This is a tool to interact with Application Integration APIs and Connector APIs. The tool lets you manage (Create,Get, List, Update, Delete, Export and Import) Integration entities like integrations, authConfigs etc.
integrationcli is a binary and you can download the appropriate one for your platform from here
NOTE: Supported platforms are:
- Darwin
- Windows
- Linux
Run this script to download & install the latest version (on Linux or Darwin)
curl -L https://raw.githubusercontent.com/GoogleCloudPlatform/application-integration-management-toolkit/main/downloadLatest.sh | sh -The simplest way to get started with integrationcli is
token=$(gcloud auth print-access-token)
project=$(gcloud config get-value project | head -n 1)
region=<set region here>
integrationcli integrations list -p $project -r $region -t $tokenIf you are using integrationcli on Cloud Shell, GCE instances, Cloud Build, then you can use the metadata to get the access token
integrationcli integrations list -p $project -r $region --metadata-tokenYou can configure gcloud to setup/create default application credentials. These credentials can be used by integrationcli.
gcloud auth application-default login
integrationcli integrations list -p $project -r $region --default-tokenor through impersonation
gcloud auth application-default login --impersonate-service-account <SA>
integrationcli integrations list -p $project -r $region --default-tokenIf you are using the same GCP project for Integration, then consider setting up preferences so they don't have to be included in every command
project=$(gcloud config get-value project | head -n 1)
region=<set region here>
integrationcli prefs set --reg=$region --proj=$projectSubsequent commands can be like this:
token=$(gcloud auth print-access-token)
integrationcli integrations list -t $tokenintegrationcli can use the service account directly and obtain an access token.
integrationcli token gen -a serviceaccount.jsonParameters The following parameters are supported. See Common Reference for a list of additional parameters.
--account -a(required) Service Account in json format
Use this access token for all subsequent calls (token expires in 1 hour)
integrationcli caches the OAuth Access token for subsequent calls (until the token expires). The access token is stored in $HOME/.integrationcli. This path must be readable/writeable by the integrationcli process.
integrationcli token cache -a serviceaccount.jsonor
token=$(gcloud auth print-access-token)
integrationcli token cache -t $tokenor
integrationcli token cache --metadata-tokenHere is a list of available commands
The following environment variables may be set to control the behavior of integrationcli. The default values are all false
INTEGRATIONCLI_DEBUG=trueenables debug logINTEGRATIONCLI_SKIPCACHE=truewill not cache the access token on the diskINTEGRATIONCLI_DISABLE_RATELIMIT=truedisables rate limiting when making calls to Integration or Connectors APIsINTEGRATIONCLI_NO_USAGE=truedoes not print usage when the command failsINTEGRATIONCLI_NO_ERRORS=truedoes not print error messages from the CLI (control plane error messages are displayed)INTEGRATIONCLI_DRYRUN=truedoes not execute control plane APIs
Please see here for details on how to automate deployments via Cloud Build. The container images for integrationcli are:
- Container image for the CLI
docker pull us-docker.pkg.dev/appintegration-toolkit/images/integrationcli:latest
integrationcli can be used to create Integration Connectors. There are two types of Integration Connectors:
Google managed applications include systems like BigQuery, PubSub, Cloud SQL etc. It is best to generate configuration like below by running the command:
integrationcli connectors get -n name -p project -r region --minimal=true --overrides=true -t $tokenThe file produced will be like this:
{
"description": "This is a sample",
"connectorDetails": {
"provider": "gcp", ## the name of the provider
"name": "pubsub", ## type of the connector
"version": 1 ## version is always 1
},
"configVariables": [ ## these values are specific to each connector type. this example is for pubsub
{
"key": "project_id",
"stringValue": "$PROJECT_ID$" ## if the project id is the same as the connection, use the variable. Otherwise set the project id explicitly
},
{
"key": "topic_id",
"stringValue": "mytopic"
}
]
}NOTE: For ConfigVariables that take a region as a parameter (ex: CloudSQL), you can also use $REGION$
Then execute via integrationcli like this:
integrationcli connectors create -n name-of-the-connector -f ./test/pub_sub_connection.jsonYou can optionally pass the service account to be used from the command line:
integrationcli connectors create -n name-of-the-connector -f ./test/pub_sub_connection.json -sa <sa-name> -sp <sa-project-id>NOTES:
- This command assumes the token is cached, otherwise pass the token via
-t - If the service account project is not passed and the service account name is passed, then the connection's project id is used
- If the service account doesn't exist, it will be created
- For Google connectors
integrationcliadds the IAM permissions for the service account to the resource (if the -g flag is passed)
Third party application include connectors like Salesforce, Service Now, etc. It is best to generate configuration like below by running the command:
integrationcli connectors get -n name -p project -r region --minimal=true --overrides=true -t $tokenThe file produced will be like this:
{
"description": "SFTP Test for demo",
"connectorDetails": {
"provider": "...", ## provider name
"name": "...", ## type of the connector
"version": 1 ## version is always 1
},
"configVariables": [ ## these values are specific to each connector type. this example is for sftp
{
"key": "remote_host",
"stringValue": "example.net"
},
{
"key": "remote_port",
"stringValue": "22"
}
],
"authConfig": {
"authType": "USER_PASSWORD",
"userPassword": {
"username": "demo",
"passwordDetails": {
"secretName": "sftp-demo", ## this secret is provisioned if it doesn't already exist
"reference": "./test/password.txt" ## this file contains the data/contents (encrypted or clear) to put in secret manager
}
}
}
}If the connector depends on secret manager, integrationcli can create the Secret Manager secret if it is not already provisioned.
Then execute via integrationcli like this:
integrationcli connectors create -n name-of-the-connector -f ./test/sftp_connection.jsonNOTE: This command assumes the token is cached, otherwise pass the token via -t
When setting the passwordDetails, the contents of the password can be encrypted using Cloud KMS
"passwordDetails": {
"secretName": "sftp-demo",
"reference": "./test/password.txt" ## the file containing the password - clear text or encrypted
}The file for the password can be in clear text or encrypted text. If encrypted, then a cloud kms key can be passed for decryption. Before storing the file, the file can be encrypted like this:
gcloud kms encrypt --plaintext-file=./test/password.txt --keyring $key-ring --project $project --location us-west1 --ciphertext-file=enc_passsword.txt --key=$key
base64 ./test/enc_password.txt > ./test/b64_enc_password.txt # on MacOS, use base64 -i ./test/enc_password.txt > ./test/b64_enc_password.txtPlease refer to this article in Google Cloud Community for how to perform CICD in Application Integration with integrationcli
All artifacts are signed by cosign. We recommend verifying any artifact before using them.
You can use the following public key to verify any integrationcli binary with:
cat cosign.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQBXcARDlva9s89a5299yn/VboBdd
9bDj+j7FVYyzKAufqC9kaCR3naZ3JIAFYjxrXF0GlRjKzJU4ubriT4P6zQ==
-----END PUBLIC KEY-----
cosign verify-blob --key=cosign.pub --signature integrationcli_<platform>_<arch>.zip.sig integrationcli_<platform>_<arch>.zipWhere platform can be one of Darwin, Linux or Windows and arch (architecture) can be one of arm64 or x86_64
All images are signed by cosign. We recommend verifying any container before using them.
cat cosign.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQBXcARDlva9s89a5299yn/VboBdd
9bDj+j7FVYyzKAufqC9kaCR3naZ3JIAFYjxrXF0GlRjKzJU4ubriT4P6zQ==
-----END PUBLIC KEY-----
cosign verify --key=cosign.pub us-docker.pkg.dev/appintegration-toolkit/images/integrationcli:latestThis is not an officially supported Google product
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent