Google Cloud の Workflows で Batch を呼び出してみた

# サービスアカウントを作成
$ gcloud iam service-accounts create sa-workflows

# roles/batch.agentReporter の権限を付与
$ gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:sa-workflows@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/batch.jobsEditor" \
    --condition None

# roles/iam.serviceAccountUser の権限を付与
$ gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:sa-workflows@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/iam.serviceAccountUser" \
    --condition None

# roles/logging.logWriter の権限を付与
$ gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:sa-workflows@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/logging.logWriter" \
    --condition None

main:
    steps:
        - init:
            assign:
                - project: ${sys.get_env("GOOGLE_CLOUD_PROJECT_ID")}
                - location: ${sys.get_env("GOOGLE_CLOUD_LOCATION")}
        - createAndRunBatchJob:
            call: googleapis.batch.v1.projects.locations.jobs.create
            args:
                parent: ${"projects/" + project + "/locations/" + location}
                body:
                    taskGroups:
                        taskSpec:
                            runnables:
                                - script:
                                    path: "/scripts/script.sh"
                            computeResource:
                                cpuMilli: "500"
                                memoryMib: "500"
                            environment:
                                variables:
                                    FILE_PATH: "test/sample.csv.gz"
                                    INPUT_BUCKET: "hanzawa-yuya-compressed-files"
                                    OUTPUT_BUCKET: "hanzawa-yuya-uncompressed-files"
                            volumes:
                                - gcs:
                                    remotePath: "hanzawa-yuya-batch-mount/test"
                                  mountPath: "/scripts"
                    allocationPolicy:
                        instances:
                            - policy:
                                machineType: "e2-micro"
                                provisioningModel: "STANDARD"
                        location:
                            allowedLocations:
                                - ${"regions/" + location}
                        serviceAccount:
                            email: ${"sa-batch@" + project + ".iam.gserviceaccount.com"}
                    logsPolicy:
                        "destination": "CLOUD_LOGGING"
            result: createAndRunBatchJobResponse