feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/__init__.py

@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The super-group for the organizations CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+class Organizations(base.Group):
+  """Create and manage Google Cloud Platform Organizations.
+
+  The {command} group lets you create and manage Cloud Organizations.
+  Google Cloud Platform resources form a hierarchy with Organizations at the
+  root. Organizations contain projects, and Projects contain the remaining
+  Google Cloud Platform resources.
+
+  More information on the Cloud Platform Resource Hierarchy and the Organization
+  resource can be found here:
+  https://cloud.google.com/resource-manager/docs/creating-managing-organization
+  and detailed documentation on creating and managing organizations can be found
+  here:
+  https://cloud.google.com/resource-manager/docs/creating-managing-organization
+  """
+
+  category = base.MANAGEMENT_TOOLS_CATEGORY
+
+  def Filter(self, context, args):
+    # TODO(b/190538570):  Determine if command group works with project number
+    base.RequireProjectID(args)
+    del context, args
+    base.DisableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/add_iam_policy_binding.yaml

@@ -0,0 +1,40 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Add IAM policy binding for an organization
+  description: |
+    Adds a policy binding to the IAM policy of an organization, given an organization ID and the
+    binding. One binding consists of a member, a role, and an optional condition.
+
+  examples: |
+    To add an IAM policy binding with the role of 'roles/editor' for the user 'test-user@example.com'
+    on an organization with identifier 'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='user:test-user@example.com' --role='roles/editor'
+
+    To add an IAM policy binding with the role of 'roles/editor' for the service account
+    'my-iam-account@my-project.iam.gserviceaccount.com' on an organization with identifier
+    'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='serviceAccount:my-iam-account@my-project.iam.gserviceaccount.com' --role='roles/editor'
+
+    To add an IAM policy binding which expires at the end of the year 2018 for the role of
+    'roles/browser' and the user 'test-user@example.com' on an organization with identifier
+    'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='user:test-user@example.com' --role='roles/browser' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: cloudresourcemanager.organizations
+
+arguments:
+  resource:
+    help_text: The organization to add the IAM policy binding.
+    spec: !REF googlecloudsdk.command_lib.organizations.resources:organization
+
+iam:
+  enable_condition: true
+  policy_version: 3
+  get_iam_policy_version_path: getIamPolicyRequest.options.requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/describe.py

@@ -0,0 +1,65 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to show metadata for a specified organization."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import textwrap
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.organizations import flags
+from googlecloudsdk.command_lib.organizations import org_utils
+
+
+class Describe(base.DescribeCommand):
+  """Show metadata for an organization.
+
+  Shows metadata for an organization, given a valid organization ID. If an
+  organization domain is supplied instead, this command will attempt to find
+  the organization by domain name.
+
+  This command can fail for the following reasons:
+      * The organization specified does not exist.
+      * The active account does not have permission to access the given
+        organization.
+      * The domain name supplied does not correspond to a unique organization
+        ID.
+  """
+  detailed_help = {
+      'EXAMPLES': textwrap.dedent("""\
+          The following command prints metadata for an organization with the
+          ID `3589215982`:
+
+            $ {command} 3589215982
+
+          The following command prints metadata for an organization associated
+          with the domain ``example.com'':
+
+            $ {command} example.com
+    """),
+  }
+
+  @staticmethod
+  def Args(parser):
+    flags.IdArg('you want to describe.').AddToParser(parser)
+
+  def Run(self, args):
+    org = org_utils.GetOrganization(args.id)
+    if org is not None:
+      return org
+    else:
+      raise org_utils.UnknownOrganizationError(args.id)

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/get_iam_policy.py

@@ -0,0 +1,62 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2015 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command to get IAM policy for an organization."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudresourcemanager import organizations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.organizations import flags
+from googlecloudsdk.command_lib.organizations import org_utils
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA, base.ReleaseTrack.BETA)
+class GetIamPolicy(base.ListCommand):
+  """Get IAM policy for an organization.
+
+  Gets the IAM policy for an organization, given an organization ID.
+
+  If a domain is supplied instead of an organization ID, this command will
+  attempt to look up the organization ID associated with that domain.
+  """
+
+  detailed_help = {
+      'EXAMPLES': """\
+          The following command prints the IAM policy for an organization with
+          the ID `123456789`:
+
+            $ {command} 123456789
+
+          The following command prints the IAM policy for the organzation
+          associated with the domain ``example.com'':
+
+            $ {command} example.com
+          """
+  }
+
+  @staticmethod
+  def Args(parser):
+    flags.IdArg('whose policy you want to get.').AddToParser(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    org_id = org_utils.GetOrganizationId(args.id)
+    if org_id:
+      return organizations.Client().GetIamPolicy(org_id)
+    else:
+      raise org_utils.UnknownOrganizationError(args.id)

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/get_iam_policy.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: Get the IAM policy for an organization.
+    description: |
+      *{command}* displays the IAM policy associated with an organization.
+      If formatted as JSON, the output can be edited and used as
+      a policy file for *set-iam-policy*. The output includes an "etag"
+      field identifying the version emitted and allowing detection of
+      concurrent policy updates;
+      see $ {parent_command} set-iam-policy for additional details.
+    examples: |
+      To print the IAM policy for a given organization, run:
+
+        $ {command} my-organization
+
+  request:
+    collection: cloudresourcemanager.organizations
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.organizations.hooks:SetOrganization
+
+  arguments:
+    resource:
+      help_text: The organization for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.organizations.resources:organization
+
+  iam:
+    policy_version: 3
+    get_iam_policy_version_path: getIamPolicyRequest.options.requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/list.py

@@ -0,0 +1,47 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to list all organization IDs associated with the active user."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudresourcemanager import organizations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.organizations import org_utils
+
+
+class List(base.ListCommand):
+  """List organizations accessible by the active account.
+
+  Lists all organizations to which the user has access. Organizations are listed
+  in an unspecified order.
+  """
+
+  @staticmethod
+  def Args(parser):
+    parser.display_info.AddFormat(
+        """
+          table(
+            displayName:label=DISPLAY_NAME,
+            name.segment():label=ID:align=right:sort=1,
+            owner.directoryCustomerId:label=DIRECTORY_CUSTOMER_ID:align=right
+          )""")
+    parser.display_info.AddUriFunc(org_utils.OrganizationsUriFunc)
+
+  def Run(self, args):
+    """Run the list command."""
+    orgs_client = organizations.Client()
+    return orgs_client.List(limit=args.limit, page_size=args.page_size)

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/remove_iam_policy_binding.yaml

@@ -0,0 +1,46 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Remove IAM policy binding for an organization
+  description: |
+    Removes a policy binding from the IAM policy of an organization, given an organization ID and
+    the binding. One binding consists of a member, a role, and an optional condition.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/editor' for the user
+    'test-user@gmail.com' on organization with identifier 'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='user:test-user@gmail.com' --role='roles/editor'
+
+    To remove an IAM policy binding for the role of 'roles/editor' from all authenticated users on
+    organization 'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='allAuthenticatedUsers' --role='roles/editor'
+
+    To remove an IAM policy binding with a condition of
+    expression='request.time < timestamp("2019-01-01T00:00:00Z")', title='expires_end_of_2018',
+    and description='Expires at midnight on 2018-12-31' for the role of 'roles/browser' for the
+    user 'test-user@gmail.com' on organization with identifier 'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='user:test-user@gmail.com' --role='roles/browser' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'
+
+    To remove all IAM policy bindings regardless of the condition for the role of 'roles/browser'
+    and for the user 'test-user@gmail.com' on organization with identifier
+    'example-organization-id-1', run:
+
+        $ {command} example-organization-id-1 --member='user:test-user@gmail.com' --role='roles/browser' --all
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: cloudresourcemanager.organizations
+
+arguments:
+  resource:
+    help_text: The organization to remove the IAM policy binding.
+    spec: !REF googlecloudsdk.command_lib.organizations.resources:organization
+
+iam:
+  enable_condition: true
+  policy_version: 3
+  get_iam_policy_version_path: getIamPolicyRequest.options.requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/organizations/set_iam_policy.py

@@ -0,0 +1,63 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2015 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command to set IAM policy for a resource."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.cloudresourcemanager import organizations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.organizations import flags
+from googlecloudsdk.command_lib.organizations import org_utils
+
+
+class SetIamPolicy(base.Command):
+  """Set IAM policy for an organization.
+
+  Given an organization ID and a file encoded in JSON or YAML that contains the
+  IAM policy, this command will set the IAM policy for that organization.
+  """
+
+  detailed_help = {
+      'EXAMPLES': (
+          '\n'.join([
+              'The following command reads an IAM policy defined in a JSON',
+              'file `policy.json` and sets it for an organization with the ID',
+              '`123456789`:',
+              '',
+              '  $ {command} 123456789 policy.json',
+              '',
+              'The following command reads an IAM policy defined in a JSON',
+              'file `policy.json` and sets it for the organization associated',
+              'with the domain `example.com`:',
+              '',
+              '  $ {command} example.com policy.json',
+          ]))
+      }
+
+  @staticmethod
+  def Args(parser):
+    flags.IdArg('whose IAM policy you want to set.').AddToParser(parser)
+    parser.add_argument(
+        'policy_file', help='JSON or YAML file containing the IAM policy.')
+
+  def Run(self, args):
+    org_id = org_utils.GetOrganizationId(args.id)
+    if org_id:
+      return organizations.Client().SetIamPolicy(org_id, args.policy_file)
+    else:
+      raise org_utils.UnknownOrganizationError(args.id)