Skip to main content
emisar

Google Cloud certificate diagnostics

v0.1.2

Read-only diagnostics for legacy Compute SSL certificates and Certificate Manager certificates, maps, entries, and DNS authorizations. Fixed projections omit certificate PEM, private keys, descriptions, and labels.

7 allowed by default
Pack ID
gcp-certificates
Vendor
emisar
OS
linux
Actions
7
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
gcloud jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install gcp-certificates --hash sha256:85625e72a48e5333aabf4f8729ed232ffb07da097b1401604919d10826ed3fa1

Setup

Drives gcloud and projects certificate API responses locally before they leave the runner. Authenticate gcloud before loading the pack.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional credential file that overrides the active gcloud account.

Notes

  • Legacy Compute certificate reads need roles/compute.networkViewer; Certificate Manager reads need roles/certificatemanager.viewer or equivalent permissions.
  • Actions use mode-0600 temporary response files so gcloud failures remain distinguishable from jq failures; files are removed before exit.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because gcloud is installed.

Verify it works

Runs gcp.managed_certificates, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-certificates

Install and configure a pack walks through the whole sequence on a host.

Actions 7 total

View on GitHub
  • gcp.certificate_map_entries script low Low — read-only or trivially reversible

    gcloud certificate-manager maps entries list

    List bounded host or primary matchers and certificates in one certificate map.

    View source on GitHub
  • gcp.certificate_maps script low Low — read-only or trivially reversible

    gcloud certificate-manager maps list

    List bounded Certificate Manager maps and attached load-balancer targets.

    View source on GitHub
  • gcp.dns_authorizations script low Low — read-only or trivially reversible

    gcloud certificate-manager dns-authorizations list

    List bounded Certificate Manager DNS authorizations and required public DNS records.

    View source on GitHub
  • gcp.managed_certificate_describe script low Low — read-only or trivially reversible

    gcloud certificate-manager certificates describe

    Show one Certificate Manager certificate's source, SANs, state, and expiry without PEM.

    View source on GitHub
  • gcp.managed_certificates script low Low — read-only or trivially reversible

    gcloud certificate-manager certificates list

    List bounded Certificate Manager certificate source, SANs, provisioning state, and expiry without PEM.

    View source on GitHub
  • gcp.ssl_certificate_describe script low Low — read-only or trivially reversible

    gcloud compute ssl-certificates describe

    Show one legacy Compute SSL certificate's status, SANs, and expiry without PEM.

    View source on GitHub
  • gcp.ssl_certificates script low Low — read-only or trivially reversible

    gcloud compute ssl-certificates list

    List bounded legacy Compute SSL certificate status, SANs, and expiry without PEM.

    View source on GitHub
← Back to registry
Pack reference  Publish your own