feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Cloud Deploy."""
+
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Targets(base.Group):
+  """Create and manage Target resources for Cloud Deploy."""
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/add_iam_policy_binding.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Add IAM policy binding for a Cloud Deploy target.
+    description: |
+      Adds a policy binding to the IAM policy of a Cloud Deploy target. One
+      binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To add an IAM policy binding for the role of 'roles/clouddeploy.operator' for the user
+      'test-user@gmail.com' on 'my-target' with the region 'us-central1', run:
+
+        $ {command} my-target \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.operator'
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      help_text: The target for which to add the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/delete.py

@@ -0,0 +1,62 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Deletes a Gcloud Deploy delivery target resource."""
+
+import textwrap
+
+from googlecloudsdk.api_lib.clouddeploy import client_util
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+        To delete a target called 'test-target' in region 'us-central1', run:
+
+          $ {command} test-target --region=us-central1
+        """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Delete(base.DeleteCommand):
+  """Deletes a Cloud Deploy target."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    target_ref = args.CONCEPTS.target.Parse()
+    op = target_util.DeleteTarget(target_ref.RelativeName())
+    client_util.OperationsClient().CheckOperationStatus(
+        {target_ref.RelativeName(): op}, 'Deleted Cloud Deploy target: {}.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/describe.py

@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describes a Gcloud Deploy target resource."""
+
+
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import describe
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import resource_args
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """ \
+    To describe a target called 'test' for delivery pipeline 'test-pipeline' in region 'us-central1', run:
+
+       $ {command} test --delivery-pipeline=test-pipeline --region=us-central1
+
+  """,
+}
+
+
+def _CommonArgs(parser):
+  """Register flags for this command.
+
+  Args:
+    parser: An argparse.ArgumentParser-like object. It is mocked out in order to
+      capture some information, but behaves like an ArgumentParser.
+  """
+  resource_args.AddTargetResourceArg(parser, positional=True)
+  flags.AddDeliveryPipeline(parser, required=False)
+  flags.AddListAllPipelines(parser)
+  flags.AddSkipPipelineLookup(parser)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Describes details specific to the individual target, delivery pipeline qualified.
+
+  The output contains four sections:
+
+  Target:
+
+    detail of the target to be described.
+
+  Latest Release:
+
+    the detail of the active release in the target.
+
+  Latest Rollout:
+
+    the detail of the active rollout in the target.
+
+  Deployed:
+
+    timestamp of the last successful deployment.
+
+  Pending Approvals:
+
+    list of the rollouts that require approval.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    _CommonArgs(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """This is what gets called when the user runs this command."""
+    target_ref = args.CONCEPTS.target.Parse()
+
+    return describe.DescribeTarget(target_ref, args.delivery_pipeline,
+                                   args.skip_pipeline_lookup,
+                                   args.list_all_pipelines)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/export.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Gcloud Deploy target resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import export_util
+from googlecloudsdk.command_lib.deploy import manifest_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.command_lib.export import util as core_export_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+
+      To return the .yaml definition of the target 'test-target' in region 'us-central1', run:
+
+        $ {command} test-target --region=us-central1
+
+      """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Export(base.ExportCommand):
+  """Returns the .yaml definition of the specified target.
+
+  The exported YAML definition can be applied by 'deploy apply' command.
+  """
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+    core_export_util.AddExportFlags(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+    """
+    target_ref = args.CONCEPTS.target.Parse()
+    target_obj = target_util.GetTarget(target_ref)
+    manifest = manifest_util.ProtoToManifest(target_obj, target_ref,
+                                             manifest_util.ResourceKind.TARGET)
+
+    export_util.Export(manifest, args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/get_iam_policy.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a Cloud Deploy target.
+    description: |
+      *{command}* displays the IAM policy associated with a Cloud Deploy
+      target. If formatted as JSON, the output can be edited
+      and used as a policy file for *set-iam-policy*. The output includes
+      an "etag" field identifying the version emitted and allowing detection
+      of concurrent policy updates; see $ {parent_command} set-iam-policy
+      for additional details.
+    examples: |
+      To print the IAM policy for a target ``my-target'', run:
+
+        $ {command} my-target --region=us-central1
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      help_text: The target for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/list.py

@@ -0,0 +1,66 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Exports a Gcloud Deploy delivery pipeline resource."""
+
+
+import textwrap
+
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import target_util
+
+_DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        textwrap.dedent("""\
+
+      To list the targets in region 'us-central1', run:
+
+        $ {command} --region=us-central1
+
+      """)
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class List(base.ListCommand):
+  """List Cloud Deploy targets."""
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddLocationResourceArg(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    """Entry point of the export command.
+
+    Args:
+      args: argparse.Namespace, An object that contains the values for the
+        arguments specified in the .Args() method.
+
+    Returns:
+       A list of target messages.
+    """
+    loc_ref = args.CONCEPTS.region.Parse()
+
+    return target_util.ListTarget(loc_ref.RelativeName())

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/redeploy.py

@@ -0,0 +1,198 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Redeploy a rollout to a target."""
+
+
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.util import apis as core_apis
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import promote_util
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import rollout_util
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import console_io
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+  To redeploy a target `prod` for delivery pipeline `test-pipeline` in region `us-central1`, run:
+
+  $ {command} prod --delivery-pipeline=test-pipeline --region=us-central1
+
+""",
+}
+_ROLLOUT = 'rollout'
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Redeploy(base.CreateCommand):
+  """Redeploy the last release to a target.
+
+  Redeploy the last rollout that has a state of SUCCESSFUL or FAILED to a
+  target.
+  If rollout-id is not specified, a rollout ID will be generated.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+    flags.AddRolloutID(parser)
+    flags.AddDeliveryPipeline(parser)
+    flags.AddDescriptionFlag(parser)
+    flags.AddAnnotationsFlag(parser, _ROLLOUT)
+    flags.AddLabelsFlag(parser, _ROLLOUT)
+    flags.AddStartingPhaseId(parser)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    target_ref = args.CONCEPTS.target.Parse()
+    # Check if target exists
+    target_util.GetTarget(target_ref)
+    ref_dict = target_ref.AsDict()
+    pipeline_ref = resources.REGISTRY.Parse(
+        args.delivery_pipeline,
+        collection='clouddeploy.projects.locations.deliveryPipelines',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': args.delivery_pipeline,
+        },
+    )
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_redeploy_prefix = 'Cannot perform redeploy.'
+    # Check is the pipeline is suspended.
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_redeploy_prefix
+    )
+    current_release_ref = _GetCurrentRelease(
+        pipeline_ref, target_ref, rollout_util.ROLLOUT_IN_TARGET_FILTER_TEMPLATE
+    )
+    release_obj = release.ReleaseClient().Get(
+        current_release_ref.RelativeName()
+    )
+
+    release_util.CheckReleaseSupportState(release_obj, 'redeploy this release')
+
+    # Check if the release is abandoned.
+    if release_obj.abandoned:
+      raise deploy_exceptions.AbandonedReleaseError(
+          failed_redeploy_prefix, current_release_ref.RelativeName()
+      )
+
+    prompt = (
+        'Are you sure you want to redeploy release {} to target {}?'.format(
+            current_release_ref.Name(), target_ref.Name()
+        )
+    )
+    console_io.PromptContinue(prompt, cancel_on_no=True)
+    # On the command line deploy policy IDs are provided, but for the
+    # CreateRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+
+    promote_util.Promote(
+        current_release_ref,
+        release_obj,
+        target_ref.Name(),
+        False,
+        rollout_id=args.rollout_id,
+        annotations=args.annotations,
+        labels=args.labels,
+        description=args.description,
+        starting_phase_id=args.starting_phase_id,
+        override_deploy_policies=policies,
+    )
+
+
+def _GetCurrentRelease(pipeline_ref, target_ref, filter_str):
+  """Gets the current release in the target.
+
+  Args:
+    pipeline_ref: pipeline_ref: protorpc.messages.Message, pipeline object.
+    target_ref: target_ref: protorpc.messages.Message, target object.
+    filter_str: Filter string to use when listing rollouts.
+
+  Returns:
+    The most recent release with the given pipeline and target with a rollout
+    that is redeployable.
+
+  Raises:
+    core.Error: Target has no rollouts or rollouts in target are not
+                redeployable.
+  """
+  # Get the most recent rollout in the target, by EnqueueTime descending. Using
+  # EnqueueTime instead of DeployEndTime because this needs to return the latest
+  # rollout in any state (e.g. PENDING_APPROVAL, IN_PROGRESS). If it's not in
+  # a state that's redeployable an exception is returned.
+  prior_rollouts = list(
+      rollout_util.GetFilteredRollouts(
+          target_ref=target_ref,
+          pipeline_ref=pipeline_ref,
+          filter_str=filter_str,
+          order_by=rollout_util.ENQUEUETIME_ROLLOUT_ORDERBY,
+          limit=1,
+      )
+  )
+  if len(prior_rollouts) < 1:
+    raise core_exceptions.Error(
+        'unable to redeploy to target {}. Target has no rollouts.'.format(
+            target_ref.Name()
+        )
+    )
+  prior_rollout = prior_rollouts[0]
+  messages = core_apis.GetMessagesModule('clouddeploy', 'v1')
+  redeployable_states = [
+      messages.Rollout.StateValueValuesEnum.SUCCEEDED,
+      messages.Rollout.StateValueValuesEnum.FAILED,
+      messages.Rollout.StateValueValuesEnum.CANCELLED,
+  ]
+  if prior_rollout.state not in redeployable_states:
+    raise deploy_exceptions.RedeployRolloutError(
+        target_ref.Name(), prior_rollout.name, prior_rollout.state
+    )
+
+  current_release_ref = resources.REGISTRY.ParseRelativeName(
+      resources.REGISTRY.Parse(
+          prior_rollout.name,
+          collection=(
+              'clouddeploy.projects.locations.deliveryPipelines'
+              '.releases.rollouts'
+          ),
+      )
+      .Parent()
+      .RelativeName(),
+      collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+  )
+  return current_release_ref

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/remove_iam_policy_binding.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Remove an IAM policy binding for a Cloud Deploy target.
+    description: |
+      Removes a policy binding to the IAM policy of a Cloud Deploy target. One
+      binding consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To remove an IAM policy binding for the role of 'roles/clouddeploy.operator' for the user
+      'test-user@gmail.com' on 'my-target' with the region 'us-central1', run:
+
+        $ {command} my-target \
+          --region='us-central1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/clouddeploy.operator'
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      help_text: The target for which to remove the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/rollback.py

@@ -0,0 +1,374 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Rollback a Cloud Deploy target to a prior rollout."""
+
+import copy
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.clouddeploy import client_util
+from googlecloudsdk.api_lib.clouddeploy import release
+from googlecloudsdk.api_lib.util import exceptions as gcloud_exception
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.deploy import delivery_pipeline_util
+from googlecloudsdk.command_lib.deploy import deploy_policy_util
+from googlecloudsdk.command_lib.deploy import deploy_util
+from googlecloudsdk.command_lib.deploy import exceptions as deploy_exceptions
+from googlecloudsdk.command_lib.deploy import flags
+from googlecloudsdk.command_lib.deploy import promote_util
+from googlecloudsdk.command_lib.deploy import release_util
+from googlecloudsdk.command_lib.deploy import resource_args
+from googlecloudsdk.command_lib.deploy import rollout_util
+from googlecloudsdk.command_lib.deploy import target_util
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import console_io
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': '{description}',
+    'EXAMPLES': """ \
+  To rollback a target 'prod' for delivery pipeline 'test-pipeline' in region 'us-central1', run:
+
+  $ {command} prod --delivery-pipeline=test-pipeline --region=us-central1
+
+
+""",
+}
+_ROLLBACK = 'rollback'
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Rollback(base.CreateCommand):
+  """Rollbacks a target to a prior rollout.
+
+  If release is not specified, the command rollbacks the target with the last
+  successful deployed release. If optional rollout-id parameter is not
+  specified, a generated rollout ID will be used.
+  """
+
+  detailed_help = _DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddTargetResourceArg(parser, positional=True)
+    flags.AddRelease(parser, 'Name of the release to rollback to.')
+    flags.AddRolloutID(parser)
+    flags.AddDeliveryPipeline(parser)
+    flags.AddDescriptionFlag(parser)
+    flags.AddAnnotationsFlag(parser, _ROLLBACK)
+    flags.AddLabelsFlag(parser, _ROLLBACK)
+    flags.AddStartingPhaseId(parser)
+    flags.AddOverrideDeployPolicies(parser)
+
+  @gcloud_exception.CatchHTTPErrorRaiseHTTPException(
+      deploy_exceptions.HTTP_ERROR_FORMAT
+  )
+  def Run(self, args):
+    target_ref = args.CONCEPTS.target.Parse()
+    ref_dict = target_ref.AsDict()
+    pipeline_ref = resources.REGISTRY.Parse(
+        args.delivery_pipeline,
+        collection='clouddeploy.projects.locations.deliveryPipelines',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': args.delivery_pipeline,
+        },
+    )
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_error_annotation_prefix = 'Cannot perform rollback.'
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_error_annotation_prefix
+    )
+    # Check if target exists
+    target_util.GetTarget(target_ref)
+
+    current_release_ref, rollback_release_ref = _GetCurrentAndRollbackRelease(
+        args.release, pipeline_ref, target_ref
+    )
+
+    release_obj = release.ReleaseClient().Get(
+        rollback_release_ref.RelativeName()
+    )
+
+    release_util.CheckReleaseSupportState(release_obj, 'roll back this target')
+
+    if release_obj.abandoned:
+      error_msg_annotation_prefix = 'Cannot perform rollback.'
+      raise deploy_exceptions.AbandonedReleaseError(
+          error_msg_annotation_prefix, rollback_release_ref.RelativeName()
+      )
+
+    prompt = 'Rolling back target {} to release {}.\n\n'.format(
+        target_ref.Name(), rollback_release_ref.Name()
+    )
+    release_util.PrintDiff(
+        rollback_release_ref, release_obj, target_ref.Name(), prompt
+    )
+
+    console_io.PromptContinue(cancel_on_no=True)
+
+    rollout_description = args.description or 'Rollback from {}'.format(
+        current_release_ref.Name()
+    )
+    # On the command line deploy policy IDs are provided, but for the
+    # CreateRollout API we need to provide the full resource name.
+    policies = deploy_policy_util.CreateDeployPolicyNamesFromIDs(
+        pipeline_ref, args.override_deploy_policies
+    )
+    rollout_resource = promote_util.Promote(
+        rollback_release_ref,
+        release_obj,
+        target_ref.Name(),
+        False,
+        rollout_id=args.rollout_id,
+        annotations=args.annotations,
+        labels=args.labels,
+        description=rollout_description,
+        # For rollbacks, default is `stable`.
+        starting_phase_id=args.starting_phase_id or 'stable',
+        override_deploy_policies=policies,
+    )
+
+    if rollout_resource:
+      try:
+        # Any 403 errors should indicate to the user that they may need to
+        # add the new permission.
+        delivery_pipeline_util.CreateRollbackTarget(
+            pipeline_ref.RelativeName(),
+            target_ref.Name(),
+            validate_only=True,
+        )
+      except apitools_exceptions.HttpError as e:
+        if e.status_code == 403:
+          log.status.Print(
+              'Starting on September 14, 2026, the rollback feature will'
+              ' require a new permission: clouddeploy.rollouts.rollback. For'
+              ' more information, see'
+              ' https://docs.cloud.google.com/deploy/docs/rollout-perms-notice'
+          )
+    return rollout_resource
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class RollbackAlpha(Rollback):
+  """Rollbacks a target to a prior rollout.
+
+  If release is not specified, the command rollbacks the target with the last
+  successful deployed release. If optional rollout-id parameter is not
+  specified, a generated rollout ID will be used.
+  """
+
+  @staticmethod
+  def Args(parser):
+    # add the original args
+    Rollback.Args(parser)
+    flags.AddRollbackOfRollout(parser)
+
+  def Run(self, args):
+    target_ref = args.CONCEPTS.target.Parse()
+    ref_dict = target_ref.AsDict()
+    pipeline_ref = resources.REGISTRY.Parse(
+        args.delivery_pipeline,
+        collection='clouddeploy.projects.locations.deliveryPipelines',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': args.delivery_pipeline,
+        },
+    )
+    pipeline_obj = delivery_pipeline_util.GetPipeline(
+        pipeline_ref.RelativeName()
+    )
+    failed_activity_error_annotation_prefix = 'Cannot perform rollback.'
+    delivery_pipeline_util.ThrowIfPipelineSuspended(
+        pipeline_obj, failed_activity_error_annotation_prefix
+    )
+
+    rollout_obj = client_util.GetMessagesModule().Rollout(
+        description=args.description
+    )
+
+    deploy_util.SetMetadata(
+        client_util.GetMessagesModule(),
+        rollout_obj,
+        deploy_util.ResourceType.ROLLOUT,
+        args.annotations,
+        args.labels,
+    )
+
+    # First call, we perform validate only call, making a copy of the response.
+    validate_response = copy.deepcopy(
+        delivery_pipeline_util.CreateRollbackTarget(
+            pipeline_ref.RelativeName(),
+            target_ref.Name(),
+            validate_only=True,
+            rollout_id=args.rollout_id,
+            rollout_to_rollback=args.rollback_of_rollout,
+            release_id=args.release,
+            rollout_obj=rollout_obj,
+            starting_phase=args.starting_phase_id,
+        )
+    )
+
+    final_rollout_id = args.rollout_id
+    rollback_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            validate_response.rollbackConfig.rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+
+    # If the rollout_id is not given, we will generate it and overwrite the
+    # name that was part of the validate_only call. The reason for this is that
+    # we want to generate the name from the release, but this isn't
+    # available until after the validate_only call.
+    # To make the initial validate_only call, there must be a rollout_id given,
+    # so UUID is initially created for the request but ignored here.
+    if not args.rollout_id:
+      final_rollout_id = rollout_util.GenerateRolloutId(
+          target_ref.Name(), rollback_release_ref
+      )
+      resource_dict = rollback_release_ref.AsDict()
+      new_rollout_ref = resources.REGISTRY.Parse(
+          final_rollout_id,
+          collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+          params={
+              'projectsId': resource_dict.get('projectsId'),
+              'locationsId': resource_dict.get('locationsId'),
+              'deliveryPipelinesId': resource_dict.get('deliveryPipelinesId'),
+              'releasesId': rollback_release_ref.Name(),
+          },
+      )
+      validate_response.rollbackConfig.rollout.name = (
+          new_rollout_ref.RelativeName()
+      )
+
+    # if args.description isn't set.
+    if not args.description:
+      current_release_ref = resources.REGISTRY.ParseRelativeName(
+          resources.REGISTRY.Parse(
+              validate_response.rollbackConfig.rollout.rollbackOfRollout,
+              collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+          )
+          .Parent()
+          .RelativeName(),
+          collection=(
+              'clouddeploy.projects.locations.deliveryPipelines.releases'
+          ),
+      )
+      validate_response.rollbackConfig.rollout.description = (
+          'Rollback from {}'.format(current_release_ref.Name())
+      )
+
+    try:
+      release_obj = release.ReleaseClient().Get(
+          rollback_release_ref.RelativeName()
+      )
+    except apitools_exceptions.HttpError as error:
+      raise exceptions.HttpException(error)
+
+    release_util.CheckReleaseSupportState(release_obj, 'roll back this target')
+
+    # prompt to see whether user wants to continue.
+    prompt = 'Rolling back target {} to release {}.\n\n'.format(
+        target_ref.Name(), rollback_release_ref.Name()
+    )
+    release_util.PrintDiff(
+        rollback_release_ref, release_obj, target_ref.Name(), prompt
+    )
+
+    console_io.PromptContinue(cancel_on_no=True)
+
+    create_response = delivery_pipeline_util.CreateRollbackTarget(
+        pipeline_ref.RelativeName(),
+        target_ref.Name(),
+        validate_only=False,
+        # use the final_rollout_id which was calculated on client
+        rollout_id=final_rollout_id,
+        release_id=rollback_release_ref.Name(),
+        # use the server calculated fields for the rest of the fields.
+        rollout_to_rollback=validate_response.rollbackConfig.rollout.rollbackOfRollout,
+        rollout_obj=validate_response.rollbackConfig.rollout,
+        starting_phase=validate_response.rollbackConfig.startingPhaseId,
+    )
+    # return the rollout resource that was created
+    return create_response.rollbackConfig.rollout
+
+
+def _GetCurrentAndRollbackRelease(release_id, pipeline_ref, target_ref):
+  """Gets the current deployed release and the release that will be used by promote API to create the rollback rollout."""
+  if release_id:
+    ref_dict = target_ref.AsDict()
+    current_rollout = target_util.GetCurrentRollout(target_ref, pipeline_ref)
+    current_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            current_rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+    rollback_release_ref = resources.REGISTRY.Parse(
+        release_id,
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+        params={
+            'projectsId': ref_dict['projectsId'],
+            'locationsId': ref_dict['locationsId'],
+            'deliveryPipelinesId': pipeline_ref.Name(),
+            'releasesId': release_id,
+        },
+    )
+    return current_release_ref, rollback_release_ref
+  else:
+    prior_rollouts = rollout_util.GetValidRollBackCandidate(
+        target_ref, pipeline_ref
+    )
+    if len(prior_rollouts) < 2:
+      raise core_exceptions.Error(
+          'unable to rollback target {}. Target has less than 2 rollouts.'
+          .format(target_ref.Name())
+      )
+    current_deployed_rollout, previous_deployed_rollout = prior_rollouts
+
+    current_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            current_deployed_rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+    rollback_release_ref = resources.REGISTRY.ParseRelativeName(
+        resources.REGISTRY.Parse(
+            previous_deployed_rollout.name,
+            collection='clouddeploy.projects.locations.deliveryPipelines.releases.rollouts',
+        )
+        .Parent()
+        .RelativeName(),
+        collection='clouddeploy.projects.locations.deliveryPipelines.releases',
+    )
+    return current_release_ref, rollback_release_ref

gcloud auth application-default login/google-cloud-sdk/lib/surface/deploy/targets/set_iam_policy.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Set the IAM policy for a Cloud Deploy target.
+    description: |
+      Set the IAM policy associated with a Cloud Deploy target.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      ``policy.json'' and set it for a target with identifier
+      ``my-target''
+
+      $ {command} my-target policy.json --region=us-central1
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+
+  request:
+    api_version: v1
+    collection: clouddeploy.projects.locations.targets
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.deploy.resources:target
+      help_text: |
+        The target for which to set the IAM policy.
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion