feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/certificate_manager/certificates/__init__.py

@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The certificates command group for the Certificate Manager."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+_UNIVERSE_ADDITIONAL_INFO_MESSAGE = """\
+          Only self-managed certificates are supported. Managed certificates are not
+          currently supported.
+          """
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class CertificateMaps(base.Group):
+  """Manage Certificate Manager certificates.
+
+  Commands for managing certificates.
+  """
+  detailed_help = {
+      'UNIVERSE ADDITIONAL INFO': _UNIVERSE_ADDITIONAL_INFO_MESSAGE,
+  }

gcloud auth application-default login/google-cloud-sdk/lib/surface/certificate_manager/certificates/create.yaml

@@ -0,0 +1,148 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Create a certificate.
+    description: |
+      Create a new certificate.
+
+      * Managed certificates can be created by supplying one or more domain names
+        and an (optional) list of DNS authorizations for those domain names.
+      * Self-managed certificates can be created by uploading a certificate
+        and its corresponding private key (both in PEM format).
+    examples: |
+      To create (upload) a self-managed certificate called `www-example-com`, run:
+
+        $ {command} www-example-com --private-key-file=key.pem --certificate-file=cert.pem
+
+      To create a certificate managed by Certificate Manager called `api-example-com`, run:
+
+        $ {command} api-example-com --domains="api.example.com"
+
+      To create a certificate managed by Certificate Manager called `api-example-com`, using an
+      existing DNS authorization, run:
+
+        $ {command} api-example-com --dns-authorizations=api-example-com \
+          --domains="api.example.com"
+
+  request:
+    collection: certificatemanager.projects.locations.certificates
+    api_version: v1
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.certificate_manager.hooks:SetAuthorizationURL
+    - googlecloudsdk.command_lib.certificate_manager.hooks:SetIssuanceConfigURL
+
+  async:
+    collection: certificatemanager.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The name of the certificate to create.
+      spec: !REF googlecloudsdk.command_lib.certificate_manager.resources:certificate
+
+    params:
+    - group:
+        mutex: true
+        required: true
+        help_text: |
+          Configuration for creating and uploading certificates to Cloud Certificate Manager.
+        params:
+        - group:
+            help_text: |
+              Configuration for creating new managed certificates.
+            params:
+            - arg_name: domains
+              api_field: certificate.managed.domains
+              repeated: true
+              required: true
+              help_text: |
+                Public domain name(s) to create a certificate for.
+
+                * If a DNS authorization is provided for the domain, the certificate will be
+                validated against the DNS record you added as part of the authorization flow.
+                * If no DNS authorization is provided, Certificate Manager will attempt to validate
+                the domain against the serving endpoint directly.
+
+                You may list multiple, comma-separated domain names to include multiple
+                names as Subject Alternative Names on the issued certificate.
+            - group:
+                mutex: true
+                params:
+                - arg_name: dns-authorizations
+                  api_field: certificate.managed.dnsAuthorizations
+                  repeated: true
+                  help_text: |
+                    Name(s) of the DNS authorizations for each listed domain.
+
+                    Note that each domain requires a matching authorization, and any domain that
+                    fails authorization will prevent issuance and/or renewal of the certificate.
+
+                    To reference multiple DNS authorizations, provide a list of comma separated DNS
+                    authorization resource names or URLs. For example:
+
+                     $ {command} --dns-authorizations=api-example-com,www-example-com
+                - arg_name: issuance-config
+                  api_field: certificate.managed.issuanceConfig
+                  help_text: |
+                    Name of the Certificate Issuance Config to use for issuance.
+        - group:
+            help_text: |
+              Configuration for uploading self-managed certificates and keys.
+            params:
+            - arg_name: certificate-file
+              api_field: certificate.selfManaged.pemCertificate
+              required: true
+              type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+              help_text: |
+                Certificate data in PEM-encoded form.
+            - arg_name: private-key-file
+              api_field: certificate.selfManaged.pemPrivateKey
+              required: true
+              type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+              help_text: |
+                Private key data in PEM-encoded form
+    - arg_name: scope
+      api_field: certificate.scope
+      default: DEFAULT
+      help_text: |
+        Scope of the managed certificate. This determines which services the certificate can
+        be attached to/associated with. Defaults to `DEFAULT`.
+      choices:
+      - arg_value: "default"
+        enum_value: DEFAULT
+        help_text: |
+          Certificates with DEFAULT scope are used for Load Balancing and Cloud CDN.
+
+          If unsure, choose this option.
+      - arg_value: "edge-cache"
+        enum_value: EDGE_CACHE
+        help_text: |
+          Certificates with scope EDGE_CACHE are special-purposed certificates,
+          scoped for use with Media Edge services only.
+      - arg_value: "all-regions"
+        enum_value: ALL_REGIONS
+        help_text: |
+          Certificates with scope ALL_REGIONS are currently used for
+          Cross-region Internal Application Load Balancer only.
+      - arg_value: "client-auth"
+        enum_value: CLIENT_AUTH
+        help_text: |
+          Certificates with scope CLIENT_AUTH are used for client authentication.
+    - arg_name: description
+      api_field: certificate.description
+      help_text: |
+        Human-readable description of the resource.
+    - arg_name: tags
+      hidden: true
+      api_field: certificate.tags.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of tag KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+
+    labels:
+      api_field: certificate.labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/certificate_manager/certificates/delete.py

@@ -0,0 +1,63 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""`gcloud certificate-manager certificates delete` command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.certificate_manager import certificates
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.certificate_manager import flags
+from googlecloudsdk.command_lib.certificate_manager import resource_args
+from googlecloudsdk.command_lib.certificate_manager import util
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Delete(base.DeleteCommand):
+  """Delete a certificate.
+
+  Delete a certificate resource.
+
+  ## EXAMPLES
+
+  To delete the certificate with name simple-cert, run:
+
+    $ {command} simple-cert
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCertificateResourceArg(parser, 'to delete')
+    flags.AddAsyncFlagToParser(parser)
+
+  def Run(self, args):
+    client = certificates.CertificateClient()
+    cert_ref = args.CONCEPTS.certificate.Parse()
+
+    console_io.PromptContinue(
+        'You are about to delete certificate \'{}\''.format(
+            cert_ref.certificatesId),
+        throw_if_unattended=True,
+        cancel_on_no=True)
+
+    response = client.Delete(cert_ref)
+
+    response = util.WaitForOperation(response, is_async=args.async_)
+    log.DeletedResource(cert_ref.Name(), 'certificate', is_async=args.async_)
+    return response

gcloud auth application-default login/google-cloud-sdk/lib/surface/certificate_manager/certificates/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Describe an existing certificate.
+    description: |
+      This command fetches and prints information about an existing certificate.
+    examples: |
+      To describe a certificate with name my-cert, run:
+
+        $ {command} my-cert
+
+  request:
+    collection: certificatemanager.projects.locations.certificates
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The certificate you want to describe.
+      spec: !REF googlecloudsdk.command_lib.certificate_manager.resources:certificate

gcloud auth application-default login/google-cloud-sdk/lib/surface/certificate_manager/certificates/list.py

@@ -0,0 +1,84 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""`gcloud certificate-manager certificates list` command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.certificate_manager import certificates
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.certificate_manager import resource_args
+from googlecloudsdk.command_lib.certificate_manager import util
+
+_FORMAT = """\
+table(
+    name.scope(certificates):sort=1,
+    name.segment(3):label=LOCATION,
+    san_dnsnames.sansToString(undefined=''):label=SUBJECT_ALTERNATIVE_NAMES,
+    description,
+    scope,
+    expireTime.date('%Y-%m-%d %H:%M:%S %Oz', undefined=''),
+    createTime.date('%Y-%m-%d %H:%M:%S %Oz', undefined=''),
+    updateTime.date('%Y-%m-%d %H:%M:%S %Oz', undefined='')
+)
+"""
+
+
+def _TransformSANs(sans, undefined=''):
+  r"""Joins list of SANs with \n as separator..
+
+  Args:
+    sans: list of SANs.
+    undefined: str, value to be returned if no SANs are found.
+
+  Returns:
+    String representation to be shown in table view.
+  """
+  return '\n'.join(sans) if sans else undefined
+
+
+_TRANSFORMS = {
+    'sansToString': _TransformSANs,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class List(base.ListCommand):
+  """List certificates.
+
+  List Certificate Manager certificates in the project.
+
+  ## EXAMPLES
+
+  To list all certificates in the project, run:
+
+    $ {command}
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddLocationResourceArg(
+        parser, verb='to list certificates for', all_default_location=True)
+    parser.display_info.AddUriFunc(util.CertificateUriFunc)
+    parser.display_info.AddFormat(_FORMAT)
+    parser.display_info.AddTransforms(_TRANSFORMS)
+
+  def Run(self, args):
+    client = certificates.CertificateClient()
+    location_ref = args.CONCEPTS.location.Parse()
+    return client.List(location_ref, args.limit, args.page_size)

gcloud auth application-default login/google-cloud-sdk/lib/surface/certificate_manager/certificates/update.py

@@ -0,0 +1,92 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""`gcloud certificate-manager certificates update` command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.certificate_manager import certificates
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.certificate_manager import flags
+from googlecloudsdk.command_lib.certificate_manager import resource_args
+from googlecloudsdk.command_lib.certificate_manager import util
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import exceptions
+from googlecloudsdk.core import log
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Update(base.UpdateCommand):
+  """Update a certificate.
+
+  This command updates existing certificate.
+
+  ## EXAMPLES
+
+  To update a certificate with name simple-cert, run:
+
+    $ {command} simple-cert --description="desc" --update-labels="key=value"
+        --certificate-file=cert.pem --private-key-file=key.pem
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCertificateResourceArg(parser, 'to update')
+    labels_util.AddUpdateLabelsFlags(parser)
+    flags.AddDescriptionFlagToParser(parser, 'certificate')
+    flags.AddSelfManagedCertificateDataFlagsToParser(parser, is_required=False)
+    flags.AddAsyncFlagToParser(parser)
+
+  # Note: the surface is split across YAML and Python as the declarative YAML
+  # approach improperly handles one-of fields in updates
+  # per go/gcloud-creating-commands#when-to-use
+  def Run(self, args):
+    client = certificates.CertificateClient()
+    cert_ref = args.CONCEPTS.certificate.Parse()
+
+    new_self_managed_cert_data = None
+    # Certificate and private key files are marked as required flags in the
+    # group, so no need to manually check situations when only one of them is
+    # provided, gcloud should take care of it.
+    if args.IsSpecified('certificate_file') and args.IsSpecified(
+        'private_key_file'):
+      new_self_managed_cert_data = client.messages.SelfManagedCertificate(
+          pemCertificate=args.certificate_file.encode('utf-8'),
+          pemPrivateKey=args.private_key_file.encode('utf-8'),
+      )
+
+    new_description = None
+    if args.IsSpecified('description'):
+      new_description = args.description
+
+    labels_update = None
+    labels_diff = labels_util.Diff.FromUpdateArgs(args)
+    if labels_diff.MayHaveUpdates():
+      orig_resource = client.Get(cert_ref)
+      labels_update = labels_diff.Apply(client.messages.Certificate.LabelsValue,
+                                        orig_resource.labels).GetOrNone()
+
+    if new_description is None and labels_update is None and new_self_managed_cert_data is None:
+      raise exceptions.Error('Nothing to update.')
+    response = client.Patch(
+        cert_ref,
+        self_managed_cert_data=new_self_managed_cert_data,
+        labels=labels_update,
+        description=new_description)
+    response = util.WaitForOperation(response, is_async=args.async_)
+    log.UpdatedResource(cert_ref.Name(), 'certificate', is_async=args.async_)
+    return response