feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/__init__.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for opsagents CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Opsagents(base.Group):
+  """Manage Google Cloud Observability agents for Compute Engine VM instances."""
+
+  def Filter(self, context, args):
+    del context, args
+    base.EnableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/policies/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for os-config guest-policies CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class OpsagentsPolicies(base.Group):
+  """Manage Google Cloud Observability agents policies that install, update, and uninstall agents for Compute Engine VM instances."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/policies/create.py

@@ -0,0 +1,242 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# pylint: disable=line-too-long
+"""Implements command to create an ops agents policy."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import encoding
+from googlecloudsdk.api_lib.compute.instances.ops_agents import cloud_ops_agents_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents import ops_agents_policy as agent_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import cloud_ops_agents_policy_to_os_assignment_policy_converter as to_os_policy_assignment
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import guest_policy_to_ops_agents_policy_converter as to_ops_agents
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import ops_agents_policy_to_guest_policy_converter as to_guest_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import os_policy_assignment_to_cloud_ops_agents_policy_converter as to_cloud_ops_agents
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import cloud_ops_agents_policy_validator
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import ops_agents_policy_validator as validator
+from googlecloudsdk.api_lib.compute.os_config import utils as osconfig_api_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute.instances.ops_agents.policies import parser_utils
+from googlecloudsdk.command_lib.compute.os_config import utils as osconfig_command_utils
+from googlecloudsdk.core import properties
+from googlecloudsdk.core import yaml
+from googlecloudsdk.generated_clients.apis.osconfig.v1 import osconfig_v1_messages as osconfig
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+class CreateAlphaBeta(base.Command):
+  """Create a Google Cloud's operations suite agents (Ops Agents) policy.
+
+  *{command}* creates a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, enables autoupgrade, and removes Ops Agents.
+
+  The command returns the content of the created policy or an error indicating
+  why the creation fails. The created policy takes effect asynchronously. It
+  can take 10-15 minutes for the VMs to enforce the newly created policy.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+          To create a policy named ``ops-agents-test-policy'' that targets a
+          single CentOS 7 VM instance named
+          ``zones/us-central1-a/instances/test-instance'' for testing or
+          development and installs both Logging and Monitoring Agents on that
+          VM instance, run:
+
+            $ {command} ops-agents-test-policy --agent-rules="type=logging,enable-autoupgrade=false;type=metrics,enable-autoupgrade=false" --description="A test policy." --os-types=short-name=centos,version=7 --instances=zones/us-central1-a/instances/test-instance
+
+          To create a policy named ``ops-agents-prod-policy'' that targets all
+          CentOS 7 VMs in zone ``us-central1-a'' with either
+          ``env=prod,product=myapp'' or ``env=staging,product=myapp'' labels
+          and makes sure the logging agent and metrics agent versions are pinned
+          to specific major versions for staging and production, run:
+
+          $ {command} ops-agents-prod-policy --agent-rules="type=logging,version=1.*.*,enable-autoupgrade=false;type=metrics,version=6.*.*,enable-autoupgrade=false" --description="A prod policy." --os-types=short-name=centos,version=7 --zones=us-central1-a --group-labels="env=prod,product=myapp;env=staging,product=myapp"
+
+          To create a policy named ``ops-agents-prod-policy'' that targets all
+          CentOS 7 VMs in zone ``us-central1-a'' with either
+          ``env=prod,product=myapp'' or ``env=staging,product=myapp'' labels
+          and makes sure the ops-agent version is pinned
+          to specific major versions for staging and production, run:
+
+          $ {command} ops-agents-prod-policy --agent-rules="type=ops-agent,version=1.*.*,enable-autoupgrade=false" --description="A prod policy." --os-types=short-name=centos,version=7 --zones=us-central1-a --group-labels="env=prod,product=myapp;env=staging,product=myapp"
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser_utils.AddSharedArgs(parser)
+    parser_utils.AddMutationArgs(parser)
+    parser_utils.AddCreateArgs(parser)
+
+  def Run(self, args):
+    """See base class."""
+
+    release_track = self.ReleaseTrack()
+    client = osconfig_api_utils.GetClientInstance(
+        release_track, api_version_override='v1beta'
+    )
+    messages = osconfig_api_utils.GetClientMessages(
+        release_track, api_version_override='v1beta'
+    )
+    ops_agents_policy = agent_policy.CreateOpsAgentPolicy(
+        args.description,
+        args.agent_rules,
+        args.group_labels,
+        args.os_types,
+        args.zones,
+        args.instances,
+    )
+    validator.ValidateOpsAgentsPolicy(ops_agents_policy)
+    guest_policy = to_guest_policy.ConvertOpsAgentPolicyToGuestPolicy(
+        messages, ops_agents_policy
+    )
+    project = properties.VALUES.core.project.GetOrFail()
+    parent_path = osconfig_command_utils.GetProjectUriPath(project)
+    request = messages.OsconfigProjectsGuestPoliciesCreateRequest(
+        guestPolicy=guest_policy,
+        guestPolicyId=args.POLICY_ID,
+        parent=parent_path,
+    )
+    service = client.projects_guestPolicies
+    complete_guest_policy = service.Create(request)
+    ops_agents_policy = to_ops_agents.ConvertGuestPolicyToOpsAgentPolicy(
+        complete_guest_policy
+    )
+    return ops_agents_policy
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Create(base.Command):
+  """Create a Google Cloud Observability agents policy for the Ops Agent.
+
+  *{command}* creates a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, and removes Ops Agents.
+
+  The command returns the content of the created policy or an error indicating
+  why the creation fails. The created policy takes effect asynchronously. It
+  can take 10-15 minutes for the VMs to enforce the newly created policy.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES':
+          """
+          To create a Google Cloud Observability agents policy, run:
+            $ {command} agent-policy --project=PROJECT --zone=ZONE --file=config.yaml
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser.add_argument(
+        'POLICY_ID',
+        type=str,
+        help="""\
+          ID of the policy.
+
+          This ID must contain only lowercase letters,
+          numbers, and hyphens, end with a number or a letter, be between 1-63
+          characters, and be unique within the project.
+          """,
+    )
+    parser.add_argument(
+        '--file',
+        required=True,
+        help="""\
+          YAML file with agents policy to create. For
+          information about the agents policy format, see https://cloud.google.com/stackdriver/docs/solutions/agents/ops-agent/agent-policies#config-files.""",
+    )
+    parser.add_argument(
+        '--zone',
+        required=True,
+        help="""\
+          Zone in which to create the agents policy.""",
+    )
+    parser.add_argument(
+        '--debug-dry-run',
+        hidden=True,
+        action='store_true',
+        help=(
+            'If provided, the resulting OSPolicyAssignment will be printed to'
+            ' standard output and no actual changes are made.'
+        ),
+    )
+
+  def Run(self, args):
+    """See base class."""
+
+    # Load config from yaml file.
+    config = yaml.load_path(args.file)
+
+    # Convert to domain object from users input.
+    ops_agents_policy = cloud_ops_agents_policy.CreateOpsAgentsPolicy(
+        args.POLICY_ID, config)
+
+    cloud_ops_agents_policy_validator.ValidateOpsAgentsPolicy(ops_agents_policy)
+
+    project = properties.VALUES.core.project.GetOrFail()
+    parent_path = osconfig_command_utils.GetProjectLocationUriPath(
+        project, args.zone
+    )
+
+    assignment_id = osconfig_command_utils.GetOsPolicyAssignmentRelativePath(
+        parent_path, args.POLICY_ID
+    )
+
+    ops_policy_assignment = (
+        to_os_policy_assignment.ConvertOpsAgentsPolicyToOSPolicyAssignment(
+            assignment_id, ops_agents_policy
+        )
+    )
+    if args.debug_dry_run:
+      return ops_policy_assignment
+
+    release_track = self.ReleaseTrack()
+    messages = osconfig_api_utils.GetClientMessages(release_track)
+
+    # Create request to projects_locations_osPolicyAssignments.
+    request = (
+        messages.OsconfigProjectsLocationsOsPolicyAssignmentsCreateRequest(
+            oSPolicyAssignment=ops_policy_assignment,
+            osPolicyAssignmentId=args.POLICY_ID,
+            parent=parent_path,
+        )
+    )
+    client = osconfig_api_utils.GetClientInstance(release_track)
+    service = client.projects_locations_osPolicyAssignments
+    response = service.Create(request)
+    # Converting response from JSON python object.
+    complete_os_policy_assignment_obj = encoding.MessageToPyValue(
+        response.response
+    )
+    complete_os_policy_assignment = encoding.PyValueToMessage(
+        osconfig.OSPolicyAssignment, complete_os_policy_assignment_obj
+    )
+    # The returned policy should now include the update_date and the rollout_state.
+    policy = to_cloud_ops_agents.ConvertOsPolicyAssignmentToCloudOpsAgentsPolicy(
+        complete_os_policy_assignment
+    )
+
+    return policy.ToPyValue()

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/policies/delete.py

@@ -0,0 +1,203 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implements command to delete an ops agents policy."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import encoding
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.compute.instances.ops_agents import cloud_ops_agents_util
+from googlecloudsdk.api_lib.compute.instances.ops_agents import exceptions as ops_agents_exceptions
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import os_policy_assignment_to_cloud_ops_agents_policy_converter as to_ops_agents_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import guest_policy_validator
+from googlecloudsdk.api_lib.compute.os_config import utils as osconfig_api_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute.instances.ops_agents.policies import parser_utils
+from googlecloudsdk.command_lib.compute.os_config import utils as osconfig_command_utils
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+from googlecloudsdk.generated_clients.apis.osconfig.v1 import osconfig_v1_messages as osconfig
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+class DeleteAlphaBeta(base.DeleteCommand):
+  """Delete a Google Cloud's operations suite agents (Ops Agents) policy.
+
+  *{command}* deletes a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, enables autoupgrade, and removes Ops Agents.
+
+  The command returns a response indicating whether the deletion succeeded.
+  After a policy is deleted, it takes 10-15 minutes to be wiped from the
+  applicable instances. Deleting a policy does not delete any existing agents
+  managed by that policy, but the agents become unmanaged by any policies. To
+  remove the agents from the
+  instances, first update the policy to set the agent ``package-state'' to
+  ``removed'', wait for the policy to take effect, then delete the policy.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+          To delete an Ops agents policy named ``ops-agents-test-policy'' in the
+          current project, run:
+
+            $ {command} ops-agents-test-policy
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser_utils.AddSharedArgs(parser)
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+    client = osconfig_api_utils.GetClientInstance(
+        release_track, api_version_override='v1beta'
+    )
+    messages = osconfig_api_utils.GetClientMessages(
+        release_track, api_version_override='v1beta'
+    )
+    project = properties.VALUES.core.project.GetOrFail()
+    guest_policy_uri_path = osconfig_command_utils.GetGuestPolicyUriPath(
+        'projects', project, args.POLICY_ID
+    )
+    service = client.projects_guestPolicies
+
+    get_request = messages.OsconfigProjectsGuestPoliciesGetRequest(
+        name=guest_policy_uri_path
+    )
+    try:
+      get_response = service.Get(get_request)
+    except apitools_exceptions.HttpNotFoundError:
+      raise ops_agents_exceptions.PolicyNotFoundError(policy_id=args.POLICY_ID)
+    if not guest_policy_validator.IsOpsAgentPolicy(get_response):
+      raise ops_agents_exceptions.PolicyNotFoundError(policy_id=args.POLICY_ID)
+
+    delete_request = messages.OsconfigProjectsGuestPoliciesDeleteRequest(
+        name=guest_policy_uri_path
+    )
+    delete_response = service.Delete(delete_request)
+
+    log.DeletedResource(args.POLICY_ID)
+    return delete_response
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Delete(base.Command):
+  """Delete a Google Cloud Observability agents policy for the Ops Agent.
+
+  *{command}* deletes a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters.
+
+  The command returns a response indicating whether the deletion succeeded.
+  After a policy is deleted, it takes 10-15 minutes to be wiped from the
+  applicable instances. Deleting a policy does not delete any existing agents
+  managed by that policy, but the agents become unmanaged by any policies. To
+  remove the agents from the instances, first update the policy to set the
+  agent ``packageState'' to ``removed'', wait for the policy to take effect,
+  then delete the policy.
+
+  The command returns the content of the deleted policy. For instance:
+
+    agentsRule:
+      packageState: installed
+      version: latest
+    instanceFilter:
+      inclusionLabels:
+      - labels:
+          env: prod
+
+  If no policies are found, or the policy is not an agents policy, then the
+  command returns a ``NOT_FOUND'' error.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+          To delete an agents policy named ``ops-agents-test-policy'' in the
+          current project, run:
+
+          $ {command} ops-agents-test-policy --zone=ZONE
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser.add_argument(
+        'POLICY_ID',
+        type=str,
+        help="""\
+          ID of the policy.
+
+          This ID must contain only lowercase letters,
+          numbers, and hyphens, end with a number or a letter, be between 1-63
+          characters, and be unique within the project.
+          """,
+    )
+    parser.add_argument(
+        '--zone',
+        required=True,
+        help="""\
+          Zone of the agents policy you want to delete.""",
+    )
+
+  def Run(self, args):
+    """See base class."""
+
+    release_track = self.ReleaseTrack()
+    project = properties.VALUES.core.project.GetOrFail()
+    # Make sure the policy we're deleting is a valid Ops Agents policy.
+    _ = cloud_ops_agents_util.GetOpsAgentsPolicyFromApi(
+        release_track, args.POLICY_ID, project, args.zone
+    )
+
+    parent_path = osconfig_command_utils.GetProjectLocationUriPath(
+        project, args.zone
+    )
+
+    assignment_id = osconfig_command_utils.GetOsPolicyAssignmentRelativePath(
+        parent_path, args.POLICY_ID
+    )
+
+    messages = osconfig_api_utils.GetClientMessages(release_track)
+    delete_request = (
+        messages.OsconfigProjectsLocationsOsPolicyAssignmentsDeleteRequest(
+            name=assignment_id
+        )
+    )
+
+    client = osconfig_api_utils.GetClientInstance(release_track)
+    service = client.projects_locations_osPolicyAssignments
+    delete_response = service.Delete(delete_request)
+
+    # Converting osconfig.Operation.ResponseValue to
+    # osconfig.OSPolicyAssignment.
+    delete_os_policy_assignment = encoding.PyValueToMessage(
+        osconfig.OSPolicyAssignment,
+        encoding.MessageToPyValue(delete_response.response),
+    )
+    ops_agents_policy = (
+        to_ops_agents_policy.ConvertOsPolicyAssignmentToCloudOpsAgentsPolicy(
+            delete_os_policy_assignment
+        )
+    )
+    return ops_agents_policy.ToPyValue()

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/policies/describe.py

@@ -0,0 +1,176 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implements command to describe an ops agents policy."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.compute.instances.ops_agents import cloud_ops_agents_util
+from googlecloudsdk.api_lib.compute.instances.ops_agents import exceptions as ops_agents_exceptions
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import guest_policy_to_ops_agents_policy_converter as to_ops_agents
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import guest_policy_validator
+from googlecloudsdk.api_lib.compute.os_config import utils as osconfig_api_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as calliope_exceptions
+from googlecloudsdk.command_lib.compute.instances.ops_agents.policies import parser_utils
+from googlecloudsdk.command_lib.compute.os_config import utils as osconfig_command_utils
+from googlecloudsdk.core import properties
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+class DescribeAlphaBeta(base.DescribeCommand):
+  """Describe a Google Cloud's operations suite agents (Ops Agents) policy.
+
+  *{command}* describes a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, enables autoupgrade, and removes Ops Agents.
+
+  The command returns the content of one policy. For instance:
+
+    agent_rules:
+    - enable_autoupgrade: true
+      package_state: installed
+      type: ops-agent
+      version: latest
+    assignment:
+      group_labels:
+      - app: myapp
+        env: prod
+      os_types:
+      - short_name: ubuntu
+        version: '18.04'
+      zones:
+      - us-central1-a
+    create_time: '2021-02-02T02:10:25.344Z'
+    description: A test policy to install agents
+    etag: <ETAG>
+    id: projects/<PROJECT_NUMBER>/guestPolicies/ops-agents-test-policy
+    update_time: '2021-02-02T02:10:25.344Z'
+
+  If no policies are found, it returns a ``NOT_FOUND'' error.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+          To describe an Ops Agents policy named ``ops-agents-test-policy'' in
+          the current project, run:
+
+            $ {command} ops-agents-test-policy
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser_utils.AddSharedArgs(parser)
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+
+    project = properties.VALUES.core.project.GetOrFail()
+    guest_policy_uri_path = osconfig_command_utils.GetGuestPolicyUriPath(
+        'projects', project, args.POLICY_ID
+    )
+    client = osconfig_api_utils.GetClientInstance(
+        release_track, api_version_override='v1beta'
+    )
+    service = client.projects_guestPolicies
+    messages = osconfig_api_utils.GetClientMessages(
+        release_track, api_version_override='v1beta'
+    )
+
+    get_request = messages.OsconfigProjectsGuestPoliciesGetRequest(
+        name=guest_policy_uri_path
+    )
+    try:
+      get_response = service.Get(get_request)
+    except apitools_exceptions.HttpNotFoundError:
+      raise ops_agents_exceptions.PolicyNotFoundError(policy_id=args.POLICY_ID)
+    if not guest_policy_validator.IsOpsAgentPolicy(get_response):
+      raise ops_agents_exceptions.PolicyNotFoundError(policy_id=args.POLICY_ID)
+    try:
+      ops_agents_policy = to_ops_agents.ConvertGuestPolicyToOpsAgentPolicy(
+          get_response
+      )
+    except calliope_exceptions.BadArgumentException:
+      raise ops_agents_exceptions.PolicyMalformedError(policy_id=args.POLICY_ID)
+    return ops_agents_policy
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Describe(base.DescribeCommand):
+  """Describe a Google Cloud Observability agents policy for the Ops Agent.
+
+  *{command}* describes a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, and removes Ops Agents.
+
+  The command returns the content of one policy. For instance:
+
+    agentsRule:
+      packageState: installed
+      version: latest
+    instanceFilter:
+      inclusionLabels:
+      - labels:
+          env: prod
+
+  If no policies are found, then the command returns a `NOT_FOUND` error.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+          To describe an agents policy named `ops-agents-test-policy` in
+          the current project, run:
+
+            $ {command} ops-agents-test-policy --zone=ZONE
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser.add_argument(
+        'POLICY_ID',
+        type=str,
+        help="""\
+          ID of the policy.
+
+          This ID must contain only lowercase letters,
+          numbers, and hyphens, end with a number or a letter, be between 1-63
+          characters, and be unique within the project.
+          """,
+    )
+    parser.add_argument(
+        '--zone',
+        required=True,
+        help="""\
+          Zone of the agents policy.""",
+    )
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+    project = properties.VALUES.core.project.GetOrFail()
+
+    return cloud_ops_agents_util.GetOpsAgentsPolicyFromApi(
+        release_track, args.POLICY_ID, project, args.zone
+    ).ToPyValue()

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/policies/list.py

@@ -0,0 +1,211 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implements command to list guest policies."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import list_pager
+from googlecloudsdk.api_lib.compute.instances.ops_agents import ops_agents_policy as agent_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import guest_policy_to_ops_agents_policy_converter as converter
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import os_policy_assignment_to_cloud_ops_agents_policy_converter as to_ops_agents_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import cloud_ops_agents_policy_validator
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import guest_policy_validator
+from googlecloudsdk.api_lib.compute.os_config import utils as osconfig_api_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.compute.os_config import utils as osconfig_command_utils
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+
+
+def _TransformGuestPolicyDescription(resource):
+  """Returns a length-limited guest policy description."""
+
+  max_len = 30  # Show only the first 30 characters if description is long.
+  description = resource.get('description', '')
+  return (description[:max_len] +
+          '...') if len(description) > max_len else description
+
+
+def _Args(parser):
+  """Parses input flags and sets up output formats."""
+
+  parser.display_info.AddFormat("""
+        table(
+          id.basename(),
+          description(),
+          create_time,
+          update_time
+        )
+      """)
+  parser.display_info.AddTransforms(
+      {'description': _TransformGuestPolicyDescription})
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+class ListAlphaBeta(base.ListCommand):
+  """List Google Cloud's operations suite agents (Ops Agents) policies.
+
+  {command} lists policies that facilitate agent management across Compute
+  Engine instances based on user specified instance filters. These policies
+  install, specify versioning, enable autoupgrade, and remove Ops Agents.
+
+  The command returns a list of policies, including the ``ID'', ``DESCRIPTION'',
+  ``CREATE_TIME'', and ``UPDATE_TIME'' for each policy. If no policies are
+  found, it returns an empty list. If malformed policies are found, they are
+  included in the result list with the descriptions replaced by ``<MALFORMED>'',
+  and a warning is shown.
+  """
+
+  detailed_help = {
+      'DESCRIPTION':
+      '{description}',
+      'EXAMPLES':
+      """\
+      To list guest policies in the current project, run:
+
+      $ {command}
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    _Args(parser)
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+    client = osconfig_api_utils.GetClientInstance(
+        release_track, api_version_override='v1beta')
+    messages = osconfig_api_utils.GetClientMessages(
+        release_track, api_version_override='v1beta')
+
+    project = properties.VALUES.core.project.GetOrFail()
+    request = messages.OsconfigProjectsGuestPoliciesListRequest(
+        pageSize=args.page_size,
+        parent=osconfig_command_utils.GetProjectUriPath(project),
+    )
+    service = client.projects_guestPolicies
+
+    for guest_policy in list_pager.YieldFromList(
+        service,
+        request,
+        limit=args.limit,
+        predicate=guest_policy_validator.IsOpsAgentPolicy,
+        batch_size=osconfig_command_utils.GetListBatchSize(args),
+        field='guestPolicies',
+        batch_size_attribute='pageSize',
+    ):
+      try:
+        yield converter.ConvertGuestPolicyToOpsAgentPolicy(guest_policy)
+      except exceptions.BadArgumentException:
+        log.warning(
+            'Encountered a malformed policy. The Ops Agents policy [%s] may '
+            'have been modified directly by the OS Config guest policy API / '
+            'gcloud commands. If so, please delete and re-create with the Ops '
+            'Agents policy gcloud commands. If not, this may be an internal '
+            'error.',
+            guest_policy.name,
+        )
+        yield agent_policy.OpsAgentPolicy(
+            assignment=None,
+            agent_rules=None,
+            description='<MALFORMED>',
+            etag=None,
+            name=guest_policy.name,
+            update_time=guest_policy.updateTime,
+            create_time=guest_policy.createTime,
+        )
+
+
+def _ArgsGA(parser):
+  """Parses input flags and sets up output formats."""
+  parser.add_argument(
+      '--zone',
+      required=True,
+      help="""\
+          Zone for which you want to list agent policies.""",
+  )
+  parser.display_info.AddFormat("""
+        table(
+          policy_id.basename(),
+          rollout_state,
+          update_time.date("%Y-%m-%dT%H:%M:%SZ")
+          )
+      """)
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class List(base.ListCommand):
+  """List a Google Cloud Observability agents policy for the Ops Agent.
+
+  {command} lists policies that facilitate agent management across Compute
+  Engine instances based on user specified instance filters. These policies
+  install, specify versioning, and remove agents.
+
+  The command returns a list of policies, including the ``POLICY_ID'',
+  ``ROLLOUT_STATE'', and ``UPDATE_TIME'' for each policy. If no policies are
+  found, then the command returns an empty list. If policies were found but they
+  don't match as agents policies, then those policies won't be shown in the
+  list.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+      To list agents policies in the current project, run:
+
+      $ {command} --zone=ZONE
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    _ArgsGA(parser)
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+    client = osconfig_api_utils.GetClientInstance(release_track)
+    messages = osconfig_api_utils.GetClientMessages(release_track)
+
+    project = properties.VALUES.core.project.GetOrFail()
+    request = messages.OsconfigProjectsLocationsOsPolicyAssignmentsListRequest(
+        pageSize=args.page_size,
+        parent=osconfig_command_utils.GetProjectLocationUriPath(
+            project, args.zone
+        ),
+    )
+    service = client.projects_locations_osPolicyAssignments
+
+    for os_policy in list_pager.YieldFromList(
+        service,
+        request,
+        limit=args.limit,
+        predicate=cloud_ops_agents_policy_validator.IsCloudOpsAgentsPolicy,
+        batch_size=osconfig_command_utils.GetListBatchSize(args),
+        field='osPolicyAssignments',
+        batch_size_attribute='pageSize',
+    ):
+      yield (
+          to_ops_agents_policy.ConvertOsPolicyAssignmentToCloudOpsAgentsPolicy(
+              os_policy
+          )
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/instances/ops_agents/policies/update.py

@@ -0,0 +1,281 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implements command to update an ops agents policy."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import encoding
+from googlecloudsdk.api_lib.compute.instances.ops_agents import cloud_ops_agents_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents import cloud_ops_agents_util
+from googlecloudsdk.api_lib.compute.instances.ops_agents import ops_agents_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import cloud_ops_agents_policy_to_os_assignment_policy_converter as to_os_policy_assignment
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import guest_policy_to_ops_agents_policy_converter
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import ops_agents_policy_to_guest_policy_converter
+from googlecloudsdk.api_lib.compute.instances.ops_agents.converters import os_policy_assignment_to_cloud_ops_agents_policy_converter as to_ops_agents_policy
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import cloud_ops_agents_policy_validator
+from googlecloudsdk.api_lib.compute.instances.ops_agents.validators import ops_agents_policy_validator
+from googlecloudsdk.api_lib.compute.os_config import utils as osconfig_api_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute.instances.ops_agents.policies import parser_utils
+from googlecloudsdk.command_lib.compute.os_config import utils as osconfig_command_utils
+from googlecloudsdk.core import properties
+from googlecloudsdk.core import yaml
+from googlecloudsdk.generated_clients.apis.osconfig.v1 import osconfig_v1_messages as osconfig
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+class UpdateAlphaBeta(base.Command):
+  """Update a Google Cloud operations suite agent (Ops Agent) policy.
+
+  *{command}* updates a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, enables autoupgrade, and removes Ops Agents.
+
+  The command returns the content of the updated policy or an error indicating
+  why the update fails. The updated policy takes effect asynchronously. It
+  can take 10-15 minutes for the VMs to enforce the updated policy.
+
+  The available flags for the ``update'' command are similar to the flags for
+  the ``create'' command. All the flags for ``update'' are optional. If a flag
+  is not specified, it retains the original value. The full value of each flag
+  needs to be re-stated during ``update''. Take the ``--agents'' flag for
+  example:
+
+  If the original policy specified two agents
+  (``--agents="type=logging;type=metrics"''), and only one agent
+  (``--agents="type=logging"'') is specified in a *{command}* command, then the
+  policy stops managing and enforcing the unspecified agent. In order to remove
+  the metrics agent in this case, set the package state explicitly to
+  ``removed'' (``--agents="type=logging;type=metrics,package-state=removed"'').
+
+  In order to explicitly clear the ``--group-labels'', ``--instances'', and
+  ``--zones'' instance filters, use the following flags as documented below:
+  ``--clear-group-labels'', ``--clear-instances'', and ``--clear-zones'' flags.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES': """\
+          To update a policy named ``ops-agents-test-policy'' to target a
+          single CentOS 7 VM instance named
+          ``zones/us-central1-a/instances/test-instance'' for testing or
+          development, and install both Logging and Monitoring Agents on that
+          VM instance, run:
+
+          $ {command} ops-agents-test-policy --agent-rules="type=logging,enable-autoupgrade=false;type=metrics,enable-autoupgrade=false" --instances=zones/us-central1-a/instances/test-instance --os-types=short-name=centos,version=7
+
+          To update a policy named ``ops-agents-prod-policy'' to target all
+          CentOS 7 VMs in zone ``us-central1-a'' with either
+          ``env=prod,product=myapp'' labels or ``env=staging,product=myapp''
+          labels, and make sure the logging agent and metrics agent versions are
+          pinned to specific major versions for staging and production, run:
+
+          $ {command} ops-agents-prod-policy --agent-rules="type=logging,version=1.*.*,enable-autoupgrade=false;type=metrics,version=6.*.*,enable-autoupgrade=false" --group-labels="env=prod,product=myapp;env=staging,product=myapp" --os-types=short-name=centos,version=7 --zones=us-central1-a
+
+          To update a policy named ``ops-agents-labels-policy'' to clear the
+          instances filters and use a group labels filter instead to target VMs
+          with either ``env=prod,product=myapp'' or
+          ``env=staging,product=myapp'' labels, run:
+
+          $ {command} ops-agents-labels-policy --clear-instances --group-labels="env=prod,product=myapp;env=staging,product=myapp"
+
+          To perform the same update as above, conditionally on the fact that
+          the policy's etag (retrieved by an earlier command) is
+          ``f59741c8-bb5e-4ee6-bf6f-c4ebeb6b06e0'', run:
+
+          $ {command} ops-agents-labels-policy --clear-instances --group-labels="env=prod,product=myapp;env=staging,product=myapp" --etag=f59741c8-bb5e-4ee6-bf6f-c4ebeb6b06e0
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser_utils.AddSharedArgs(parser)
+    parser_utils.AddMutationArgs(parser=parser, required=False)
+    parser_utils.AddUpdateArgs(parser)
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+    client = osconfig_api_utils.GetClientInstance(
+        release_track, api_version_override='v1beta'
+    )
+    messages = osconfig_api_utils.GetClientMessages(
+        release_track, api_version_override='v1beta'
+    )
+
+    project = properties.VALUES.core.project.GetOrFail()
+    request = messages.OsconfigProjectsGuestPoliciesGetRequest(
+        name=osconfig_command_utils.GetGuestPolicyUriPath(
+            'projects', project, args.POLICY_ID
+        )
+    )
+    service = client.projects_guestPolicies
+    current_guest_policy = service.Get(request)
+    current_ops_agents_policy = guest_policy_to_ops_agents_policy_converter.ConvertGuestPolicyToOpsAgentPolicy(
+        current_guest_policy
+    )
+    updated_ops_agents_policy = ops_agents_policy.UpdateOpsAgentsPolicy(
+        current_ops_agents_policy,
+        args.description,
+        args.etag,
+        args.agent_rules,
+        args.os_types,
+        [] if args.clear_group_labels else args.group_labels,
+        [] if args.clear_zones else args.zones,
+        [] if args.clear_instances else args.instances,
+    )
+    ops_agents_policy_validator.ValidateOpsAgentsPolicy(
+        updated_ops_agents_policy
+    )
+    updated_os_config_policy = ops_agents_policy_to_guest_policy_converter.ConvertOpsAgentPolicyToGuestPolicy(
+        messages, updated_ops_agents_policy, current_guest_policy.recipes
+    )
+    request = messages.OsconfigProjectsGuestPoliciesPatchRequest(
+        guestPolicy=updated_os_config_policy,
+        name=osconfig_command_utils.GetGuestPolicyUriPath(
+            'projects', project, args.POLICY_ID
+        ),
+        updateMask=None,
+    )
+    complete_os_config_policy = service.Patch(request)
+    complete_ops_agent_policy = guest_policy_to_ops_agents_policy_converter.ConvertGuestPolicyToOpsAgentPolicy(
+        complete_os_config_policy
+    )
+    return complete_ops_agent_policy
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Update(base.Command):
+  """Update a Google Cloud Observability agents policy for the Ops Agent.
+
+  *{command}* modifies a policy that facilitates agent management across
+  Compute Engine instances based on user specified instance filters. This policy
+  installs, specifies versioning, and removes Ops Agents.
+
+  The command returns the content of the modified policy or an error indicating
+  why the modification fails. The modified policy takes effect asynchronously.
+  It can take 10-15 minutes for the VMs to enforce the newly modified policy.
+  """
+
+  detailed_help = {
+      'DESCRIPTION': '{description}',
+      'EXAMPLES':
+          """
+          To update a Google Cloud Observability agents policy, run:
+            $ {command} agent-policy --project=PROJECT --zone=ZONE --file=config.yaml
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    parser.add_argument(
+        'POLICY_ID',
+        type=str,
+        help="""\
+          ID of the policy.
+
+          This ID must contain only lowercase letters,
+          numbers, and hyphens, end with a number or a letter, be between 1-63
+          characters, and be unique within the project.
+          """,
+    )
+    parser.add_argument(
+        '--file',
+        required=True,
+        help="""\
+          YAML file with a subset of agents policy fields you wish to update. For
+          information about the agents policy format, see https://cloud.google.com/stackdriver/docs/solutions/agents/ops-agent/agent-policies#config-files.""",
+    )
+    parser.add_argument(
+        '--zone',
+        required=True,
+        help="""\
+          Zone where the agents policy is located.""",
+    )
+    parser.add_argument(
+        '--debug-dry-run',
+        action='store_true',
+        hidden=True,
+        help=(
+            'If provided, the resulting OSPolicyAssignment will be printed to'
+            ' standard output and no actual changes are made.'
+        ),
+    )
+
+  def Run(self, args):
+    """See base class."""
+    release_track = self.ReleaseTrack()
+    project = properties.VALUES.core.project.GetOrFail()
+    # Make sure the policy we're updating is a valid Ops Agents policy.
+    current_ops_agents_policy = cloud_ops_agents_util.GetOpsAgentsPolicyFromApi(
+        release_track, args.POLICY_ID, project, args.zone
+    )
+
+    # Grab user's config.
+    config = yaml.load_path(args.file)
+
+    updated_policy = cloud_ops_agents_policy.UpdateOpsAgentsPolicy(
+        update_ops_agents_policy=config,
+        ops_agents_policy=current_ops_agents_policy,
+    )
+    cloud_ops_agents_policy_validator.ValidateOpsAgentsPolicy(updated_policy)
+
+    parent_path = osconfig_command_utils.GetProjectLocationUriPath(
+        project, args.zone
+    )
+    assignment_id = osconfig_command_utils.GetOsPolicyAssignmentRelativePath(
+        parent_path, args.POLICY_ID
+    )
+    messages = osconfig_api_utils.GetClientMessages(release_track)
+
+    # TODO: b/339694475 - Include updateMask to better indicate what fields
+    # were updated.
+    os_policy_assignment = (
+        to_os_policy_assignment.ConvertOpsAgentsPolicyToOSPolicyAssignment(
+            name=assignment_id, ops_agents_policy=updated_policy
+        )
+    )
+    if args.debug_dry_run:
+      return os_policy_assignment
+
+    update_request = (
+        messages.OsconfigProjectsLocationsOsPolicyAssignmentsPatchRequest(
+            oSPolicyAssignment=os_policy_assignment,
+            name=assignment_id,
+        )
+    )
+    client = osconfig_api_utils.GetClientInstance(release_track)
+    service = client.projects_locations_osPolicyAssignments
+    update_response = service.Patch(update_request)
+
+    # Converting osconfig.Operation.ReponseValue to osconfig.OSPolicyAssignment.
+    updated_os_policy_assignment = encoding.PyValueToMessage(
+        osconfig.OSPolicyAssignment,
+        encoding.MessageToPyValue(update_response.response),
+    )
+
+    updated_ops_agents_policy = (
+        to_ops_agents_policy.ConvertOsPolicyAssignmentToCloudOpsAgentsPolicy(
+            updated_os_policy_assignment
+        )
+    )
+    # Picking up the update time and rollout state from the underlying API
+    # object.
+    return updated_ops_agents_policy.ToPyValue()