The sample code's REST API is described using theOpenAPI specification. The tutorial also shows you how to create anAPI keyto send requests to the API.
The tutorial uses prebuilt container images of the sample code and
ESPv2, which are stored inArtifact Registry. If you are
unfamiliar with containers, see the following for more information:
To generate a cost estimate based on your projected usage,
use thepricing calculator.
New Google Cloud users might be eligible for afree trial.
When you finish the tasks that are described in this document, you can avoid
continued billing by deleting the resources that you created. For more information, seeClean up.
Before you begin
This tutorial assumes that you already have Minikube or a Kubernetes cluster
set up. For more information, see theKubernetes documentation.
Sign in to your Google Cloud account. If you're new to
Google Cloud,create an accountto evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Make a note of the Google Cloud project ID because it is needed later.
Installing and configuring required software
In this tutorial, you install the Google Cloud CLI to use thegcloud CLIto manage your project.
You usekubectl,
a command-line interface, to run commands against Kubernetes clusters. You also
need a way to test the API.
In the following procedure, if you already have the required
software installed, continue with the next step.
Linux and macOS users: This tutorial provides an example of usingcurl, which typically comes pre-installed on your operating system.
If you don't havecurl, you can download it from thecurlReleases and downloads page.
Windows users: This tutorial provides an example usingInvoke-WebRequest, which is
supported in PowerShell 3.0 and later.
Update the gcloud CLI and install the Endpoints
components:
gcloud components update
Make sure that the Google Cloud CLI (gcloud) is authorized to access
your data and services on Google Cloud:
gcloud auth login
In the new tab that opens, select an account.
Set the default project to your project ID:
gcloud config set projectYOUR_PROJECT_ID
ReplaceYOUR_PROJECT_IDwith your project ID.
If you have other Google Cloud projects, and you want to usegcloudto manage them, seeManaging gcloud CLI configurations.
Installkubectl:
gcloudcomponentsinstallkubectl
Acquire new user credentials to use for application default credentials.
The user credentials authorizekubectl.
gcloud auth application-default login
In the new tab that opens, choose an account.
Run the following command to make sure your Kubernetes client
is properly configured:
Optionally, download the sample code. In this tutorial, you deploy a prebuilt
container image, so you don't have to build a container from the sample code.
However, you might want to download the sample code, which is provided in
several languages to help you understand how the sample API works.
To download the sample code:Java
To clone or download the sample API:
Clone the sample app repository to your local machine:
The configuration sample displays the lines near thehostfield, which you need to modify. To deploy theopenapi.yamlfile
to Endpoints, the complete OpenAPI document is required.
The exampleopenapi.yamlfile contains a section for configuring
authentication that isn't needed for this tutorial. You don't need to
configure the lines withYOUR-SERVICE-ACCOUNT-EMAILandYOUR-CLIENT-ID.
OpenAPI is a language-agnostic specification. The sameopenapi.yamlfile is in thegetting-startedsample in each language GitHub
repository for convenience.
In thehostfield, replace the text with the
Endpoints service name, which should be in the following format:
Note thatecho-api.endpoints.YOUR_PROJECT_ID.cloud.googis the Endpoints service name. It isn't the fully qualified
domain name (FQDN) that you use for sending requests to the API.
For information about the fields in the OpenAPI document that
Endpoints requires, seeConfiguring
Endpoints.
After you finish all the following configuration steps, and you can
successfully send requests to the sample API using an IP address, seeConfiguring DNS for Endpointsfor information on how to configureecho-api.endpoints.YOUR_PROJECT_ID.cloud.googto be the FQDN.
Make sure you are in theendpoints-samples/kubernetesdirectory.
Upload the configuration and create a managed service:
gcloud endpoints services deploy openapi.yaml
Thegcloudcommand then calls the Service Management
API to create a managed service with the name that you specified in thehostfield of theopenapi.yamlfile.
Service Management configures the service according to the
settings in theopenapi.yamlfile. When you make changes toopenapi.yaml, you must redeploy the file to update the
Endpoints service.
As it is creating and configuring the service, Service Management
outputs information to the terminal. You can safely ignore the warnings about
the paths in theopenapi.yamlfile not requiring an API key.
When it finishes configuring the service, Service Management displays a
message with the service configuration ID and the service name, similar to the
following:
Service Configuration [2017-02-13r0] uploaded for service [echo-api.endpoints.example-project-12345.cloud.goog]
In the preceding example,2017-02-13r0is the service
configuration ID, andecho-api.endpoints.example-project-12345.cloud.googis the
Endpoints service. The service configuration ID consists of a
date stamp followed by a revision number. If you deploy theopenapi.yamlfile again on the same day, the revision
number is incremented in the service configuration ID. You can view
the Endpoints service configuration on theEndpoints>Servicespage in the Google Cloud console.
At a minimum, Endpoints and ESP require the
following Google services to be enabled:
Name
Title
servicemanagement.googleapis.com
Service Management API
servicecontrol.googleapis.com
Service Control API
In most cases, thegcloud endpoints services deploycommand enables these
required services. However, thegcloudcommand completes successfully but
doesn't enable the required services in the following circumstances:
If you used a third-party application such as Terraform, and you don't
include these services.
You deployed the Endpoints configuration to an existing
Google Cloud project in which these services were explicitly disabled.
Use the following command to confirm that the required services are enabled:
gcloud services list
If you do not see the required services listed, enable them:
To determine theENDPOINTS_SERVICE_NAMEyou can either:
After deploying the Endpoints configuration, go to theEndpointspage in the Cloud console. The list of possibleENDPOINTS_SERVICE_NAMEare shown under theService namecolumn.
For OpenAPI, theENDPOINTS_SERVICE_NAMEis what you specified in thehostfield of your OpenAPI spec. For gRPC, theENDPOINTS_SERVICE_NAMEis what you specified in thenamefield of your gRPC Endpoints configuration.
For more information about thegcloudcommands, seegcloudservices.
Creating credentials for your service
To provide management for your API, both ESP and ESPv2 require the services inService Infrastructure.
To call these services, ESP and ESPv2 must use access tokens.
When you deploy ESP or ESPv2 to Google Cloud environments, such as
GKE, Compute Engine, or the App Engine flexible
environment, ESP and ESPv2 obtain access tokens for you through the
Google Cloud metadata service.
When you deploy ESP or ESPv2 to a non-Google Cloud environment, such
as your local desktop, an on-premises Kubernetes cluster, or another cloud
provider, you must provide aservice account JSON filethat contains a private key. ESP and ESPv2 use theservice accountto generate access tokens to call the services that it needs to manage your API.
You can use either the Google Cloud console or the Google Cloud CLI
to create the service account and private key file:
Console
In the Google Cloud console, open theService Accountspage .
Select the project that your API was created in and clickOpen.
Click+ Create Service Account.
In theService account namefield, enter the name for your service
account.
ClickCreate.
ClickContinue.
ClickDone.
Click the email address of the newly created service account.
ClickKeys.
ClickAdd key, then clickCreate new key.
ClickCreate. A JSON key file is downloaded to your computer.
Make sure to store the key file securely, because it can be used to
authenticate as your service account. You can move and rename this file
however you would like.
ClickClose.
gcloud
Enter the following to display the project IDs for your
Google Cloud projects:
gcloud projects list
ReplacePROJECT_IDin the following command to set the default
project to the one that your API is in:
gcloud config set projectPROJECT_ID
Make sure that the Google Cloud CLI (gcloud) is authorized to access your
data and services on Google Cloud:
gcloud auth login
If you have more than one account, make sure to choose the account that
is in the Google Cloud project that the API is in. If you rungcloud auth list, the account that you selected is shown as the active
account for the project.
To create a service account, run the following command and replaceSERVICE_ACCOUNT_NAMEandMy Service Accountwith the name and
display name that you want to use:
gcloud iam service-accounts createSERVICE_ACCOUNT_NAME\
--display-name "My Service Account"
The command assigns an email address for the service account in the
following format:
This email address is required in the subsequent commands.
Create a service account key file:
gcloud iam service-accounts keys create ~/service-account-creds.json \
--iam-accountSERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com
Add required IAM roles:
This section describes the IAM resources used by ESP and
ESPv2 and the IAM roles required for the attached service account to
access these resources.
Endpoint Service Configuration
ESP and ESPv2 call Service Control
which uses the endpoint service configuration. The endpoint service configuration
is an IAM resource and ESP and ESPv2 need theService Controllerrole to access it.
The IAM role is on the endpoint service configuration, not on the project.
A project may have multiple endpoint service configurations.
Use the following gcloud command to add the role to the attached service
account for the endpoint service configuration.
Where *SERVICE_NAMEis the endpoint service name *SERVICE_ACCOUNT_NAME@DEPLOY_PROJECT_ID.iam.gserviceaccount.comis the attached service account.
Cloud Trace
ESP and ESPv2 callCloud Traceservice to
export Trace to a project. This project is called the tracing
project. In ESP, the tracing project and the project that owns
the endpoint service configuration are the same. In ESPv2, the
tracing project can be specified by the flag--tracing_project_id, and
defaults to the deploying project.
ESP and ESPv2 require theCloud Trace Agentrole to enable Cloud Trace.
Use the following gcloud command to add the role to the attached service
account:
Where *TRACING_PROJECT_IDis the tracing project ID *SERVICE_ACCOUNT_NAME@DEPLOY_PROJECT_ID.iam.gserviceaccount.com
is the attached service account.
For more information, seeWhat are roles and permissions?
So far you have deployed the OpenAPI document to Service Management, but
you haven't yet deployed the code that serves the API backend. This section
walks you through deploying prebuilt containers for the sample API and
ESPv2 to Kubernetes.
Checking required permissions
Grant required permissions to the service account associated with your cluster:
ESPv2, which runs inside a container, needs access to the
credentials stored locally in theservice-account-creds.jsonfile. To provide
ESPv2 with access to the credentials, you create aKubernetes secretand mount the Kubernetes secret as aKubernetes volume.
To create the Kubernetes secret and mount the volume:
Make sure to rename the JSON file toservice-account-creds.jsonand copy it
toendpoints-samples/kubernetesif it was downloaded to a different directory.
This way, the name matches the options specified in theecho.yamldeployment manifest file.
Make sure you are in theendpoints-samples/kubernetesdirectory.
Create a Kubernetes secret with the service account credentials using the following command:
The deployment manifest file that you use to deploy the API
and ESPv2 to Kubernetes already contains thesecret volume,
as shown in the following two sections of the file:
Configuring the service name and starting the service
ESPv2 needs to know the name of your service to find the
configuration that you deployed previously (by using thegcloud endpoints services deploycommand).
To configure the service name and start the service:
Open the deployment manifest file,echo.yaml, and replaceSERVICE_NAMEin the ESPv2 startup options with the name of your service. This is the same name that you configured in thehostfield of your OpenAPI document. For example:
The"--rollout_strategy=managed"option
configures ESPv2 to use the latest deployed service configuration. When you
specify this option, within a minute after you deploy a new service
configuration, ESPv2 detects the change and automatically begins using it. We
recommend that you specify this option instead of providing a specific configuration ID
for ESPv2 to use.
For information about the other ESPv2 options used, seeESPv2 startup options.
Start the service to deploy the Endpoints service on
Kubernetes with the following command:
kubectl create -f echo.yaml
If you see an error message similar to the following:
If you are using Minikube, skip toSending a request by using an IP address.
It can take a few minutes after you start your service in the container before
the external IP address is ready.
To view the service's external IP address:
Run the following command:
kubectl get service
Make a note of the value forEXTERNAL-IP. You use that IP address when
you send a request to the sample API.
Sending a request by using an IP address
After the sample API is running in the container cluster, you can send requests
to the API.
Create an API key and set an environment variable
The sample code requires an API key. To simplify the request, you set an
environment variable for the API key.
In the same Google Cloud project that you used for your API, create an API key on the
API credentials page. If you want to create an API key in a different Google Cloud project,
seeEnabling an API in your Google Cloud project.
Usecurlto send an HTTP request by using theENDPOINTS_KEYenvironment
variable you set previously. ReplaceIP_ADDRESSwith
the external IP address of your instance.
The--dataoption specifies the data to post to the API.
The--headeroption specifies that the data is in JSON format.
PowerShell
UseInvoke-WebRequestto send an HTTP request by using theENDPOINTS_KEYenvironment variable you set previously. ReplaceIP_ADDRESSwith the external IP address of your
instance.
In the previous example, the first two lines end in a backtick. When you paste the
example into PowerShell, make sure there isn't a space following the backticks.
For information about the options used in the example request, seeInvoke-WebRequestin the Microsoft
documentation.
Third-party app
You can use a third-party application such as the Chrome browser
extensionPostmanto send the
request:
SelectPOSTas the HTTP verb.
For the header, select the keycontent-typeand the valueapplication/json.
For the body, enter the following: {"message":"hello world"}
In the URL, use the actual API key rather than the environment variable.
For example: http://192.0.2.0:80/echo?key=AIza...
The API echoes back the message that you send, and responds with the
following:
Because the Endpoints service name for the API is in the.endpoints.YOUR_PROJECT_ID.cloud.googdomain, you can
use it as the fully qualified domain name (FQDN) by making a small
configuration change in youropenapi.yamlfile. This way, you can
send requests to the sample API by usingecho-api.endpoints.YOUR_PROJECT_ID.cloud.googinstead of the IP address.
To configure Endpoints DNS:
Open your OpenAPI configuration file,openapi.yaml, and add thex-google-endpointsproperty at the top level of the file
(not indented or nested) as shown in the following snippet:
When you deploy theopenapi.yamlfile by using the precedinggcloudcommand, Service Management creates a DNS A-record,echo-api.endpoints.my-project-id.cloud.goog, which resolves to the
target IP address,192.0.2.1. It might take a few minutes for the
new DNS configuration to propagate.
Now that you have the DNS record configured for the sample API, send a
request to it by using the FQDN (replaceYOUR_PROJECT_IDwith your project ID) and theENDPOINTS_KEYenvironment variable set
previously:
To avoid incurring charges to your Google Cloud account for the resources used in this
tutorial, either delete the project that contains the resources, or keep the project and
delete the individual resources.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eThis tutorial guides users through configuring and deploying a sample API and Extensible Service Proxy V2 (ESPv2) to a non-Google Cloud Kubernetes cluster, using the OpenAPI specification for the REST API.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves setting up a Google Cloud project, installing required software, downloading and configuring the sample code and Kubernetes files, deploying the Endpoints configuration, and creating service credentials.\u003c/p\u003e\n"],["\u003cp\u003eUsers will deploy the API and ESPv2 to the Kubernetes cluster using prebuilt container images, obtain the service's external IP address, and send requests to the API using either an IP address or a fully qualified domain name (FQDN) after configuring DNS.\u003c/p\u003e\n"],["\u003cp\u003eThe tutorial explains how to track API activity and offers guidance on creating an API key, sending requests, and checking required Google services to be enabled, such as Service Management API and Service Control API.\u003c/p\u003e\n"],["\u003cp\u003eAfter completion of the tutorial, users can learn how to delete deployed resources, configure SSL, and create a developer portal, as well as explore further resources such as deploying Endpoints on Google Kubernetes Engine or building a Docker image.\u003c/p\u003e\n"]]],[],null,[]]
