Skip to content

Commit 254e61a

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
docs: add caution messages for container runnable username and password fields
--- docs: refine proto comment for run_as_non_root PiperOrigin-RevId: 608664745
1 parent 5ff3e52 commit 254e61a

4 files changed

Lines changed: 47 additions & 16 deletions

File tree

‎google/cloud/batch/v1alpha/batch_v1alpha.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ types:
1212
- name: google.cloud.batch.v1alpha.OperationMetadata
1313

1414
documentation:
15-
summary: An API to manage the running of batch jobs on Google Cloud Platform.
15+
summary: An API to manage the running of batch resources on Google Cloud Platform.
1616
overview: '(include == google/cloud/batch/doc/overview.md ==)'
1717
rules:
1818
- selector: google.cloud.location.Locations.GetLocation

‎google/cloud/batch/v1alpha/batch_v1alpha_grpc_service_config.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33
"name": [
44
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "ListJobs" },
55
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "ListTasks" },
6+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "ListResourceAllowances" },
67
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "GetJob" },
7-
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "GetTask" }
8+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "GetTask" },
9+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "GetResourceAllowance" }
810
],
911
"timeout": "60s",
1012
"retryPolicy": {
@@ -19,7 +21,10 @@
1921
"name": [
2022
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "CreateJob" },
2123
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "DeleteJob" },
22-
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "CancelJob"}
24+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "CancelJob"},
25+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "CreateResourceAllowance" },
26+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "DeleteResourceAllowance" },
27+
{ "service": "google.cloud.batch.v1alpha.BatchService", "method": "UpdateResourceAllowance"}
2328
],
2429
"timeout": "60s"
2530
}]

‎google/cloud/batch/v1alpha/job.proto‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -698,17 +698,18 @@ message TaskGroup {
698698

699699
// When true, Batch will populate a file with a list of all VMs assigned to
700700
// the TaskGroup and set the BATCH_HOSTS_FILE environment variable to the path
701-
// of that file. Defaults to false.
701+
// of that file. Defaults to false. The host file supports up to 1000 VMs.
702702
bool require_hosts_file = 11;
703703

704704
// When true, Batch will configure SSH to allow passwordless login between
705705
// VMs running the Batch tasks in the same TaskGroup.
706706
bool permissive_ssh = 12;
707707

708-
// Optional. If not set or set to false, Batch will use root user to execute
709-
// runnables. If set to true, Batch will make sure to run the runnables using
710-
// non-root user. Currently, the non-root user Batch used is generated by OS
711-
// login. Reference: https://cloud.google.com/compute/docs/oslogin
708+
// Optional. If not set or set to false, Batch uses the root user to execute
709+
// runnables. If set to true, Batch runs the runnables using a non-root user.
710+
// Currently, the non-root user Batch used is generated by OS Login. For more
711+
// information, see [About OS
712+
// Login](https://cloud.google.com/compute/docs/oslogin).
712713
bool run_as_non_root = 14 [(google.api.field_behavior) = OPTIONAL];
713714
}
714715

‎google/cloud/batch/v1alpha/task.proto‎

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -198,14 +198,39 @@ message Runnable {
198198
// `container.options` field.
199199
bool block_external_network = 9;
200200

201-
// Optional username for logging in to a docker registry. If username
202-
// matches `projects/*/secrets/*/versions/*` then Batch will read the
203-
// username from the Secret Manager.
201+
// Required if the container image is from a private Docker registry. The
202+
// username to login to the Docker registry that contains the image.
203+
//
204+
// You can either specify the username directly by using plain text or
205+
// specify an encrypted username by using a Secret Manager secret:
206+
// `projects/*/secrets/*/versions/*`. However, using a secret is
207+
// recommended for enhanced security.
208+
//
209+
// Caution: If you specify the username using plain text, you risk the
210+
// username being exposed to any users who can view the job or its logs.
211+
// To avoid this risk, specify a secret that contains the username instead.
212+
//
213+
// Learn more about [Secret
214+
// Manager](https://cloud.google.com/secret-manager/docs/) and [using
215+
// Secret Manager with
216+
// Batch](https://cloud.google.com/batch/docs/create-run-job-secret-manager).
204217
string username = 10;
205218

206-
// Optional password for logging in to a docker registry. If password
207-
// matches `projects/*/secrets/*/versions/*` then Batch will read the
208-
// password from the Secret Manager;
219+
// Required if the container image is from a private Docker registry. The
220+
// password to login to the Docker registry that contains the image.
221+
//
222+
// For security, it is strongly recommended to specify an
223+
// encrypted password by using a Secret Manager secret:
224+
// `projects/*/secrets/*/versions/*`.
225+
//
226+
// Warning: If you specify the password using plain text, you risk the
227+
// password being exposed to any users who can view the job or its logs.
228+
// To avoid this risk, specify a secret that contains the password instead.
229+
//
230+
// Learn more about [Secret
231+
// Manager](https://cloud.google.com/secret-manager/docs/) and [using
232+
// Secret Manager with
233+
// Batch](https://cloud.google.com/batch/docs/create-run-job-secret-manager).
209234
string password = 11;
210235

211236
// Optional. If set to true, this container runnable uses Image streaming.
@@ -238,7 +263,7 @@ message Runnable {
238263
// first line of the file.(For example, to execute the script using bash,
239264
// `#!/bin/bash` should be the first line of the file. To execute the
240265
// script using`Python3`, `#!/usr/bin/env python3` should be the first
241-
// line of the file.) Otherwise, the file will by default be excuted by
266+
// line of the file.) Otherwise, the file will by default be executed by
242267
// `/bin/sh`.
243268
string path = 1;
244269

@@ -248,7 +273,7 @@ message Runnable {
248273
// beginning of the text.(For example, to execute the script using bash,
249274
// `#!/bin/bash\n` should be added. To execute the script using`Python3`,
250275
// `#!/usr/bin/env python3\n` should be added.) Otherwise, the script will
251-
// by default be excuted by `/bin/sh`.
276+
// by default be executed by `/bin/sh`.
252277
string text = 2;
253278
}
254279
}

0 commit comments

Comments
 (0)