# Openflow Gdrive Update Ip

> Update network rule IP for OpenFlow Google Drive demo. Use when nipyapi returns 401 after PAT rotation due to network change.

- Skill: `snowflake-labs/openflow-gdrive-update-ip` (Agent Skill)
- Install (CLI): `npx skillmds@latest add snowflake-labs/openflow-gdrive-update-ip`
- Raw SKILL.md: https://api.skillmd.com/api/skills/snowflake-labs/openflow-gdrive-update-ip/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: snowflake-labs (https://skillmd.com/u/snowflake-labs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/snowflake-labs/openflow-gdrive-update-ip

---


# OpenFlow Google Drive — Update IP

Use when nipyapi returns 401 after a successful PAT rotation — indicates the machine's IP is not in the network rule.

## When to Load

Parent SKILL.md routes here on: "moved networks", "conference wifi", "hotel wifi", "IP changed", "update IP", "blocked"

## Workflow

### Step 1: Resolve Config and Detect Current IP

```bash
eval $(python3 -c "
import tomllib, os
m = tomllib.load(open('.sfutils/manifest.toml', 'rb'))
s = m.get('snowflake', {})
o = m.get('openflow', {})
print(f'CONNECTION={s.get(\"connection\", os.environ.get(\"SNOWFLAKE_DEFAULT_CONNECTION_NAME\", \"\"))}')
print(f'NETWORK_RULE={o.get(\"network_rule\", os.environ.get(\"OPENFLOW_NETWORK_RULE\", \"\"))}')
")
curl -s ifconfig.me && echo ""
```

Store IP as `<CURRENT_IP>`.

### Step 2: Show Current Network Rule

```bash
snow sql -q "DESCRIBE NETWORK RULE $NETWORK_RULE" -c $CONNECTION --format json
```

### Step 3: Confirm Before Updating

Present:
```
Current IP:    <CURRENT_IP>
Network rule:  $NETWORK_RULE

This will REPLACE the existing IP allowlist with your current IP.
Proceed? (yes / no)
```

**⚠️ MANDATORY STOP** — wait for explicit confirmation.

### Step 4: Update Network Rule

```bash
snow sql -q "CREATE OR REPLACE NETWORK RULE $NETWORK_RULE \
  TYPE = IPV4 \
  MODE = INGRESS \
  VALUE_LIST = ('<CURRENT_IP>/32') \
  COMMENT = 'Updated by openflow-gdrive-demo skill'" \
  -c $CONNECTION
```

### Step 5: Rotate PAT

**STOP. Invoke `$sfutils:programmatic-access-token` to rotate the PAT** for the service user in manifest `[pat.openflow-runner].sa_user`.

Tell the skill to rotate (not create new) -- it will update the keychain and manifest.

Do NOT write PAT SQL manually.

### Step 6: Verify

```bash
eval $(python3 -c "
import tomllib
m = tomllib.load(open('.sfutils/manifest.toml', 'rb'))
rt = m.get('openflow', {}).get('runtime', {})
print(f'PROFILE={rt.get(\"nipyapi_profile\", \"\")}')
")
nipyapi --profile $PROFILE canvas get_root_pg_id
```

## Stopping Points

- ✋ Step 3: Before replacing network rule — always confirm

## Output

```
Network updated!
  New IP:       <CURRENT_IP>
  Network rule: $NETWORK_RULE — updated
  PAT:          rotated
  nipyapi:      connected ✓
```