How can I set AutoResizeLimit when creating a Cloud SQL MySQL instance?
The GCP API defines it here: https://cloud.google.com/sql/docs/mysql/admin-api/v1beta4/instances
The terraform provider has disk_autoresize, which is a boolean:
https://www.terraform.io/docs/providers/google/r/sql_database_instance.html#disk_autoresize
But, there is no attribute to set the auto_resize_limit.
A way to create a Cloud SQL instance with auto_resize_limit is to create it directly with querying an API e.g. with cURL and setting storageAutoResizeLimit.
The query should look like this:
ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
--header 'Content-Type: application/json' \
--data '{"name":"[INSTANCE_NAME]", "region":"[REGION]",
"settings": {"tier":"[MACHINE_TYPE]",
"storageAutoResizeLimit":[SIZE],
"backupConfiguration": {"binaryLogEnabled":true, "enabled":true}}}' \
-X POST \
https://www.googleapis.com/sql/v1beta4/projects/[PROJECT-ID]/instances
Note that storageAutoResize is set to True by default.
Related
It is possible to list GitHub repository secrets via the REST API. For example:
!curl \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer KEY"\
-H "X-GitHub-Api-Version: 2022-11-28" \
https://api.github.com/repos/ORG/REPO/actions/secrets
I do not see any way to get metadata about secrets using the GraphQL API.
When calling the keycloak REST api (see below) the output value is a string of asterisks (stars) - is it possible to get this information in clear text?
curl \
--silent \
--request GET \
-H "Authorization: bearer <MYACCESSTOKEN>" \
--header 'Content-Type: application/x-www-form-urlencoded' \
"http://keycloakserver:8180/auth/admin/realms/myrealm/clients/<MYCLIENTID>/client-secret"
returns/output:
{"type":"secret","value":"**********"}
How can it be retrieved in a text (not stars) format?
The client is configured with:
clientt protocol: openid-connect
access type: confidential
standard flow: enabled
First, you need to generate the secret. Either via Admin Console:
Or via keycloak REST api, in your case (using POST instead of GET):
curl \
--silent \
--request POST \
-H "Authorization: bearer <MYACCESSTOKEN>" \
--header 'Content-Type: application/x-www-form-urlencoded' \
"http://keycloakserver:8180/auth/admin/realms/myrealm/clients/<MYCLIENTID>/client-secret"
While trying to use encryption/decryption feature of spring cloud config server with Pivotal Cloud Foundry's p-config-server service which is configured with a symmetric key for encryption, I am getting a 403 forbidden response which calling /decrypt on config server .
I am able to call the /encrypt endpoint successfully for encrypting values using below sample curl -
curl --location --request POST 'https://config-xxxx.apps.xxx.com/encrypt' \
--header 'Authorization: bearer <cf oauth_token here>' \
--header 'Content-Type: text/plain' \
--data-raw 'sample data'
But when trying to decrypt those values using /decrypt, I am getting 403 Forbidden error -
{
"error": "access_denied",
"error_description": "invalid issuer"
}
Sample curl for decryption -
curl --location --request POST 'https://config-xxxx.apps.xxx.com/decrypt' \
--header 'Authorization: bearer <cf oauth_token here>' \
--header 'Content-Type: text/plain' \
--data-raw '<encrypted value from previous step>'
In pivotal's config server documentation though there are reference to /encrypt but nothing related to /decrypt pivotal config server
Any pointers ?
In the Pivotal/Tanzu Spring Cloud Services (commercial product), the /encrypt API is exposed to anyone with the admin scope or to anyone that is a Space Developer in the space of the service.
The /decrypt endpoint is not exposed specifically, so you're not allowed to access with the same credentials, hence why you're seeing a 403.
My quick read of the code is that you'd need a token with scope config_server_<guide>.read to access that endpoint. Where <guid> is the config server's service guide (run cf service --guid <name> to obtain the guide).
To make that work, you'd need to get a token from the bound service or a service key, the latter is easier:
Run cf create-service-key <service_instance> decrypt-key
Run cf service-key <service_instance> decrypt-key
Run export TOKEN=$(curl -vv <access_token_uri> -d 'grant_type=client_credentials' -d 'client_id=<client_id>' -d 'client_secret=<client_secret>' | jq -r .access_token) where the values in <...> are from the output of #2.
Run curl -vv '<uri>/decrypt' -H "Authorization: bearer $TOKEN" -H 'Content-type: text/plain' -d '<encrypted-value>'
These depend on a Bash shell. You can do them on Windows, but the commands will vary. It also uses jq to make extracting the token easier. You could split the command in step #3 into two steps, fetching with curl and manually exporting TOKEN.
I have been trying to generate an IBM Cloud IAM token using the following command:
curl -ik -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" --data-urlencod
e "grant_type=urn:ibm:params:oauth:grant-type:apikey" --data-urlencode "apikey=rzQV6ahSbPLzXjzhzuAEtbXXXXXXXXXXXXXXXX" --data-urlencode "response_type=cloud_iam,uaa&uaa_client_id=cf&uaa_client_secret=" "https://iam.ng.bluemix.net/oidc/passcode"
But it keeps giving me 405 method not allowed. What is the right way to generate the token? Is there any documentation which could be followed?
The problem is with the endpoint you are using. Here's the working curl command to generate an IBM Cloud IAM token
curl -ik -X POST \
--header "Content-Type: application/x-www-form-urlencoded" \
--header "Accept: application/json" \
--data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" \
--data-urlencode "apikey=<APIKEY>" \
"https://iam.cloud.ibm.com/identity/token"
You can generate an IAM token by using either your IBM Cloud API key or a service ID's API key.
Here's the link to the documentation
I am writing an application to fetch query logs from google cloud sql using stack driver monitoring. I am able to retrieve the logs using API explorer. I will be using a curl call to download the logs.
curl --header "Authorization: Bearer ACCESS_TOKEN" --header
'Content-Type: application/json' --header 'x-referer:
https://developers.google.com' -X POST --data
'{"resourceNames":["projectname"],"filter":"logName=logname"}'
"https://content-logging.googleapis.com/v2/entries:list?fields=entries(jsonPayload%2ClogName%2Coperation%2CreceiveTimestamp%2CtextPayload%2Ctimestamp)&key=APIkey"
API key is available in the interface. I have downloaded the json with client details. But I am not able to find any documentation on how to generate ACCESS_TOKEN in this case. Can someone please help me on this?
You can try:
curl -H "Authorization: Bearer "$(gcloud auth application-default
print-access-token) ...
or set:
ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
and then:
curl --header "Authorization: Bearer ${ACCESS_TOKEN}" ...