Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(bigtable): support requested_policy_version for Instance IAM #10001

Merged
merged 7 commits into from
Jan 13, 2020
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 22 additions & 3 deletions bigtable/google/cloud/bigtable/instance.py
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@

from google.protobuf import field_mask_pb2

from google.cloud.bigtable_admin_v2.types import instance_pb2
from google.cloud.bigtable_admin_v2.types import instance_pb2, options_pb2

from google.api_core.exceptions import NotFound

Expand Down Expand Up @@ -434,7 +434,7 @@ def delete(self):
"""
self._client.instance_admin_client.delete_instance(name=self.name)

def get_iam_policy(self):
def get_iam_policy(self, requested_policy_version=None):
"""Gets the access control policy for an instance resource.

For example:
Expand All @@ -443,11 +443,30 @@ def get_iam_policy(self):
:start-after: [START bigtable_get_iam_policy]
:end-before: [END bigtable_get_iam_policy]

:type requested_policy_version: int or ``NoneType``
:param requested_policy_version: Optional. The version of IAM policies to request.
If a policy with a condition is requested without
setting this, the server will return an error.
This must be set to a value of 3 to retrieve IAM
policies containing conditions. This is to prevent
client code that isn't aware of IAM conditions from
interpreting and modifying policies incorrectly.
The service might return a policy with version lower
than the one that was requested, based on the
feature syntax in the policy fetched.

:rtype: :class:`google.cloud.bigtable.policy.Policy`
:returns: The current IAM policy of this instance
"""
args = {"resource": self.name}
if requested_policy_version is not None:
args["options_"] = options_pb2.GetPolicyOptions(
requested_policy_version=requested_policy_version
)

instance_admin_client = self._client.instance_admin_client
resp = instance_admin_client.get_iam_policy(resource=self.name)

resp = instance_admin_client.get_iam_policy(**args)
return Policy.from_pb(resp)

def set_iam_policy(self, policy):
Expand Down
38 changes: 38 additions & 0 deletions bigtable/tests/unit/test_instance.py
Original file line number Diff line number Diff line change
Expand Up @@ -633,6 +633,44 @@ def test_get_iam_policy(self):
for found, expected in zip(sorted(admins), sorted(members)):
self.assertEqual(found, expected)

def test_get_iam_policy_w_requested_policy_version(self):
from google.cloud.bigtable_admin_v2.gapic import bigtable_instance_admin_client
from google.iam.v1 import policy_pb2, options_pb2
from google.cloud.bigtable.policy import BIGTABLE_ADMIN_ROLE

credentials = _make_credentials()
client = self._make_client(
project=self.PROJECT, credentials=credentials, admin=True
)
instance = self._make_one(self.INSTANCE_ID, client)

version = 1
etag = b"etag_v1"
members = ["serviceAccount:service_acc1@test.com", "user:user1@test.com"]
bindings = [{"role": BIGTABLE_ADMIN_ROLE, "members": members}]
iam_policy = policy_pb2.Policy(version=version, etag=etag, bindings=bindings)

# Patch the stub used by the API method.
instance_api = mock.create_autospec(
bigtable_instance_admin_client.BigtableInstanceAdminClient
)
client._instance_admin_client = instance_api
instance_api.get_iam_policy.return_value = iam_policy

# Perform the method and check the result.
result = instance.get_iam_policy(requested_policy_version=3)

instance_api.get_iam_policy.assert_called_once_with(
resource=instance.name,
options_=options_pb2.GetPolicyOptions(requested_policy_version=3),
)
self.assertEqual(result.version, version)
self.assertEqual(result.etag, etag)
admins = result.bigtable_admins
self.assertEqual(len(admins), len(members))
for found, expected in zip(sorted(admins), sorted(members)):
self.assertEqual(found, expected)

def test_set_iam_policy(self):
from google.cloud.bigtable_admin_v2.gapic import bigtable_instance_admin_client
from google.iam.v1 import policy_pb2
Expand Down