Connect to a Git repository over a private network¶

Configure the private link connection¶

Before you can configure Snowflake for access to the remote Git repository, you must set up a private link between Snowflake and your cloud service provider.

To apply configuration changes to both Snowflake and your infrastructure, follow these steps:

1. In your cloud service provider, create a private link service to receive requests from the Snowflake private endpoint service.

   For details, see the knowledge base article Configuring Git Integration with Snowflake over Private Link.

2. In Snowflake, provision a private endpoint that will reach your infrastructure through a private IP.

   To provision the endpoint, use the SYSTEM$PROVISION_PRIVATELINK_ENDPOINT function with the following two arguments:

   • Your cloud provider’s private link service ID

   • Your Git server’s domain name

   AWSAzureGoogle Cloud

   CopyExpand

   SELECT SYSTEM$PROVISION_PRIVATELINK_ENDPOINT(
     'com.amazonaws.vpce.us-west-2.vpce-svc-xxx', // VPC Endpoint Service Name
     'git_address.com' // Git server domain
   );
   

   Show lessSee more

   Scroll to top

3. In your cloud service provider, accept the Snowflake private endpoint setup to finish setting up the private link connection.

4. To check status of the provisioning, call the SYSTEM$GET_PRIVATELINK_ENDPOINTS_INFO system function.

Configure Snowflake access to the remote Git repository¶

After you set up a private link between Snowflake and your cloud service provider, you can configure Snowflake access to the remote Git repository.

1. Create an API integration that supports authenticating with a certificate.

   Because Snowflake will reach your Git server using the HTTPS protocol, the domain name needs to have a valid certificate. The configuration you use differs depending on whether you use a self-signed certificate or a certificate signed by a certificate authority.

   • Using a self-signed certificate:

     

     1. Provide credentials in a generic string secret.

        This should be a public key of a self-signed domain to establish an HTTPS connection. To provide to Snowflake the credentials it will use to authenticate with the server, create a secret that contains the following details:

        • A TYPE parameter value of GENERIC_STRING

        • A public certificate string as the value of the SECRET_STRING parameter

          For the parameter’s value, specify a secret string, such as a public certificate body.

        CopyExpand

        CREATE OR REPLACE SECRET my_public_certificate
          TYPE = GENERIC_STRING
          SECRET_STRING = '-----BEGIN CERTIFICATE-----
                    <certificate_body>
                    -----END CERTIFICATE-----';
        

        Show lessSee more

        Scroll to top

     2. Create an API integration to integrate with the Git API, and specify the following details:

        • An API_PROVIDER parameter set to git_https_api

        • An API_ALLOWED_PREFIXES set to the base URL beneath which access is allowed

        • A USE_PRIVATELINK_ENDPOINT parameter set to TRUE

        • A TLS_TRUSTED_CERTIFICATES parameter set to the name of the secret you created, which contains the certificate

        For more information, see CREATE API INTEGRATION.

        CopyExpand

        CREATE OR REPLACE API INTEGRATION my_git_api_integration
          API_PROVIDER = git_https_api
          API_ALLOWED_PREFIXES = ('https://example.com/my-account')
          ALLOWED_AUTHENTICATION_SECRETS = ALL
          USE_PRIVATELINK_ENDPOINT = TRUE
          TLS_TRUSTED_CERTIFICATES = (my_public_certificate)
          ENABLED = TRUE;
        

        Show lessSee more

        Scroll to top

   • Using a certificate signed by a certificate authority:

     

     1. Create an API integration to integrate with the Git API, and specify the following details:

        • An API_PROVIDER parameter set to git_https_api

        • An API_ALLOWED_PREFIXES set to the base URL beneath which access is allowed

        • A USE_PRIVATELINK_ENDPOINT parameter set to TRUE

        • A TLS_TRUSTED_CERTIFICATES parameter set to the name of the secret you created, which contains the certificate

        For more information, see CREATE API INTEGRATION.

        CopyExpand

        CREATE OR REPLACE API INTEGRATION my_git_api_integration
          API_PROVIDER = git_https_api
          API_ALLOWED_PREFIXES = ('https://example.com/my-account')
          ALLOWED_AUTHENTICATION_SECRETS = ALL
          USE_PRIVATELINK_ENDPOINT = TRUE
          ENABLED = TRUE;
        

        Show lessSee more

        Scroll to top

2. Provide credentials in a basic authentication secret.

   After successfully connecting to the Git server over private link, you must still authenticate with the repository by creating another secret that provides credentials for the repository.

   To provide the credentials that Snowflake uses to authenticate with the repository, create a secret that contains the following:

   • A TYPE value of password

   • A username and token, such as a personal access token (PAT)

     Note

     For information about creating a personal access token in GitHub, see Managing your personal access tokens in the GitHub documentation.

   For more information on the SQL command for creating a secret, see the CREATE SECRET.

3. Create a Git repository clone as described in Create a Snowflake Git repository clone.

Create a Snowflake Git repository clone¶

After you configure Snowflake for access to your remote repository, create a Git repository clone in Snowflake to contain files fetched from the remote repository.

A Git repository clone in Snowflake specifies the following details:

• The remote repository’s origin

  In Git, origin is the remote repository’s URL. Use that URL when setting up Snowflake to use a remote Git repository. The URL must use HTTPS. For example, you can retrieve the origin URL in the following ways:

  • In the GitHub user interface, you can get the origin URL from the repository home page. Select the Code button, and then copy the HTTPS URL from the box displayed beneath the button.

  • From the command line, use the git config command from within your local repository, as in the following example:

    CopyExpand

    $ git config --get remote.origin.url
    

    Show lessSee more

    Scroll to top

    The command produces output such as the following:

    Expand

    https://github.com/my-account/snowflake-extensions.git
    

    Show lessSee more

    Scroll to top

    For reference information about git config, see the git documentation.

• Credentials, if needed, for Snowflake to use when authenticating with the repository

  For the GIT_CREDENTIALS parameter, specify a Snowflake secret you created.

• An API integration specifying details for Snowflake interaction with the repository API

You can create a Git repository clone by using either Snowsight or SQL.

USE ROLE ACCOUNTADMIN;
GRANT CREATE GIT REPOSITORY ON SCHEMA myco_db.integrations TO ROLE myco_git_admin;
GRANT USAGE ON INTEGRATION my_git_api_integration TO ROLE myco_git_admin;
GRANT USAGE ON SECRET db.schema.my_git_secret TO ROLE myco_git_admin;

USE ROLE myco_git_admin;

CREATE OR REPLACE GIT REPOSITORY snowflake_extensions
  API_INTEGRATION = my_git_api_integration
  GIT_CREDENTIALS = my_git_secret
  ORIGIN = 'https://github.com/my-account/snowflake-extensions.git';