feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/__init__.py

@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for ekm config."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.kms import flags
+from googlecloudsdk.core import resources
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class EkmConfig(base.Group):
+  """Update and retrieve the EkmConfig.
+
+  EkmConfig is a singleton resource that represents configuration
+  parameters that apply to all CryptoKeys and CryptoKeyVersions of EXTERNAL_VPC
+  protecion level.
+  """
+
+  category = base.IDENTITY_AND_SECURITY_CATEGORY
+
+  @staticmethod
+  def Args(parser):
+    pass

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/add_iam_policy_binding.py

@@ -0,0 +1,65 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Add IAM Policy Binding for EkmConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import iam
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iam import iam_util
+from googlecloudsdk.command_lib.kms import resource_args
+
+
+class AddIamPolicyBinding(base.Command):
+  """Add IAM policy binding to an EkmConfig.
+
+  Adds a policy binding to the IAM policy of a kms EkmConfig. A binding consists
+  of at least one member, a role, and an optional condition.
+
+  ## EXAMPLES
+  To add an IAM policy binding for the role of 'roles/editor' for the user
+  `test-user@gmail.com` on the EkmConfig with location `us-central1`, run:
+
+    $ {command} --location='us-central1' --member='user:test-user@gmail.com'
+    --role='roles/editor'
+
+  To add an IAM policy binding which expires at the end of the year 2022 for the
+  role of 'roles/editor' and the user `test-user@gmail.com` and location
+  `us-central1`, run:
+
+    $ {command} --location='us-central1' --member='user:test-user@gmail.com'
+    --role='roles/editor' --condition='expression=request.time <
+    timestamp("2023-01-01T00:00:00Z"),title=expires_end_of_2022,description=Expires
+    at midnight on 2022-12-31'
+
+  See https://cloud.google.com/iam/docs/managing-policies for details of
+  policy role and member types.
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddKmsLocationResourceArgForKMS(parser, True, '--location')
+    iam_util.AddArgsForAddIamPolicyBinding(parser, add_condition=True)
+
+  def Run(self, args):
+    location_ref = args.CONCEPTS.location.Parse()
+    ekm_config_name = 'projects/{0}/locations/{1}/ekmConfig'.format(
+        location_ref.projectsId, location_ref.locationsId)
+    result = iam.AddPolicyBindingToEkmConfig(ekm_config_name, args.member,
+                                             args.role)
+    iam_util.LogSetIamPolicy(ekm_config_name, 'EkmConfig')
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/describe.py

@@ -0,0 +1,58 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describe the EkmConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.kms import resource_args
+
+
+class Describe(base.DescribeCommand):
+  r"""Describe the EkmConfig.
+
+  {command} can be used to retrieve the EkmConfig.
+
+  ## EXAMPLES
+
+  The following command retrieves the EkmConfig in `us-east1` for the current
+  project:
+
+  $ {command} --location=us-east1
+
+  The following command retrieves the EkmConfig for its project `foo` and
+  location `us-east1`:
+
+    $ {command} --location="projects/foo/locations/us-east1"
+
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddKmsLocationResourceArgForKMS(parser, True, '--location')
+
+  def Run(self, args):
+    client = cloudkms_base.GetClientInstance()
+    messages = cloudkms_base.GetMessagesModule()
+    location_ref = args.CONCEPTS.location.Parse()
+    ekm_config_name = 'projects/{0}/locations/{1}/ekmConfig'.format(
+        location_ref.projectsId, location_ref.locationsId)
+
+    return client.projects_locations.GetEkmConfig(
+        messages.CloudkmsProjectsLocationsGetEkmConfigRequest(
+            name=ekm_config_name))

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/get_iam_policy.py

@@ -0,0 +1,50 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Fetch the IAM policy for an EkmConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import iam
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.kms import resource_args
+
+
+class GetIamPolicy(base.ListCommand):
+  """Get the IAM policy for an EkmConfig.
+
+  Gets the IAM policy for the given location.
+
+  Returns an empty policy if the resource does not have a policy set.
+
+  ## EXAMPLES
+
+  The following command gets the IAM policy for the EkmConfig
+  within the location `us-central1`:
+
+    $ {command} --location=us-central1
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddKmsLocationResourceArgForKMS(parser, True, '--location')
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    location_ref = args.CONCEPTS.location.Parse()
+    ekm_config_name = 'projects/{0}/locations/{1}/ekmConfig'.format(
+        location_ref.projectsId, location_ref.locationsId)
+    return iam.GetEkmConfigIamPolicy(ekm_config_name)

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/remove_iam_policy_binding.py

@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Remove IAM Policy Binding for EkmConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import iam
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iam import iam_util
+from googlecloudsdk.command_lib.kms import resource_args
+
+
+class RemoveIamPolicyBinding(base.Command):
+  """Remove IAM policy binding from an EkmConfig.
+
+  Removes a policy binding from the IAM policy of a kms EkmConfig. A binding
+  consists of at
+  least one member, a role, and an optional condition.
+
+  ## EXAMPLES
+  To remove an IAM policy binding for the role of 'roles/editor' for the user
+  'test-user@gmail.com' on the EkmConfig with location us-central1, run:
+
+    $ {command} --location='us-central1' --member='user:test-user@gmail.com'
+    --role='roles/editor'
+
+  To remove an IAM policy binding with a condition of
+  expression='request.time < timestamp("2023-01-01T00:00:00Z")',
+  title='expires_end_of_2022',
+  and description='Expires at midnight on 2022-12-31' for the role of
+  'roles/editor'
+  for the user 'test-user@gmail.com' on the EkmConfig with location us-central1,
+  run:
+
+    $ {command} --location='us-central1' --member='user:test-user@gmail.com'
+    --role='roles/editor' --condition='expression=request.time <
+    timestamp("2023-01-01T00:00:00Z"),title=expires_end_of_2022,description=Expires
+    at midnight on 2022-12-31'
+
+  To remove all IAM policy bindings regardless of the condition for the role of
+  'roles/editor' and for the user 'test-user@gmail.com' on the EkmConfig with
+  location us-central1, run:
+
+    $ {command} laplace --location='us-central1'
+    --member='user:test-user@gmail.com' --role='roles/editor' --all
+
+  See https://cloud.google.com/iam/docs/managing-policies for details of
+  policy role and member types.
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddKmsLocationResourceArgForKMS(parser, True, '--location')
+    iam_util.AddArgsForRemoveIamPolicyBinding(parser, add_condition=True)
+
+  def Run(self, args):
+    location_ref = args.CONCEPTS.location.Parse()
+    ekm_config_name = 'projects/{0}/locations/{1}/ekmConfig'.format(
+        location_ref.projectsId, location_ref.locationsId)
+    result = iam.RemovePolicyBindingFromEkmConfig(ekm_config_name, args.member,
+                                                  args.role)
+    iam_util.LogSetIamPolicy(ekm_config_name, 'EkmConfig')
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/set_iam_policy.py

@@ -0,0 +1,62 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Set the IAM policy for EkmConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.api_lib.cloudkms import iam
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iam import iam_util
+from googlecloudsdk.command_lib.kms import resource_args
+
+
+class SetIamPolicy(base.Command):
+  """Set the IAM policy for an EkmConfig.
+
+  Sets the IAM policy for the EkmConfig in a location as defined in a JSON or
+  YAML file.
+
+  See https://cloud.google.com/iam/docs/managing-policies for details of
+  the policy file format and contents.
+
+  ## EXAMPLES
+  The following command will read am IAM policy defined in a JSON file
+  'policy.json' and set it for the EkmConfig with location `us-central1`:
+
+    $ {command} policy.json --location=us-central1
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddKmsLocationResourceArgForKMS(parser, True, '--location')
+    parser.add_argument(
+        'policy_file', help=('JSON or YAML file with '
+                             'the IAM policy'))
+
+  def Run(self, args):
+    messages = cloudkms_base.GetMessagesModule()
+
+    policy, update_mask = iam_util.ParseYamlOrJsonPolicyFile(
+        args.policy_file, messages.Policy)
+
+    location_ref = args.CONCEPTS.location.Parse()
+    ekm_config_name = 'projects/{0}/locations/{1}/ekmConfig'.format(
+        location_ref.projectsId, location_ref.locationsId)
+    result = iam.SetEkmConfigIamPolicy(ekm_config_name, policy, update_mask)
+    iam_util.LogSetIamPolicy(ekm_config_name, 'EkmConfig')
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/ekm_config/update.py

@@ -0,0 +1,87 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Update the EkmConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.kms import flags
+from googlecloudsdk.command_lib.kms import resource_args
+
+
+class Update(base.UpdateCommand):
+  r"""Update the EkmConfig.
+
+  {command} can be used to update the EkmConfig. Applies to all CryptoKeys and
+  CryptoKeyVersions with a `protection level` of `external vpc`.
+
+  ## EXAMPLES
+
+  The following command sets the default ekm-connection to `laplace` for its
+  project `foo` and location `us-east1`:
+
+    $ {command} --location=us-east1
+    --default-ekm-connection="projects/foo/locations/us-east1/ekmConnections/laplace"
+
+  The following command removes the default-ekm-connection in `us-east1` for the
+  current project:
+
+  $ {command} --location=us-east1 --default-ekm-connection=""
+
+
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddDefaultEkmConnectionFlag(parser)
+    resource_args.AddKmsLocationResourceArgForKMS(parser, True, '--location')
+
+  def CreateRequest(self, messages, ec_name, ekm_config):
+    ekm_config_to_update = ekm_config
+    ekm_config_to_update.defaultEkmConnection = ec_name
+    req = messages.CloudkmsProjectsLocationsUpdateEkmConfigRequest(
+        name=ekm_config.name, ekmConfig=ekm_config_to_update)
+
+    req.updateMask = 'defaultEkmConnection'
+
+    return req
+
+  def Run(self, args):
+    client = cloudkms_base.GetClientInstance()
+    messages = cloudkms_base.GetMessagesModule()
+    loc_ref = args.CONCEPTS.location.Parse()
+    # Currently default_ekm_connection is the only field so it must be specified
+    # but it can be an empty string to remove the default ekm connection from
+    # the config.
+    if args.default_ekm_connection is None:
+      raise exceptions.RequiredArgumentException('--default-ekm-connection',
+                                                 'Must be specified.')
+
+    # Try to get the ekmConfig and raise an exception if it doesn't exist.
+    ekm_config_name = 'projects/{0}/locations/{1}/ekmConfig'.format(
+        loc_ref.projectsId, loc_ref.locationsId)
+    ekm_config = client.projects_locations.GetEkmConfig(
+        messages.CloudkmsProjectsLocationsGetEkmConfigRequest(
+            name=ekm_config_name))
+
+    # Make update request
+    update_req = self.CreateRequest(messages, args.default_ekm_connection,
+                                    ekm_config)
+
+    return client.projects_locations.UpdateEkmConfig(update_req)