Skip to content

Commit 6f599f0

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
docs: refine proto comment for run_as_non_root
docs: add caution messages for container runnable username and password fields PiperOrigin-RevId: 608240389
1 parent 990a29a commit 6f599f0

4 files changed

Lines changed: 47 additions & 16 deletions

File tree

‎google/cloud/batch/v1/batch_v1.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ types:
1212
- name: google.cloud.batch.v1.OperationMetadata
1313

1414
documentation:
15-
summary: An API to manage the running of batch jobs on Google Cloud Platform.
15+
summary: An API to manage the running of batch resources on Google Cloud Platform.
1616
overview: '(include == google/cloud/batch/doc/overview.md ==)'
1717
rules:
1818
- selector: google.cloud.location.Locations.GetLocation

‎google/cloud/batch/v1/batch_v1_grpc_service_config.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33
"name": [
44
{ "service": "google.cloud.batch.v1.BatchService", "method": "ListJobs" },
55
{ "service": "google.cloud.batch.v1.BatchService", "method": "ListTasks" },
6+
{ "service": "google.cloud.batch.v1.BatchService", "method": "ListResourceAllowances" },
67
{ "service": "google.cloud.batch.v1.BatchService", "method": "GetJob" },
7-
{ "service": "google.cloud.batch.v1.BatchService", "method": "GetTask" }
8+
{ "service": "google.cloud.batch.v1.BatchService", "method": "GetTask" },
9+
{ "service": "google.cloud.batch.v1.BatchService", "method": "GetResourceAllowance" }
810
],
911
"timeout": "60s",
1012
"retryPolicy": {
@@ -19,7 +21,10 @@
1921
"name": [
2022
{ "service": "google.cloud.batch.v1.BatchService", "method": "CreateJob" },
2123
{ "service": "google.cloud.batch.v1.BatchService", "method": "DeleteJob" },
22-
{ "service": "google.cloud.batch.v1.BatchService", "method": "CancelJob"}
24+
{ "service": "google.cloud.batch.v1.BatchService", "method": "CancelJob"},
25+
{ "service": "google.cloud.batch.v1.BatchService", "method": "CreateResourceAllowance" },
26+
{ "service": "google.cloud.batch.v1.BatchService", "method": "DeleteResourceAllowance" },
27+
{ "service": "google.cloud.batch.v1.BatchService", "method": "UpdateResourceAllowance"}
2328
],
2429
"timeout": "60s"
2530
}]

‎google/cloud/batch/v1/job.proto‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -607,17 +607,18 @@ message TaskGroup {
607607

608608
// When true, Batch will populate a file with a list of all VMs assigned to
609609
// the TaskGroup and set the BATCH_HOSTS_FILE environment variable to the path
610-
// of that file. Defaults to false.
610+
// of that file. Defaults to false. The host file supports up to 1000 VMs.
611611
bool require_hosts_file = 11;
612612

613613
// When true, Batch will configure SSH to allow passwordless login between
614614
// VMs running the Batch tasks in the same TaskGroup.
615615
bool permissive_ssh = 12;
616616

617-
// Optional. If not set or set to false, Batch will use root user to execute
618-
// runnables. If set to true, Batch will make sure to run the runnables using
619-
// non-root user. Currently, the non-root user Batch used is generated by OS
620-
// login. Reference: https://cloud.google.com/compute/docs/oslogin
617+
// Optional. If not set or set to false, Batch uses the root user to execute
618+
// runnables. If set to true, Batch runs the runnables using a non-root user.
619+
// Currently, the non-root user Batch used is generated by OS Login. For more
620+
// information, see [About OS
621+
// Login](https://cloud.google.com/compute/docs/oslogin).
621622
bool run_as_non_root = 14 [(google.api.field_behavior) = OPTIONAL];
622623
}
623624

‎google/cloud/batch/v1/task.proto‎

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -179,14 +179,39 @@ message Runnable {
179179
// `container.options` field.
180180
bool block_external_network = 9;
181181

182-
// Optional username for logging in to a docker registry. If username
183-
// matches `projects/*/secrets/*/versions/*` then Batch will read the
184-
// username from the Secret Manager.
182+
// Required if the container image is from a private Docker registry. The
183+
// username to login to the Docker registry that contains the image.
184+
//
185+
// You can either specify the username directly by using plain text or
186+
// specify an encrypted username by using a Secret Manager secret:
187+
// `projects/*/secrets/*/versions/*`. However, using a secret is
188+
// recommended for enhanced security.
189+
//
190+
// Caution: If you specify the username using plain text, you risk the
191+
// username being exposed to any users who can view the job or its logs.
192+
// To avoid this risk, specify a secret that contains the username instead.
193+
//
194+
// Learn more about [Secret
195+
// Manager](https://cloud.google.com/secret-manager/docs/) and [using
196+
// Secret Manager with
197+
// Batch](https://cloud.google.com/batch/docs/create-run-job-secret-manager).
185198
string username = 10;
186199

187-
// Optional password for logging in to a docker registry. If password
188-
// matches `projects/*/secrets/*/versions/*` then Batch will read the
189-
// password from the Secret Manager;
200+
// Required if the container image is from a private Docker registry. The
201+
// password to login to the Docker registry that contains the image.
202+
//
203+
// For security, it is strongly recommended to specify an
204+
// encrypted password by using a Secret Manager secret:
205+
// `projects/*/secrets/*/versions/*`.
206+
//
207+
// Warning: If you specify the password using plain text, you risk the
208+
// password being exposed to any users who can view the job or its logs.
209+
// To avoid this risk, specify a secret that contains the password instead.
210+
//
211+
// Learn more about [Secret
212+
// Manager](https://cloud.google.com/secret-manager/docs/) and [using
213+
// Secret Manager with
214+
// Batch](https://cloud.google.com/batch/docs/create-run-job-secret-manager).
190215
string password = 11;
191216

192217
// Optional. If set to true, this container runnable uses Image streaming.
@@ -219,7 +244,7 @@ message Runnable {
219244
// first line of the file.(For example, to execute the script using bash,
220245
// `#!/bin/bash` should be the first line of the file. To execute the
221246
// script using`Python3`, `#!/usr/bin/env python3` should be the first
222-
// line of the file.) Otherwise, the file will by default be excuted by
247+
// line of the file.) Otherwise, the file will by default be executed by
223248
// `/bin/sh`.
224249
string path = 1;
225250

@@ -229,7 +254,7 @@ message Runnable {
229254
// beginning of the text.(For example, to execute the script using bash,
230255
// `#!/bin/bash\n` should be added. To execute the script using`Python3`,
231256
// `#!/usr/bin/env python3\n` should be added.) Otherwise, the script will
232-
// by default be excuted by `/bin/sh`.
257+
// by default be executed by `/bin/sh`.
233258
string text = 2;
234259
}
235260
}

0 commit comments

Comments
 (0)