Proposal: IAM Meta Interface #2031

elibixby · 2016-07-27T23:59:35Z

Definition of an IAM meta interface to be used for resources which have implemented the IAM meta api

elibixby · 2016-07-28T00:02:38Z

Note: I left the contributor usage section blank because I want to (try to) avoid thinking about it until the user interface is solid.

dhermes · 2016-07-28T00:11:54Z

Nit: rename as iam-usage.rst

docs/iam.rst

+Using IAM For Users
+===================
+
+This document does not explain how Google Cloud IAM works, for that, please check out `the docs <https://cloud.google.com/iam/docs/>`_.


googlebot · 2016-07-28T00:31:59Z

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for the commit author(s). If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.

googlebot · 2016-07-28T00:35:07Z

CLAs look good, thanks!

docs/iam-usage.rst

+Policy Editing Methods
+----------------------
+
+>>> resource.add_roles(iam.user('alice@example.com'), iam.roles.OWNER.name, iam.roles.EDITOR.name)


daspecster · 2016-07-28T22:27:50Z

This is going to be really awesome! Thanks for your work @elibixby!

elibixby · 2016-08-10T18:44:56Z

I can push a skeleton implementation if someone gives this surface the thumbs up...

elibixby · 2016-08-16T18:35:34Z

@daspecster Ping on this? Does this seem like a reasonable surface?

docs/iam-usage.rst

+
+``set_policy`` takes a policy dictionary, as well as optional ``version`` and ``etag`` paramters. If updates are made to your policy during this change, they will be overwritten with exactly what is in your policy, or, if an etag is specified they will fail with a ``iam.ConcurrentModificationError``. ``iam.PolicyChange`` performs this "read-modify-write" cycle automatically for the user.
+
+>>> policy['roles/owner'].add('user:charles@example.com')


docs/iam-usage.rst

+~~~~~~~
+An IAM member is one of the following:
+
+- ``iam.user(email)`` an individual Google account


elibixby · 2016-08-25T17:42:13Z

@dhermes On talking with @jonparrott I think I'm going to scale back the initial pull request to just get_policy and set_policy (as well as the ancillary member and Role stuff). Then we can discuss additional sugar in future pull requests.

I think get_policy and set_policy returning the policy, version, etag , and policy being a dict of sets is enough of a usability improvement that it's worth rolling out to the supporting APIs first.

The interface for contributors depends on the implementation details, which I will (try to) avoid thinking about until after the user interface has solidified fixed all caps Alternate usage of PolicyChange Typo and note fix Yet another typo iam.rst -> iam-usage.rst Parentheses are annoying PolicyChange and *_members same si Roles in iam instead of Resource 1. This is a bit of future proofing. Right now there is a Role resource https://cloud.google.com/iam/reference/rest/v1/roles/queryGrantableRoles#Role That defines a role, but can only be listed as roles are only curated right now. In the future this will be a fully fledged resource with users able to define custom roles, and I anticipate them needing a resource class of their own. Hence wrapping the enumeration of curated roles in this resource (and needing a .name) 2. The same role can be used across multiple resources, and because of custom roles there's no sense in adding any "sanity check" code to the mapping between resources and roles. We'll let the IAM API take care of this for us, and so just move IAM Curated Roles into the central iam module. Add misc methods remove_fn as seperate function Added clarification of failure Exception Also note about retry kwarg Add version kwarg Also, make clear that PolicyChange stores state Sequences instead of *args misc methods on resource not in iam Reworked into "Resources" and "Methods" sections Formatting errors Remove sugar Replace gcloud with python

docs/iam-usage.rst

+  e.g:
+  >>> from gcloud import pubsub
+  >>> client = pubsub.Client()
+  >>> resource = client.Topic('my-topic')


theacodes · 2016-08-26T19:40:48Z

@elibixby the smaller surface is looking way easier to swallow.

docs/iam-usage.rst

+``set_policy`` takes one positional, and three keyword arguments:
+
+- The first argument is a policy dictionary, described above.
+- ``version`` is an optional integer. If ommited the version of the policy will be set to 0


ncouture · 2017-01-01T19:12:06Z

@elibixby can I help you with this PR?

Last update was in August and looking at the discussion it seems like there are only small fixes in the documentation that remains to be fixed.

Can someone confirm the state of this PR, or of general IAM functionality for this project?

elibixby · 2017-03-22T21:20:27Z

@ncouture This PR was ready for review and merge... It was only a proposal and I wanted confirmation on the surface before I went ahead an implemented since I have had really poor review experiences on this repo before. However it looks like it was neglected for long enough they ignored it and did their own thing.

googlebot added the cla: yes This human has signed the Contributor License Agreement. label Jul 27, 2016

elibixby mentioned this pull request Jul 28, 2016

Plan To Implement: IAM Mixin for resources to provide idempotent policy updates #2030

Closed

dhermes reviewed Jul 28, 2016
View reviewed changes

docs/iam.rst

Using IAM For Users

===================

This document does not explain how Google Cloud IAM works, for that, please check out `the docs <https://cloud.google.com/iam/docs/>`_.

This comment was marked as spam.

Sign in to view

googlebot added cla: no This human has *not* signed the Contributor License Agreement. and removed cla: yes This human has signed the Contributor License Agreement. labels Jul 28, 2016

elibixby force-pushed the iam branch 2 times, most recently from 7e40029 to 7429c6c Compare July 28, 2016 00:35

googlebot added cla: yes This human has signed the Contributor License Agreement. and removed cla: no This human has *not* signed the Contributor License Agreement. labels Jul 28, 2016

theacodes reviewed Jul 28, 2016
View reviewed changes

dhermes reviewed Aug 23, 2016
View reviewed changes

elibixby mentioned this pull request Aug 24, 2016

Duplicate code between resource classes #2186

Closed

theacodes reviewed Aug 25, 2016
View reviewed changes

docs/iam-usage.rst

~~~~~~~

An IAM member is one of the following:

- ``iam.user(email)`` an individual Google account

This comment was marked as spam.

Sign in to view

elibixby force-pushed the iam branch 2 times, most recently from caf020b to 243ba02 Compare August 25, 2016 19:01

elibixby force-pushed the iam branch from 243ba02 to fae868d Compare August 25, 2016 19:02

Duplicate note from rebase

5b86c24

theacodes reviewed Aug 26, 2016
View reviewed changes

docs/iam-usage.rst

e.g:

>>> from gcloud import pubsub

>>> client = pubsub.Client()

>>> resource = client.Topic('my-topic')

This comment was marked as spam.

Sign in to view

waprin reviewed Aug 26, 2016
View reviewed changes

ncouture mentioned this pull request Jan 1, 2017

Add IAM support to APIs which support it #1679

Closed

6 tasks

elibixby mentioned this pull request Mar 22, 2017

Factor common IAM policy bits into 'google.cloud.iam'. #3188

Merged

lukesneeringer closed this Apr 19, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Proposal: IAM Meta Interface #2031

Proposal: IAM Meta Interface #2031

elibixby commented Jul 27, 2016

elibixby commented Jul 28, 2016

dhermes commented Jul 28, 2016

This comment was marked as spam.

googlebot commented Jul 28, 2016

googlebot commented Jul 28, 2016

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

daspecster commented Jul 28, 2016

elibixby commented Aug 10, 2016

elibixby commented Aug 16, 2016

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

elibixby commented Aug 25, 2016

This comment was marked as spam.

theacodes commented Aug 26, 2016

This comment was marked as spam.

This comment was marked as spam.

ncouture commented Jan 1, 2017

elibixby commented Mar 22, 2017


		``set_policy`` takes a policy dictionary, as well as optional ``version`` and ``etag`` paramters. If updates are made to your policy during this change, they will be overwritten with exactly what is in your policy, or, if an etag is specified they will fail with a ``iam.ConcurrentModificationError``. ``iam.PolicyChange`` performs this "read-modify-write" cycle automatically for the user.

		>>> policy['roles/owner'].add('user:charles@example.com')

Proposal: IAM Meta Interface #2031

Proposal: IAM Meta Interface #2031

Conversation

elibixby commented Jul 27, 2016

elibixby commented Jul 28, 2016

dhermes commented Jul 28, 2016

This comment was marked as spam.

googlebot commented Jul 28, 2016

googlebot commented Jul 28, 2016

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

daspecster commented Jul 28, 2016

elibixby commented Aug 10, 2016

elibixby commented Aug 16, 2016

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

elibixby commented Aug 25, 2016

This comment was marked as spam.

theacodes commented Aug 26, 2016

This comment was marked as spam.

This comment was marked as spam.

ncouture commented Jan 1, 2017

elibixby commented Mar 22, 2017