Oliver Frolovs olliefr

Create and Configure Service Agents on Google Cloud

Note

Service agent == Google-managed service account

In Google Cloud, project-level, folder-level, and organization-level service agents are created automatically as you enable and use Google Cloud services.
Sometimes, these service agents are also automatically granted roles that allow them to create and access resources on your behalf.

Sometimes, either of these things is not done for some reason. When that happens, don't "power cycle" the API off and on. There is a better way.

Uptime Checks on Google Cloud

gcloud monitoring uptime list-configs --project=dml-sandbox-pigeon

---
checkerType: STATIC_IP_CHECKERS
displayName: hello-iam-direct

Security Best Practices: Google Cloud

A set of links to official Google documentation for security best practices and services relevant to the security domain.

Tip

Need more advice? Reach out to me at Devil Mice Labs to book a workshop or a deep dive.

Use reglient:

src="ghcr.io/iximiuz/labs/nginx:alpine"

dst="us-central1-docker.pkg.dev/dml-sandbox-firebass-21/demorepo/nginx:alpine"

curl -LO https://github.com/regclient/regclient/releases/download/v0.8.0/regctl-linux-amd64

chmod +x regctl-linux-amd64

Google Cloud Blog post:

Synthetic data generation with Dataflow data generator flex template

More detail on the Streaming Data Generator template:

Streaming Data Generator to Pub/Sub, BigQuery, and Cloud Storage

The source code for the template:

Dataflow Streaming Data Generator

Datastore is weird!

It is a legacy service tied to App Engine. Once enabled, App Engine API cannot be disabled on a Cloud project.

Cloud projects can use either Datastore or Firestore but not both. Once set, it cannot be changed. Since all legacy App Engine apps use Datastore, a different project must be used for Firestore usage.

This Codelab gives some historical context on App Engine, Datastore, and Firestore.

For Python client for Datastore API there are at least two options:

mkdir sandpit-one && cd $_
conda create --prefix ./conda --yes python=3.8 ipython
conda activate ./conda
python -m pip install --upgrade pip

	#!/bin/bash
	# Network Traffic Capture and Profiling for Python scripts
	#
	# - Runs a Python script in an isolated network namespace and captures all its network
	# traffic.
	# - Profiles the Python script's performance using cProfile.
	# - Captures SSL/TLS keys for decrypting HTTPS traffic in Wireshark.
	#
	# Usage: ./run.sh <python_script.py>
	#

	terraform {
	required_providers {
	databricks = {
	source = "databricks/databricks"
	version = "1.74.0"
	}
	google = {
	source = "hashicorp/google"
	version = "6.30.0"
	}

	The configuration uses default credentials as set up by:

	databricks auth login --host https://9999487995419999.1.gcp.databricks.com/