feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Deploy(base.Group):
+  """Create and manage Cloud Deploy resources."""
+
+  category = base.CI_CD_CATEGORY
+
+  def Filter(self, context, args):
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/apply.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Applies a yaml configuration containing Delivery Pipeline(s), Target(s), Custom Target Type(s), and Automation(s) declarative definitions."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import deploy
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import yaml
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+      To apply a Cloud Deploy YAML file `deploy.yaml`:
+
+         $ {command} --file=deploy.yaml --region=us-central1
+
+    """,
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  flags.AddConfigFile(parser)
+  resource_args.AddLocationResourceArg(parser)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Apply(base.UpdateCommand):
+  """Applies a yaml configuration containing Delivery Pipeline(s), Target(s), Custom Target Type(s), Deploy Policy(ies), and Automation(s) declarative definitions."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """This is what gets called when the user runs this command."""
+    loaded_yaml = list(yaml.load_all_path(args.file))
+    deploy_client = deploy.DeployClient()
+    region_ref = args.CONCEPTS.region.Parse()
+    region = region_ref.AsDict()['locationsId']
+
+    deploy_client.CreateResources(loaded_yaml, region)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automation_runs/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class AutomationRuns(base.Group):
+  """Manages AutomationRuns resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automation_runs/cancel.py

@@ -0,0 +1,65 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Cancels a Cloud Deploy AutomationRun."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import automation_run
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import log
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': textwrap.dedent("""\
+     To cancel an AutomationRun `test-run` for delivery pipeline `test-pipeline`
+     in region `us-central1`, run:
+
+      $ {command} test-run --delivery-pipeline=test-pipeline
+      --region=us-central1
+      """),
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Cancel(base.CreateCommand):
+  """Cancels a Cloud Deploy Automation Run."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddAutomationRunResourceArg(parser, positional=True)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    automation_run_ref = args.CONCEPTS.automation_run.Parse()
+    log.status.Print(
+        'Cancelling automation run {}.\n'.format(
+            automation_run_ref.RelativeName()
+        )
+    )
+
+    return automation_run.AutomationRunsClient().Cancel(
+        automation_run_ref.RelativeName()
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automation_runs/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Show details for an Automation Run.
+    description: Show details for a specified automation run.
+    examples: |
+      To show details about a automation run 'test-automationrun', for delivery pipeline 'test-pipeline', in region 'us-central1', run:
+
+        $ {command} test-automationrun --delivery-pipeline=test-pipeline --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.automationRuns
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The name of the automation run you want to describe.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:automation_run
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automation_runs/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: List the Automation Runs.
+    description: |
+      List the automation runs for a specified delivery pipeline.
+    examples: |
+      To list the automation runs for delivery pipeline 'test-pipeline' in region 'us-central1', run:
+
+        $ {command} --delivery-pipeline=test-pipeline --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.automationRuns
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The delivery pipeline for which you want to list the automation runs.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automations/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Automations(base.Group):
+  """Manages Automations resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automations/delete.py

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Deletes a Gcloud Deploy Automation resource."""
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import client_util
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import automation_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core.console import console_io
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': textwrap.dedent("""\
+        To delete an automation `test-automation` for delivery pipeline `test-pipeline`, in region `us-central1`, run:
+
+          $ {command} test-automation --delivery-pipeline=test-pipeline --region=us-central1
+        """),
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Delete(base.DeleteCommand):
+  """Deletes a Cloud Deploy Automation."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddAutomationResourceArg(parser, positional=True)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the delete command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    console_io.PromptContinue(
+        prompt_string='Once an automation is deleted, it cannot be recovered.',
+        cancel_on_no=True,
+    )
+    automation_ref = args.CONCEPTS.automation.Parse()
+    op = automation_util.DeleteAutomation(automation_ref.RelativeName())
+    client_util.OperationsClient().CheckOperationStatus(
+        {automation_ref.RelativeName(): op},
+        'Deleted Cloud Deploy automation: {}.',
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automations/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Show details for an Automation.
+    description: Show details for a specified automation.
+    examples: |
+      To show details about an automation 'test-automation', for delivery pipeline 'test-pipeline', in region 'us-central1', run:
+
+        $ {command} test-automation --delivery-pipeline=test-pipeline --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.automations
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The name of the automation you want to describe.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:automation
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automations/export.py

@@ -0,0 +1,76 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Gcloud Deploy automation resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import automation
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import export_util
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.export import util as core_export_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': textwrap.dedent("""\
+
+      To return the YAML definition of the automation `test-automation` of delivery pipeline `test-pipeline`, in region `us-central1`, run:
+
+        $ {command} test-automation --delivery-pipeline=test-pipeline --region=us-central1
+
+      """),
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Export(base.ExportCommand):
+  """Returns the YAML definition of the specified Automation.
+
+  The exported yaml definition can be applied by using the `deploy apply`
+  command.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddAutomationResourceArg(parser, positional=True)
+    core_export_util.AddExportFlags(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    resource_ref = args.CONCEPTS.automation.Parse()
+    resource = automation.AutomationsClient().Get(resource_ref.RelativeName())
+
+    manifest = manifest_util.ProtoToManifest(
+        resource, resource_ref, manifest_util.ResourceKind.AUTOMATION
+    )
+
+    export_util.Export(manifest, args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/automations/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: List the Automations.
+    description: |
+      List the automations for a specified delivery pipeline.
+    examples: |
+      To list the automations for delivery pipeline 'test-pipeline' in region 'us-central1', run:
+
+        $ {command} --delivery-pipeline=test-pipeline --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.automations
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The delivery pipeline for which you want to list the automations.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Custom Target Type command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class CustomTargetTypes(base.Group):
+  """Create and manage Custom Target Type resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/add_iam_policy_binding.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Add IAM policy binding for a Cloud Deploy Custom Target Type.
+    description: |
+      Adds a policy binding to the IAM policy of a Cloud Deploy Custom
+      Target Type. One binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To add an IAM policy binding for the role of `roles/clouddeploy.customTargetTypeAdmin`
+      for the user `test-user@gmail.com` on `my-custom-target-type` with the region
+      `us-central1`, run:
+
+        $ {command} my-custom-target-type \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.customTargetTypeAdmin'
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.customTargetTypes
+  arguments:
+    resource:
+      help_text: The custom target type for which to add the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:custom_target_type
+      is_positional: true
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/delete.yaml

@@ -0,0 +1,21 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Delete a custom target type.
+    description: Delete a custom target type for a specified region.
+    examples: |
+      The following command will delete custom target type `test-custom-target-type`, in region `us-central1`:
+
+        $ {command} test-custom-target-type --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.customTargetTypes
+    api_version: v1
+
+  async:
+    collection: clouddeploy.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The name of the custom target type to delete.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:custom_target_type
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Show details for a custom target type.
+    description: Show details for a specified custom target type.
+    examples: |
+      To show details about a custom target type `test-custom-target-type` in region `us-central`, run:
+
+        $ {command} test-custom-target-type --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.customTargetTypes
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The name of the custom target type you want to describe.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:custom_target_type
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/export.py

@@ -0,0 +1,78 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Cloud Deploy custom target type resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import custom_target_type
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import export_util
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.export import util as core_export_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': textwrap.dedent("""\
+
+      To return the .yaml definition of the custom target type `test-custom-target-type`, in region `us-central1`, run:
+
+        $ {command} test-custom-target-type --region=us-central1
+
+      """),
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Export(base.ExportCommand):
+  """Returns the .yaml definition of the specified custom target type.
+
+  The exported yaml definition can be applied by `deploy apply` command.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCustomTargetTypeResourceArg(parser, positional=True)
+    core_export_util.AddExportFlags(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparser.Namespace, an object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    custom_target_type_ref = args.CONCEPTS.custom_target_type.Parse()
+    resource = custom_target_type.CustomTargetTypesClient().Get(
+        custom_target_type_ref.RelativeName()
+    )
+    manifest = manifest_util.ProtoToManifest(
+        resource,
+        custom_target_type_ref,
+        manifest_util.ResourceKind.CUSTOM_TARGET_TYPE,
+    )
+
+    export_util.Export(manifest, args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/get_iam_policy.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Get the IAM policy for a Cloud Deploy Custom Target Type.
+    description: |
+      *{command}* displays the IAM policy associated with a Cloud Deploy
+      Custom Target Type. If formatted as JSON, the output can be edited
+      and used as a policy file for *set-iam-policy*. The output includes
+      an "etag" field identifying the version emitted and allowing detection
+      of concurrent policy updates; see $ {parent_command} set-iam-policy
+      for additional details.
+    examples: |
+      To print the IAM policy for a custom target type `my-custom-target-type` in region `us-central1`, run:
+
+        $ {command} my-custom-target-type --region=us-central1
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.customTargetTypes
+  arguments:
+    resource:
+      help_text: The custom target type for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:custom_target_type
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/list.yaml

@@ -0,0 +1,21 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: List the custom target types.
+    description: List the custom target types for a specified region.
+    examples: |
+      To list the custom target types in region `us-central1`, run:
+
+        $ {command} --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.customTargetTypes
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The region for which you want to list the custom target types.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:location
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/remove_iam_policy_binding.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Remove an IAM policy binding for a Cloud Deploy Custom Target Type.
+    description: |
+      Removes a policy binding to the IAM policy of a Cloud Deploy Custom Target Type.
+      One binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To remove an IAM policy binding for the role of `roles/clouddeploy.customTargetTypeAdmin`
+      for the user `test-user@gmail.com` on `my-custom-target-type` with the region `us-central1`, run:
+
+        $ {command} my-custom-target-type \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.customTargetTypeAdmin'
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.customTargetTypes
+  arguments:
+    resource:
+      help_text: The custom target type for which to remove the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:custom_target_type
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/custom_target_types/set_iam_policy.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Set the IAM policy for a Cloud Deploy Custom Target Type.
+    description: |
+      Set the IAM policy associated with a Cloud Deploy Custom Target Type.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      `policy.json` and set it for a custom target type with identifier
+      `my-custom-target-type` in region `us-central1`:
+
+      $ {command} my-custom-target-type policy.json --region=us-central1
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.customTargetTypes
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:custom_target_type
+      is_positional: true
+      help_text: |
+        The custom target type for which to set the IAM policy.
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delete.py

@@ -0,0 +1,76 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Deletes(n >= 0) Delivery Pipeline(s), Target(s), Custom Target Type(s), Deploy Policy(ies), and Automation(s) with current project's Cloud Deploy service.."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import deploy
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import yaml
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+    To delete the resources in a Cloud Deploy YAML file `deploy.yaml`:
+
+       $ {command} --file=deploy.yaml --region=us-central1
+
+  """,
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  flags.AddConfigFile(parser)
+  flags.AddForce(
+      parser, 'If true, the delivery pipeline and '
+      'its sub-resources (releases and rollouts) are deleted.')
+  resource_args.AddLocationResourceArg(parser)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Delete(base.UpdateCommand):
+  """Deletes Delivery Pipeline(s), Target(s), Custom Target Type(s), and Automation(s) in a yaml configuration."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """This is what gets called when the user runs this command."""
+    loaded_yaml = list(yaml.load_all_path(args.file))
+    deploy_client = deploy.DeployClient()
+    region_ref = args.CONCEPTS.region.Parse()
+    region = region_ref.AsDict()['locationsId']
+
+    deploy_client.DeleteResources(loaded_yaml, region, args.force)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class DeliveryPipelines(base.Group):
+  """Create and manage Delivery Pipeline resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/add_iam_policy_binding.yaml

@@ -0,0 +1,35 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Add IAM policy binding for a Cloud Deploy delivery pipeline.
+    description: |
+      Adds a policy binding to the IAM policy of a Cloud Deploy delivery
+      pipeline. One binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To add an IAM policy binding for the role of 'roles/clouddeploy.operator'
+      for the user 'test-user@gmail.com' on 'my-pipeline' with the region
+      'us-central1', run:
+
+        $ {command} my-pipeline \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.operator'
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deliveryPipelines
+
+  arguments:
+    resource:
+      help_text: The delivery pipeline for which to add the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: true
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/delete.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Delete a delivery pipeline.
+    description: Delete a delivery pipeline.
+    examples: |
+
+      The following command will delete delivery pipeline 'test-pipeline', in region 'us-central1',
+      but only if the delivery pipeline doesn't have any sub-resources (targets, releases or rollouts):
+
+        $ {command} test-pipeline --region=us-central1
+
+      The following command will delete delivery pipeline 'test-pipeline', in region 'us-central1'
+      and its sub-resources (targets, releases or rollouts):
+
+        $ {command} test-pipeline --region=us-central1 --force
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines
+    api_version: v1
+
+  async:
+    collection: clouddeploy.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The Cloud Deploy delivery pipeline to delete.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: true
+    params:
+    - arg_name: force
+      api_field: force
+      action: store_true
+      help_text: If true, the delivery pipeline with sub-resources will be deleted
+                 and its sub-resources will also be deleted.
+  input:
+    confirmation_prompt: Once a delivery pipeline is deleted, it cannot be recovered.

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/describe.py

@@ -0,0 +1,113 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describes a Gcloud Deploy delivery pipeline resource."""
+
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.clouddeploy import delivery_pipeline
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import describe
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.core import log
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+  To describe a delivery pipeline called 'test-pipeline' in region 'us-central1', run:
+
+     $ {command} test-pipeline --region=us-central1
+
+""",
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddDeliveryPipelineResourceArg(parser, positional=True)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Show details about a delivery pipeline.
+
+  The output contains the following sections:
+
+  Delivery Pipeline:
+
+    - detail of the delivery pipeline to be described.
+
+  Targets:
+
+    - target name.
+
+    - active release in the target.
+
+    - timestamp of the last successful deployment.
+
+    - list of the rollouts that require approval.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """This is what gets called when the user runs this command."""
+    pipeline_ref = args.CONCEPTS.delivery_pipeline.Parse()
+    # Check if the pipeline exists.
+    pipeline = delivery_pipeline.DeliveryPipelinesClient().Get(
+        pipeline_ref.RelativeName()
+    )
+    output = {'Delivery Pipeline': pipeline}
+    region = pipeline_ref.AsDict()['locationsId']
+    targets = []
+    # output the deployment status of the targets in the pipeline.
+    for stage in pipeline.serialPipeline.stages:
+      target_ref = target_util.TargetReference(
+          stage.targetId,
+          pipeline_ref.AsDict()['projectsId'], region)
+      try:
+        target_obj = target_util.GetTarget(target_ref)
+      except apitools_exceptions.HttpError as error:
+        log.debug('Failed to get target {}: {}'.format(stage.targetId, error))
+        log.status.Print('Unable to get target {}'.format(stage.targetId))
+        continue
+      detail = {'Target': target_ref.RelativeName()}
+      current_rollout = target_util.GetCurrentRollout(target_ref, pipeline_ref)
+      detail = describe.SetCurrentReleaseAndRollout(current_rollout, detail)
+      if target_obj.requireApproval:
+        detail = describe.ListPendingApprovals(target_ref, pipeline_ref, detail)
+      targets.append(detail)
+
+    output['Targets'] = targets
+
+    return output

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/export.py

@@ -0,0 +1,76 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Gcloud Deploy delivery pipeline resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import delivery_pipeline
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import export_util
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.export import util as core_export_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+
+      To return the .yaml definition of the delivery pipeline 'test-pipeline', in region 'us-central1', run:
+
+        $ {command} test-pipeline --region=us-central1
+
+      """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Export(base.ExportCommand):
+  """Returns the .yaml definition of the specified delivery pipeline.
+
+  The exported yaml definition can be applied by 'deploy apply' command.
+  """
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddDeliveryPipelineResourceArg(parser, positional=True)
+    core_export_util.AddExportFlags(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    pipeline_ref = args.CONCEPTS.delivery_pipeline.Parse()
+    pipeline = delivery_pipeline.DeliveryPipelinesClient().Get(
+        pipeline_ref.RelativeName()
+    )
+
+    manifest = manifest_util.ProtoToManifest(
+        pipeline, pipeline_ref, manifest_util.ResourceKind.DELIVERY_PIPELINE)
+
+    export_util.Export(manifest, args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/get_iam_policy.yaml

@@ -0,0 +1,30 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a Cloud Deploy delivery pipeline.
+    description: |
+      *{command}* displays the IAM policy associated with a Cloud Deploy
+      delivery pipeline. If formatted as JSON, the output can be edited
+      and used as a policy file for *set-iam-policy*. The output includes
+      an "etag" field identifying the version emitted and allowing detection
+      of concurrent policy updates; see $ {parent_command} set-iam-policy
+      for additional details.
+    examples: |
+      To print the IAM policy for delivery pipeline ``my-pipeline'', run:
+
+        $ {command} my-pipeline --region=us-central1
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deliveryPipelines
+
+  arguments:
+    resource:
+      help_text: The delivery pipeline for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: true
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List Cloud Deploy delivery pipelines.
+    description: |
+      List your Cloud Deploy delivery pipelines.
+    examples: |
+      To list the delivery pipelines in region 'us-central1', run:
+
+        $ {command} --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The location for which you want to list the delivery pipelines.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:location

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/remove_iam_policy_binding.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Remove an IAM policy binding for a Cloud Deploy delivery pipeline.
+    description: |
+      Removes a policy binding to the IAM policy of a Cloud Deploy delivery
+      pipeline. One binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To remove an IAM policy binding for the role of 'roles/clouddeploy.operator' for the user
+      'test-user@gmail.com' on 'my-pipeline' with the region 'us-central1', run:
+
+        $ {command} my-pipeline \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.operator'
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deliveryPipelines
+
+  arguments:
+    resource:
+      help_text: The delivery pipeline for which to remove the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: true
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/delivery_pipelines/set_iam_policy.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Set the IAM policy for a Cloud Deploy delivery pipeline.
+    description: |
+      Set the IAM policy associated with a Cloud Deploy delivery pipeline.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      ``policy.json'' and set it for a delivery pipeline with identifier
+      ``my-pipeline''
+
+      $ {command} my-pipeline policy.json --region=us-central1
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deliveryPipelines
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: true
+      help_text: |
+        The delivery pipeline for which to set the IAM policy..
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Deploy Policy command group for Google Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class DeployPolicies(base.Group):
+  """Create and manage Deploy Policy resources for Google Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/add_iam_policy_binding.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Add IAM policy binding for a Cloud Deploy Policy.
+    description: |
+      Adds a policy binding to the IAM policy of a Cloud Deploy Policy.
+      One binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To add an IAM policy binding for the role of `roles/clouddeploy.policyAdmin`
+      for the user `test-user@gmail.com` on `holiday-policy` with the region
+      `us-central1`, run:
+
+        $ {command} holiday-policy \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.policyAdmin'
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deployPolicies
+  arguments:
+    resource:
+      help_text: The deploy policy for which to add the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:deploy_policy
+      is_positional: true
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/delete.yaml

@@ -0,0 +1,21 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Delete a deploy policy.
+    description: Delete a deploy policy for a specified region.
+    examples: |
+      The following command will delete deploy policy `test-policy`, in region `us-central1`:
+
+        $ {command} test-policy --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deployPolicies
+    api_version: v1
+
+  async:
+    collection: clouddeploy.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The name of the deploy policy to delete.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:deploy_policy
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/describe.py

@@ -0,0 +1,105 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describes a Gcloud Deploy Policy resource."""
+
+
+from apitools.base.py import encoding
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+  To describe a deploy policy called 'test-policy' in region 'us-central1', run:
+
+     $ {command} test-policy --region=us-central1
+
+""",
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddDeployPolicyResourceArg(parser, positional=True)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Show details about a deploy policy."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """This is what gets called when the user runs this command."""
+    policy_ref = args.CONCEPTS.deploy_policy.Parse()
+    # Check if the policy exists.
+    policy_obj = deploy_policy_util.GetDeployPolicy(policy_ref)
+    manifest = encoding.MessageToDict(policy_obj)
+    manifest_util.ApplyTransforms(
+        manifest,
+        _TRANSFORMS,
+        manifest_util.ResourceKind.DEPLOY_POLICY,
+        policy_ref.Name(),
+        policy_ref.projectsId,
+        policy_ref.locationsId,
+    )
+    return manifest
+
+# We can't use manifest_util._EXPORT_TRANSFORMS because it has several
+# transforms we don't want for `describe`. Specifically:
+# * it adds `apiVersion`/`kind`
+# * it moves a bunch of fields into `metadata`, and turns the `name` into an id
+# * it removes fields like `createTime`/`updateTime`
+_TRANSFORMS = [
+    manifest_util.TransformConfig(
+        kinds=[manifest_util.ResourceKind.DEPLOY_POLICY],
+        # Using the always-present `name` field to make sure this transform is
+        # always applied.
+        fields=['name'],
+        move=manifest_util.AddApiVersionAndKind,
+    ),
+    manifest_util.TransformConfig(
+        kinds=[manifest_util.ResourceKind.DEPLOY_POLICY],
+        fields=['rules[].rolloutRestriction.timeWindows.oneTimeWindows[]'],
+        replace=manifest_util.ConvertPolicyOneTimeWindowToYamlFormat,
+    ),
+    manifest_util.TransformConfig(
+        kinds=[manifest_util.ResourceKind.DEPLOY_POLICY],
+        fields=[
+            'rules[].rolloutRestriction.timeWindows.weeklyWindows[].startTime',
+            'rules[].rolloutRestriction.timeWindows.weeklyWindows[].endTime',
+        ],
+        replace=manifest_util.ConvertTimeProtoToString,
+    ),
+]

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/export.py

@@ -0,0 +1,79 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Cloud Deploy deploy policy resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import deploy_policy
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import export_util
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.export import util as core_export_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': textwrap.dedent("""\
+
+      To return the .yaml definition of the deploy policy `test-policy`, in region `us-central1`, run:
+
+        $ {command} test-policy --region=us-central1
+
+      """),
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Export(base.ExportCommand):
+  """Returns the .yaml definition of the specified deploy policy.
+
+  The exported yaml definition can be applied by `deploy apply` command.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddDeployPolicyResourceArg(parser, positional=True)
+    core_export_util.AddExportFlags(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparser.Namespace, an object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    deploy_policy_type_ref = args.CONCEPTS.deploy_policy.Parse()
+    resource = deploy_policy.DeployPoliciesClient().Get(
+        deploy_policy_type_ref.RelativeName()
+    )
+
+    manifest = manifest_util.ProtoToManifest(
+        resource,
+        deploy_policy_type_ref,
+        manifest_util.ResourceKind.DEPLOY_POLICY,
+    )
+
+    export_util.Export(manifest, args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/get_iam_policy.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Get the IAM policy for a Cloud Deploy Policy.
+    description: |
+      *{command}* displays the IAM policy associated with a Cloud Deploy
+      Policy. If formatted as JSON, the output can be edited
+      and used as a policy file for *set-iam-policy*. The output includes
+      an "etag" field identifying the version emitted and allowing detection
+      of concurrent policy updates; see $ {parent_command} set-iam-policy
+      for additional details.
+    examples: |
+      To print the IAM policy for a deploy policy `my-holiday-policy` in region `us-central1`, run:
+
+        $ {command} my-holiday-policy --region=us-central1
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deployPolicies
+  arguments:
+    resource:
+      help_text: The deploy policy for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:deploy_policy
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA, BETA, GA]
+  hidden: true
+  help_text:
+    brief: List the deploy policies.
+    description: List the deploy policies for a specified region.
+    examples: |
+      To list the deploy policies in region `us-central1`, run:
+
+        $ {command} --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deployPolicies
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The region for which to list the deploy policies.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:location
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/remove_iam_policy_binding.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Remove an IAM policy binding for a Cloud Deploy Policy.
+    description: |
+      Removes a policy binding to the IAM policy of a Cloud Deploy Policy.
+      One binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To remove an IAM policy binding for the role of `roles/roles/clouddeploy.policyAdmin`
+      for the user `test-user@gmail.com` on `holiday-policy` with the region `us-central1`, run:
+
+        $ {command} holiday-policy \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/roles/clouddeploy.policyAdmin'
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deployPolicies
+  arguments:
+    resource:
+      help_text: The deploy policy for which to remove the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:deploy_policy
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/deploy_policies/set_iam_policy.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Set the IAM policy for a Cloud Deploy Policy.
+    description: |
+      Set the IAM policy associated with a Cloud Deploy Policy.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      `policy.json` and set it for a deploy policy with identifier
+      `my-holiday-policy` in region `us-central1`:
+
+      $ {command} my-holiday-policy policy.json --region=us-central1
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.deployPolicies
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:deploy_policy
+      is_positional: true
+      help_text: |
+        The deploy policy for which to set the IAM policy.
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/get_config.py

@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Get the Cloud Deploy config for the provided region."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import config
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+    To get the config for project `test-project` in region `us-central1`:
+
+       $ {command} --project=test-project --region=us-central1
+
+  """,
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddLocationResourceArg(parser)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class GetConfig(base.DescribeCommand):
+  """Get the Cloud Deploy config for the provided region and project.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    location_ref = args.CONCEPTS.region.Parse()
+    project = location_ref.AsDict()['projectsId']
+    region = location_ref.AsDict()['locationsId']
+    config_client = config.ConfigClient()
+    conf = config_client.GetConfig(project, region)
+    return conf

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/job_runs/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class JobRuns(base.Group):
+  """Manages job runs resources for Cloud Deploy."""
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/job_runs/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Show details for a job run.
+    description: Show details for a specified job run.
+    examples: |
+      To show details about a job run 'test-jobrun', for delivery pipeline 'test-pipeline', release 'test-release', rollout 'test-rollout', in region 'us-central1', run:
+
+        $ {command} test-jobrun --delivery-pipeline=test-pipeline --release=test-release --rollout=test-rollout --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.releases.rollouts.jobRuns
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The name of the job run you want to describe.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:job_run
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/job_runs/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: List the job runs.
+    description: |
+      List the job runs for a specified delivery pipeline.
+    examples: |
+      To list the job runs for delivery pipeline 'test-pipeline', release 'test-release', and rollout 'test-rollout' in region 'us-central1', run:
+
+        $ {command} --delivery-pipeline=test-pipeline --release=test-release --rollout=test-rollout --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.releases.rollouts.jobRuns
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The rollouts for which you want to list the job runs.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:rollout
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/job_runs/terminate.py

@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Terminates a Cloud Deploy job run."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import job_run
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import log
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+    To terminate a job run `test-jobrun`, for delivery pipeline 'test-pipeline', release 'test-release', rollout 'test-rollout', in region 'us-central1', run:
+
+      $ {command} test-jobrun --delivery-pipeline=test-pipeline --release=test-release --rollout=test-rollout --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Terminate(base.UpdateCommand):
+  """Terminates a Cloud Deploy job run."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddJobRunResourceArg(parser, positional=True)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    job_run_ref = args.CONCEPTS.job_run.Parse()
+
+    log.status.Print(
+        'Terminating job run {}.\n'.format(job_run_ref.RelativeName())
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # Terminate API we need to provide the full resource name.
+    pipeline_ref = job_run_ref.Parent().Parent().Parent()
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+
+    return job_run.JobRunsClient().Terminate(
+        name=job_run_ref.RelativeName(),
+        override_deploy_policies=policies,
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/releases/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Releases(base.Group):
+  """Create and manage Release resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/releases/abandon.py

@@ -0,0 +1,101 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Abandons Cloud Deploy release."""
+
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core.console import console_io
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+  To abandon a release called `test-release` for delivery pipeline `test-pipeline` in region `us-central1`, run:
+
+  $ {command} test-release --delivery-pipeline=test-pipeline --region=us-central1
+
+
+""",
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddReleaseResourceArg(parser, positional=True, required=True)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Abandon(base.CreateCommand):
+  """Abandons a release.
+
+  After a release is abandoned, no new rollouts can be created from it.
+
+  Rollouts of abandoned releases can't be rolled back to.
+
+  Existing rollouts of abandoned releases will be unaffected.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    release_ref = args.CONCEPTS.release.Parse()
+    try:
+      release_obj = release.ReleaseClient().Get(release_ref.RelativeName())
+    except apitools_exceptions.HttpError as error:
+      raise exceptions.HttpException(error)
+    deployed_targets = release_util.ListCurrentDeployedTargets(
+        release_ref, release_obj.targetSnapshots)
+
+    console_message = _GetAbandonReleaseMessageString(deployed_targets)
+    console_io.PromptContinue(
+        message=console_message,
+        prompt_string='Are you sure you want to abandon release {}.'.format(
+            release_ref.Name()),
+        cancel_on_no=True)
+    release.ReleaseClient().Abandon(release_obj.name)
+    console_io.log.Print('Abandoned release {}'.format(
+        release_ref.RelativeName()))
+
+
+def _GetAbandonReleaseMessageString(deployed_targets):
+  if deployed_targets:
+    return 'This release is the latest in {} target(s):\n{}\n'.format(
+        len(deployed_targets), '\n'.join([
+            '- {}'.format(target_ref.RelativeName())
+            for target_ref in deployed_targets
+        ]))
+  return None

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/releases/create.py

@@ -0,0 +1,320 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create a release."""
+
+
+import datetime
+import os.path
+
+from googlecloudsdk.api_lib.clouddeploy import client_util
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as c_exceptions
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import deploy_util
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import promote_util
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.util import files
+from googlecloudsdk.core.util import times
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+    To create a release with source located at storage URL `gs://bucket/object.zip`
+    and the first rollout in the first target of the promotion sequence:
+
+       $ {command} my-release --source=`gs://bucket/object.zip` --delivery-pipeline=my-pipeline --region=us-central1
+
+    To create a release with source located at current directory
+    and deploy a rollout to target prod :
+
+      $ {command} my-release --delivery-pipeline=my-pipeline --region=us-central1 --to-target=prod
+
+    The following command creates a release without a `skaffold.yaml` as input, and generates one
+    for you:
+
+      $ {command} my-release --delivery-pipeline=my-pipeline --region=us-central1 --from-k8s-manifest=path/to/kubernetes/k8.yaml
+
+    The current UTC date and time on the machine running the gcloud command can
+    also be included in the release name by adding $DATE and $TIME parameters:
+
+      $ {command} 'my-release-$DATE-$TIME' --delivery-pipeline=my-pipeline --region=us-central1
+
+    If the current UTC date and time is set to 2021-12-21 12:02, then the created release
+    will have its name set as my-release-20211221-1202.
+
+    When using these parameters, please be sure to wrap the release name in single quotes
+    or else the template parameters will be overridden by environment variables.
+    """,
+}
+_RELEASE = 'release'
+_MAINTENANCE_WARNING_DAYS = 28
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddReleaseResourceArg(parser, positional=True, required=True)
+  flags.AddGcsSourceStagingDirFlag(parser)
+  flags.AddImagesGroup(parser)
+  flags.AddIgnoreFileFlag(parser)
+  flags.AddToTargetFlag(parser)
+  flags.AddDescription(parser, 'Description of the release.')
+  flags.AddAnnotationsFlag(parser, _RELEASE)
+  flags.AddLabelsFlag(parser, _RELEASE)
+  flags.AddDockerVersion(parser)
+  flags.AddHelmVersion(parser)
+  flags.AddKptVersion(parser)
+  flags.AddKubectlVersion(parser)
+  flags.AddKustomizeVersion(parser)
+  flags.AddSkaffoldVersion(parser)
+  flags.AddSkaffoldSources(parser)
+  flags.AddInitialRolloutGroup(parser)
+  flags.AddDeployParametersFlag(parser)
+  flags.AddOverrideDeployPolicies(parser)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Create(base.CreateCommand):
+  """Creates a new release, delivery pipeline qualified."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  def _CheckIfNearMaintenance(self, release_obj):
+    """Checks to see if a release is close to the maintenance window."""
+
+    def _ParseDt(dt):
+      """Parses the maintenance dt, returning a datetime or None."""
+      if dt is None:
+        return None
+      try:
+        return times.ParseDateTime(dt)
+      except (times.DateTimeSyntaxError, times.DateTimeValueError):
+        return None
+
+    release_condition = release_obj.condition
+    if release_condition is None:
+      return
+
+    has_tool_versions = (
+        release_condition.dockerVersionSupportedCondition
+        or release_condition.helmVersionSupportedCondition
+        or release_condition.kptVersionSupportedCondition
+        or release_condition.kubectlVersionSupportedCondition
+        or release_condition.kustomizeVersionSupportedCondition
+        or release_condition.skaffoldVersionSupportedCondition
+    )
+    if not has_tool_versions:
+      if release_condition.skaffoldSupportedCondition is None:
+        return
+      maintenance_dt = _ParseDt(
+          release_condition.skaffoldSupportedCondition.maintenanceModeTime
+      )
+      # It is possible to have no maintenance mode time.
+      # Like `skaffold_preview` for example.
+      if (
+          maintenance_dt is not None
+          and maintenance_dt - times.Now()
+          <= datetime.timedelta(days=_MAINTENANCE_WARNING_DAYS)
+      ):
+        log.status.Print(
+            "WARNING: This release's Skaffold version will be"
+            ' in maintenance mode beginning on {date}.'
+            " After that you won't be able to create releases"
+            ' using this version of Skaffold.\n'
+            'https://cloud.google.com/deploy/docs/using-skaffold'
+            '/select-skaffold#skaffold_version_deprecation'
+            '_and_maintenance_policy'.format(
+                date=maintenance_dt.strftime('%Y-%m-%d')
+            )
+        )
+      return
+
+    # use an array to have deterministic ordering.
+    tools_supported_condition_to_process = [
+        (
+            release_util.Tools.DOCKER,
+            release_condition.dockerVersionSupportedCondition,
+        ),
+        (
+            release_util.Tools.HELM,
+            release_condition.helmVersionSupportedCondition,
+        ),
+        (
+            release_util.Tools.KPT,
+            release_condition.kptVersionSupportedCondition,
+        ),
+        (
+            release_util.Tools.KUBECTL,
+            release_condition.kubectlVersionSupportedCondition,
+        ),
+        (
+            release_util.Tools.KUSTOMIZE,
+            release_condition.kustomizeVersionSupportedCondition,
+        ),
+        (
+            release_util.Tools.SKAFFOLD,
+            release_condition.skaffoldVersionSupportedCondition,
+        ),
+    ]
+    tools_almost_in_maintenance = []
+    for tool, condition in tools_supported_condition_to_process:
+      if not condition:
+        continue
+      maintenance_dt = _ParseDt(condition.maintenanceModeTime)
+      if (
+          maintenance_dt is not None
+          and maintenance_dt - times.Now()
+          <= datetime.timedelta(days=_MAINTENANCE_WARNING_DAYS)
+      ):
+        tools_almost_in_maintenance.append(tool)
+    if tools_almost_in_maintenance:
+      joined = ', '.join([tool.value for tool in tools_almost_in_maintenance])
+      log.status.Print(
+          f'WARNING: The versions used for tools: [{joined}] will be in'
+          " maintenance mode soon. After that you won't be able to create"
+          ' releases using these versions of the tools.\n'
+          'https://cloud.google.com/deploy/docs/select-tool-version'
+      )
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: All the arguments that were provided to this command invocation.
+
+    Returns:
+      The release and rollout created.
+    """
+    if args.disable_initial_rollout and args.to_target:
+      raise c_exceptions.ConflictingArgumentsException(
+          '--disable-initial-rollout', '--to-target'
+      )
+
+    args.CONCEPTS.parsed_args.release = release_util.RenderPattern(
+        args.CONCEPTS.parsed_args.release
+    )
+    release_ref = args.CONCEPTS.release.Parse()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        release_ref.Parent().RelativeName()
+    )
+    failed_activity_msg = 'Cannot create release {}.'.format(
+        release_ref.RelativeName()
+    )
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_msg
+    )
+
+    # Only when the skaffold file is an absolute path needs to be handled
+    # here.
+    if args.skaffold_file and os.path.isabs(args.skaffold_file):
+      if args.source == '.':
+        source = os.getcwd()
+        source_description = 'current working directory'
+      else:
+        source = args.source
+        source_description = 'source'
+      if not files.IsDirAncestorOf(source, args.skaffold_file):
+        raise core_exceptions.Error(
+            'The skaffold file {} could not be found in the {}. Please enter'
+            ' a valid Skaffold file path.'.format(
+                args.skaffold_file, source_description
+            )
+        )
+      args.skaffold_file = os.path.relpath(
+          os.path.abspath(args.skaffold_file), os.path.abspath(source)
+      )
+
+    client = release.ReleaseClient()
+    # Create the release create request.
+    release_config = release_util.CreateReleaseConfig(
+        args.source,
+        args.gcs_source_staging_dir,
+        args.ignore_file,
+        args.images,
+        args.build_artifacts,
+        args.description,
+        args.docker_version,
+        args.helm_version,
+        args.kpt_version,
+        args.kubectl_version,
+        args.kustomize_version,
+        args.skaffold_version,
+        args.skaffold_file,
+        release_ref.AsDict()['locationsId'],
+        pipeline_obj.uid,
+        args.from_k8s_manifest,
+        args.from_run_manifest,
+        pipeline_obj,
+        args.deploy_parameters,
+    )
+
+    deploy_util.SetMetadata(
+        client.messages,
+        release_config,
+        deploy_util.ResourceType.RELEASE,
+        args.annotations,
+        args.labels,
+    )
+    operation = client.Create(release_ref, release_config)
+    operation_ref = resources.REGISTRY.ParseRelativeName(
+        operation.name, collection='clouddeploy.projects.locations.operations'
+    )
+    client_util.OperationsClient().WaitForOperation(operation, operation_ref)
+
+    log.status.Print(
+        'Created Cloud Deploy release {}.'.format(release_ref.Name())
+    )
+
+    release_obj = release.ReleaseClient().Get(release_ref.RelativeName())
+    self._CheckIfNearMaintenance(release_obj)
+    if args.disable_initial_rollout:
+      return release_obj
+    # On the command line deploy policy IDs are provided, but for the
+    # CreateRollout API we need to provide the full resource name.
+    pipeline_ref = release_ref.Parent()
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    rollout_resource = promote_util.Promote(
+        release_ref,
+        release_obj,
+        args.to_target,
+        is_create=True,
+        labels=args.initial_rollout_labels,
+        annotations=args.initial_rollout_annotations,
+        starting_phase_id=args.initial_rollout_phase_id,
+        override_deploy_policies=policies,
+    )
+
+    return release_obj, rollout_resource

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/releases/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Show details about a release.
+    description: Show details a specified release.
+    examples: |
+      To show details about the release 'test-release', for delivery pipeline 'test-pipeline', in region 'us-central1', run:
+
+        $ {command} test-release --delivery-pipeline=test-pipeline --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.releases
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The release you want to describe.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:release
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/releases/list.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List releases.
+    description: |
+      List the releases for a specified delivery pipeline.
+    examples: |
+      To list the releases for delivery pipeline 'test-pipeline', in region 'us-central1', run:
+
+        $ {command} --delivery-pipeline=test-pipeline --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.releases
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The delivery pipeline for which you want to list the releases.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:delivery_pipeline
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/releases/promote.py

@@ -0,0 +1,137 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Promote new Cloud Deploy release."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import promote_util
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core.console import console_io
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+  To promote a release called 'test-release' for delivery pipeline 'test-pipeline' in region 'us-central1' to target 'prod', run:
+
+  $ {command} --release=test-release --delivery-pipeline=test-pipeline --region=us-central1 --to-target=prod
+
+
+""",
+}
+_ROLLOUT = 'rollout'
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddReleaseResourceArg(parser)
+  flags.AddToTarget(parser)
+  flags.AddRolloutID(parser)
+  flags.AddAnnotationsFlag(parser, _ROLLOUT)
+  flags.AddLabelsFlag(parser, _ROLLOUT)
+  flags.AddStartingPhaseId(parser)
+  flags.AddOverrideDeployPolicies(parser)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Promote(base.CreateCommand):
+  """Promotes a release from one target (source), to another (destination).
+
+  If to-target is not specified the command promotes the release from the target
+  that is farthest along in the promotion sequence to its next stage in the
+  promotion sequence.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    release_ref = args.CONCEPTS.release.Parse()
+    pipeline_ref = release_ref.Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_msg = 'Cannot promote release {}.'.format(
+        release_ref.RelativeName()
+    )
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_msg
+    )
+    release_obj = release.ReleaseClient().Get(release_ref.RelativeName())
+
+    release_util.CheckReleaseSupportState(release_obj, 'promote this release')
+
+    if release_obj.abandoned:
+      raise deploy_exceptions.AbandonedReleaseError(
+          'Cannot promote release.', release_ref.RelativeName()
+      )
+
+    # Get the to_target id if the argument is not specified.
+    to_target_id = args.to_target
+    if not to_target_id:
+      to_target_id = promote_util.GetToTargetID(release_obj, False)
+
+      # If there are any rollouts in progress for the given release, and no
+      # to-target was given throw an exception.
+      promote_util.CheckIfInProgressRollout(
+          release_ref, release_obj, to_target_id
+      )
+
+    release_util.PrintDiff(release_ref, release_obj, args.to_target)
+
+    console_io.PromptContinue(
+        'Promoting release {} to target {}.'.format(
+            release_ref.Name(), to_target_id
+        ),
+        cancel_on_no=True,
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # CreateRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    rollout_resource = promote_util.Promote(
+        release_ref,
+        release_obj,
+        to_target_id,
+        False,
+        rollout_id=args.rollout_id,
+        annotations=args.annotations,
+        labels=args.labels,
+        starting_phase_id=args.starting_phase_id,
+        override_deploy_policies=policies,
+    )
+    return rollout_resource

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Rollouts(base.Group):
+  """Create and manage Rollout resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/advance.py

@@ -0,0 +1,139 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Advances a Cloud Deploy rollout to the specified phase."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import rollout
+from googlecloudsdk.api_lib.util import apis as core_apis
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+    To advance a rollout `test-rollout` to phase `test-phase` for delivery pipeline `test-pipeline`, release `test-release` in region `us-central1`, run:
+
+      $ {command} test-rollout --phase-id=test-phase --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Advance(base.CreateCommand):
+  """Advances a rollout."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRolloutResourceArg(parser, positional=True)
+    # Phase ID does not need to be required. If not specified, then the latest
+    # Phase to be processed on the rollout will be calculated and a prompt will
+    # be surfaced to the user.
+    flags.AddPhaseId(parser, required=False)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    rollout_ref = args.CONCEPTS.rollout.Parse()
+    pipeline_ref = rollout_ref.Parent().Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_msg = 'Cannot advance rollout {}.'.format(
+        rollout_ref.RelativeName()
+    )
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_msg
+    )
+    phase_id = args.phase_id
+    if phase_id is None:
+      phase_id = self._DetermineNextPhase(rollout_ref)
+
+    log.status.Print(
+        'Advancing rollout {} to phase {}.\n'.format(
+            rollout_ref.RelativeName(), phase_id
+        )
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # AdvanceRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    return rollout.RolloutClient().AdvanceRollout(
+        rollout_ref.RelativeName(),
+        phase_id,
+        override_deploy_policies=policies,
+    )
+
+  def _DetermineNextPhase(self, rollout_ref):
+    """Determines the phase in which the advance command should apply."""
+    messages = core_apis.GetMessagesModule('clouddeploy', 'v1')
+    ro = rollout.RolloutClient().Get(rollout_ref.RelativeName())
+    if ro.state != messages.Rollout.StateValueValuesEnum.IN_PROGRESS:
+      raise deploy_exceptions.RolloutNotInProgressError(
+          rollout_name=rollout_ref.RelativeName()
+      )
+    pending_phase_index = None
+    for index, phase in enumerate(ro.phases):
+      if phase.state == messages.Phase.StateValueValuesEnum.PENDING:
+        pending_phase_index = index
+        break
+    if pending_phase_index is None:
+      # There are no pending phases.
+      raise deploy_exceptions.RolloutCannotAdvanceError(
+          rollout_name=rollout_ref.RelativeName(),
+          failed_activity_msg='No pending phases.',
+      )
+    if pending_phase_index == 0:
+      # There is no need to advance the first phase, it is automatically done.
+      raise deploy_exceptions.RolloutCannotAdvanceError(
+          rollout_name=rollout_ref.RelativeName(),
+          failed_activity_msg='Cannot advance first phase of a rollout.',
+      )
+    advanceable_prior_phase_states = [
+        messages.Phase.StateValueValuesEnum.SUCCEEDED,
+        messages.Phase.StateValueValuesEnum.SKIPPED,
+    ]
+    prior_phase = ro.phases[pending_phase_index - 1]
+    if prior_phase.state not in advanceable_prior_phase_states:
+      # The previous state is not in a terminal state that is advanceable.
+      raise deploy_exceptions.RolloutCannotAdvanceError(
+          rollout_name=rollout_ref.RelativeName(),
+          failed_activity_msg=(
+              'Prior phase {} is in {} state which is not advanceable.'.format(
+                  prior_phase.id, prior_phase.state
+              )
+          ),
+      )
+    # Ask whether user would like to advance the rollout to the phase.
+    prompt = 'Are you sure you want to advance rollout {} to phase {}?'.format(
+        rollout_ref.RelativeName(), ro.phases[pending_phase_index].id
+    )
+    console_io.PromptContinue(prompt, cancel_on_no=True)
+    return ro.phases[pending_phase_index].id

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/approve.py

@@ -0,0 +1,98 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Approves a Cloud Deploy rollout."""
+
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.clouddeploy import rollout
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import console_io
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+To approve a rollout 'test-rollout' for delivery pipeline 'test-pipeline', release 'test-release' in region 'us-central1', run:
+
+$ {command} test-rollout --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Approve(base.CreateCommand):
+  """Approves a rollout having an Approval state of "Required"."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRolloutResourceArg(parser, positional=True)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    rollout_ref = args.CONCEPTS.rollout.Parse()
+    pipeline_ref = rollout_ref.Parent().Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName())
+    failed_activity_msg = 'Cannot approve rollout {}.'.format(
+        rollout_ref.RelativeName())
+    delivery_pipeline_util.ThrowIfPipelineSuspended(pipeline_obj,
+                                                    failed_activity_msg)
+    try:
+      rollout_obj = rollout.RolloutClient().Get(rollout_ref.RelativeName())
+    except apitools_exceptions.HttpError as error:
+      raise exceptions.HttpException(error)
+
+    release_ref = resources.REGISTRY.ParseRelativeName(
+        rollout_ref.Parent().RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases')
+    try:
+      release_obj = release.ReleaseClient().Get(release_ref.RelativeName())
+    except apitools_exceptions.HttpError as error:
+      raise exceptions.HttpException(error)
+
+    prompt = 'Approving rollout {} from {} to target {}.\n\n'.format(
+        rollout_ref.Name(), release_ref.Name(), rollout_obj.targetId)
+    release_util.PrintDiff(release_ref, release_obj, prompt=prompt)
+
+    console_io.PromptContinue(cancel_on_no=True)
+    # On the command line deploy policy IDs are provided, but for the Approve
+    # API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+
+    return rollout.RolloutClient().Approve(
+        rollout_ref.RelativeName(),
+        True,
+        policies,
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/cancel.py

@@ -0,0 +1,80 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Cancels a Cloud Deploy rollout."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import rollout
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import log
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+    To cancel a rollout `test-rollout` for delivery pipeline `test-pipeline`, release `test-release` in region `us-central1`, run:
+
+      $ {command} test-rollout --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Cancel(base.CreateCommand):
+  """Cancel a Rollout."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRolloutResourceArg(parser, positional=True)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    rollout_ref = args.CONCEPTS.rollout.Parse()
+    pipeline_ref = rollout_ref.Parent().Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_msg = 'Cannot cancel rollout {}.'.format(
+        rollout_ref.RelativeName()
+    )
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_msg
+    )
+
+    log.status.Print(
+        'Cancelling rollout {}.\n'.format(rollout_ref.RelativeName())
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # CancelRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+
+    return rollout.RolloutClient().CancelRollout(
+        rollout_ref.RelativeName(), policies
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Show details for a rollout.
+    description: Show details for a specified rollout.
+    examples: |
+      To show details about a rollout 'test-rollout', for delivery pipeline 'test-pipeline', and release 'test-release' in region 'us-central1', run:
+
+        $ {command} test-rollout --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.releases.rollouts
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The name of the rollout you want to describe.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:rollout
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/ignore_job.py

@@ -0,0 +1,86 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Ignores a job and phase combination on a Cloud Deploy rollout."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import rollout
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import log
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+    To ignore a job `test-job` in phase `test-phase` on a rollout `test-rollout` for delivery pipeline `test-pipeline`, release `test-release` in region `us-central1`, run:
+
+      $ {command} test-rollout --job-id=test-job --phase-id=test-phase --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class IgnoreJob(base.CreateCommand):
+  """Ignores a specified job and phase combination on a rollout."""
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRolloutResourceArg(parser, positional=True)
+    flags.AddJobId(parser)
+    flags.AddPhaseId(parser)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    rollout_ref = args.CONCEPTS.rollout.Parse()
+    pipeline_ref = rollout_ref.Parent().Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_msg = 'Cannot ignore job on rollout {}.'.format(
+        rollout_ref.RelativeName()
+    )
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_msg
+    )
+
+    log.status.Print(
+        'Ignoring job {} in phase {} of rollout {}.\n'.format(
+            args.job_id, args.phase_id, rollout_ref.RelativeName()
+        )
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # IgnoreJob API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    return rollout.RolloutClient().IgnoreJob(
+        rollout_ref.RelativeName(),
+        args.job_id,
+        args.phase_id,
+        override_deploy_policies=policies,
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/list.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List the rollouts.
+    description: |
+      List the rollouts for a specified delivery pipeline.
+    examples: |
+      To list the rollouts for delivery pipeline 'test-pipeline' and release 'test-release' in region 'us-central1', run:
+
+        $ {command} --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+  request:
+    collection: clouddeploy.projects.locations.deliveryPipelines.releases.rollouts
+    api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The release for which you want to list the rollouts.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:release
+      is_positional: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/reject.py

@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Rejects a Cloud Deploy rollout."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import rollout
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core.console import console_io
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+    To reject a rollout 'test-rollout' for delivery pipeline 'test-pipeline', release 'test-release' in region 'us-central1', run:
+
+      $ {command} test-rollout --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Reject(base.CreateCommand):
+  """Rejects a rollout having an Approval state of "Required"."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRolloutResourceArg(parser, positional=True)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    rollout_ref = args.CONCEPTS.rollout.Parse()
+    pipeline_ref = rollout_ref.Parent().Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName())
+    failed_activity_msg = 'Cannot reject rollout {}.'.format(
+        rollout_ref.RelativeName())
+    delivery_pipeline_util.ThrowIfPipelineSuspended(pipeline_obj,
+                                                    failed_activity_msg)
+
+    console_io.PromptContinue(
+        message='Rejecting rollout {}.\n'.format(rollout_ref.RelativeName()),
+        cancel_on_no=True)
+    # On the command line deploy policy IDs are provided, but for the Approve
+    # API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+
+    return rollout.RolloutClient().Approve(
+        rollout_ref.RelativeName(), False, policies
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/rollouts/retry_job.py

@@ -0,0 +1,80 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Retries a Cloud Deploy rollout job specified by job and phase."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import rollout
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.core import log
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+    To retry a job 'test-job' in phase 'test-phase' on a rollout 'test-rollout' for delivery pipeline 'test-pipeline', release 'test-release' in region 'us-central1', run:
+
+      $ {command} test-rollout --job-id=test-job --phase-id=test-phase --delivery-pipeline=test-pipeline --release=test-release --region=us-central1
+
+""",
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class RetryJob(base.CreateCommand):
+  """Retries a specified job, phase combination on a rollout."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRolloutResourceArg(parser, positional=True)
+    flags.AddJobId(parser)
+    flags.AddPhaseId(parser)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    rollout_ref = args.CONCEPTS.rollout.Parse()
+    pipeline_ref = rollout_ref.Parent().Parent()
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName())
+    failed_activity_msg = 'Cannot retry job on rollout {}.'.format(
+        rollout_ref.RelativeName())
+    delivery_pipeline_util.ThrowIfPipelineSuspended(pipeline_obj,
+                                                    failed_activity_msg)
+
+    log.status.Print('Retrying job {} in phase {} of rollout {}.\n'.format(
+        args.job_id, args.phase_id, rollout_ref.RelativeName()))
+    # On the command line deploy policy IDs are provided, but for the
+    # RetryJob API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    return rollout.RolloutClient().RetryJob(
+        rollout_ref.RelativeName(),
+        args.job_id,
+        args.phase_id,
+        override_deploy_policies=policies,
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Targets(base.Group):
+  """Create and manage Target resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/add_iam_policy_binding.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Add IAM policy binding for a Cloud Deploy target.
+    description: |
+      Adds a policy binding to the IAM policy of a Cloud Deploy target. One
+      binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To add an IAM policy binding for the role of 'roles/clouddeploy.operator' for the user
+      'test-user@gmail.com' on 'my-target' with the region 'us-central1', run:
+
+        $ {command} my-target \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.operator'
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      help_text: The target for which to add the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/delete.py

@@ -0,0 +1,62 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Deletes a Gcloud Deploy delivery target resource."""
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import client_util
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+        To delete a target called 'test-target' in region 'us-central1', run:
+
+          $ {command} test-target --region=us-central1
+        """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Delete(base.DeleteCommand):
+  """Deletes a Cloud Deploy target."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    target_ref = args.CONCEPTS.target.Parse()
+    op = target_util.DeleteTarget(target_ref.RelativeName())
+    client_util.OperationsClient().CheckOperationStatus(
+        {target_ref.RelativeName(): op}, 'Deleted Cloud Deploy target: {}.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/describe.py

@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describes a Gcloud Deploy target resource."""
+
+
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import describe
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+    To describe a target called 'test' for delivery pipeline 'test-pipeline' in region 'us-central1', run:
+
+       $ {command} test --delivery-pipeline=test-pipeline --region=us-central1
+
+  """,
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddTargetResourceArg(parser, positional=True)
+  flags.AddDeliveryPipeline(parser, required=False)
+  flags.AddListAllPipelines(parser)
+  flags.AddSkipPipelineLookup(parser)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Describes details specific to the individual target, delivery pipeline qualified.
+
+  The output contains four sections:
+
+  Target:
+
+    detail of the target to be described.
+
+  Latest Release:
+
+    the detail of the active release in the target.
+
+  Latest Rollout:
+
+    the detail of the active rollout in the target.
+
+  Deployed:
+
+    timestamp of the last successful deployment.
+
+  Pending Approvals:
+
+    list of the rollouts that require approval.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """This is what gets called when the user runs this command."""
+    target_ref = args.CONCEPTS.target.Parse()
+
+    return describe.DescribeTarget(target_ref, args.delivery_pipeline,
+                                   args.skip_pipeline_lookup,
+                                   args.list_all_pipelines)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/export.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Gcloud Deploy target resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import export_util
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.command_lib.export import util as core_export_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+
+      To return the .yaml definition of the target 'test-target' in region 'us-central1', run:
+
+        $ {command} test-target --region=us-central1
+
+      """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Export(base.ExportCommand):
+  """Returns the .yaml definition of the specified target.
+
+  The exported YAML definition can be applied by 'deploy apply' command.
+  """
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+    core_export_util.AddExportFlags(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    target_ref = args.CONCEPTS.target.Parse()
+    target_obj = target_util.GetTarget(target_ref)
+    manifest = manifest_util.ProtoToManifest(target_obj, target_ref,
+                                             manifest_util.ResourceKind.TARGET)
+
+    export_util.Export(manifest, args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/get_iam_policy.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a Cloud Deploy target.
+    description: |
+      *{command}* displays the IAM policy associated with a Cloud Deploy
+      target. If formatted as JSON, the output can be edited
+      and used as a policy file for *set-iam-policy*. The output includes
+      an "etag" field identifying the version emitted and allowing detection
+      of concurrent policy updates; see $ {parent_command} set-iam-policy
+      for additional details.
+    examples: |
+      To print the IAM policy for a target ``my-target'', run:
+
+        $ {command} my-target --region=us-central1
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      help_text: The target for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/list.py

@@ -0,0 +1,66 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Gcloud Deploy delivery pipeline resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+
+      To list the targets in region 'us-central1', run:
+
+        $ {command} --region=us-central1
+
+      """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class List(base.ListCommand):
+  """List Cloud Deploy targets."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddLocationResourceArg(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+
+    Returns:
+       A list of target messages.
+    """
+    loc_ref = args.CONCEPTS.region.Parse()
+
+    return target_util.ListTarget(loc_ref.RelativeName())

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/redeploy.py

@@ -0,0 +1,198 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Redeploy a rollout to a target."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.util import apis as core_apis
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import promote_util
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import rollout_util
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import console_io
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+  To redeploy a target `prod` for delivery pipeline `test-pipeline` in region `us-central1`, run:
+
+  $ {command} prod --delivery-pipeline=test-pipeline --region=us-central1
+
+""",
+}
+_ROLLOUT = 'rollout'
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Redeploy(base.CreateCommand):
+  """Redeploy the last release to a target.
+
+  Redeploy the last rollout that has a state of SUCCESSFUL or FAILED to a
+  target.
+  If rollout-id is not specified, a rollout ID will be generated.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+    flags.AddRolloutID(parser)
+    flags.AddDeliveryPipeline(parser)
+    flags.AddDescriptionFlag(parser)
+    flags.AddAnnotationsFlag(parser, _ROLLOUT)
+    flags.AddLabelsFlag(parser, _ROLLOUT)
+    flags.AddStartingPhaseId(parser)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    target_ref = args.CONCEPTS.target.Parse()
+    # Check if target exists
+    target_util.GetTarget(target_ref)
+    ref_dict = target_ref.AsDict()
+    pipeline_ref = resources.REGISTRY.Parse(
+        args.delivery_pipeline,
+        collection='clouddeploy.projects.locations.deliveryPipelines',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': args.delivery_pipeline,
+        },
+    )
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_redeploy_prefix = 'Cannot perform redeploy.'
+    # Check is the pipeline is suspended.
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_redeploy_prefix
+    )
+    current_release_ref = _GetCurrentRelease(
+        pipeline_ref, target_ref, rollout_util.ROLLOUT_IN_TARGET_FILTER_TEMPLATE
+    )
+    release_obj = release.ReleaseClient().Get(
+        current_release_ref.RelativeName()
+    )
+
+    release_util.CheckReleaseSupportState(release_obj, 'redeploy this release')
+
+    # Check if the release is abandoned.
+    if release_obj.abandoned:
+      raise deploy_exceptions.AbandonedReleaseError(
+          failed_redeploy_prefix, current_release_ref.RelativeName()
+      )
+
+    prompt = (
+        'Are you sure you want to redeploy release {} to target {}?'.format(
+            current_release_ref.Name(), target_ref.Name()
+        )
+    )
+    console_io.PromptContinue(prompt, cancel_on_no=True)
+    # On the command line deploy policy IDs are provided, but for the
+    # CreateRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+
+    promote_util.Promote(
+        current_release_ref,
+        release_obj,
+        target_ref.Name(),
+        False,
+        rollout_id=args.rollout_id,
+        annotations=args.annotations,
+        labels=args.labels,
+        description=args.description,
+        starting_phase_id=args.starting_phase_id,
+        override_deploy_policies=policies,
+    )
+
+
+def _GetCurrentRelease(pipeline_ref, target_ref, filter_str):
+  """Gets the current release in the target.
+
+  Args:
+    pipeline_ref: pipeline_ref: protorpc.messages.Message, pipeline object.
+    target_ref: target_ref: protorpc.messages.Message, target object.
+    filter_str: Filter string to use when listing rollouts.
+
+  Returns:
+    The most recent release with the given pipeline and target with a rollout
+    that is redeployable.
+
+  Raises:
+    core.Error: Target has no rollouts or rollouts in target are not
+                redeployable.
+  """
+  # Get the most recent rollout in the target, by EnqueueTime descending. Using
+  # EnqueueTime instead of DeployEndTime because this needs to return the latest
+  # rollout in any state (e.g. PENDING_APPROVAL, IN_PROGRESS). If it's not in
+  # a state that's redeployable an exception is returned.
+  prior_rollouts = list(
+      rollout_util.GetFilteredRollouts(
+          target_ref=target_ref,
+          pipeline_ref=pipeline_ref,
+          filter_str=filter_str,
+          order_by=rollout_util.ENQUEUETIME_ROLLOUT_ORDERBY,
+          limit=1,
+      )
+  )
+  if len(prior_rollouts) < 1:
+    raise core_exceptions.Error(
+        'unable to redeploy to target {}. Target has no rollouts.'.format(
+            target_ref.Name()
+        )
+    )
+  prior_rollout = prior_rollouts[0]
+  messages = core_apis.GetMessagesModule('clouddeploy', 'v1')
+  redeployable_states = [
+      messages.Rollout.StateValueValuesEnum.SUCCEEDED,
+      messages.Rollout.StateValueValuesEnum.FAILED,
+      messages.Rollout.StateValueValuesEnum.CANCELLED,
+  ]
+  if prior_rollout.state not in redeployable_states:
+    raise deploy_exceptions.RedeployRolloutError(
+        target_ref.Name(), prior_rollout.name, prior_rollout.state
+    )
+
+  current_release_ref = resources.REGISTRY.ParseRelativeName(
+      resources.REGISTRY.Parse(
+          prior_rollout.name,
+          collection=(
+              'clouddeploy.projects.locations.deliveryPipelines'
+              '.releases.rollouts'
+          ),
+      )
+      .Parent()
+      .RelativeName(),
+      collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+  )
+  return current_release_ref

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/remove_iam_policy_binding.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Remove an IAM policy binding for a Cloud Deploy target.
+    description: |
+      Removes a policy binding to the IAM policy of a Cloud Deploy target. One
+      binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To remove an IAM policy binding for the role of 'roles/clouddeploy.operator' for the user
+      'test-user@gmail.com' on 'my-target' with the region 'us-central1', run:
+
+        $ {command} my-target \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.operator'
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      help_text: The target for which to remove the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/rollback.py

@@ -0,0 +1,374 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Rollback a Cloud Deploy target to a prior rollout."""
+
+import copy
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.clouddeploy import client_util
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import deploy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import promote_util
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import rollout_util
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import console_io
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+  To rollback a target 'prod' for delivery pipeline 'test-pipeline' in region 'us-central1', run:
+
+  $ {command} prod --delivery-pipeline=test-pipeline --region=us-central1
+
+
+""",
+}
+_ROLLBACK = 'rollback'
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Rollback(base.CreateCommand):
+  """Rollbacks a target to a prior rollout.
+
+  If release is not specified, the command rollbacks the target with the last
+  successful deployed release. If optional rollout-id parameter is not
+  specified, a generated rollout ID will be used.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+    flags.AddRelease(parser, 'Name of the release to rollback to.')
+    flags.AddRolloutID(parser)
+    flags.AddDeliveryPipeline(parser)
+    flags.AddDescriptionFlag(parser)
+    flags.AddAnnotationsFlag(parser, _ROLLBACK)
+    flags.AddLabelsFlag(parser, _ROLLBACK)
+    flags.AddStartingPhaseId(parser)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    target_ref = args.CONCEPTS.target.Parse()
+    ref_dict = target_ref.AsDict()
+    pipeline_ref = resources.REGISTRY.Parse(
+        args.delivery_pipeline,
+        collection='clouddeploy.projects.locations.deliveryPipelines',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': args.delivery_pipeline,
+        },
+    )
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_error_annotation_prefix = 'Cannot perform rollback.'
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_error_annotation_prefix
+    )
+    # Check if target exists
+    target_util.GetTarget(target_ref)
+
+    current_release_ref, rollback_release_ref = _GetCurrentAndRollbackRelease(
+        args.release, pipeline_ref, target_ref
+    )
+
+    release_obj = release.ReleaseClient().Get(
+        rollback_release_ref.RelativeName()
+    )
+
+    release_util.CheckReleaseSupportState(release_obj, 'roll back this target')
+
+    if release_obj.abandoned:
+      error_msg_annotation_prefix = 'Cannot perform rollback.'
+      raise deploy_exceptions.AbandonedReleaseError(
+          error_msg_annotation_prefix, rollback_release_ref.RelativeName()
+      )
+
+    prompt = 'Rolling back target {} to release {}.\n\n'.format(
+        target_ref.Name(), rollback_release_ref.Name()
+    )
+    release_util.PrintDiff(
+        rollback_release_ref, release_obj, target_ref.Name(), prompt
+    )
+
+    console_io.PromptContinue(cancel_on_no=True)
+
+    rollout_description = args.description or 'Rollback from {}'.format(
+        current_release_ref.Name()
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # CreateRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    rollout_resource = promote_util.Promote(
+        rollback_release_ref,
+        release_obj,
+        target_ref.Name(),
+        False,
+        rollout_id=args.rollout_id,
+        annotations=args.annotations,
+        labels=args.labels,
+        description=rollout_description,
+        # For rollbacks, default is `stable`.
+        starting_phase_id=args.starting_phase_id or 'stable',
+        override_deploy_policies=policies,
+    )
+
+    if rollout_resource:
+      try:
+        # Any 403 errors should indicate to the user that they may need to
+        # add the new permission.
+        delivery_pipeline_util.CreateRollbackTarget(
+            pipeline_ref.RelativeName(),
+            target_ref.Name(),
+            validate_only=True,
+        )
+      except apitools_exceptions.HttpError as e:
+        if e.status_code == 403:
+          log.status.Print(
+              'Starting on September 14, 2026, the rollback feature will'
+              ' require a new permission: clouddeploy.rollouts.rollback. For'
+              ' more information, see'
+              ' https://docs.cloud.google.com/deploy/docs/rollout-perms-notice'
+          )
+    return rollout_resource
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class RollbackAlpha(Rollback):
+  """Rollbacks a target to a prior rollout.
+
+  If release is not specified, the command rollbacks the target with the last
+  successful deployed release. If optional rollout-id parameter is not
+  specified, a generated rollout ID will be used.
+  """
+
+  @staticmethod
+  def Args(parser):
+    # add the original args
+    Rollback.Args(parser)
+    flags.AddRollbackOfRollout(parser)
+
+  def Run(self, args):
+    target_ref = args.CONCEPTS.target.Parse()
+    ref_dict = target_ref.AsDict()
+    pipeline_ref = resources.REGISTRY.Parse(
+        args.delivery_pipeline,
+        collection='clouddeploy.projects.locations.deliveryPipelines',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': args.delivery_pipeline,
+        },
+    )
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_error_annotation_prefix = 'Cannot perform rollback.'
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_error_annotation_prefix
+    )
+
+    rollout_obj = client_util.GetMessagesModule().Rollout(
+        description=args.description
+    )
+
+    deploy_util.SetMetadata(
+        client_util.GetMessagesModule(),
+        rollout_obj,
+        deploy_util.ResourceType.ROLLOUT,
+        args.annotations,
+        args.labels,
+    )
+
+    # First call, we perform validate only call, making a copy of the response.
+    validate_response = copy.deepcopy(
+        delivery_pipeline_util.CreateRollbackTarget(
+            pipeline_ref.RelativeName(),
+            target_ref.Name(),
+            validate_only=True,
+            rollout_id=args.rollout_id,
+            rollout_to_rollback=args.rollback_of_rollout,
+            release_id=args.release,
+            rollout_obj=rollout_obj,
+            starting_phase=args.starting_phase_id,
+        )
+    )
+
+    final_rollout_id = args.rollout_id
+    rollback_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            validate_response.rollbackConfig.rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+
+    # If the rollout_id is not given, we will generate it and overwrite the
+    # name that was part of the validate_only call. The reason for this is that
+    # we want to generate the name from the release, but this isn't
+    # available until after the validate_only call.
+    # To make the initial validate_only call, there must be a rollout_id given,
+    # so UUID is initially created for the request but ignored here.
+    if not args.rollout_id:
+      final_rollout_id = rollout_util.GenerateRolloutId(
+          target_ref.Name(), rollback_release_ref
+      )
+      resource_dict = rollback_release_ref.AsDict()
+      new_rollout_ref = resources.REGISTRY.Parse(
+          final_rollout_id,
+          collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+          params={
+              'projectsId': resource_dict.get('projectsId'),
+              'locationsId': resource_dict.get('locationsId'),
+              'deliveryPipelinesId': resource_dict.get('deliveryPipelinesId'),
+              'releasesId': rollback_release_ref.Name(),
+          },
+      )
+      validate_response.rollbackConfig.rollout.name = (
+          new_rollout_ref.RelativeName()
+      )
+
+    # if args.description isn't set.
+    if not args.description:
+      current_release_ref = resources.REGISTRY.ParseRelativeName(
+          resources.REGISTRY.Parse(
+              validate_response.rollbackConfig.rollout.rollbackOfRollout,
+              collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+          )
+          .Parent()
+          .RelativeName(),
+          collection=(
+              'clouddeploy.projects.locations.deliveryPipelines.releases'
+          ),
+      )
+      validate_response.rollbackConfig.rollout.description = (
+          'Rollback from {}'.format(current_release_ref.Name())
+      )
+
+    try:
+      release_obj = release.ReleaseClient().Get(
+          rollback_release_ref.RelativeName()
+      )
+    except apitools_exceptions.HttpError as error:
+      raise exceptions.HttpException(error)
+
+    release_util.CheckReleaseSupportState(release_obj, 'roll back this target')
+
+    # prompt to see whether user wants to continue.
+    prompt = 'Rolling back target {} to release {}.\n\n'.format(
+        target_ref.Name(), rollback_release_ref.Name()
+    )
+    release_util.PrintDiff(
+        rollback_release_ref, release_obj, target_ref.Name(), prompt
+    )
+
+    console_io.PromptContinue(cancel_on_no=True)
+
+    create_response = delivery_pipeline_util.CreateRollbackTarget(
+        pipeline_ref.RelativeName(),
+        target_ref.Name(),
+        validate_only=False,
+        # use the final_rollout_id which was calculated on client
+        rollout_id=final_rollout_id,
+        release_id=rollback_release_ref.Name(),
+        # use the server calculated fields for the rest of the fields.
+        rollout_to_rollback=validate_response.rollbackConfig.rollout.rollbackOfRollout,
+        rollout_obj=validate_response.rollbackConfig.rollout,
+        starting_phase=validate_response.rollbackConfig.startingPhaseId,
+    )
+    # return the rollout resource that was created
+    return create_response.rollbackConfig.rollout
+
+
+def _GetCurrentAndRollbackRelease(release_id, pipeline_ref, target_ref):
+  """Gets the current deployed release and the release that will be used by promote API to create the rollback rollout."""
+  if release_id:
+    ref_dict = target_ref.AsDict()
+    current_rollout = target_util.GetCurrentRollout(target_ref, pipeline_ref)
+    current_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            current_rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+    rollback_release_ref = resources.REGISTRY.Parse(
+        release_id,
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': pipeline_ref.Name(),
+            'releasesId': release_id,
+        },
+    )
+    return current_release_ref, rollback_release_ref
+  else:
+    prior_rollouts = rollout_util.GetValidRollBackCandidate(
+        target_ref, pipeline_ref
+    )
+    if len(prior_rollouts) < 2:
+      raise core_exceptions.Error(
+          'unable to rollback target {}. Target has less than 2 rollouts.'
+          .format(target_ref.Name())
+      )
+    current_deployed_rollout, previous_deployed_rollout = prior_rollouts
+
+    current_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            current_deployed_rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+    rollback_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            previous_deployed_rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+    return current_release_ref, rollback_release_ref

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/set_iam_policy.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Set the IAM policy for a Cloud Deploy target.
+    description: |
+      Set the IAM policy associated with a Cloud Deploy target.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      ``policy.json'' and set it for a target with identifier
+      ``my-target''
+
+      $ {command} my-target policy.json --region=us-central1
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+      help_text: |
+        The target for which to set the IAM policy.
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion