what I mean by "Scheduled task" is a task scheduled via Google Cloud Scheduler. Actually it's a little more involved.
FIRST, you need logic that tells Apigee to create a debugsession. This will be a bash script, or a Python script, or a nodejs app, or a Windows powershell script, etc. Your choice. And inside the script, you're just invoking the Apigee API to create a debugsession. (doc here) Pseudo code example:
POST :apigee/v1/organizations/:org/environments/:env/apis/:api/revisions/:rev/debugsessions
Authorization: Bearer :token
content-type: application/json
{
"filter": "response.status.code = 502",
"timeout": "600"
}
SECOND, You need to put that logic somewhere. That will be Cloud Run. With the gcloud command line tool, you can create a Cloud Run job from a source directory, Cloud Run will know what to do with it. Do this like so:
PROJECT_ID=my-google-cloud-project-that-will-run-the-job
gcloud config set core/project $PROJECT_ID
JOB_NAME=debugsession-creation-job
JOB_SERVICE_ACCOUNT=${JOB_NAME}-sa
# create a job-specific service account
gcloud iam service-accounts create ${JOB_SERVICE_ACCOUNT}
JOB_SA_EMAIL=${JOB_SERVICE_ACCOUNT}@${PROJECT_ID}.iam.gserviceaccount.com
# Add Environment Admin role to the SA, to allow it to create a debug session.
# Can also use a custom role; the required permission is
# apigee.tracesessions.create .
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
--member="serviceAccount:${JOB_SA_EMAIL}" \
--role="roles/apigee.environmentAdmin"
# add SA user to yourself, to allow creation of the cloud run job which acts
# as this SA. If you have Editor or Owner role in the project, you already
# have the required permission.
MY_USER=me@example.com
gcloud iam service-accounts add-iam-policy-binding ${JOB_SA_EMAIL} \
--member user:${MY_USER} \
--role "roles/iam.serviceAccountUser"
# create the job that runs with that service account
REGION=us-west1
gcloud run jobs deploy ${JOB_NAME} \
--source . \
--tasks 1 \
--max-retries 3 \
--region ${REGION} \
--project=${PROJECT_ID} \
--service-account ${JOB_SA_EMAIL}
Ok that creates a job that runs in the cloud, from your source code. When that job runs, Apigee will create the debugsession, and will begin collecting debug data for transactions, just as if you created it within the UI. Then Apigee will retain the session data for 24 hours. So later, you can sign in to the Admin console and view the debugsession for that particular proxy.
THIRD, you want to tell Google Cloud to run that job every day, just before midnight. For that you configure Google Cloud Scheduler using the HTTP target type. It will send out a HTTP GET or POST request, to a URL that you designate. In your case, the URL will be a special URL that triggers your Cloud Run job, and you will set the schedule to be "every day at 23:56" or similar. (You can use Cron Guru to figure out how to set the schedule.) Setting this up looks like so:
SCHEDULER_JOB_NAME=debugsession-job-trigger
# create service account for the scheduler
SCHEDULER_SERVICE_ACCOUNT="${SCHEDULER_JOB_NAME}-sa"
gcloud iam service-accounts create ${SCHEDULER_SERVICE_ACCOUNT}
SCHEDULER_SA_EMAIL=${SCHEDULER_SERVICE_ACCOUNT}@${PROJECT_ID}.iam.gserviceaccount.com
# grant it rights to invoke your Cloud Run job
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
--member="serviceAccount:${SCHEDULER_SA_EMAIL}" \
--role="roles/run.invoker"
# every day, at 23:56
SCHEDULE="56 23 * * *"
gcloud scheduler jobs create http ${SCHEDULER_JOB_NAME} \
--location ${REGION} \
--schedule="${SCHEDULE}" \
--uri="https://${REGION}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${PROJECT_ID}/jobs/${JOB_NAME}:run" \
--http-method POST \
--oauth-service-account-email ${SCHEDULER_SA_EMAIL}
The only trick here is ... how do you get the token to use within your Cloud Run job.... the token that gets sent to apigee.googleapis.com in the request to create a debug session. Actually it's very simple. If you followed the instructions above, you configured the Cloud Run job to run as a particular Service Account. And we added the Environment Admin role to that SA. To get a token for that service account from within a cloud run job, you can just invoke a particular endpoint from within your cloud run logic:
curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token \
-H "Metadata-Flavor:Google"
Of course, substitute something else for curl if you are using Java or nodejs or Python, etc. The point is, just send a GET to that URL (with the required header). The response will be a JSON payload with an access_token field. Extract that, then insert it into the request I showed above, to create a debug session.
Whew.
It sounds a little involved, but it's really just 2 pieces: a Cloud Run job that invokes the Apigee API to create a debugsession, and a scheduler job to trigger the cloud run job on a repeated schedule. The other stuff is just service accounts that allow you to do this securely, without storing secrets in the source code for your Cloud Run job.
To tear it all down,
gcloud scheduler jobs delete ${SCHEDULER_JOB_NAME} --location ${REGION}
gcloud iam service-accounts delete ${SCHEDULER_SERVICE_ACCOUNT}
gcloud run jobs delete ${JOB_NAME}
gcloud iam service-accounts delete ${JOB_SERVICE_ACCOUNT}
By the way, this is all really cheap. Cloud Run and Scheduler have free tiers, so probably you will not be charged anything for using this.
LinkedIn
Twitter
