fix!: Added optional flag of an existing field limit, consumed, `…

…carryover` in ResourceAllowance

---
feat: remove GOOGLE_INTERNAL restriction of update job api

---
feat: add a service_account field to taskGroup for service account support
PiperOrigin-RevId: 623158227

google/cloud/batch/v1alpha/job.proto

@@ -593,7 +593,17 @@ message AllocationPolicy {
   // Deprecated: please use service_account instead.
   string service_account_email = 5 [deprecated = true];
 
-  // Service account that VMs will run as.
+  // Defines the service account for Batch-created VMs. If omitted, the [default
+  // Compute Engine service
+  // account](https://cloud.google.com/compute/docs/access/service-accounts#default_service_account)
+  // is used. Must match the service account specified in any used instance
+  // template configured in the Batch job.
+  //
+  // Includes the following fields:
+  //  * email: The service account's email address. If not set, the default
+  //  Compute Engine service account is used.
+  //  * scopes: Additional OAuth scopes to grant the service account, beyond the
+  //  default cloud-platform scope. (list of strings)
   ServiceAccount service_account = 9;
 
   // Labels applied to all VM instances and other resources
@@ -711,17 +721,23 @@ message TaskGroup {
   // information, see [About OS
   // Login](https://cloud.google.com/compute/docs/oslogin).
   bool run_as_non_root = 14 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. ServiceAccount used by tasks within the task group for the access
+  // to other Cloud resources. This allows tasks to operate with permissions
+  // distinct from the service account for the VM set at `AllocationPolicy`. Use
+  // this field when tasks require different access rights than those of the VM.
+  //
+  // Specify the service account's `email` field. Ensure `scopes`
+  // include any necessary permissions for tasks, in addition to the default
+  // 'cloud-platform' scope.
+  ServiceAccount service_account = 15 [(google.api.field_behavior) = OPTIONAL];
 }
 
 // Carries information about a Google Cloud service account.
 message ServiceAccount {
-  // Email address of the service account. If not specified, the default
-  // Compute Engine service account for the project will be used. If instance
-  // template is being used, the service account has to be specified in the
-  // instance template and it has to match the email field here.
+  // Email address of the service account.
   string email = 1;
 
-  // List of scopes to be enabled for this service account on the VM, in
-  // addition to the cloud-platform API scope that will be added by default.
+  // List of scopes to be enabled for this service account.
   repeated string scopes = 2;
 }

google/cloud/batch/v1alpha/resource_allowance.proto

@@ -172,10 +172,10 @@ message UsageResourceAllowanceStatus {
 
     // Output only. Limit value of a UsageResourceAllowance within its one
     // duration.
-    double limit = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+    optional double limit = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
 
     // Output only. Accumulated consumption during `consumption_interval`.
-    double consumed = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+    optional double consumed = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
   }
 
   message PeriodConsumption {
@@ -184,7 +184,7 @@ message UsageResourceAllowanceStatus {
         [(google.api.field_behavior) = OUTPUT_ONLY];
 
     // Output only. Accumulated consumption during `consumption_interval`.
-    double consumed = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+    optional double consumed = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
   }
 
   // ConsumptionReport is the report of ResourceAllowance consumptions in a time