airbyte-internal-ops 0.1.6__tar.gz → 0.1.7__tar.gz

airbyte_internal_ops-0.1.7/CONTRIBUTING.md

@@ -0,0 +1,110 @@
+# Contributing
+
+First clone the repo, then use something like the following MCP config.
+
+```json
+{
+  "mcpServers": {
+    "airbyte-ops-mcp": {
+      "type": "stdio",
+      "command": "uv",
+      "args": [
+        "run",
+        "--project=/Users/{my-user-id}/repos/airbyte-ops-mcp/",
+        "airbyte-ops-mcp"
+      ],
+      "env": {
+        "AIRBYTE_MCP_ENV_FILE": "/path/to/airbyte-ops-mcp/.env"
+      }
+    },
+    "airbyte-coral-mcp": {
+      "type": "stdio",
+      "command": "uvx",
+      "args": [
+        "--python=3.11",
+        "--from=airbyte@latest",
+        "airbyte-mcp"
+      ],
+      "env": {
+        "AIRBYTE_MCP_ENV_FILE": "/Users/{user-id}/.mcp/airbyte_mcp.env"
+      }
+    }
+  }
+}
+```
+
+## Internal Secrets for Live Tests
+
+The live tests feature can retrieve unmasked connection secrets from Airbyte Cloud's internal database. This requires:
+
+- **GCP_PROD_DB_ACCESS_CREDENTIALS** - Access to prod Cloud SQL and Google Secret Manager for DB connection details
+
+To test locally:
+
+1. Set up GCP Application Default Credentials: `gcloud auth application-default login`
+2. Ensure you have access to the `prod-ab-cloud-proj` project
+3. Connect to Tailscale (required for private network access)
+
+In CI, these secrets are available at the org level and a Cloud SQL Auth Proxy handles connectivity.
+
+## Authorizing Service Accounts
+
+To grant a service account access to the prod database query tools, you need to grant permissions on the `CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS` secret in Google Secret Manager (see `CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS_SECRET_ID` in `src/airbyte_ops_mcp/constants.py`). The service account needs both `secretAccessor` (to read the secret value) and `viewer` (to list secret versions) roles.
+
+### Required Permissions
+
+#### Secret Manager Permissions
+
+Grant both roles scoped to the specific secret:
+
+```bash
+# Grant secretAccessor role (for reading secret values)
+gcloud secrets add-iam-policy-binding projects/587336813068/secrets/CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS \
+  --member="serviceAccount:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --role="roles/secretmanager.secretAccessor"
+
+# Grant viewer role (for listing secret versions)
+gcloud secrets add-iam-policy-binding projects/587336813068/secrets/CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS \
+  --member="serviceAccount:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --role="roles/secretmanager.viewer"
+```
+
+#### Cloud SQL Permissions
+
+Grant Cloud SQL access at the project level:
+
+```bash
+# Grant Cloud SQL Client role (required for connecting via Cloud SQL Proxy or Python Connector)
+gcloud projects add-iam-policy-binding prod-ab-cloud-proj \
+  --member="serviceAccount:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --role="roles/cloudsql.client"
+
+# Grant Cloud SQL Instance User role (may be required depending on org policies)
+gcloud projects add-iam-policy-binding prod-ab-cloud-proj \
+  --member="serviceAccount:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --role="roles/cloudsql.instanceUser"
+```
+
+Note: `roles/cloudsql.client` is required for the Cloud SQL Python Connector and Cloud SQL Auth Proxy to establish connections. `roles/cloudsql.instanceUser` is typically needed for IAM database authentication; it may be redundant when using username/password authentication (as this codebase does), but some environments may still require it.
+
+### Verifying Permissions
+
+To check existing permissions on the secret:
+
+```bash
+gcloud secrets get-iam-policy projects/587336813068/secrets/CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS
+```
+
+### Using Cloud SQL Proxy
+
+When running outside of the VPC (without Tailscale), use the Cloud SQL Auth Proxy:
+
+```bash
+# Start the proxy (use a non-conflicting port if 5432 is in use)
+cloud-sql-proxy prod-ab-cloud-proj:us-west3:prod-pgsql-replica --port=5433
+
+# Set environment variables for your application
+export USE_CLOUD_SQL_PROXY=1
+export DB_PORT=5433
+export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json
+```

{airbyte_internal_ops-0.1.6 → airbyte_internal_ops-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: airbyte-internal-ops
-Version: 0.1.6
+Version: 0.1.7
 Summary: MCP and API interfaces that let the agents do the admin work
 Author-email: Aaron Steers <aj@airbyte.io>
 Keywords: admin,airbyte,api,mcp

{airbyte_internal_ops-0.1.6 → airbyte_internal_ops-0.1.7}/src/airbyte_ops_mcp/live_tests/connection_secret_retriever.py

@@ -32,7 +32,9 @@ from __future__ import annotations
 
 import logging
 import os
+import tempfile
 from dataclasses import replace
+from pathlib import Path
 from typing import TYPE_CHECKING
 
 from airbyte_ops_mcp.connection_config_retriever import (
@@ -57,18 +59,27 @@ def _ensure_gcp_credentials_env() -> None:
     """Ensure GCP credentials are available via standard env var.
 
     If GOOGLE_APPLICATION_CREDENTIALS is not set but GCP_PROD_DB_ACCESS_CREDENTIALS is,
-    copy the value to GOOGLE_APPLICATION_CREDENTIALS. This provides a fallback
-    for internal employees who use GCP_PROD_DB_ACCESS_CREDENTIALS as their standard
-    credential path for prod database access.
+    write the JSON credentials to a temp file and set GOOGLE_APPLICATION_CREDENTIALS
+    to point to that file. This provides a fallback for internal employees who use
+    GCP_PROD_DB_ACCESS_CREDENTIALS as their standard credential source for prod
+    database access.
+
+    Note: GOOGLE_APPLICATION_CREDENTIALS must be a file path, not JSON content.
+    The GCP_PROD_DB_ACCESS_CREDENTIALS env var contains the JSON content directly,
+    so we write it to a temp file first.
 
     This function is idempotent and safe to call multiple times.
     """
     if ENV_GOOGLE_APPLICATION_CREDENTIALS not in os.environ:
         gsm_creds = os.getenv(ENV_GCP_PROD_DB_ACCESS_CREDENTIALS)
         if gsm_creds:
-            os.environ[ENV_GOOGLE_APPLICATION_CREDENTIALS] = gsm_creds
+            # Write credentials to a temp file since GOOGLE_APPLICATION_CREDENTIALS
+            # expects a file path, not JSON content
+            creds_file = Path(tempfile.gettempdir()) / "gcp_prod_db_creds.json"
+            creds_file.write_text(gsm_creds)
+            os.environ[ENV_GOOGLE_APPLICATION_CREDENTIALS] = str(creds_file)
             logger.debug(
-                f"Using {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS} as fallback for "
+                f"Wrote {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS} to {creds_file} and set "
                 f"{ENV_GOOGLE_APPLICATION_CREDENTIALS}"
             )
 

{airbyte_internal_ops-0.1.6 → airbyte_internal_ops-0.1.7}/src/airbyte_ops_mcp/prod_db_access/db_engine.py

@@ -19,9 +19,8 @@ from google.cloud import secretmanager
 from google.cloud.sql.connector import Connector
 from google.cloud.sql.connector.enums import IPTypes
 
-# Secret ID for database connection details
-CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS_SECRET_ID = (
-    "projects/587336813068/secrets/CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS"
+from airbyte_ops_mcp.constants import (
+    CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS_SECRET_ID,
 )
 
 PG_DRIVER = "pg8000"

airbyte_internal_ops-0.1.6/CONTRIBUTING.md

@@ -1,48 +0,0 @@
-# Contributing
-
-First clone the repo, then use something like the following MCP config.
-
-```json
-{
-  "mcpServers": {
-    "airbyte-ops-mcp": {
-      "type": "stdio",
-      "command": "uv",
-      "args": [
-        "run",
-        "--project=/Users/{my-user-id}/repos/airbyte-ops-mcp/",
-        "airbyte-ops-mcp"
-      ],
-      "env": {
-        "AIRBYTE_MCP_ENV_FILE": "/path/to/airbyte-ops-mcp/.env"
-      }
-    },
-    "airbyte-coral-mcp": {
-      "type": "stdio",
-      "command": "uvx",
-      "args": [
-        "--python=3.11",
-        "--from=airbyte@latest",
-        "airbyte-mcp"
-      ],
-      "env": {
-        "AIRBYTE_MCP_ENV_FILE": "/Users/{user-id}/.mcp/airbyte_mcp.env"
-      }
-    }
-  }
-}
-```
-
-## Internal Secrets for Live Tests
-
-The live tests feature can retrieve unmasked connection secrets from Airbyte Cloud's internal database. This requires:
-
-- **GCP_PROD_DB_ACCESS_CREDENTIALS** - Access to prod Cloud SQL and Google Secret Manager for DB connection details
-
-To test locally:
-
-1. Set up GCP Application Default Credentials: `gcloud auth application-default login`
-2. Ensure you have access to the `prod-ab-cloud-proj` project
-3. Connect to Tailscale (required for private network access)
-
-In CI, these secrets are available at the org level and a Cloud SQL Auth Proxy handles connectivity.