Review documentation for IAM policy protocol buffers messages [323813650]

Assigned

Bug

Status Update

No update yet.

Description

[Deleted User]

created issue #1

Feb 5, 2024 08:50PM

This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered: IAM Policy is incorrect described in the JSON API documentation as 'access control policy'. There is no such thing. Worse, it could give the reader the impression that they are setting an ACL

What you expected to happen: Describe policy as either 'IAM Policy' or 'IAM allow policy'

Steps to reproduce: Visit

https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings/setIamPolicy

Other information (workarounds you have tried, documentation consulted, etc):

Comments

ba...@google.com <ba...@google.com> Feb 6, 2024 03:40AM

Assigned to ma...@google.com.

ma...@google.com <ma...@google.com> #2Feb 6, 2024 10:24AM

Hello,

Thanks for reaching out to us!

The Product Engineering Team has been made aware of your feature request, and will address it in due course. Though we can't provide an ETA on feature requests nor guarantee their implementation, rest assured that your feedback is always taken very seriously, as it allows us to improve our products. Thank you for your trust and continued support to improve Google Cloud Platform products.

In case you want to report a new issue, please do not hesitate to create a new [Issue Tracker] 1 thread describing your issue. Once again, thank you for the suggestions.

Thanks and Regards,
Onkar Mhetre
Google Cloud Support

[Deleted User] <[Deleted User]> #3Feb 6, 2024 05:41PM

Specifically, this happened to us. We have a GKE cluster with two similarly-sized node pools. One has E2 nodes and the other has C2D nodes. We wanted to temporarily double the size of our E2 nodepool and checked the quotas page first. The only quota in the entire GCP project that was above 20% was "CPUs" at 55%. We reasoned that since only half of our machines were in the nodepool we wanted to double, this would only raise us to around 80-85% of quota, which seemed safe for a temporary change. We were surprised to see our scale-up fail due to quota. (And then we clumsily tried to quickly scale down to get below quota using direct GCE ASG scaling rather than GKE autoscaler, which ended up deleting a bunch of our more active machines instead of the empty ones — perhaps user error, but a bigger impact than we had expected for what we thought was going to be a simple "scale up fast, let it scale down slowly once our temporary need was over".)

Had the human-readable label in the UI said "E2 and N1 CPUs" instead of "CPUs" we would not have made that mistake: we would have tried for a smaller scale-up or requested more quota first.

I assume that the "internal"/computer-readable name `CPUS` is unlikely to change for compatibility reasons, but hopefully the UI display name is less hardcoded?

bd...@google.com <bd...@google.com> #4Feb 6, 2024 07:17PM

The language in question comes from IAM's protocol buffers documentation (link); up to IAM if they would like to make a change here.

IAM policies are a kind of hierarchized ACL, so I don't think the current language is wrong, but perhaps it could be more precise.

[Deleted User] <[Deleted User]> #5Feb 6, 2024 07:43PM

Thanks. I'm highlighting how frustrating this imprecision is with Google
documentation because it furthers misunderstanding. Using the proper noun
"IAM Policy" should be preferred with referencing IAM policy in lieu of the
casual reference "access control policy" because the latter gives the
impression that's what is called and somehow related to ACLs (only
applicable to storage and BQ)., which they are not.
I deal with this every day and can tell you, people don't understand the
difference :)

[image: Screenshot 2024-02-06 at 1.36.54 PM.png]

On Tue, Feb 6, 2024 at 1:17 PM <buganizer-system@google.com> wrote:

- Show quoted text -

ma...@google.com <ma...@google.com> #6Feb 7, 2024 08:04AM

Hello,

Thank you for reaching out to us with your request.

We have duly noted your feedback and will thoroughly validate it. While we cannot provide an estimated time of implementation or guarantee the fulfillment of the issue, please be assured that your input is highly valued. Your feedback enables us to enhance our products and services.

We appreciate your continued trust and support in improving our Google Cloud Platform products. In case you want to report a new issue, Please do not hesitate to create a new issue on the Issue Tracker providing a detailed description of your issue.

Once again, we sincerely appreciate your valuable feedback; Thank you for your understanding and collaboration.

ma...@google.com <ma...@google.com> Feb 7, 2024 11:55AM

Reassigned to gc...@google.com.