google-cloud-platformgoogle-artifact-registrygcp-vpc-firewall

Why is priority treated differently in VPC firewall rules vs Artifact Registry on GCP?


In the VPC firewall priority rules documentation on Google Cloud, it states:

  1. Specify the Priority of the rule. The lower the number, the higher the priority

In the Artifact Registry virtual repository priority rules documentation, it states:

When you request an artifact that is in multiple upstream repositories, Artifact Registry uses the following prioritization logic:

The repository with the highest value is prioritized. For example, a value of 10 is treated as higher priority than a value of 1.

I'm confused why is GCP inconsistent in how it treats priority numbers in these 2 services. Is there some sort of technical reason for this? Or is it just a lack of synchronization between how the services were designed on GCP?


Solution

  • There is no technical reason for this concept. It is more likely a result of the logical model that GCP uses.

    In networking, most prioritization rules also follow this concept, where lower values are prioritized first. For example, when creating ACLs (Access Control Lists) on networking hardware, such as Cisco devices, the system evaluates rules starting with the ones that have lower numbers. Other vendors, such as Juniper and Palo Alto, also use this concept in their firewall. This approach is designed so that most network engineers can apply what they have been practicing in the field. On the other hand, it seems that GCP has chosen to use higher value to represent higher priority in Artifact Registry.