minor documentation requests

[wlandau]

I am setting up a second GCP account (another 90-day free trial) and I ran into some setup snags.

• When I create a new project and the name already exists somewhere else, GCP secretly appends a 6-digit string to the end. I hit HTTP403 errors in cr_setup_test() until I figured out that my project ID, example-project-123456 (censored), was different from the project name, example-project. Related: https://youtu.be/RrYrMsoIXsw?t=1181.
• To be able to delete buckets, I found that my service account needed the "Storage Admin" role, which I granted post-hoc using the instructions at https://cloud.google.com/iam/docs/granting-changing-revoking-access.
• I am now set up enough to wrap up https://github.com/ropensci/targets/issues/720, but I am running into errors in the last test in cr_setup_test(). Not sure which roles to add.

> cr_setup_test()
ℹ Perform deployments to test your setup is working. Takes around 5mins.  ESC or 0 to skip.
✓ Successfully auto-authenticated via /home/landau/.gcp/CENSORED.json
✓ Validated authentication in GCE_AUTH_FILE
Select which deployments to test 

1: All tests
2: Cloud Build - Docker
3: Cloud Run - plumber API with Pub/Sub
4: Cloud Build - R script
5: Cloud Scheduler - R script

Selection: 5

── Testing scheduling R script deployments via cr_deploy_r(schedule = '* * * * *') ──

ℹ 2022-03-15 12:55:28 > Deploy R script cr_rscript_CENSORED to Cloud Build
ℹ 2022-03-15 12:55:28 > Scheduling R script on cron schedule: * * * * *
ℹ 2022-03-15 12:55:28 > Creating PubSub topic: cr_rscript_CENSORED-topic
✓ projects/CENSORED/topics/cr_rscript_CENSORED-topic succesfully created
ℹ 2022-03-15 12:55:31 > Request Status Code:  403
Error: http_403 User not authorized to perform this action.

[MarkEdmondson1234]

Thanks! These startup bumps are my priority for smoothing out. It sounds like I forgot to put the new googlePubsubR integration scopes in the setup script.

[wlandau]

Thanks so much Mark! You have already done a lot to make this process easier for new users, and the video and cr_setup() are super helpful.

Would it also be possible to mention GCS_AUTH_FILE somewhere? I believe the setup docs refer to GCE_AUTH_FILE instead.

[MarkEdmondson1234]

The GCS_AUTH_FILE is only googleCloudStorageR specific, when using Cloud Storage with googleCloudRunner it uses the GCE_AUTH_FILE as that contains auth for all the related services (Cloud Run, Storage, Cloud Build etc)

[wlandau]

So these environment variables are different for security reasons (bare minimum permissions)?

[MarkEdmondson1234]

That was the thinking, although wasn't followed for googleCloudRunner that reused googleComputeEngineR's GCE_AUTH_FILE, potentially a CR_AUTH_FILE would be more consistent but with the recent Google auth changes in general I would like to use the more agnostic application defaults, supported by gargle, that reuse what gcloud and other SDKs look at.