feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/__init__.py

@@ -0,0 +1,38 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for import jobs."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.kms import flags
+
+
+class ImportJobs(base.Group):
+  """Create and manage import jobs.
+
+  Import jobs can be used to create CryptoKeyVersions using
+  pre-existing key material, generated outside of Cloud KMS.
+  """
+
+  category = base.IDENTITY_AND_SECURITY_CATEGORY
+
+  @classmethod
+  def Args(cls, parser):
+    parser.display_info.AddUriFunc(
+        cloudkms_base.MakeGetUriFunc(flags.IMPORT_JOB_COLLECTION))

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/add_iam_policy_binding.yaml

@@ -0,0 +1,28 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: Add IAM policy binding to a KMS import job.
+  description: |
+    Adds a policy binding to the IAM policy of a KMS import job. One binding consists of a member
+    and a role.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/viewer' for the user 'test-user@gmail.com'
+    on the import job frodo with the keyring fellowship and location global, run:
+
+      $ {command} frodo --keyring='fellowship' --location='global' --member='user:test-user@gmail.com' --role='roles/viewer'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: cloudkms.projects.locations.keyRings.importJobs
+
+arguments:
+  resource:
+    help_text: The import job to add the IAM policy binding to.
+    spec: !REF googlecloudsdk.command_lib.kms.resources:import_job
+
+iam:
+  policy_version: 3
+  get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/create.py

@@ -0,0 +1,114 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create a new import job."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.kms import flags
+from googlecloudsdk.command_lib.kms import maps
+
+
+@base.DefaultUniverseOnly
+class Create(base.CreateCommand):
+  r"""Create a new import job.
+
+  Creates a new import job within the given keyring.
+
+  ## EXAMPLES
+
+  The following command creates a new import job named `strider` within the
+  `fellowship` keyring, and `us-central1` location:
+
+    $ {command} strider --location=us-central1 \
+        --keyring=fellowship --import-method=rsa-oaep-3072-sha256-aes-256 \
+        --protection-level=hsm
+
+  The following command creates a new import job named `strider` within the
+  `fellowship` keyring, and `us-central1` location:
+
+    $ {command} strider --location=us-central1 \
+        --keyring=fellowship --import-method=rsa-oaep-3072-sha256-aes-256 \
+        --protection-level=hsm-single-tenant --single-tenant-hsm-instance=my_sthi
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSingleTenantHsmInstanceFlag(parser)
+    flags.AddLocationFlag(parser, 'import job')
+    flags.AddKeyRingFlag(parser, 'import job')
+    flags.AddRequiredProtectionLevelFlag(parser)
+    flags.AddRequiredImportMethodFlag(parser)
+    flags.AddPositionalImportJobArgument(parser, 'to create')
+
+    parser.display_info.AddCacheUpdater(flags.KeyRingCompleter)
+
+  def _CreateRequest(self, args):
+    messages = cloudkms_base.GetMessagesModule()
+
+    if not args.protection_level:
+      raise exceptions.ArgumentError(
+          '--protection-level needs to be specified when creating an import job'
+      )
+
+    if not args.import_method:
+      raise exceptions.ArgumentError(
+          '--import-method needs to be specified when creating an import job')
+
+    import_job_ref = flags.ParseImportJobName(args)
+    parent_ref = flags.ParseParentFromResource(import_job_ref)
+    if args.protection_level == 'hsm-single-tenant':
+      if not args.single_tenant_hsm_instance:
+        raise exceptions.BadArgumentException(
+            '--single-tenant-hsm-instance',
+            'Single tenant HSM instance must be specified when protection level'
+            ' is hsm-single-tenant',
+        )
+    if args.single_tenant_hsm_instance:
+      single_tenant_hsm_instance_ref = flags.ParseSingleTenantHsmInstanceName(
+          args
+      )
+      if (
+          single_tenant_hsm_instance_ref.Parent().RelativeName()
+          != import_job_ref.Parent().Parent().RelativeName()
+      ):
+        raise exceptions.BadArgumentException(
+            '--single-tenant-hsm-instance',
+            'Single tenant HSM instance must be in the same location as the'
+            ' import job',
+        )
+
+    return messages.CloudkmsProjectsLocationsKeyRingsImportJobsCreateRequest(
+        parent=parent_ref.RelativeName(),
+        importJobId=import_job_ref.Name(),
+        importJob=messages.ImportJob(
+            protectionLevel=maps.IMPORT_PROTECTION_LEVEL_MAPPER.GetEnumForChoice(
+                args.protection_level
+            ),
+            importMethod=maps.IMPORT_METHOD_MAPPER.GetEnumForChoice(
+                args.import_method
+            ),
+            cryptoKeyBackend=args.single_tenant_hsm_instance,
+        ),
+    )
+
+  def Run(self, args):
+    client = cloudkms_base.GetClientInstance()
+    return client.projects_locations_keyRings_importJobs.Create(
+        self._CreateRequest(args))

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/describe.py

@@ -0,0 +1,100 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describe a version."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.kms import exceptions as kms_exceptions
+from googlecloudsdk.command_lib.kms import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core.util import files
+
+
+class Describe(base.DescribeCommand):
+  r"""Get metadata for a given import job.
+
+  Returns metadata for the given import job.
+
+  The optional flag `--attestation-file` specifies file to write the attestation
+  into. The attestation enables the user to verify the integrity and provenance
+  of the key. See https://cloud.google.com/kms/docs/attest-key for more
+  information about attestations.
+
+  ## EXAMPLES
+
+  The following command returns metadata for import job 'strider' within the
+  keyring 'fellowship' in the location 'us-central1':
+
+    $ {command} strider --keyring=fellowship --location=us-central1
+
+  For import jobs with protection level `HSM`, use the `--attestation-file`
+  flag to save the attestation to a local file.
+
+    $ {command} strider --keyring=fellowship --location=us-central1 \
+        --attestation-file=path/to/attestation.dat
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddKeyRingFlag(parser, 'import job')
+    flags.AddLocationFlag(parser, 'import job')
+    flags.AddPositionalImportJobArgument(parser, 'to describe')
+    flags.AddAttestationFileFlag(parser)
+
+  def Run(self, args):
+    client = cloudkms_base.GetClientInstance()
+    messages = cloudkms_base.GetMessagesModule()
+
+    import_job_ref = flags.ParseImportJobName(args)
+    if not import_job_ref.Name():
+      raise exceptions.InvalidArgumentException(
+          'import_job', 'import job id must be non-empty.')
+    import_job = client.projects_locations_keyRings_importJobs.Get(  # pylint: disable=line-too-long
+        messages.CloudkmsProjectsLocationsKeyRingsImportJobsGetRequest(
+            name=import_job_ref.RelativeName()))
+
+    # Raise exception if --attestation-file is provided for software
+    # import jobs.
+    if (args.attestation_file and import_job.protectionLevel !=
+        messages.ImportJob.ProtectionLevelValueValuesEnum.HSM):
+      raise kms_exceptions.ArgumentError(
+          'Attestations are only available for HSM import jobs.')
+
+    if (args.attestation_file and import_job.state == messages.ImportJob
+        .StateValueValuesEnum.PENDING_GENERATION):
+      raise kms_exceptions.ArgumentError(
+          'The attestation is unavailable until the import job is generated.')
+
+    if args.attestation_file and import_job.attestation is not None:
+      try:
+        log.WriteToFileOrStdout(
+            args.attestation_file,
+            import_job.attestation.content,
+            overwrite=True,
+            binary=True)
+      except files.Error as e:
+        raise exceptions.BadFileException(e)
+
+    if import_job.attestation is not None:
+      # Suppress the attestation content in the printed output. Users can use
+      # --attestation-file to obtain it, instead.
+      import_job.attestation.content = None
+
+    return import_job

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/get_iam_policy.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for an import job.
+    description: |
+      Displays the IAM policy associated with an import job.
+      If formatted as JSON, the output can be edited and used as
+      a policy file for *set-iam-policy*. The output includes an "etag"
+      field identifying the version emitted and allowing detection of
+      concurrent policy updates;
+      see $ {parent_command} set-iam-policy for additional details.
+    examples: |
+      To print the IAM policy for a given import job, run:
+
+        $ {command} --keyring=my-key-ring --location=my-location my-importjob
+
+  request:
+    collection: cloudkms.projects.locations.keyRings.importJobs
+
+  arguments:
+    resource:
+      help_text: The import job for which to get the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.kms.resources:import_job
+
+  iam:
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/list.py

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""List the import jobs within a keyring."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import list_pager
+from googlecloudsdk.api_lib.cloudkms import base as cloudkms_base
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.kms import flags
+
+
+class List(base.ListCommand):
+  """Lists import jobs within a keyring.
+
+  Lists all import jobs within the given keyring.
+
+  ## EXAMPLES
+
+  The following command lists a maximum of five import jobs within the
+  keyring 'fellowship' and location 'global':
+
+    $ {command} --keyring=fellowship --location=global
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddKeyRingFlag(parser, 'import job')
+    flags.AddLocationFlag(parser, 'import job')
+    parser.display_info.AddFormat("""
+        table(
+          name,
+          state,
+          import_method,
+          protection_level,
+          labels.list())
+    """)
+
+  def Run(self, args):
+    client = cloudkms_base.GetClientInstance()
+    messages = cloudkms_base.GetMessagesModule()
+
+    key_ring_ref = flags.ParseKeyRingName(args)
+
+    request = messages.CloudkmsProjectsLocationsKeyRingsImportJobsListRequest(
+        parent=key_ring_ref.RelativeName())
+
+    return list_pager.YieldFromList(
+        client.projects_locations_keyRings_importJobs,
+        request,
+        field='importJobs',
+        limit=args.limit,
+        batch_size_attribute='pageSize')

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/remove_iam_policy_binding.yaml

@@ -0,0 +1,29 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: Remove IAM policy binding for a KMS import job.
+  description: |
+    Removes a policy binding from the IAM policy of a KMS import job. One binding consists of a
+    member and a role.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/viewer' for the user
+    'test-user@gmail.com' on the import job frodo with the keyring fellowship and location global,
+    run:
+
+      $ {command} frodo --keyring='fellowship' --location='global' --member='user:test-user@gmail.com' --role='roles/viewer'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: cloudkms.projects.locations.keyRings.importJobs
+
+arguments:
+  resource:
+    help_text: The import job from which to remove the IAM policy binding.
+    spec: !REF googlecloudsdk.command_lib.kms.resources:import_job
+
+iam:
+  policy_version: 3
+  get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/kms/import_jobs/set_iam_policy.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Set the IAM policy binding for a KMS import job.
+    description: |
+      Sets the IAM policy for the given import job as defined in a JSON or YAML file.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the import job 'frodo' with the keyring
+      'fellowship' and location 'global':
+
+        $ {command} frodo policy.json --keyring=fellowship --location=global
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+  request:
+    collection: cloudkms.projects.locations.keyRings.importJobs
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.iam.hooks:UseMaxRequestedPolicyVersion:api_field=setIamPolicyRequest.policy.version
+    - googlecloudsdk.command_lib.iam.hooks:AddVersionToUpdateMaskIfNotPresent:update_mask_path=setIamPolicyRequest.updateMask
+
+  arguments:
+    resource:
+      help_text: The import job for which to set the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.kms.resources:import_job
+
+  iam:
+    policy_version: 3