Gcp | inetshell

GCP Cloud VPN will not come up: reading the IKE logs (peer not responding, traffic selectors narrowed) and BGP with pfSense

Logs Explorer with resource.type=vpn_gateway and the IKE status text. ‘peer not responding’ = IKE version, PSK, IP or UDP 500/4500; ’traffic selectors narrowed’ = phase 2 subnets that do not match. With pfSense and BGP: permit route maps in/out or no routes are accepted.

GitHub Actions → Google Cloud without keys: Workload Identity Federation with gcloud and Terraform

Pool + OIDC provider with issuer token.actions.githubusercontent.com and an attribute-condition on repository_owner; roles/iam.workloadIdentityUser to the repo’s principalSet; auth@v3 with workload_identity_provider and service_account. No secrets to rotate.

Google-managed certificate that never gets issued: CAA (pki.goog, letsencrypt.org), FAILED_NOT_VISIBLE and the right order

CAA with issue pki.goog and issue letsencrypt.org (or no CAA at all), A/AAAA pointing only to the load balancer IP, certificate attached to the target proxy, and up to 60 minutes. gcloud compute ssl-certificates describe shows the domainStatus that tells which of the three is failing.

Importing dumps into Cloud SQL without errors: DEFINER and SUPER (ERROR 1227) on MySQL, extensions and owners on PostgreSQL

MySQL: mysqldump –hex-blob –single-transaction –set-gtid-purged=OFF –default-character-set=utf8mb4; DEFINER clauses for users that do not exist on the instance (or root@localhost) break the import. PostgreSQL: pg_dump –format=plain –no-owner –no-acl plus sed to comment out DROP/CREATE/COMMENT ON EXTENSION. Instance service account with objectAdmin on the bucket; gcloud sql import sql with –database and –user.

Vault Agent Injector on a private GKE cluster: no sidecar and pods take 30 s (the control plane cannot reach the webhook on 8080)

gcloud compute firewall-rules create … –source-ranges= –target-tags= –rules=tcp:8080. Validate by deleting a pod and grepping the injector for ‘handler: Request received: Method=POST URL=/mutate’. Applies to any webhook not listening on 443 or 10250.