAL

# Autenticar con cuenta GCP
gcloud auth login

# Setear proyecto
gcloud config set project project-cbd42e2d-0a78-4c20-9df

# Verificar
gcloud config get-value project
gcloud config get-value account

---

2. HABILITAR APIs

gcloud services enable \
  run.googleapis.com \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com \
  secretmanager.googleapis.com \
  --project=project-cbd42e2d-0a78-4c20-9df

---

3. PERMISOS SERVICE ACCOUNT

El service account de Cloud Run siempre sigue este patrón: {PROJECT_NUMBER}-compute@developer.gserviceaccount.com

Obtén el PROJECT_NUMBER dinámicamente — así funciona para cualquier proyecto:

# Obtener project number (NO hardcodear)
PROJECT_NUMBER=$(gcloud projects describe project-cbd42e2d-0a78-4c20-9df --format="value(projectNumber)")
echo "Project Number: $PROJECT_NUMBER"

# Storage para Cloud Build
gcloud projects add-iam-policy-binding project-cbd42e2d-0a78-4c20-9df \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

# Cloud Build
gcloud projects add-iam-policy-binding project-cbd42e2d-0a78-4c20-9df \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/cloudbuild.builds.builder"

# Secret Manager (para la Gemini API key)
gcloud secrets add-iam-policy-binding GEMINI_API_KEY \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor" \
  --project=project-cbd42e2d-0a78-4c20-9df

---

4. GEMINI API KEY → SECRET MANAGER

# Crear secret (reemplazar con tu key real)
echo -n "TU_GEMINI_API_KEY" | gcloud secrets create GEMINI_API_KEY \
  --data-file=- \
  --project=project-cbd42e2d-0a78-4c20-9df

# Dar acceso al service account de Cloud Run
gcloud secrets add-iam-policy-binding GEMINI_API_KEY \
  --member="serviceAccount:39303680563-compute@developer.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor" \
  --project=project-cbd42e2d-0a78-4c20-9df

---

5. DEPLOY × 7 AGENTES

# Parámetros comunes
PROJECT=project-cbd42e2d-0a78-4c20-9df
REGION=us-central1
BASE_DIR=/Users/nicolasneiragarcia/NICOLASNEIRA/yt/videos/13-agentes-adk-a2a-cloud-run/scripts/proyecto-video-idp

cd $BASE_DIR

# Función de deploy (mismos flags para todos)
deploy_agent() {
  gcloud run deploy $1 \
    --source=agents_adk/$1/ \
    --region=$REGION \
    --no-allow-unauthenticated \
    --memory=1Gi \
    --cpu=1 \
    --min-instances=0 \
    --max-instances=1 \
    --cpu-throttling \
    --timeout=300 \
    --port=8080 \
    --set-secrets="GEMINI_API_KEY=GEMINI_API_KEY:latest" \
    --quiet \
    --project=$PROJECT
}

# Deploy uno por uno
deploy_agent platform_architect   # ✅ ya deployado
deploy_agent infrastructure
deploy_agent security
deploy_agent cicd
deploy_agent observability
deploy_agent devex
deploy_agent web_portal

---

6. URLs DE LOS AGENTES (llenar después del deploy)

platform_architect  → https://platform-architect-r7xydrdtta-uc.a.run.app
infrastructure      → https://infrastructure-r7xydrdtta-uc.a.run.app
security            → https://security-r7xydrdtta-uc.a.run.app
cicd                → https://cicd-r7xydrdtta-uc.a.run.app
observability       → https://observability-r7xydrdtta-uc.a.run.app
devex               → https://devex-r7xydrdtta-uc.a.run.app
web_portal          → https://web-portal-r7xydrdtta-uc.a.run.app

Nota: el patrón real de Cloud Run es {service-name}-{hash}-uc.a.run.app, no {project-number}.{region}.run.app. El hash (r7xydrdtta) es único por proyecto y región — aparece al hacer el primer deploy.

---

7. VERIFICAR AGENTES

# Verificar que un agente responde
TOKEN=$(gcloud auth print-identity-token)

curl -s https://platform-architect-r7xydrdtta-uc.a.run.app/list-apps \
  -H "Authorization: Bearer $TOKEN"
# Esperado: ["platform_architect"]

---

8. CORRER LA CADENA COMPLETA

cd $BASE_DIR

# Setear URLs de Cloud Run
export PLATFORM_ARCHITECT_URL=https://platform-architect-r7xydrdtta-uc.a.run.app
export INFRASTRUCTURE_URL=https://infrastructure-r7xydrdtta-uc.a.run.app
export SECURITY_URL=https://security-r7xydrdtta-uc.a.run.app
export CICD_URL=https://cicd-r7xydrdtta-uc.a.run.app
export OBSERVABILITY_URL=https://observability-r7xydrdtta-uc.a.run.app
export DEVEX_URL=https://devex-r7xydrdtta-uc.a.run.app
export WEB_PORTAL_URL=https://web-portal-r7xydrdtta-uc.a.run.app

# Ejecutar cadena completa
python orchestrator_a2a.py "Build IDP for a Python FastAPI application"

---

9. SPLIT SCREEN — LOGS EN TIEMPO REAL (abrir ANTES de correr el orchestrator)

Abrir 7 terminales (o las que quepan en pantalla) y correr cada una:

# Terminal 1
gcloud run services logs tail platform-architect --region=us-central1

# Terminal 2
gcloud run services logs tail infrastructure --region=us-central1

# Terminal 3
gcloud run services logs tail security --region=us-central1

# Terminal 4
gcloud run services logs tail cicd --region=us-central1

# Terminal 5
gcloud run services logs tail observability --region=us-central1

# Terminal 6
gcloud run services logs tail devex --region=us-central1

# Terminal 7
gcloud run services logs tail web-portal --region=us-central1

Tip grabación: con —min-instances=0 los agentes escalan a cero entre llamadas. El cold start aparece en los logs (“Started server process”) — mostrarlo es parte del demo, prueba de que no hay nada corriendo hasta que se necesita.

---

10. CORRER EL ORCHESTRATOR A2A REAL

cd $BASE_DIR/agents_adk/platform_architect

export PLATFORM_ARCHITECT_URL=https://platform-architect-r7xydrdtta-uc.a.run.app
export INFRASTRUCTURE_URL=https://infrastructure-r7xydrdtta-uc.a.run.app
export SECURITY_URL=https://security-r7xydrdtta-uc.a.run.app
export CICD_URL=https://cicd-r7xydrdtta-uc.a.run.app
export OBSERVABILITY_URL=https://observability-r7xydrdtta-uc.a.run.app
export DEVEX_URL=https://devex-r7xydrdtta-uc.a.run.app
export WEB_PORTAL_URL=https://web-portal-r7xydrdtta-uc.a.run.app

uv run python ../../orchestrator_sequential_a2a.py \
  "Build IDP for a Python FastAPI application"

---

10. DEPLOY DEL PORTAL + DOMINIO

# Deploy portal (público)
gcloud run deploy idp-portal \
  --source=outputs/portal/ \
  --region=us-central1 \
  --allow-unauthenticated \
  --memory=512Mi --cpu=1 \
  --min-instances=0 --max-instances=1 \
  --port=8080

# Domain mapping
gcloud beta run domain-mappings create \
  --service=idp-portal \
  --domain=idp.nicolasneira.dev \
  --region=us-central1
# → Agrega en Cloudflare: idp CNAME ghs.googlehosted.com.

URLs finales:

• Portal: https://idp-portal-39303680563.us-central1.run.app
• Dominio: https://idp.nicolasneira.dev (SSL automático ~15 min)

---

NOTAS DE PRODUCCIÓN

• El primer deploy tarda ~4-5 min (Cloud Build construye la imagen)
• Deploys siguientes son más rápidos (cache de capas Docker)
• Si falla por OOM: subir memory a 2Gi
• Si falla por timeout: subir —timeout a 600
• A2A requiere DOS cosas: --a2a en Dockerfile + agent.json en la carpeta del agente
• URL pattern Cloud Run: {service}-{hash}-uc.a.run.app (hash compartido por proyecto/región)