Implement IAM API

[stephenplusplus]

IAM is currently buried inside of our Pub/Sub code, but should be abstracted to be used with any API that supports it:

• Compute
• Logging (not supported)
• Pub/Sub
• Resource Manager (not supported)
• Storage
  • Bucket
  • Object

[dhermes]

/cc @tseaver

[stephenplusplus]

I haven't been able to get through to IAM with gRPC: stephenplusplus/grpc-usage-question#1

// @jgeewax

[stephenplusplus]

@jgeewax for the libraries that use gRPC, there are no IAM endpoints defined within each service's proto files. For an HTTP API like Compute, can you give me an example of a URL where you think I can find an IAM endpoint?

I've tried on an autoscaler to test, https://www.googleapis.com/compute/v1/projects/nth-circlet-705/zones/us-central1-a/autoscalers/gcloud-tests-autoscaler-1468433795482/getIamPolicy -- 404, but I'm not sure if that was a good guess for where I could find an IAM endpoint.

[jgeewax]

I'm pretty sure that you use the iam_policy.proto file to send the request with the right resource name, but to the pubsub endpoint... ( https://cloud.google.com/pubsub/reference/rpc/google.iam.v1 and https://github.com/googleapis/googleapis/blob/master/google/iam/v1/iam_policy.proto ) No?

[stephenplusplus]

Pub/Sub is supported using IAM: https://github.com/GoogleCloudPlatform/gcloud-node/blob/master/lib/pubsub/iam.js. It's Logging that's been an issue.

Maybe you can take a look at the repo I put together to demonstrate the problem. If it's an easy solution, it should be easy to catch where I went wrong. https://github.com/stephenplusplus/grpc-usage-question -- you can replace the URL at line 19 to send the request to a different "base URL". In my experience, I either get a "Not Implemented" error when I send the request to a Logging URL, or an error like the ones I describe in the issue: stephenplusplus/grpc-usage-question#1

Just worth mentioning, all of the above only affects the gRPC APIs (Logging, PubSub) -- there is still Compute, Resource Manager, and Storage that I don't know how to make IAM requests for.

[jgeewax]

The demo looks like it's dealing with resource manager -- which you're saying is giving you a cancelled error (in the issue), right? For Logging, I don't see any IAM support there -- what resource are you trying to :getIamPolicy on ?

[stephenplusplus]

The demo looks like it's dealing with resource manager -- which you're
saying is giving you a cancelled error (in the issue), right?

Yeah, I just wanted to make the repo as easy as possible to reproduce, since everyone should have a "Project" resource (but maybe not a "Sink" or "Log", etc)

For Logging, I don't see any IAM support there -- what resource are you
trying to :getIamPolicy on ?

I don't see any IAM support either, which is what I'm saying... only Pub/Sub seems to have a way to use IAM.

[stephenplusplus]

I get a Not Implemented API error when I try to send this request to the Logging base URL:

var protoOpts = {
  service: 'IAMPolicy',
  method: 'getIamPolicy'
};

var reqOpts = {
  resource: 'a/log/resource'
};

[jgeewax]

Right -- the frame error for gRPC with IAM on Resource Manager is legit, going to dig more. The Logging piece... I don't believe it supports IAM. AKA, your work is done for Logging.... If the REST methods aren't defined in the docs, then it's not supported.

[jgeewax]

Good - that's what's expected.

[stephenplusplus]

Cool, thanks for checking into this stuff!

[jgeewax]

OK -- Resource Manager's docs are lying : they don't support gRPC today. Carry on.

[stephenplusplus]

Trying to move on with accessing Compute IAM through the IAM gRPC API to get the policy of an Address resource. Let me know what these values should be:

Base URL for the IAM request: ?
What I tried: www.googleapis.com/compute/v1 and www.googleapis.com/compute

Resource ID: ?
What I tried: projects/nth-circlet-705/regions/us-central1/addresses/gcloud-tests-address-1468516804722

gRPC prints this error to the console:

E0714 13:20:16.169033000 123145338609664 resolve_address_posix.c:118] getaddrinfo: nodename nor servname provided, or not known

[stephenplusplus]

Update!

I ran it with this base URL: compute.googleapis.com and received the same error that we did with Resource Manager:

{ code: 499,
  metadata: Metadata { _internal_repr: {} },
  message: 'Client Closed Request' } null

[stephenplusplus]

Our support of IAM at this time seems to be complete, in regards to what IAM accessors are available at this point upstream. The issue can stay open for when IAM is opened up for the missing APIs.

[jmuk]

"status: blocked" is removed due to the current status -- pubsub is done, and storage is coming.

[stephenplusplus]

Only Compute remains. Issue opened: googleapis/nodejs-compute#28