Class: Gcloud::ResourceManager::Policy

Inherits:
Object
  • Object
show all
Defined in:
lib/gcloud/resource_manager/policy.rb

Overview

# Policy

Represents a Cloud IAM Policy for the Resource Manager service.

A common pattern for updating a resource’s metadata, such as its Policy, is to read the current data from the service, update the data locally, and then send the modified data for writing. This pattern may result in a conflict if two or more processes attempt the sequence simultaneously. IAM solves this problem with the #etag property, which is used to verify whether the policy has changed since the last request. When you make a request to with an ‘etag` value, Cloud IAM compares the `etag` value in the request with the existing `etag` value associated with the policy. It writes the policy only if the `etag` values match.

When you update a policy, first read the policy (and its current ‘etag`) from the service, then modify the policy locally, and then write the modified policy to the service. See Gcloud::ResourceManager::Project#policy and Gcloud::ResourceManager::Project#policy=.

Examples:

require "gcloud"

gcloud = Gcloud.new
resource_manager = gcloud.resource_manager
project = resource_manager.project "tokyo-rain-123"

policy = project.policy # API call

policy.remove "roles/owner", "user:[email protected]" # Local call
policy.add "roles/owner", "user:[email protected]" # Local call
policy.roles["roles/viewer"] = ["allUsers"] # Local call

project.policy = policy # API call

See Also:

Constant Summary collapse

API =

Alias to the Google Client API module

Google::Apis::CloudresourcemanagerV1

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(etag, roles) ⇒ Policy

Returns a new instance of Policy.



81
82
83
84
 
# File 'lib/gcloud/resource_manager/policy.rb', line 81

def initialize etag, roles
  @etag = etag
  @roles = roles
end

Instance Attribute Details

#etag ⇒ String

Used to verify whether the policy has changed since the last request. The policy will be written only if the ‘etag` values match.

Returns:

  • (String) —

    the current value of etag



72
73
74
 
# File 'lib/gcloud/resource_manager/policy.rb', line 72

def etag
  @etag
end

#roles ⇒ Hash{String => Array<String>}

The bindings that associate roles with an array of members. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/resource-manager/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Returns:

  • (Hash{String => Array<String>}) —

    the current value of roles



72
73
74
 
# File 'lib/gcloud/resource_manager/policy.rb', line 72

def roles
  @roles
end

Class Method Details

.from_gapi(gapi) ⇒ Object

Google::Apis::CloudresourcemanagerV1::Policy object.



203
204
205
206
207
208
 
# File 'lib/gcloud/resource_manager/policy.rb', line 203

def self.from_gapi gapi
  roles = gapi.bindings.each_with_object({}) do |binding, memo|
    memo[binding.role] = binding.members.to_a
  end
  new gapi.etag, roles
end

Instance Method Details

#add(role_name, member) ⇒ Object

Convenience method for adding a member to a binding on this policy. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/resource-manager/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Examples:

require "gcloud"

gcloud = Gcloud.new
resource_manager = gcloud.resource_manager
project = resource_manager.project "tokyo-rain-123"

policy = project.policy # API call

policy.add "roles/owner", "user:[email protected]" # Local call

project.policy = policy # API call

Parameters:

  • role_name (String) —

    A Cloud IAM role, such as ‘“roles/owner”`.

  • member (String) —

    A Cloud IAM identity, such as ‘“user:[email protected]”`.



111
112
113
 
# File 'lib/gcloud/resource_manager/policy.rb', line 111

def add role_name, member
  role(role_name) << member
end

#deep_dup ⇒ Policy

Returns a deep copy of the policy.

Returns:



175
176
177
178
179
180
181
182
 
# File 'lib/gcloud/resource_manager/policy.rb', line 175

def deep_dup
  dup.tap do |p|
    roles_dup = p.roles.each_with_object({}) do |(k, v), memo|
      memo[k] = v.dup rescue value
    end
    p.instance_variable_set "@roles", roles_dup
  end
end

#remove(role_name, member) ⇒ Object

Convenience method for removing a member from a binding on this policy. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/resource-manager/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Examples:

require "gcloud"

gcloud = Gcloud.new
resource_manager = gcloud.resource_manager
project = resource_manager.project "tokyo-rain-123"

policy = project.policy # API call

policy.remove "roles/owner", "user:[email protected]" # Local call

project.policy = policy # API call

Parameters:

  • role_name (String) —

    A Cloud IAM role, such as ‘“roles/owner”`.

  • member (String) —

    A Cloud IAM identity, such as ‘“user:[email protected]”`.



140
141
142
 
# File 'lib/gcloud/resource_manager/policy.rb', line 140

def remove role_name, member
  role(role_name).delete member
end

#role(role_name) ⇒ Array<String>

Convenience method returning the array of members bound to a role in this policy, or an empty array if no value is present for the role in #roles. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/resource-manager/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Examples:

require "gcloud"

gcloud = Gcloud.new
resource_manager = gcloud.resource_manager
project = resource_manager.project "tokyo-rain-123"

policy = project.policy

policy.role("roles/viewer") << "user:[email protected]"

Returns:

  • (Array<String>) —

    The members strings, or an empty array.



166
167
168
 
# File 'lib/gcloud/resource_manager/policy.rb', line 166

def role role_name
  roles[role_name] ||= []
end

#to_gapi ⇒ Object

Google::Apis::CloudresourcemanagerV1::Policy.



187
188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/gcloud/resource_manager/policy.rb', line 187

def to_gapi
  API::Policy.new(
    etag: etag,
    bindings: roles.keys.map do |role_name|
      next if roles[role_name].empty?
      API::Binding.new(
        role: role_name,
        members: roles[role_name]
      )
    end
  )
end