feat: add storage control anywhere cache samples

.eslintrc.json

@@ -12,6 +12,7 @@
     "node/no-unsupported-features/es-syntax": ["off"]
   },
   "parserOptions": {
+    "ecmaVersion": 2020,
     "sourceType": "module"
   }
 }

.github/config/nodejs-dev.jsonc

@@ -185,6 +185,7 @@
     "functions/v2/tips/retry",
     "functions/v2/typed/googlechatbot",
     "functions/v2/typed/greeting",
+    "genai", // parent directory
     "generative-ai/snippets",
     "healthcare/consent",
     "healthcare/datasets",

.github/config/nodejs.jsonc

@@ -70,6 +70,7 @@
     "functions/http/uploadFile", // no tests exist
     "functions/log", // parent directory
     "functions/pubsub", // parent directory
+    "genai", // parent directory
     "memorystore/redis", // parent directory
     "recaptcha_enterprise/demosite/app", // no tests exist
 

ai-platform/snippets/test/imagen.test.js

@@ -66,7 +66,8 @@ describe('AI platform edit image using Imagen inpainting and outpainting', () =>
   });
 });
 
-describe('AI platform get image captions and responses using Imagen', () => {
+// b/452720552
+describe.skip('AI platform get image captions and responses using Imagen', () => {
   it('should get short form captions for an image', async () => {
     const stdout = execSync('node ./imagen-get-short-form-image-captions.js', {
       cwd,

appengine/building-an-app/build/app.yaml

@@ -12,5 +12,5 @@
 # limitations under the License.
 
 # [START gae_build_app_yaml_node]
-runtime: nodejs20
+runtime: nodejs24
 # [END gae_build_app_yaml_node]

appengine/building-an-app/build/package.json

@@ -14,7 +14,7 @@
     "url": "https://github.com/GoogleCloudPlatform/nodejs-docs-samples.git"
   },
   "engines": {
-    "node": "20.x.x"
+    "node": "24.x.x"
   },
   "author": "Google Inc.",
   "license": "Apache-2.0",

appengine/hello-world/flexible/app.yaml

@@ -16,7 +16,7 @@
 runtime: nodejs
 env: flex
 runtime_config:
-  operating_system: ubuntu22
+  operating_system: ubuntu24
 # This sample incurs costs to run on the App Engine flexible environment.
 # The settings below are to reduce costs during testing and are not appropriate
 # for production use. For more information, see:

auth/.eslintrc.json

@@ -0,0 +1,6 @@
+{
+  "extends": "../.eslintrc.json",
+  "rules": {
+    "no-unused-vars": "off"
+  }
+}

auth/README.md

@@ -64,4 +64,4 @@ information](https://developers.google.com/identity/protocols/application-defaul
 
 For more information on downscoped credentials you can visit:
 
-> https://github.com/googleapis/google-auth-library-nodejs
+> https://github.com/googleapis/google-auth-library-nodejs

auth/customcredentials/aws/Dockerfile

@@ -0,0 +1,15 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+COPY package*.json ./
+
+RUN npm install --omit=dev
+
+RUN useradd -m appuser
+
+COPY --chown=appuser:appuser . .
+
+USER appuser
+
+CMD [ "node", "customCredentialSupplierAws.js" ]

auth/customcredentials/aws/README.md

@@ -0,0 +1,121 @@
+# Running the Custom AWS Credential Supplier Sample (Node.js)
+
+This sample demonstrates how to use a custom AWS security credential supplier to authenticate with Google Cloud using AWS as an external identity provider. It uses the **AWS SDK for JavaScript (v3)** to fetch credentials from sources like Amazon Elastic Kubernetes Service (EKS) with IAM Roles for Service Accounts (IRSA), Elastic Container Service (ECS), or Fargate.
+
+## Prerequisites
+
+*   An AWS account.
+*   A Google Cloud project with the IAM API enabled.
+*   A GCS bucket.
+*   **Node.js 16** or later installed.
+*   **npm** installed.
+
+If you want to use AWS security credentials that cannot be retrieved using methods supported natively by the Google Auth library, a custom `AwsSecurityCredentialsSupplier` implementation may be specified. The supplier must return valid, unexpired AWS security credentials when called by the Google Cloud Auth library.
+
+## Running Locally
+
+For local development, you can provide credentials and configuration in a JSON file.
+
+### Install Dependencies
+
+Ensure you have Node.js installed, then install the required libraries:
+
+```bash
+npm install
+```
+
+### Configure Credentials for Local Development
+
+1.  Copy the example secrets file to a new file named `custom-credentials-aws-secrets.json` in the project root:
+    ```bash
+    cp custom-credentials-aws-secrets.json.example custom-credentials-aws-secrets.json
+    ```
+2.  Open `custom-credentials-aws-secrets.json` and fill in the required values for your AWS and Google Cloud configuration. Do not check your `custom-credentials-aws-secrets.json` file into version control.
+
+
+### Run the Application
+
+Execute the script using node:
+
+```bash
+node customCredentialSupplierAws.js
+```
+
+When run locally, the application will detect the `custom-credentials-aws-secrets.json` file and use it to configure the necessary environment variables for the AWS SDK.
+
+## Running in a Containerized Environment (EKS)
+
+This section provides a brief overview of how to run the sample in an Amazon EKS cluster.
+
+### EKS Cluster Setup
+
+First, you need an EKS cluster. You can create one using `eksctl` or the AWS Management Console. For detailed instructions, refer to the [Amazon EKS documentation](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html).
+
+### Configure IAM Roles for Service Accounts (IRSA)
+
+IRSA enables you to associate an IAM role with a Kubernetes service account. This provides a secure way for your pods to access AWS services without hardcoding long-lived credentials.
+
+Run the following command to create the IAM role and bind it to a Kubernetes Service Account:
+
+```bash
+eksctl create iamserviceaccount \
+  --name your-k8s-service-account \
+  --namespace default \
+  --cluster your-cluster-name \
+  --region your-aws-region \
+  --role-name your-role-name \
+  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
+  --approve
+```
+
+> **Note**: The `--attach-policy-arn` flag is used here to demonstrate attaching permissions. Update this with the specific AWS policy ARN your application requires.
+
+For a deep dive into how this works without using `eksctl`, refer to the [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) documentation.
+
+### Configure Google Cloud to Trust the AWS Role
+
+To allow your AWS role to authenticate as a Google Cloud service account, you need to configure Workload Identity Federation. This process involves these key steps:
+
+1.  **Create a Workload Identity Pool and an AWS Provider:** The pool holds the configuration, and the provider is set up to trust your AWS account.
+
+2.  **Create or select a Google Cloud Service Account:** This service account will be impersonated by your AWS role.
+
+3.  **Bind the AWS Role to the Google Cloud Service Account:** Create an IAM policy binding that gives your AWS role the `Workload Identity User` (`roles/iam.workloadIdentityUser`) role on the Google Cloud service account.
+
+For more detailed information, see the documentation on [Configuring Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds).
+
+### Containerize and Package the Application
+
+Create a `Dockerfile` for the Node.js application and push the image to a container registry (for example Amazon ECR) that your EKS cluster can access.
+
+**Note:** The provided [`Dockerfile`](Dockerfile) is an example and may need modification for your specific needs.
+
+Build and push the image:
+```bash
+docker build -t your-container-image:latest .
+docker push your-container-image:latest
+```
+
+### Deploy to EKS
+
+Create a Kubernetes deployment manifest to deploy your application to the EKS cluster. See the [`pod.yaml`](pod.yaml) file for an example.
+
+**Note:** The provided [`pod.yaml`](pod.yaml) is an example and may need to be modified for your specific needs.
+
+Deploy the pod:
+
+```bash
+kubectl apply -f pod.yaml
+```
+
+### Clean Up
+
+To clean up the resources, delete the EKS cluster and any other AWS and Google Cloud resources you created.
+
+```bash
+eksctl delete cluster --name your-cluster-name
+```
+
+## Testing
+
+This sample is not continuously tested. It is provided for instructional purposes and may require modifications to work in your environment.

auth/customcredentials/aws/custom-credentials-aws-secrets.json.example

@@ -0,0 +1,8 @@
+{
+  "aws_access_key_id": "YOUR_AWS_ACCESS_KEY_ID",
+  "aws_secret_access_key": "YOUR_AWS_SECRET_ACCESS_KEY",
+  "aws_region": "YOUR_AWS_REGION",
+  "gcp_workload_audience": "YOUR_GCP_WORKLOAD_AUDIENCE",
+  "gcs_bucket_name": "YOUR_GCS_BUCKET_NAME",
+  "gcp_service_account_impersonation_url": "YOUR_GCP_SERVICE_ACCOUNT_IMPERSONATION_URL"
+}