feat(storage): support bucket ip filter by shubhangi-google · Pull Request #34612 · googleapis/google-cloud-ruby

shubhangi-google · 2026-06-12T04:30:27Z

This pull request introduces the capability to configure IP filters for Google Cloud Storage buckets directly through the Ruby client library. It extends existing bucket management functionalities to allow specifying IP filter settings during bucket creation and provides methods to update these settings on existing buckets. The changes also include new sample code to demonstrate the usage of this feature.

Highlights

IP Filter Support: Introduces functionality to manage IP filters for Google Cloud Storage buckets, allowing for network access control.
Bucket Class Extension: Adds ip_filter getter and setter methods to the Google::Cloud::Storage::Bucket class, enabling programmatic access and modification of IP filter settings.
Bucket Creation with IP Filter: Extends the create_bucket method in Google::Cloud::Storage::Project to accept an ip_filter parameter, allowing IP filter configuration during bucket creation.
New Sample Code: Adds new sample methods to demonstrate how to use the new IP filter features.

snippet-bot · 2026-06-18T11:18:51Z

Here is the summary of changes.

You are about to add 6 region tags.

google-cloud-storage/samples/storage_create_bucket_with_ip_filter.rb:15, tag storage_create_bucket_ip_filtering
google-cloud-storage/samples/storage_delete_bucket_ip_filter.rb:15, tag storage_delete_ip_filtering_rules
google-cloud-storage/samples/storage_disable_ip_filtering.rb:15, tag storage_disable_ip_filtering
google-cloud-storage/samples/storage_enable_bucket_ip_filter.rb:15, tag storage_enable_ip_filtering
google-cloud-storage/samples/storage_get_bucket_ip_filter.rb:15, tag storage_get_ip_filtering
google-cloud-storage/samples/storage_list_bucket_ip_filters.rb:15, tag storage_list_buckets_ip_filtering

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

Removed redundant explanation about uniform bucket-level access.

Removed unnecessary line break before accessing the IP filter.

bajajneha27 · 2026-07-08T05:28:32Z

We cannot access the bucket after IP filter is enabled, right? So, we can still test enabling part.

in tests we are testing for disabled only, in samples user can change it according to there requirement
added this particular test as it was requested

bajajneha27 · 2026-07-29T05:46:12Z

+# limitations under the License.
+
+# [START storage_enable_bucket_ip_filter]
+def enable_bucket_ip_filter bucket_name:, mode: "Enabled"


If we're enabling the ip_filter, we won't need to accept mode separately. Just like we have it for previous sample "disabling_ip_filter` .

we included the mode parameter (which defaults to "Enabled") specifically for our acceptance tests. In the tests, we override this to "Disabled". If we enable the IP filter for real during the test run, it can lock the test runner out of the bucket, causing 403 Forbidden.

reference taken from PHP samples PR here: GoogleCloudPlatform/php-docs-samples#2221 (in enable_ip_filtering.php).
exact same pattern to get around the test lockout issue

The CI test runner lockout concern makes sense, and parameterizing mode: "Enabled" with a default is a reasonable workaround.

To keep the snippet and test output consistent when mode: "Disabled" is passed, could we update the log message to dynamically reflect the mode (e.g. puts "Set IP filter mode to #{mode} for bucket #{bucket_name}." or puts "Configured IP filter for bucket #{bucket_name} (mode: #{mode}).") and adjust the test assertion accordingly?

bajajneha27 · 2026-07-29T05:53:54Z

+  ip_filter = {
+    mode: "Disabled",
+    public_network_source: {
+      allowed_ip_cidr_ranges: [


Shouldn't public_network_source be nil and vpc_network_sources be [] when disabling ip_filter?

We are intentionally keeping mode: "Disabled" here while still providing the allowed_ip_cidr_ranges configuration. Just like with the enable sample, this is a workaround for our automated tests. We want to demonstrate to users how to attach an IP filter configuration during bucket creation, if we set the mode to "Enabled" in the snippet, the test runner immediately locks itself out of the new bucket and fails with a 403 Forbidden.

bajajneha27 · 2026-07-29T05:54:38Z

+    mode: mode,
+    allow_all_service_agent_access: true,
+    public_network_source: {
+      allowed_ip_cidr_ranges: ["0.0.0.0/0", "::/0"]


Can you please also add a test to include multiple allowed_ip_cidr_ranges ?

bajajneha27 · 2026-07-29T05:55:59Z

QQ: Do we not use ip_filter_config to disable IP filter?

shubhangi-google · 2026-07-31T13:27:18Z

QQ: Do we not use ip_filter_config to disable IP filter?

we can provide IP-filter configuration with mode Disabled
doc exmaple- https://docs.cloud.google.com/storage/docs/disable-ip-filtering#json-api

kalragauri · 2026-09-08T12:01:36Z

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# [START storage_create_bucket_with_ip_filter]


Please update the sample region tags to match the standard Cloud Storage sample registry (storage.txtpb). Here and elsewhere in this PR.

kalragauri · 2026-09-08T12:06:04Z

+# limitations under the License.
+
+# [START storage_delete_ip_filtering_rules]
+def delete_bucket_ip_filter bucket_name:


Here, the sample should demonstrate removing specific CIDR/VPC rules from an existing configuration rather than setting mode: "Disabled".

kalragauri · 2026-09-08T12:07:37Z

+# [START storage_list_bucket_ip_filters]
+def list_bucket_ip_filters
+  # The ID of your GCP project
+  # project_id = "your-project-id"


Please remove the unused # project_id = "your-project-id" comment to stay consistent with other list_buckets samples.

kalragauri · 2026-09-08T12:09:15Z

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative "../storage_helper"


Please change require_relative "../storage_helper" to require "storage_helper" in for consistency with all other acceptance tests in the repository.

kalragauri · 2026-09-08T12:11:11Z

+# limitations under the License.
+
+# [START storage_enable_bucket_ip_filter]
+def enable_bucket_ip_filter bucket_name:, mode: "Enabled"


The CI test runner lockout concern makes sense, and parameterizing mode: "Enabled" with a default is a reasonable workaround.

To keep the snippet and test output consistent when mode: "Disabled" is passed, could we update the log message to dynamically reflect the mode (e.g. puts "Set IP filter mode to #{mode} for bucket #{bucket_name}." or puts "Configured IP filter for bucket #{bucket_name} (mode: #{mode}).") and adjust the test assertion accordingly?

kalragauri · 2026-09-08T12:11:47Z

+    mode: "Disabled",
+    public_network_source: {
+      allowed_ip_cidr_ranges: [
+        "8.8.8.8/32"


This sample should focus on setting mode: "Disabled" without assigning arbitrary dummy CIDRs.

kalragauri · 2026-09-08T12:14:00Z

+  if ip_filter
+    puts "Bucket #{bucket.name} has IP filter mode: #{ip_filter.mode}."
+    if ip_filter.public_network_source
+      puts "Allowed public network CIDR ranges: #{ip_filter.public_network_source.allowed_ip_cidr_ranges.join(', ')}."


allowed_ip_cidr_ranges may be nil when a network source is present without ranges, causing .join(', ') to raise a NoMethodError.

handled the scenario

kalragauri · 2026-09-08T12:17:03Z

Could we add a unit test for assigning bucket.ip_filter = hash directly outside of bucket.update? This will ensure test coverage for patch_gapi! :ip_filter when passing a Hash payload.

kalragauri · 2026-10-01T04:22:54Z

+  require "google/cloud/storage"
+
+  storage = Google::Cloud::Storage.new
+  bucket = storage.bucket bucket_name


This does not pass projection: "full", which causes bucket.ip_filter to always return nil and silently skips the deletion block while still printing success. Additionally, we should only report success and trigger an update if the target CIDR was actually matched and removed from the configuration.

Could we fetch the bucket using projection: "full" and guard the update/log behind a check that confirms a rule was removed (similar to https://github.com/GoogleCloudPlatform/php-docs-samples/blob/main/storage/src/delete_ip_filtering_rules.php)?

kalragauri · 2026-10-01T04:24:12Z

+
+  storage = Google::Cloud::Storage.new
+  ip_filter = {
+    mode: "Disabled",


mode: "Disabled" is hardcoded here, which means users copying the sample from documentation will create buckets with IP filtering disabled.

Could we use the same parameter pattern as enable_bucket_ip_filter (def create_bucket_with_ip_filter bucket_name:, mode: "Enabled") so the documentation defaults to "Enabled" while acceptance tests can pass "Disabled"?

kalragauri · 2026-10-01T04:25:28Z

+      expected = "Deleted IP filter rule for bucket #{bucket_name}.\n"
+      retry_resource_exhaustion do
+        assert_output expected do
+          delete_bucket_ip_filter bucket_name: bucket_name


delete_bucket_ip_filter runs after disable_ip_filtering has already cleared the network sources, meaning no rule was present or deleted during the test.

Once delete_bucket_ip_filter is updated with projection: "full", could we reorder the steps or re-populate a rule before calling delete, and assert that the rule is absent from the bucket's refreshed metadata rather than asserting only on console output?

kalragauri · 2026-10-01T04:26:21Z

+
+# [START storage_list_buckets_ip_filtering]
+def list_bucket_ip_filters
+  # The ID of your GCP project


This does not have an associated variable.

kalragauri · 2026-10-01T04:27:58Z

+        #   the bucket will include additional metadata, such as ACL policies and
+        #   IP filter settings.
        #
+        # @param [Hash] ip_filter The bucket's IP filter configuration.


ip_filter is typed as @param [Hash], but the parameter also accepts Google::Apis::StorageV1::Bucket::IpFilter. Could we update the type tag to @PARAM [Google::Apis::StorageV1::Bucket::IpFilter, Hash] ip_filter to match Bucket#ip_filter=?

kalragauri

The PR description still mentions "although some debugging code is still present, suggesting it is a work-in-progress" and omits the new projection: parameter added to Project#bucket, Project#buckets, Project#create_bucket, Bucket#reload!, and Bucket::List#next.

Please update the description to remove the WIP note and mention projection: support.

kalragauri · 2026-10-05T10:19:30Z

+  ip_filter = bucket.ip_filter
+
+  if ip_filter
+    if ip_filter.public_network_source


Removing puts "Bucket #{bucket.name} has IP filter mode: #{ip_filter.mode}." means this sample no longer reports whether IP filtering is enabled or disabled, and produces no output at all when ip_filter is present without public_network_source (such as after disabling IP filtering or when only VPC sources are configured).

Could we restore printing ip_filter.mode under if ip_filter and update the expected output in samples/acceptance/buckets_test.rb to match both lines?

kalragauri · 2026-10-05T10:20:30Z

  end

+  describe "storage_bucket_ip_filter" do
+    let(:bucket_name) { random_bucket_name }


Because samples/acceptance/helper.rb uses minitest/hooks/default, after :all executes on a different instance than the it block where let(:bucket_name) is memoized. Calling bucket_name in after :all evaluates random_bucket_name a second time with a new random name, leaving the created test bucket undeleted.

Could we change after :all do to after do (matching storage_quickstart_test.rb) so teardown runs on the same test instance?

kalragauri · 2026-10-05T10:22:11Z

+        bucket = storage_client.bucket bucket_name, projection: "full"
+        if bucket.ip_filter&.public_network_source&.allowed_ip_cidr_ranges
+          ranges = bucket.ip_filter.public_network_source.allowed_ip_cidr_ranges
+          refute_includes ranges, "0.0.0.0/0"


Wrapping refute_includes in if bucket.ip_filter&.public_network_source&.allowed_ip_cidr_ranges allows the test to pass without running the assertion if allowed_ip_cidr_ranges is nil, even though "::/0" should still be present.

Could we assert ranges = bucket.ip_filter.public_network_source.allowed_ip_cidr_ranges directly (e.g., refute_nil ranges and refute_includes ranges, "0.0.0.0/0")?

kalragauri · 2026-10-05T10:22:30Z

+        assert_includes out, "Bucket Name: #{bucket_name}, IP Filtering Mode: Disabled"
+      end
+
+      # Deletes IP filter of an existing bucket (MOVED UP)


Pls remove (MOVED UP) from this comment.

kalragauri · 2026-10-05T10:23:59Z

There are a few trailing whitespace and indentation issues in samples/storage_list_bucket_ip_filters.rb and samples/acceptance/buckets_test.rb. Please clean those up.

shubhangi-google added 11 commits January 21, 2026 17:27

wip-- create bucket with ip filter working

56b0425

wip

6c1fe37

wip

dcfdafb

check samples

4d2bbe7

adding tests and samples

e4877d3

remove pry

e6ccd0c

updating comments

6e8951c

Merge branch 'main' into set_bucket_ip_filter_1

326947d

fix syntax

febdecf

remove pry

447bd86

debugging kokoro

49f3eb3

shubhangi-google marked this pull request as ready for review June 18, 2026 11:18

shubhangi-google requested review from a team and yoshi-approver as code owners June 18, 2026 11:18

shubhangi-google added 3 commits June 22, 2026 18:21

Simplify documentation for uniform bucket-level access

a098c2d

Removed redundant explanation about uniform bucket-level access.

Clean up code by removing extra line break

8dbd4ce

Removed unnecessary line break before accessing the IP filter.

updating samples

24f955a

shubhangi-google changed the title ~~storage(feat): support bucket ip filter~~ feat(storage): support bucket ip filter Jul 2, 2026

bajajneha27 requested changes Jul 8, 2026

View reviewed changes

shubhangi-google added 3 commits July 13, 2026 11:34

Merge branch 'main' into set_bucket_ip_filter_1

d4d5402

modifying samples and addng projection filter

fe37199

updating scenarios and docs

9332501

shubhangi-google marked this pull request as draft July 20, 2026 06:26

shubhangi-google added 4 commits July 20, 2026 12:35

fixing unit test

1c9975d

fix tests

1d038b8

fix indentation

a8cc1fb

blank commit

04bc406

bajajneha27 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 21, 2026

blank commit

e09856b

shubhangi-google marked this pull request as ready for review July 21, 2026 09:08

shubhangi-google requested a review from bajajneha27 July 21, 2026 09:13

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 21, 2026

bajajneha27 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 22, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 22, 2026

bajajneha27 reviewed Jul 29, 2026

View reviewed changes

adding test for multiple cidr range

76ea001

shubhangi-google requested a review from bajajneha27 July 31, 2026 13:22

removing not required check

d40ec0f

cpriti-os requested a review from kalragauri September 7, 2026 08:00

kalragauri reviewed Sep 8, 2026

View reviewed changes

shubhangi-google added 2 commits September 28, 2026 10:05

Merge branch 'main' into set_bucket_ip_filter_1

815372d

fixing review comments

16c5e07

shubhangi-google requested a review from kalragauri September 30, 2026 05:48

updating region tags

05afba5

kalragauri reviewed Oct 1, 2026

View reviewed changes

shubhangi-google added 2 commits October 1, 2026 11:29

updating samples

a37d067

updating

a221502

shubhangi-google requested a review from kalragauri October 1, 2026 12:20

kalragauri reviewed Oct 5, 2026

View reviewed changes

refactor

45b78ae

Conversation

shubhangi-google commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Highlights

Uh oh!

snippet-bot Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bajajneha27 commented Jul 29, 2026

Uh oh!

shubhangi-google commented Jul 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

shubhangi-google commented Jun 12, 2026 •

edited

Loading

snippet-bot Bot commented Jun 18, 2026 •

edited

Loading