feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for pools."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Pools(base.Group):
+  """Manage CA pools.
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/add_iam_policy_binding.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: |
+      Add IAM policy binding for a CA pool.
+    description: |
+      Adds a policy binding to the IAM policy of a CA pool. One binding
+      consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To add an IAM policy binding for the role of 'roles/privateca.certificateManager' for the user
+      'test-user@gmail.com' on the CA pool 'my-pool' with the location 'us-west1', run:
+
+        $ {command} my-pool \
+          --location='us-west1' \
+          --member='user:test-user@gmail.com' \
+          --role='roles/privateca.certificateManager'
+
+  request:
+    collection: privateca.projects.locations.caPools
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The CA pool for which to add the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.privateca.resources:ca_pool
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/create.py

@@ -0,0 +1,93 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create a new CA pool."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.privateca import base as privateca_base
+from googlecloudsdk.api_lib.privateca import request_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.privateca import flags
+from googlecloudsdk.command_lib.privateca import operations
+from googlecloudsdk.command_lib.privateca import resource_args
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Create(base.CreateCommand):
+  r"""Create a new CA Pool.
+
+  ## EXAMPLES
+
+  To create a CA pool in the dev ops tier:
+
+      $ {command} my-pool --location=us-west1 \
+          --tier=devops
+
+  To create a CA pool and restrict what it can issue:
+
+      $ {command} my-pool --location=us-west1 \
+          --issuance-policy=policy.yaml
+
+  To create a CA pool that doesn't publicly publish CA certificates and CRLs:
+
+      $ {command} my-pool --location=us-west1 \
+          --issuance-policy=policy.yaml \
+          --no-publish-ca-cert \
+          --no-publish-crl
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCaPoolPositionalResourceArg(parser, 'to create')
+    flags.AddTierFlag(parser)
+    flags.AddPublishingOptionsFlags(parser, use_update_help_text=False)
+    flags.AddCaPoolIssuancePolicyFlag(parser)
+    flags.AddEncryptionKeyFlag(parser)
+    labels_util.AddCreateLabelsFlags(parser)
+
+  def Run(self, args):
+    client = privateca_base.GetClientInstance('v1')
+    messages = privateca_base.GetMessagesModule('v1')
+
+    ca_pool_ref = args.CONCEPTS.ca_pool.Parse()
+    issuance_policy = flags.ParseIssuancePolicy(args)
+    publishing_options = flags.ParsePublishingOptions(args)
+    tier = flags.ParseTierFlag(args)
+    labels = labels_util.ParseCreateArgs(args, messages.CaPool.LabelsValue)
+    encryption_spec = flags.ParseEncryptionSpec(args)
+    new_ca_pool = messages.CaPool(
+        issuancePolicy=issuance_policy,
+        publishingOptions=publishing_options,
+        tier=tier,
+        labels=labels,
+        encryptionSpec=encryption_spec)
+    operation = client.projects_locations_caPools.Create(
+        messages.PrivatecaProjectsLocationsCaPoolsCreateRequest(
+            caPool=new_ca_pool,
+            caPoolId=ca_pool_ref.Name(),
+            parent=ca_pool_ref.Parent().RelativeName(),
+            requestId=request_utils.GenerateRequestId()))
+
+    ca_pool_response = operations.Await(
+        operation, 'Creating CA Pool.', api_version='v1')
+    ca_pool = operations.GetMessageFromResponse(ca_pool_response,
+                                                messages.CaPool)
+
+    log.status.Print('Created CA Pool [{}].'.format(ca_pool.name))

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/delete.py

@@ -0,0 +1,88 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Delete a CA pool."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.privateca import base as privateca_base
+from googlecloudsdk.api_lib.privateca import request_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.privateca import flags
+from googlecloudsdk.command_lib.privateca import operations
+from googlecloudsdk.command_lib.privateca import resource_args
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Delete(base.DeleteCommand):
+  r"""Delete a CA pool.
+
+    Note that all certificate authorities must be removed from the CA Pool
+    before the CA pool can be deleted.
+
+    ## EXAMPLES
+
+    To delete a CA pool:
+
+      $ {command} my-pool --location=us-west1
+
+    To delete a CA pool while skipping the confirmation input:
+
+      $ {command} my-pool --location=us-west1 --quiet
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCaPoolPositionalResourceArg(parser, 'to delete')
+    flags.AddIgnoreDependentResourcesFlag(parser)
+
+  def Run(self, args):
+    client = privateca_base.GetClientInstance('v1')
+    messages = privateca_base.GetMessagesModule('v1')
+
+    ca_pool_ref = args.CONCEPTS.ca_pool.Parse()
+
+    if args.ignore_dependent_resources:
+      prompt_message = (
+          'You are about to delete the CA Pool [{}] without '
+          'checking if it is being used by another cloud '
+          'resource. If you proceed, there may be unintended and '
+          'unrecoverable effects on any dependent resource(s) since the '
+          'CA Pool would not be able to issue certificates.'
+      ).format(ca_pool_ref.RelativeName())
+    else:
+      prompt_message = ('You are about to delete the CA pool [{}]').format(
+          ca_pool_ref.RelativeName())
+
+    if not console_io.PromptContinue(
+        message=prompt_message,
+        default=True):
+      log.status.Print('Aborted by user.')
+      return
+
+    operation = client.projects_locations_caPools.Delete(
+        messages.PrivatecaProjectsLocationsCaPoolsDeleteRequest(
+            name=ca_pool_ref.RelativeName(),
+            ignoreDependentResources=args.ignore_dependent_resources,
+            requestId=request_utils.GenerateRequestId()))
+
+    operations.Await(
+        operation, 'Deleting the CA pool', api_version='v1')
+
+    log.status.Print('Deleted the CA pool [{}].'.format(
+        ca_pool_ref.RelativeName()))

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/describe.yaml

@@ -0,0 +1,20 @@
+- release_tracks: [GA]
+  help_text:
+    brief: |
+      Get metadata for a CA pool.
+    description: |
+      Returns metadata for the given CA pool.
+    examples: |
+      To get metadata for the CA pool 'my-pool' in location 'us-west1':
+
+        $ {command} my-pool \
+          --location=us-west1
+
+  request:
+    collection: privateca.projects.locations.caPools
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The CA pool for which to obtain metadata.
+      spec: !REF googlecloudsdk.command_lib.privateca.resources:ca_pool

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/get_ca_certs.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Get the root CA certs for all active CAs in a CA Pool."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.privateca import base as privateca_base
+from googlecloudsdk.api_lib.privateca import request_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.privateca import pem_utils
+from googlecloudsdk.command_lib.privateca import resource_args
+from googlecloudsdk.core import log
+from googlecloudsdk.core.util import files
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class GetCaCerts(base.Command):
+  r"""Get the root CA certs for all active CAs in the CA pool.
+
+  ## EXAMPLES
+
+    To get the root CA certs for all active CAs in the CA pool:
+
+      $ {command} my-pool --output-file=ca-certificates.pem \
+          --location=us-west1
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCaPoolPositionalResourceArg(
+        parser, 'whose CA certificates should be fetched')
+    base.Argument(
+        '--output-file',
+        help='The path where the concatenated PEM certificates will be '
+             'written. This will include the root CA certificate for each '
+             'active CA in the CA pool. ',
+        required=True).AddToParser(parser)
+
+  def _GetRootCerts(self, ca_pool_ref):
+    """Returns the root CA certs for all active CAs in the CA pool."""
+    client = privateca_base.GetClientInstance('v1')
+    messages = privateca_base.GetMessagesModule('v1')
+
+    fetch_ca_certs_response = client.projects_locations_caPools.FetchCaCerts(
+        messages.PrivatecaProjectsLocationsCaPoolsFetchCaCertsRequest(
+            caPool=ca_pool_ref.RelativeName(),
+            fetchCaCertsRequest=messages.FetchCaCertsRequest(
+                requestId=request_utils.GenerateRequestId())))
+    root_certs = [
+        chain.certificates[-1] for chain in fetch_ca_certs_response.caCerts
+    ]
+    return ''.join(pem_utils.PemChainForOutput(root_certs))
+
+  def Run(self, args):
+    ca_pool_ref = args.CONCEPTS.ca_pool.Parse()
+    pem_bag = self._GetRootCerts(ca_pool_ref)
+    files.WriteFileContents(args.output_file, pem_bag)
+    log.status.write('Exported the CA certificates to [{}].'.format(
+        args.output_file))

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/get_iam_policy.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: Get the IAM policy for a CA pool.
+    description: |
+     Gets the IAM policy for the given CA pool.
+
+      Returns an empty policy if the resource does not have a policy
+      set.
+    examples: |
+     To get the IAM policy for the CA pool 'my-pool' with the location 'us-west1', run:
+
+       $ {command} my-pool --location=us-west1
+
+  request:
+    collection: privateca.projects.locations.caPools
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The CA pool for which to display the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.privateca.resources:ca_pool
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/list.py

@@ -0,0 +1,85 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""List CA pools within a project."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import list_pager
+
+from googlecloudsdk.api_lib.privateca import base as privateca_base
+from googlecloudsdk.api_lib.privateca import resource_utils
+from googlecloudsdk.api_lib.util import common_args
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.privateca import response_utils
+from googlecloudsdk.core import properties
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class List(base.ListCommand):
+  """List CA pools within a project.
+
+  ## EXAMPLES
+
+  To list the CA Pools within a project:
+
+  $ {command}
+
+
+  To list the CA Pools within a project and region 'us-west1':
+
+  $ {command} --location=us-west1
+  """
+
+  @staticmethod
+  def Args(parser):
+    base.Argument(
+        '--location',
+        help='Location of the CA pools. If this is not specified, CA pools '
+        'across all locations will be listed.').AddToParser(parser)
+    base.PAGE_SIZE_FLAG.SetDefault(parser, 100)
+
+    parser.display_info.AddFormat("""
+        table(
+          name.basename(),
+          name.scope().segment(-3):label=LOCATION,
+          tier)
+        """)
+    parser.display_info.AddUriFunc(
+        resource_utils.MakeGetUriFunc('privateca.projects.locations.caPools'))
+
+  def Run(self, args):
+    client = privateca_base.GetClientInstance('v1')
+    messages = privateca_base.GetMessagesModule('v1')
+
+    location = args.location if args.IsSpecified('location') else '-'
+
+    parent_resource = 'projects/{}/locations/{}'.format(
+        properties.VALUES.core.project.GetOrFail(), location)
+
+    request = messages.PrivatecaProjectsLocationsCaPoolsListRequest(
+        parent=parent_resource,
+        filter=args.filter,
+        orderBy=common_args.ParseSortByArg(args.sort_by))
+
+    return list_pager.YieldFromList(
+        client.projects_locations_caPools,
+        request,
+        field='caPools',
+        limit=args.limit,
+        batch_size_attribute='pageSize',
+        batch_size=args.page_size,
+        get_field_func=response_utils.GetFieldAndLogUnreachable)

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/remove_iam_policy_binding.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: |
+      Remove IAM policy binding for a CA pool.
+    description: |
+      Removes a policy binding to the IAM policy of a CA pool. One binding
+      consists of a member and a role.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      To remove an IAM policy binding for the role of 'roles/privateca.certificateManager' for the user
+      'test-user@gmail.com' on the CA pool 'my-pool' with the location 'us-west1', run:
+
+        $ {command} my-pool \
+            --location=us-west1 \
+            --member='user:test-user@gmail.com' \
+            --role='roles/privateca.certificateManager'
+
+  request:
+    collection: privateca.projects.locations.caPools
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The CA pool for which to remove the IAM policy binding.
+      spec: !REF googlecloudsdk.command_lib.privateca.resources:ca_pool
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/set_iam_policy.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [GA]
+  help_text:
+    brief: |
+      Set the IAM policy for a CA pool.
+    description: |
+      Sets the IAM policy for the given CA pool as defined in a JSON or YAML file.
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      the policy file format and contents.
+    examples: |
+      The following command will read an IAM policy defined in a JSON file
+      'policy.json' and set it for the CA pool 'my-pool' with the location 'us-west1':
+
+        $ {command} my-pool policy.json --location=us-west1
+
+  request:
+    collection: privateca.projects.locations.caPools
+    api_version: v1
+
+  arguments:
+    resource:
+      help_text: The CA pool for which to update the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.privateca.resources:ca_pool
+
+  iam:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: options_requestedPolicyVersion

gcloud auth application-default login/google-cloud-sdk/lib/surface/privateca/pools/update.py

@@ -0,0 +1,79 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Update a CA pool."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.privateca import base as privateca_base
+from googlecloudsdk.api_lib.privateca import request_utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.privateca import flags
+from googlecloudsdk.command_lib.privateca import operations
+from googlecloudsdk.command_lib.privateca import resource_args
+from googlecloudsdk.command_lib.privateca import update_utils
+from googlecloudsdk.command_lib.util.args import labels_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Update(base.UpdateCommand):
+  r"""Update an existing  CA Pool.
+
+  ## EXAMPLES
+    To update labels on a CA pool:
+
+      $ {command} my-pool \
+        --location=us-west1 \
+        --update-labels=foo=bar
+
+    To disable publishing CRLs on a CA pool:
+
+      $ {command} my-pool \
+        --location=us-west1 \
+        --no-publish-crl
+  """
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddCaPoolPositionalResourceArg(
+        parser, 'to update')
+    flags.AddPublishingOptionsFlags(parser, use_update_help_text=True)
+    flags.AddCaPoolIssuancePolicyFlag(parser)
+    flags.AddEncryptionKeyFlag(parser)
+    labels_util.AddUpdateLabelsFlags(parser)
+
+  def Run(self, args):
+    client = privateca_base.GetClientInstance('v1')
+    messages = privateca_base.GetMessagesModule('v1')
+
+    ca_pool_ref = args.CONCEPTS.ca_pool.Parse()
+
+    current_ca_pool = client.projects_locations_caPools.Get(
+        messages.PrivatecaProjectsLocationsCaPoolsGetRequest(
+            name=ca_pool_ref.RelativeName()))
+
+    pool_to_update, update_mask = update_utils.UpdateCaPoolFromArgs(
+        args, current_ca_pool.labels)
+
+    operation = client.projects_locations_caPools.Patch(
+        messages.PrivatecaProjectsLocationsCaPoolsPatchRequest(
+            name=ca_pool_ref.RelativeName(),
+            caPool=pool_to_update,
+            updateMask=','.join(update_mask),
+            requestId=request_utils.GenerateRequestId()))
+
+    return operations.Await(operation, 'Updating CA pool.', api_version='v1')