July 2023 Summaries

GCP IAM's access management system is based on tuple matching, where access config can be expressed as a simple tuple of (User X, Y, Z), but the actual surface complexity lies in how these tuples are configured and checked. GCP has two types of identities: human user accounts and service accounts, with groups such as Google Groups and Google Workspace account used for referencing sets of accounts when giving permissions. Roles and permissions are also key components, where roles are named sets of permissions that can be customized or used pre-defined ones. The resource hierarchy in GCP allows for parent-child relationships between resources, with access control policies applied at each level. GCP IAM is built on top of the Zanzibar system, which uses (object, relation, user) tuples as its foundation and allows configuration on how these tuples can be expanded. Understanding the object models of GCP IAM can help in implementing custom access control mechanisms based on open-source Zanzibar implementations.

The text discusses the challenges of code reviews in software development, particularly when dealing with large changes. It introduces the concept of "stacked PRs," where smaller, iterative changes are reviewed one by one instead of bundling them into a single pull request. This approach helps maintain the effectiveness of code reviews and reduces the time-consuming process of reviewing large changes. The benefits of stacked PRs include early feedback, faster CI feedback cycles, knowledge sharing, and staying unblocked. However, there are also challenges associated with managing stacked PRs, such as updating and merging them, which can lead to merge conflicts and require manual rebasing and resolution of conflicts. To address these challenges, the Aviator CLI is introduced as a tool that provides an enhanced developer experience by automating the management of stacked PRs, including creating, updating, and merging them seamlessly.