Secure and fast deployments to Google Agent Engine with GitLab

Google Agent Engine provides a managed, scalable runtime for AI agents built with Google’s Agent Development Kit (ADK). The post shows how to deploy an ADK agent through GitLab using Workload Identity Federation, avoiding service-account keys while integrating security scanning into CI/CD. A GitLab pipeline can automatically test and deploy the agent to Agent Engine when changes reach the main branch.

Agent Engine and GitLab

• Agent Engine manages infrastructure, scaling, sessions, memory storage, logging, monitoring, and IAM.
• GitLab simplifies deployment through:
  • Dependency scanning, SAST, and secret detection.
  • Native Google Cloud integration.
  • Keyless authentication with Workload Identity Federation.
  • CI/CD templates and the ADK deployment CLI.

Prerequisites

• A Google Cloud project with the Cloud Storage and Vertex AI APIs enabled.
• A GitLab project containing the agent source code.
• A Google Cloud Storage bucket for deployment staging.
• GitLab’s Google Cloud IAM integration configured.

Configure IAM with Workload Identity Federation

• In GitLab, configure the Google Cloud IAM integration with:
  • Project ID
  • Project number
  • Workload Identity Pool ID
  • Provider ID
• Run GitLab’s generated setup script in Google Cloud Shell.
• Grant the federated service principal:
  • roles/aiplatform.user
  • roles/storage.objectAdmin
• This setup lets GitLab authenticate to Google Cloud without storing long-lived service-account keys.

Build the GitLab CI/CD Pipeline

• Add a .gitlab-ci.yml file with test and deploy stages.
• Use the google/cloud-sdk:slim image and define variables for:
  • Google Cloud project and region
  • Staging bucket
  • Agent name
  • Agent entry point
• Include GitLab templates for:
  • Dependency scanning
  • Static application security testing
  • Secret detection
• Enable keyless authentication with:

identity: google_cloud

• Install the ADK and required Google Cloud libraries during the job.
• Deploy with:

adk deploy agent_engine \
  --project=$GCP_PROJECT_ID \
  --region=$GCP_REGION \
  --staging_bucket=gs://$STORAGE_BUCKET \
  --display_name="$AGENT_NAME" \
  $AGENT_ENTRY

• Restrict deployment to the main branch.
• Cache Python dependencies to speed up later pipeline runs.

Deploy and Verify

• Commit the agent code and .gitlab-ci.yml to GitLab.
• Monitor the pipeline under Build > Pipelines.
• Confirm that security scans complete successfully before deployment.
• The deployment stage packages the agent, places it in the staging bucket, and publishes it to Agent Engine.

The recommended approach is to combine GitLab’s built-in security checks and Workload Identity Federation with the ADK CLI. This provides a secure, keyless, and repeatable deployment process for Google AI agents.