openflow-gdrive-update-ip

name	openflow-gdrive-update-ip
description	Update network rule IP for OpenFlow Google Drive demo. Use when nipyapi returns 401 after PAT rotation due to network change.
parent_skill	openflow-gdrive-demo

OpenFlow Google Drive — Update IP

Use when nipyapi returns 401 after a successful PAT rotation — indicates the machine's IP is not in the network rule.

When to Load

Parent SKILL.md routes here on: "moved networks", "conference wifi", "hotel wifi", "IP changed", "update IP", "blocked"

Workflow

Step 1: Resolve Config and Detect Current IP

eval $(python3 -c "
import tomllib, os
m = tomllib.load(open('.sfutils/manifest.toml', 'rb'))
s = m.get('snowflake', {})
o = m.get('openflow', {})
print(f'CONNECTION={s.get(\"connection\", os.environ.get(\"SNOWFLAKE_DEFAULT_CONNECTION_NAME\", \"\"))}')
print(f'NETWORK_RULE={o.get(\"network_rule\", os.environ.get(\"OPENFLOW_NETWORK_RULE\", \"\"))}')
")
curl -s ifconfig.me && echo ""

Store IP as <CURRENT_IP>.

Step 2: Show Current Network Rule

snow sql -q "DESCRIBE NETWORK RULE $NETWORK_RULE" -c $CONNECTION --format json

Step 3: Confirm Before Updating

Present:

Current IP:    <CURRENT_IP>
Network rule:  $NETWORK_RULE

This will REPLACE the existing IP allowlist with your current IP.
Proceed? (yes / no)

⚠️ MANDATORY STOP — wait for explicit confirmation.

Step 4: Update Network Rule

snow sql -q "CREATE OR REPLACE NETWORK RULE $NETWORK_RULE \
  TYPE = IPV4 \
  MODE = INGRESS \
  VALUE_LIST = ('<CURRENT_IP>/32') \
  COMMENT = 'Updated by openflow-gdrive-demo skill'" \
  -c $CONNECTION

Step 5: Rotate PAT

STOP. Invoke $sfutils:programmatic-access-token to rotate the PAT for the service user in manifest [pat.openflow-runner].sa_user.

Tell the skill to rotate (not create new) -- it will update the keychain and manifest.

Do NOT write PAT SQL manually.

Step 6: Verify

eval $(python3 -c "
import tomllib
m = tomllib.load(open('.sfutils/manifest.toml', 'rb'))
rt = m.get('openflow', {}).get('runtime', {})
print(f'PROFILE={rt.get(\"nipyapi_profile\", \"\")}')
")
nipyapi --profile $PROFILE canvas get_root_pg_id

Stopping Points

• ✋ Step 3: Before replacing network rule — always confirm

Output

Network updated!
  New IP:       <CURRENT_IP>
  Network rule: $NETWORK_RULE — updated
  PAT:          rotated
  nipyapi:      connected ✓