cloudidentity

project:region:db_instance_name

authorizationInfo: [
  0: {
    granted: true
    permission: "cloudsql.instances.connect"
    resource: "projects/uxu-io-staging/instances/database-instance-uxu-8898595"
    resourceAttributes: {
    name: "projects/uxu-io-staging/instances/database-instance-uxu-8898595"
    service: "<http://sqladmin.googleapis.com|sqladmin.googleapis.com>"
    type: "<http://sqladmin.googleapis.com/Instance|sqladmin.googleapis.com/Instance>"
  }}]
methodName: "cloudsql.instances.connect"

host

authorizationInfo: [
  0: {
    granted: true
    permission: "cloudsql.instances.connect"
    resource: "projects/my-project/instances/my-db-instance-8898595"
    resourceAttributes: {
    name: "projects/my-project/instances/my-db-instance-8898595"
    service: "<http://sqladmin.googleapis.com|sqladmin.googleapis.com>"
    type: "<http://sqladmin.googleapis.com/Instance|sqladmin.googleapis.com/Instance>"
  }}]
methodName: "cloudsql.instances.connect"

driverName := "cloudsql-postgres"
cleanup, err := pgxv4.RegisterDriver(driverName, cloudsqlconn.WithIAMAuthN())

connStr := fmt.Sprintf("host=%v user=%v dbname=%v sslmode=disable", host, user, name)
db, err := sql.Open(driverName, connStr)

ctx, cancelfunc := context.WithTimeout(context.Background(), 30*time.Second)
pingErr := db.PingContext(ctx) // times out here

if pingErr != nil {
  log.Fatalf("server: Got error: %v\n", pingErr) // logs error here due to timeout
}

const saJob = new gcp.serviceaccount.Account("sa-job", {
    accountId: "sa-for-job",
    displayName: "My Service Account for the ping Job",
  });

  const iamDBEditor = new gcp.projects.IAMBinding("iam-db-editor", {
    project: gcpProject,
    role: "roles/cloudsql.editor",
    members: [pulumi.interpolate`serviceAccount:${saJob.email}`],
  }, {
    parent: saJob
  });

  const iamDBUser = new gcp.projects.IAMBinding("iam-db-user", {
    project: gcpProject,
    role: "roles/cloudsql.instanceUser",
    members: [pulumi.interpolate`serviceAccount:${saJob.email}`],
  }, {
    parent: saJob
  });

  const k8sSAJob = new k8s.core.v1.ServiceAccount("k8s-sa-job", {
      metadata: {
        namespace: namespaceName,
        annotations: {
          "<http://iam.gke.io/gcp-service-account|iam.gke.io/gcp-service-account>": saJob.email,
        },
      }
    },
    {
      provider: clusterProvider,
    })

  const iamK8sBinding = new gcp.serviceaccount.IAMBinding("iam-k8s-db-editor", {
    serviceAccountId: saJob.name,
    role: "roles/iam.workloadIdentityUser",
    members: [pulumi.interpolate`serviceAccount:${gcpProject}.svc.id.goog[${namespaceName}/${k8sSAJob.metadata.name}]`],
  })

  /* Create a user with the configured IAM credentials (linked to the service account).
     For more info:
       * <https://cloud.google.com/sql/docs/postgres/iam-logins>
       * <https://cloud.google.com/sql/docs/postgres/add-manage-iam-users#creating-a-database-user>
   */
  const dbUserJobAPIServerMigration = new gcp.sql.User("api_server_migrator", {
    instance: db.instance.name,
    name: saJob.email.apply((v) =>
      v.replace(".<http://gserviceaccount.com|gserviceaccount.com>", "")
    ),
    project: gcpProject,
    type: "CLOUD_IAM_SERVICE_ACCOUNT",
  });

cloudsqlconn.WithCredentialsFile("/Users/me/creds/sa-creds.json")

IAMMemberCondition

Output<string>

Error: invocation of kubernetes:helm:template returned an error: failed to generate YAML for specified Helm chart: failed to create chart from template: execution error at (neo4j-cluster-core/templates/_helpers.tpl:73:16): No node exists in the cluster which has all the below labels (.Values.nodeSelector)
     %smap[<http://cloud.google.com/gke-nodepool:primarynodes-1d024b4|cloud.google.com/gke-nodepool:primarynodes-1d024b4>]
        at Object.callback (/e/node_modules/@pulumi/runtime/invoke.ts:172:33)
        at Object.onReceiveStatus (/node_modules/@grpc/grpc-js/src/client.ts:338:26)
        at Object.onReceiveStatus (/node_modules/@grpc/grpc-js/src/client-interceptors.ts:426:34)
        at Object.onReceiveStatus (/node_modules/@grpc/grpc-js/src/client-interceptors.ts:389:48)
        at /node_modules/@grpc/grpc-js/src/call-stream.ts:276:24
        at processTicksAndRejections (node:internal/process/task_queues:77:11)

gcp.sql.Database

gcp.sql.User

gcp.sql.User

gcp.sql.Database

deletionPolicy: 'ABANDON'

pulumi up

pulumi up

const issuer = new k8s.apiextensions.CustomResource(issuerName, {
  apiVersion: "<http://cert-manager.io/v1|cert-manager.io/v1>",
  kind: "Issuer",
  metadata: {
      namespace: appNs.metadata.name,
      name: issuerName,
  },
  spec: {
      acme: {
        server: "<https://acme-v02.api.letsencrypt.org/directory>",
        email: "",
        privateKeySecretRef: {
          name: issuerSecret.metadata.name,
        },
        solvers: [{
          http01: {
              ingress: {
                  name: "api-ingress-dev"
              },
          },
        }],
      },
  },

// Create a PubSub Topic
let requests = new gcp.pubsub.Topic("requests");
requests.onMessagePublished("newMessage", (data) => {
    // Print out a log message for every message on the Topic.
    // Change this code to fit your needs!
    console.log(Buffer.from(data.data, "base64").toString());
});

// Create a PubSub Topic
let requests = await gcp.pubsub.getTopic("requests");
/// ???
requests.onMessagePublished("newMessage", (data) => {
    // Print out a log message for every message on the Topic.
    // Change this code to fit your needs!
    console.log(Buffer.from(data.data, "base64").toString());
});

gcp.cloudfunctions.CallbackFunction

@google-cloud/workflows

gsutil iam ch serviceAccount:<sa-name>:<bucketrole> gs://<bucket-name>

@pulumi/postgresql.Provider

error: error sending request: googleapi: Error 429: Project docket-grabber-dev exceeded its quota. Resource Exhausted: