feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2017 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for the Access Context Manager levels CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+class AccessContextManager(base.Group):
+  """Manage Access Context Manager levels.
+
+  An access level is a classification of requests based on raw attributes of
+  that request (e.g. IP address, device identity, time of day, etc.).
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/conditions/__init__.py

@@ -0,0 +1,30 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2017 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for the Access Context Manager levels CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+class LevelCondition(base.Group):
+  """Manage Access Context Manager level conditions.
+
+  An access level is a classification of requests based on raw attributes of
+  that request (e.g. IP address, device identity, time of day, etc.). These
+  individual attributes are called conditions.
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/conditions/list.yaml

@@ -0,0 +1,43 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  command_type: DESCRIBE
+  help_text:
+    brief: List conditions for an access level.
+    description: List conditions for a basic access level.
+
+  request:
+    collection: accesscontextmanager.accessPolicies.accessLevels
+    api_version: v1
+    BETA:
+      api_version: v1
+    ALPHA:
+      api_version: v1alpha
+    static_fields:
+      accessLevelFormat: AS_DEFINED
+
+  arguments:
+    resource:
+      help_text: The access level you want to list the conditions for.
+      spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:level
+      is_positional: false
+
+  output:
+    format: |
+      table(
+         basic:format="
+           table(format('Conditions are joined with {} operator.
+
+      ', combiningFunction):label='')",
+         basic.conditions:format="
+           table[all-box,title='ACCESS LEVEL CONDITIONS'](
+               negate:label=NEGATED,
+               devicePolicy.list(),
+               ipSubnetworks.list(separator='
+      '),
+               members.list(separator='
+      '),
+               requiredAccessLevels.map().basename().list(separator='
+      ')
+           )
+           "
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/config/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for managing Access Context Manager access level configurations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Config(base.Group):
+  """Manage Access Context Manager access level configurations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/config/export.yaml

@@ -0,0 +1,38 @@
+release_tracks: [ALPHA]
+command_type: CONFIG_EXPORT
+help_text:
+  brief: Export the configuration for a Access Context Manager access level.
+  description: |
+    *{command}* exports the configuration for a Access Context Manager access level.
+
+    Access level configurations can be exported in
+    Kubernetes Resource Model (krm) or Terraform HCL formats. The
+    default format is `krm`.
+
+    Specifying `--all` allows you to export the configurations for all
+    access levels within the project.
+
+    Specifying `--path` allows you to export the configuration(s) to
+    a local directory.
+  examples: |
+    To export the configuration for an access level, run:
+
+      $ {command} my-access-level
+
+    To export the configuration for an access level to a file, run:
+
+      $ {command} my-access-level --path=/path/to/dir/
+
+    To export the configuration for an access level in Terraform
+    HCL format, run:
+
+      $ {command} my-access-level --resource-format=terraform
+
+    To export the configurations for all access levels within a
+    project, run:
+
+      $ {command} --all
+arguments:
+  resource:
+    help_text: Access level to export the configuration for.
+    spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:level

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/create.yaml

@@ -0,0 +1,89 @@
+- release_tracks: [GA, BETA, ALPHA]
+
+  help_text:
+    brief: Create a new access level.
+    description: Create a new access level in a given access policy.
+
+  request:
+    collection: accesscontextmanager.accessPolicies.accessLevels
+    api_version: v1
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.util.hooks.request_modifiers:SetFieldFromRelativeName:api_field=accessLevel.name
+    - googlecloudsdk.command_lib.accesscontextmanager.policies:ValidateAccessPolicyArg
+    - googlecloudsdk.command_lib.accesscontextmanager.levels:ClearCombiningFunctionUnlessBasicSpecSet
+    ALPHA:
+      api_version: v1alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.util.hooks.request_modifiers:SetFieldFromRelativeName:api_field=accessLevel.name
+      - googlecloudsdk.command_lib.accesscontextmanager.policies:ValidateAccessPolicyArg
+      - googlecloudsdk.command_lib.accesscontextmanager.levels:ClearCombiningFunctionUnlessBasicSpecSet
+  async:
+    collection: accesscontextmanager.operations
+  arguments:
+    resource:
+      help_text: The access level to create.
+      spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:level
+    params:
+    - api_field: accessLevel.description
+      arg_name: description
+      required: false
+      help_text: Long-form description of access level.
+    - api_field: accessLevel.title
+      arg_name: title
+      required: true
+      help_text: Short human-readable title of the access level.
+    - group:
+        required: true
+        mutex: true
+        help_text: Level specification.
+        params:
+        - group:
+            help_text: Basic level specification.
+            params:
+            - api_field: accessLevel.basic.combiningFunction
+              arg_name: combine-function
+              default: and
+              help_text: For a basic level, determines how conditions are combined.
+              choices:
+              - arg_value: and
+                enum_value: AND
+              - arg_value: or
+                enum_value: OR
+            - api_field: accessLevel.basic.conditions
+              arg_name: basic-level-spec
+              required: true
+              help_text: |
+                Path to a file containing a list of basic access level conditions.
+
+                An access level condition file is a YAML-formatted list of
+                conditions, which are YAML objects representing a Condition as
+                described in the API reference. For example:
+
+                    ```
+                     - ipSubnetworks:
+                       - 162.222.181.197/24
+                       - 2001:db8::/48
+                     - members:
+                       - user:user@example.com
+                    ```
+              repeated: false
+              processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseBasicLevelConditions:api_version=v1
+              ALPHA:
+                processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseBasicLevelConditions:api_version=v1alpha
+        - group:
+            help_text: Custom level specification.
+            params:
+            - api_field: accessLevel.custom.expr
+              arg_name: custom-level-spec
+              help_text: |
+                Path to a file representing an expression that represents an access level.
+
+                The expression is in the Common Expression Language (CEL) format. For example:
+
+                    ```
+                      expression: "origin.region_code in ['US', 'CA']"
+                    ```
+              repeated: false
+              processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseCustomLevel:api_version=v1
+              ALPHA:
+                processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseCustomLevel:api_version=v1alpha

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/delete.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [GA, BETA, ALPHA]
+
+  help_text:
+    brief: Delete an access level.
+    description: Delete an access level in a given access policy.
+
+  request:
+    collection: accesscontextmanager.accessPolicies.accessLevels
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.accesscontextmanager.policies:ValidateAccessPolicyArg
+    api_version: v1
+    BETA:
+      api_version: v1
+    ALPHA:
+      api_version: v1alpha
+
+  async:
+    collection: accesscontextmanager.operations
+
+  arguments:
+    resource:
+      help_text: The access level you want to delete.
+      spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:level

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/describe.yaml

@@ -0,0 +1,38 @@
+- release_tracks: [GA, ALPHA, BETA]
+
+  help_text:
+    brief: Show details about an access level.
+    description: Show details about an access level in a given access policy.
+    examples: |
+      To show the details of the access policy ``my-policy'', run:
+
+        $ {command} my-policy
+
+  request:
+    collection: accesscontextmanager.accessPolicies.accessLevels
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.accesscontextmanager.policies:ValidateAccessPolicyArg
+    api_version: v1
+    BETA:
+      api_version: v1
+    ALPHA:
+      api_version: v1alpha
+
+  arguments:
+    resource:
+      help_text: The access level you want to show details about.
+      spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:level
+    params:
+    - api_field: accessLevelFormat
+      arg_name: level-format
+      required: false
+      default: as_defined
+      hidden: true  # Hide until CEL is ready
+      help_text: The format in which to display the access level.
+      choices:
+      - arg_value: as_defined
+        enum_value: AS_DEFINED
+        help_text: Display each access level as-defined.
+      - arg_value: cel
+        enum_value: CEL
+        help_text: Display basic levels in CEL expression format.

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/list.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [GA, ALPHA, BETA]
+
+  help_text:
+    brief: List access levels.
+    description: List access levels.
+
+  request:
+    collection: accesscontextmanager.accessPolicies.accessLevels
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.accesscontextmanager.policies:ValidateAccessPolicyArg
+    api_version: v1
+    BETA:
+      api_version: v1
+    ALPHA:
+      api_version: v1alpha
+
+  arguments:
+    resource:
+      help_text: The access policy you want to list the access levels for.
+      spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:policy
+
+  output:
+    format: |
+      table(
+          name.basename(),
+          title,
+          format("{0}", basic.yesno(yes="Basic", no="Custom")):label=LEVEL_TYPE
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/replace_all.yaml

@@ -0,0 +1,97 @@
+- release_tracks: [ALPHA, BETA, GA]
+  command_type: GENERIC
+
+  help_text:
+    brief: |
+      Replace all existing access levels.
+    description: |
+      Replace all existing access level in specified access policy with access levels specified in a
+      file.
+
+      ## EXAMPLES
+
+      To replace all levels within a policy, using etag:
+
+        $ {command} my-policy-number --source-file=path-to-file-containing-all-replacement-access-levels.yaml --etag=optional-latest-etag-of-policy
+
+      To replace all levels within a policy, without using etag:
+
+        $ {command} my-policy-number --source-file=path-to-file-containing-all-replacement-access-levels.yaml
+
+  request:
+    collection: accesscontextmanager.accessPolicies.accessLevels
+    ALPHA:
+      api_version: v1alpha
+      method: replaceAll
+    BETA:
+      api_version: v1
+      method: replaceAll
+    GA:
+      api_version: v1
+      method: replaceAll
+  response:
+    ALPHA:
+      modify_response_hooks:
+      - googlecloudsdk.command_lib.accesscontextmanager.levels:ParseReplaceAccessLevelsResponse:api_version=v1alpha
+    BETA:
+      modify_response_hooks:
+      - googlecloudsdk.command_lib.accesscontextmanager.levels:ParseReplaceAccessLevelsResponse:api_version=v1
+    GA:
+      modify_response_hooks:
+      - googlecloudsdk.command_lib.accesscontextmanager.levels:ParseReplaceAccessLevelsResponse:api_version=v1
+
+  arguments:
+    resource:
+      help_text: The access policy that contains the levels you want to replace.
+      spec: !REF googlecloudsdk.command_lib.accesscontextmanager.resources:policy
+      override_resource_collection: true
+
+    params:
+    - api_field: replaceAccessLevelsRequest.etag
+      arg_name: etag
+      required: false
+      help_text: |
+        An etag which specifies the version of the Access Policy. Only etags
+        that represent the latest version of the Access Policy will be accepted.
+      repeated: false
+    - api_field: replaceAccessLevelsRequest.accessLevels
+      arg_name: source-file
+      required: true
+      help_text: |
+        Path to a file containing a list of access levels.
+
+        An access level file is a YAML-formatted list of access levels,
+        which are YAML objects representing a Basic or Custom level as described in
+        the API reference. For example:
+
+        ```
+        - name: accessPolicies/my_policy/accessLevels/my_level
+          title: My Basic Level
+          description: Basic level for foo.
+          basic:
+            combiningFunction: AND
+            conditions:
+            - ipSubnetworks:
+              - 192.168.100.14/24
+              - 2001:db8::/48
+            - members
+              - user1:user1@example.com
+        - name: accessPolicies/my_policy/accessLevels/my_other_level
+          title: My Other Custom Level
+          description: Custom level for bar.
+          custom:
+            expr:
+              expression: "origin.region_code in ['US', 'CA']"
+        ```
+
+        For more information about the alpha version, see:
+        https://cloud.google.com/access-context-manager/docs/reference/rest/v1alpha/accessPolicies.accessLevels
+        For other versions, see:
+        https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies.accessLevels
+      repeated: false
+      ALPHA:
+        processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseAccessLevels:api_version=v1alpha
+      BETA:
+        processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseAccessLevels:api_version=v1
+      GA:
+        processor: googlecloudsdk.command_lib.accesscontextmanager.levels:ParseAccessLevels:api_version=v1

gcloud auth application-default login/google-cloud-sdk/lib/surface/access_context_manager/levels/update.py

@@ -0,0 +1,105 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2018 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""`gcloud access-context-manager levels update` command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.accesscontextmanager import levels as levels_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.accesscontextmanager import levels
+from googlecloudsdk.command_lib.accesscontextmanager import policies
+
+_API_VERSION_PER_TRACK = {'ALPHA': 'v1alpha', 'BETA': 'v1', 'GA': 'v1'}
+
+_FEATURE_MASK_PER_TRACK = {
+    'ALPHA': {
+        'custom_levels': True
+    },
+    'BETA': {
+        'custom_levels': True
+    },
+    'GA': {
+        'custom_levels': True
+    }
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class UpdateLevelGA(base.UpdateCommand):
+  """Update an existing access level."""
+
+  _API_VERSION = _API_VERSION_PER_TRACK.get('GA')
+  _FEATURE_MASK = _FEATURE_MASK_PER_TRACK.get('GA')
+
+  @staticmethod
+  def Args(parser):
+    UpdateLevelGA.ArgsVersioned(parser, release_track='GA')
+
+  @staticmethod
+  def ArgsVersioned(parser, release_track):
+    api_version = _API_VERSION_PER_TRACK.get(release_track, 'v1')
+    feature_mask = _FEATURE_MASK_PER_TRACK.get(release_track, {})
+    levels.AddResourceArg(parser, 'to update')
+    levels.AddLevelArgs(parser)
+    levels.AddLevelSpecArgs(
+        parser, api_version=api_version, feature_mask=feature_mask)
+
+  def Run(self, args):
+    client = levels_api.Client(version=self._API_VERSION)
+
+    level_ref = args.CONCEPTS.level.Parse()
+    policies.ValidateAccessPolicyArg(level_ref, args)
+
+    basic_level_combine_function = None
+    if args.IsSpecified('combine_function'):
+      mapper = levels.GetCombineFunctionEnumMapper(
+          api_version=self._API_VERSION)
+      basic_level_combine_function = mapper.GetEnumForChoice(
+          args.combine_function)
+
+    custom_level_expr = None
+    if (self._FEATURE_MASK.get('custom_levels', False) and
+        args.IsSpecified('custom_level_spec')):
+      custom_level_expr = args.custom_level_spec
+
+    return client.Patch(
+        level_ref,
+        description=args.description,
+        title=args.title,
+        basic_level_combine_function=basic_level_combine_function,
+        basic_level_conditions=args.basic_level_spec,
+        custom_level_expr=custom_level_expr)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class UpdateLevelBeta(UpdateLevelGA):
+  _API_VERSION = _API_VERSION_PER_TRACK.get('BETA')
+  _FEATURE_MASK = _FEATURE_MASK_PER_TRACK.get('BETA')
+
+  @staticmethod
+  def Args(parser):
+    UpdateLevelGA.ArgsVersioned(parser, release_track='BETA')
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class UpdateLevelAlpha(UpdateLevelGA):
+  _API_VERSION = _API_VERSION_PER_TRACK.get('ALPHA')
+  _FEATURE_MASK = _FEATURE_MASK_PER_TRACK.get('ALPHA')
+
+  @staticmethod
+  def Args(parser):
+    UpdateLevelGA.ArgsVersioned(parser, release_track='ALPHA')