creds | Simple local encrypted credential management with GPG | Command Line Interface library

Invalid service account credentials

Normally means that the key fine you are using is invalid. You need to create a service account key file.

If you open the json key file it should look something like this

You would need to create server-scoped credential to allow access to storage files.

Server-scoped credential

These are used when SQL login calls OPENROWSET function without DATA_SOURCE to read files on some storage account. The name of server-scoped credential must match the base URL of Azure storage (optionally followed by a container name). However, SQL users can't use Azure AD authentication to access storage and serverless SQL pool doesn't return subfolders unless you specify /** at the end of path.

You are a little confused here lets start by looking at the difference between authentication and authorization.

Authentication or Open Id connect is signin your letting a user signin to their google account and you get an id token back and you are able to access their profile information because the user signed in. You are authentication that the user who is behind the machine owns the account. In your code see the id_token you are using Open id connect to authentication the user.

This issue is caused by Azure CLI version 2.30.0 which seemed to be rolled out MS hosted agents recently.

Hence I adapted all my Python scripts running on (MS and self) hosted agents to this model:

Not a kube user but you can try:

As it turns out, it only takes a simple setup in the config on the backend side as per How to enable CORS in flask

Thanks @mplungjan for your help!

It looks like there was an issue with the Azure CLI versions installed on the workers.

According to the GH issue, this has been resolved now and shouldn't occur in the future anymore: https://github.com/Azure/cli/issues/56#issuecomment-965186851

Released a long term fix for any further mismatch issues. Now the default value for azcliversion dynamically points to the version installed on agent. So there will be no mismatch again unless someone explicitly mentions latest. If for some reason there is no version of az cli on the agent then action fall backs to latest.

Most of the hosted agents are also updated to 2.30.0.

Please test your scenarios and let us know if you face any more issues.

About your following goal,

This problem, in my opinion, is different from merely filtering the spreadsheet based on a column value, as described here. I want to fetch only those rows of a spreadsheet that are not hidden. The default API call to fetch content of a spreadsheet (see my code above) fetches all the rows, even those that have manually been hidden and hence are not visible for people opening the spreadsheet via a link.

My sample script retrieves the showing rows from the sheet with the hidden rows using Query Language. So, about I want to fetch only those rows of a spreadsheet that are not hidden., this can be achieved by the sample script. From The default API call to fetch content of a spreadsheet (see my code above) fetches all the rows, even those that have manually been hidden and hence are not visible for people opening the spreadsheet via a link., I thought that you have tried to use Sheets API. In this case, all rows are retrieved even when the hidded rows are existing.

And from read them into a pandas dataframe., I thought that your goal can be achieved by modifying the sample script of this answer.

So, in order to achieve your goal, the sample script is as follows.

You need to publish your app to production in order to remove the 7 days limitation.

In APIs & Services / Oauth consent screen:

From google documentation about refresh token expiration:

A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days.

Also about Testing publishing status:

Projects configured with a publishing status of Testing are limited to up to 100 test users listed in the OAuth consent screen. A test user consumes a project's test user quota once added to the project.

Google will display a warning message before allowing a specified test user to authorize scopes requested by your project's OAuth clients. The warning message confirms the user has test access to your project but should consider the risks associated with granting access to their data to an unverified app.

Authorizations by a test user will expire seven days from the time of consent. If your OAuth client requests an offline access type and receives a refresh token, that token will also expire.

A Brand Account may authorize scopes requested by your project's OAuth clients if a specified test user manages the Brand Account.

A test user may be unable to authorize scopes requested by your project's OAuth clients due to the availability of Google Services for the account or configured restrictions. A Google Workspace may control which third-party apps access its data or an account enrolled in Advanced Protection may block most non-Google apps.