feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/__init__.py

@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Manage secret versions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+class CloudSecrets(base.Group):
+  """Manage secret versions.
+
+  Manage secret versions on Google Cloud.
+  """
+
+  def Filter(self, context, args):
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/access.py

@@ -0,0 +1,171 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Access a secret version's data."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.api_lib.util import exceptions
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as calliope_exceptions
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+from googlecloudsdk.command_lib.secrets import fmt as secrets_fmt
+from googlecloudsdk.command_lib.secrets import util as secrets_util
+from googlecloudsdk.command_lib.util import crc32c
+
+
+CHECKSUM_VERIFICATION_FAILURE_MESSAGE = (
+    'An incorrect data_crc32c was calculated for the provided payload. This '
+    'might be a transient issue that resolves with a retry. If this is '
+    'happening repeatedly open an issue with Secret Manager at '
+    'https://issuetracker.google.com/issues/new?component=784854&template=1380926.'
+)
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Access(base.DescribeCommand):
+  # pylint: disable=line-too-long
+  r"""Access a secret version's data.
+
+  Access the data for the specified secret version.
+
+  ## EXAMPLES
+
+  Access the data for version 123 of the secret 'my-secret':
+
+    $ {command} 123 --secret=my-secret
+
+  Note: The output will be formatted as UTF-8 which can corrupt binary secrets.
+
+  To write raw bytes to a file use --out-file flag:
+
+    $ {command} 123 --secret=my-secret --out-file=/tmp/secret
+
+  To get the raw bytes, have Google Cloud CLI print the response as
+  base64-encoded and decode:
+
+    $ {command} 123 --secret=my-secret --format='get(payload.data)' | tr '_-' '/+' | base64 -d
+  """
+  EMPTY_OUT_FILE_MESSAGE = (
+      'The value provided for --out-file is the empty string. This can happen '
+      'if you pass or pipe a variable that is undefined. Please verify that '
+      'the --out-file flag is not the empty string.')
+  # pylint: enable=line-too-long
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions access command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddVersionOrAlias(
+        parser, purpose='to access', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to access secret', hidden=False)
+    secrets_args.AddOutFile(parser)
+    secrets_fmt.UseSecretData(parser)
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions access command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version access.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    version = secrets_api.Versions(api_version=api_version).Access(
+        version_ref, secret_location=args.location
+    )
+    if version.payload.dataCrc32c is None or crc32c.does_data_match_checksum(
+        version.payload.data, version.payload.dataCrc32c
+    ):
+      if args.IsSpecified('out_file'):
+        if not args.out_file:
+          raise calliope_exceptions.BadFileException(
+              self.EMPTY_OUT_FILE_MESSAGE)
+        # if flag --out-file is provided use the 'disable'
+        # format from go/gcloud-ref/topic/formats
+        args.format = 'disable'
+        secrets_util.WriteBinaryFile(args.out_file, version.payload.data)
+      return version
+    raise exceptions.HttpException(CHECKSUM_VERIFICATION_FAILURE_MESSAGE)
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class AccessBeta(Access):
+  # pylint: disable=line-too-long
+  r"""Access a secret version's data.
+
+  Access the data for the specified secret version.
+
+  ## EXAMPLES
+
+  Access the data for version 123 of the secret 'my-secret':
+
+    $ {command} 123 --secret=my-secret
+
+  Note: The output will be formatted as UTF-8 which can corrupt binary secrets.
+
+  To write raw bytes to a file use --out-file flag:
+
+    $ {command} 123 --secret=my-secret --out-file=/tmp/secret
+
+  To get the raw bytes, have Google Cloud CLI print the response as
+  base64-encoded and decode:
+
+    $ {command} 123 --secret=my-secret --format='get(payload.data)' | tr '_-' '/+' | base64 -d
+  """
+  # pylint: enable=line-too-long
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddVersionOrAlias(
+        parser, purpose='to access', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to access secret', hidden=False)
+    secrets_args.AddOutFile(parser)
+    secrets_fmt.UseSecretData(parser)
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    version = secrets_api.Versions(api_version=api_version).Access(
+        version_ref, secret_location=args.location
+    )
+    if version.payload.dataCrc32c is None or crc32c.does_data_match_checksum(
+        version.payload.data, version.payload.dataCrc32c
+    ):
+      if args.IsSpecified('out_file'):
+        if not args.out_file:
+          raise calliope_exceptions.BadFileException(
+              self.EMPTY_OUT_FILE_MESSAGE)
+        # if flag --out-file is provided use the 'disable'
+        # format from go/gcloud-ref/topic/formats
+        args.format = 'disable'
+        secrets_util.WriteBinaryFile(args.out_file, version.payload.data)
+      return version
+    raise exceptions.HttpException(CHECKSUM_VERIFICATION_FAILURE_MESSAGE)

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/add.py

@@ -0,0 +1,186 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Enable the version of the provided secret."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+from googlecloudsdk.command_lib.secrets import log as secrets_log
+from googlecloudsdk.command_lib.secrets import util as secrets_util
+from googlecloudsdk.command_lib.util import crc32c
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Create(base.CreateCommand):
+  r"""Create a new version of an existing secret.
+
+  Create a new version of an existing secret with the provided data. The
+  command will return an error if no such secret exists.
+
+  ## EXAMPLES
+
+  Create a new version of an existing secret named 'my-secret' with secret data
+  "s3cr3t":
+
+    $ printf "s3cr3t" | {command} my-secret --data-file=-
+
+  Create a new version of an existing secret named 'my-secret' with secret data
+  "s3cr3t" using PowerShell (Note: PowerShell will add a newline to the
+  resulting secret):
+
+    $ Write-Output "s3cr3t" | {command} my-secret --data-file=-
+
+  Create a new version of an existing secret named 'my-secret' with secret data
+  from a file:
+
+    $ {command} my-secret --data-file=/tmp/secret
+  """
+
+  EMPTY_DATA_FILE_MESSAGE = (
+      'The value provided for --data-file is the empty string. This can happen '
+      'if you pass or pipe a variable that is undefined. Please verify that '
+      'the --data-file flag is not the empty string.')
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions add command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddSecret(
+        parser, purpose='to create', positional=True, required=True
+    )
+    secrets_args.AddLocation(
+        parser, purpose='to create secret version', hidden=False
+    )
+    secrets_args.AddDataFile(parser, required=True)
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions add command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version add.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    secret_ref = args.CONCEPTS.secret.Parse()
+    is_regional = args.location is not None
+    data = secrets_util.ReadFileOrStdin(args.data_file)
+
+    # Differentiate between the flag being provided with an empty value and the
+    # flag being omitted. See b/138796299 for info.
+    if args.data_file == '':  # pylint: disable=g-explicit-bool-comparison
+      raise exceptions.BadFileException(self.EMPTY_DATA_FILE_MESSAGE)
+
+    data_crc32c = crc32c.get_crc32c(data)
+    version = secrets_api.Secrets(api_version=api_version).AddVersion(
+        secret_ref,
+        data,
+        crc32c.get_checksum(data_crc32c),
+        secret_location=args.location,
+    )
+    if is_regional:
+      version_ref = secrets_args.ParseRegionalVersionRef(version.name)
+    else:
+      version_ref = secrets_args.ParseVersionRef(version.name)
+    secrets_log.Versions().Created(version_ref)
+    if not version.clientSpecifiedPayloadChecksum:
+      raise exceptions.HttpException(
+          'Version created but payload data corruption may have occurred, '
+          'please destroy the created version, and retry. See also '
+          'https://cloud.google.com/secret-manager/docs/data-integrity.'
+      )
+    return version
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class CreateBeta(Create):
+  r"""Create a new version of an existing secret.
+
+  Create a new version of an existing secret with the provided data. The
+  command will return an error if no such secret exists.
+
+  ## EXAMPLES
+
+  Create a new version of an existing secret named 'my-secret' with secret data
+  "s3cr3t":
+
+    $ printf "s3cr3t" | {command} my-secret --data-file=-
+
+  Create a new version of an existing secret named 'my-secret' with secret data
+  "s3cr3t" using PowerShell (Note: PowerShell will add a newline to the
+  resulting secret):
+
+    $ Write-Output "s3cr3t" | {command} my-secret --data-file=-
+
+  Create a new version of an existing secret named 'my-secret' with secret data
+  from a file:
+
+    $ {command} my-secret --data-file=/tmp/secret
+  """
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddSecret(
+        parser, purpose='to create', positional=True, required=True
+    )
+    secrets_args.AddLocation(
+        parser, purpose='to create secret version', hidden=False
+    )
+    secrets_args.AddDataFile(parser, required=True)
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    secret_ref = args.CONCEPTS.secret.Parse()
+    is_regional = args.location is not None
+    data = secrets_util.ReadFileOrStdin(args.data_file)
+
+    # Differentiate between the flag being provided with an empty value and the
+    # flag being omitted. See b/138796299 for info.
+    if args.data_file == '':  # pylint: disable=g-explicit-bool-comparison
+      raise exceptions.BadFileException(self.EMPTY_DATA_FILE_MESSAGE)
+
+    data_crc32c = crc32c.get_crc32c(data)
+    version = secrets_api.Secrets(api_version=api_version).AddVersion(
+        secret_ref,
+        data,
+        crc32c.get_checksum(data_crc32c),
+        secret_location=args.location,
+    )
+    if is_regional:
+      version_ref = secrets_args.ParseRegionalVersionRef(version.name)
+    else:
+      version_ref = secrets_args.ParseVersionRef(version.name)
+    secrets_log.Versions().Created(version_ref)
+    if not version.clientSpecifiedPayloadChecksum:
+      raise exceptions.HttpException(
+          'Version created but payload data corruption may have occurred, '
+          'please destroy the created version, and retry. See also '
+          'https://cloud.google.com/secret-manager/docs/data-integrity.')
+    return version

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/config/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for managing Secretmanager version configurations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Config(base.Group):
+  """Manage Secretmanager version configurations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/config/export.yaml

@@ -0,0 +1,38 @@
+release_tracks: [ALPHA]
+command_type: CONFIG_EXPORT
+help_text:
+  brief: Export the configuration for a Secretmanager version.
+  description: |
+    *{command}* exports the configuration for a Secretmanager version.
+
+    Version configurations can be exported in
+    Kubernetes Resource Model (krm) or Terraform HCL formats. The
+    default format is `krm`.
+
+    Specifying `--all` allows you to export the configurations for all
+    versions within the project.
+
+    Specifying `--path` allows you to export the configuration(s) to
+    a local directory.
+  examples: |
+    To export the configuration for a version, run:
+
+      $ {command} my-version
+
+    To export the configuration for a version to a file, run:
+
+      $ {command} my-version --path=/path/to/dir/
+
+    To export the configuration for a version in Terraform
+    HCL format, run:
+
+      $ {command} my-version --resource-format=terraform
+
+    To export the configurations for all versions within a
+    project, run:
+
+      $ {command} --all
+arguments:
+  resource:
+    help_text: Version to export the configuration for.
+    spec: !REF googlecloudsdk.command_lib.secrets.resources:version

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/describe.py

@@ -0,0 +1,98 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Describe metadata about the secret version."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Describe(base.DescribeCommand):
+  r"""Describe metadata about the secret version.
+
+  Describe a secret version's metadata. This command does not include the
+  secret version's secret data.
+
+  ## EXAMPLES
+
+  Describe version '123' of the secret named 'my-secret':
+
+    $ {command} 123 --secret=my-secret
+  """
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions describe command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddVersionOrAlias(
+        parser, purpose='to describe', positional=True, required=True)
+    secrets_args.AddLocation(parser, purpose='to describe secret', hidden=False)
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    return secrets_api.Versions(api_version=api_version).Get(
+        version_ref, secret_location=args.location
+    )
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class DescribeBeta(base.DescribeCommand):
+  r"""Describe metadata about the secret version.
+
+  Describe a secret version's metadata. This command does not include the
+  secret version's secret data.
+
+  ## EXAMPLES
+
+  Describe version '123' of the secret named 'my-secret':
+
+    $ {command} 123 --secret=my-secret
+  """
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddVersionOrAlias(
+        parser, purpose='to describe', positional=True, required=True)
+    secrets_args.AddLocation(parser, purpose='to describe secret', hidden=False)
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions describe command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version describe.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    return secrets_api.Versions(api_version=api_version).Get(
+        version_ref, secret_location=args.location
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/destroy.py

@@ -0,0 +1,146 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Destroy a secret version's metadata and secret data."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+from googlecloudsdk.command_lib.secrets import log as secrets_log
+from googlecloudsdk.core.console import console_io
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Destroy(base.DeleteCommand):
+  r"""Destroy a secret version's metadata and secret data.
+
+  Destroy a secret version's metadata and secret data. This action is
+  irreversible.
+
+  ## EXAMPLES
+
+  Destroy version `123` of the secret named `my-secret`:
+
+    $ {command} 123 --secret=my-secret
+
+  Destroy version `123` of the secret named `my-secret` using etag:
+
+    $ {command} 123 --secret=my-secret --etag=123
+  """
+
+  CONFIRM_DESTROY_MESSAGE = (
+      'You are about to destroy version [{version}] of the secret [{secret}]. '
+      'This action cannot be reversed.')
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions destroy command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddVersion(
+        parser, purpose='to destroy', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to destroy ', hidden=False)
+    secrets_args.AddVersionEtag(parser, action='destroyed')
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions destroy command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version destroy.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    # Destructive action, prompt to continue
+    console_io.PromptContinue(
+        self.CONFIRM_DESTROY_MESSAGE.format(
+            version=version_ref.Name(), secret=version_ref.Parent().Name()
+        ),
+        throw_if_unattended=True,
+        cancel_on_no=True,
+    )
+    result = secrets_api.Versions(api_version=api_version).Destroy(
+        version_ref, etag=args.etag, secret_location=args.location
+    )
+    if result.scheduledDestroyTime is None:
+      secrets_log.Versions().Destroyed(version_ref)
+    else:
+      secrets_log.Versions().ScheduledDestroy(
+          result.scheduledDestroyTime, version_ref
+      )
+    return result
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class DestroyBeta(Destroy):
+  r"""Destroy a secret version's metadata and secret data.
+
+  Destroy a secret version's metadata and secret data. This action is
+  irreversible.
+
+  ## EXAMPLES
+
+  Destroy version `123` of the secret named `my-secret`:
+
+    $ {command} 123 --secret=my-secret
+
+  Destroy version `123` of the secret named `my-secret` using an etag:
+
+    $ {command} 123 --secret=my-secret --etag=123
+  """
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddVersion(
+        parser, purpose='to destroy', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to destroy ', hidden=False)
+    secrets_args.AddVersionEtag(parser, action='destroyed')
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    # Destructive action, prompt to continue
+    console_io.PromptContinue(
+        self.CONFIRM_DESTROY_MESSAGE.format(
+            version=version_ref.Name(), secret=version_ref.Parent().Name()
+        ),
+        throw_if_unattended=True,
+        cancel_on_no=True,
+    )
+    result = secrets_api.Versions(api_version=api_version).Destroy(
+        version_ref, etag=args.etag, secret_location=args.location
+    )
+    if result.scheduledDestroyTime is None:
+      secrets_log.Versions().Destroyed(version_ref)
+    else:
+      secrets_log.Versions().ScheduledDestroy(
+          result.scheduledDestroyTime, version_ref
+      )
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/disable.py

@@ -0,0 +1,115 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Disable the version of the provided secret."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+from googlecloudsdk.command_lib.secrets import log as secrets_log
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Disable(base.DeleteCommand):
+  r"""Disable the version of the provided secret.
+
+  Disable the version of the provided secret. It can be re-enabled with
+  `{parent_command} enable`.
+
+  ## EXAMPLES
+
+  Disable version `123` of the secret named `my-secret`:
+
+    $ {command} 123 --secret=my-secret
+
+  Disable version `123` of the secret named `my-secret` using etag:
+
+    $ {command} 123 --secret=my-secret --etag=123
+  """
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddVersion(
+        parser, purpose='to disable', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to disable', hidden=False)
+    secrets_args.AddVersionEtag(parser, action='disabled')
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    result = secrets_api.Versions(api_version=api_version).Disable(
+        version_ref, etag=args.etag, secret_location=args.location
+    )
+    secrets_log.Versions().Disabled(version_ref)
+    return result
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class DisableBeta(Disable):
+  r"""Disable the version of the provided secret.
+
+  Disable the version of the provided secret. It can be re-enabled with
+  `{parent_command} enable`.
+
+  ## EXAMPLES
+
+  Disable version `123` of the secret named `my-secret`:
+
+    $ {command} 123 --secret=my-secret
+
+  Disable version `123` of the secret named `my-secret` using an etag:
+
+    $ {command} 123 --secret=my-secret --etag=123
+  """
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions disable command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddVersion(
+        parser, purpose='to disable', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to disable', hidden=False)
+    secrets_args.AddVersionEtag(parser, action='disabled')
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions disable command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version disable.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    result = secrets_api.Versions(api_version=api_version).Disable(
+        version_ref, etag=args.etag, secret_location=args.location
+    )
+    secrets_log.Versions().Disabled(version_ref)
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/enable.py

@@ -0,0 +1,115 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Enable the version of the provided secret."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+from googlecloudsdk.command_lib.secrets import log as secrets_log
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Create(base.CreateCommand):
+  r"""Enable the version of the provided secret.
+
+  Enable the version of the provided secret. It can be disabled with
+  `{parent_command} disable`.
+
+  ## EXAMPLES
+
+  Enable version `123` of the secret named `my-secret`:
+
+    $ {command} 123 --secret=my-secret
+
+  Enable version `123` of the secret named `my-secret` using etag:
+
+    $ {command} 123 --secret=my-secret --etag=123
+  """
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions enable command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddVersion(
+        parser, purpose='to enable', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to enable', hidden=False)
+    secrets_args.AddVersionEtag(parser, action='enabled')
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions enable command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version enable.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    result = secrets_api.Versions(api_version=api_version).Enable(
+        version_ref, etag=args.etag, secret_location=args.location
+    )
+    secrets_log.Versions().Enabled(version_ref)
+    return result
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class CreateBeta(Create):
+  r"""Enable the version of the provided secret.
+
+  Enable the version of the provided secret. It can be disabled with
+  `{parent_command} disable`.
+
+  ## EXAMPLES
+
+  Enable version `123` of the secret named `my-secret`:
+
+    $ {command} 123 --secret=my-secret
+
+  Enable version `123` of the secret named `my-secret` using an etag:
+
+    $ {command} 123 --secret=my-secret --etag=123
+  """
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddVersion(
+        parser, purpose='to enable', positional=True, required=True
+    )
+    secrets_args.AddLocation(parser, purpose='to enable', hidden=False)
+    secrets_args.AddVersionEtag(parser, action='enabled')
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    version_ref = args.CONCEPTS.version.Parse()
+    result = secrets_api.Versions(api_version=api_version).Enable(
+        version_ref, etag=args.etag, secret_location=args.location
+    )
+    secrets_log.Versions().Enabled(version_ref)
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/secrets/versions/list.py

@@ -0,0 +1,147 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""List all versions for a secret."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.secrets import api as secrets_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import parser_arguments
+from googlecloudsdk.calliope import parser_extensions
+from googlecloudsdk.command_lib.secrets import args as secrets_args
+from googlecloudsdk.command_lib.secrets import fmt as secrets_fmt
+from googlecloudsdk.core.resource import resource_expr_rewrite
+from googlecloudsdk.core.resource import resource_projection_spec
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class List(base.ListCommand):
+  r"""List all versions for a secret.
+
+  List all versions and their status (For example: active/disabled/destroyed)
+  for a secret.
+
+  ## EXAMPLES
+
+  List all versions for the secret named 'my-secret':
+
+    $ {command} my-secret
+  """
+
+  @staticmethod
+  def Args(parser: parser_arguments.ArgumentInterceptor):
+    """Args is called by calliope to gather arguments for secrets versions list command.
+
+    Args:
+      parser: An argparse parser that you can use to add arguments that will be
+        available to this command.
+    """
+    secrets_args.AddSecret(
+        parser,
+        purpose='from which to list versions',
+        positional=True,
+        required=True,
+    )
+    secrets_args.AddLocation(parser, purpose='to create secret', hidden=False)
+    base.PAGE_SIZE_FLAG.SetDefault(parser, 100)
+
+  def Run(self, args: parser_extensions.Namespace) -> secrets_api.Versions:
+    """Run is called by calliope to implement the secret versions list command.
+
+    Args:
+      args: an argparse namespace, all the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      API call to invoke secret version list.
+    """
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    secret_ref = args.CONCEPTS.secret.Parse()
+    if args.location:
+      secrets_fmt.RegionalSecretVersionTableUsingArgument(
+          args, api_version=api_version
+      )
+    else:
+      secrets_fmt.SecretVersionTableUsingArgument(args, api_version=api_version)
+    server_filter = None
+    if args.filter:
+      rewriter = resource_expr_rewrite.Backend()
+      display_info = args.GetDisplayInfo()
+      defaults = resource_projection_spec.ProjectionSpec(
+          symbols=display_info.transforms, aliases=display_info.aliases
+      )
+      _, server_filter = rewriter.Rewrite(args.filter, defaults=defaults)
+
+    return secrets_api.Versions(api_version=api_version).ListWithPager(
+        secret_ref=secret_ref,
+        limit=args.limit,
+        request_filter=server_filter,
+        secret_location=args.location,
+    )
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class ListBeta(List):
+  r"""List all versions for a secret.
+
+  List all versions and their status (For example: active/disabled/destroyed)
+  for a secret.
+
+  ## EXAMPLES
+
+  List all versions for the secret named 'my-secret':
+
+    $ {command} my-secret
+  """
+
+  @staticmethod
+  def Args(parser):
+    secrets_args.AddSecret(
+        parser,
+        purpose='from which to list versions',
+        positional=True,
+        required=True,
+    )
+    secrets_args.AddLocation(parser, purpose='to create secret', hidden=False)
+    base.PAGE_SIZE_FLAG.SetDefault(parser, 100)
+
+  def Run(self, args):
+    api_version = secrets_api.GetApiFromTrack(self.ReleaseTrack())
+    secret_ref = args.CONCEPTS.secret.Parse()
+    if args.location:
+      secrets_fmt.RegionalSecretVersionTableUsingArgument(
+          args, api_version=api_version
+      )
+    else:
+      secrets_fmt.SecretVersionTableUsingArgument(args, api_version=api_version)
+    server_filter = None
+    if args.filter:
+      rewriter = resource_expr_rewrite.Backend()
+      display_info = args.GetDisplayInfo()
+      defaults = resource_projection_spec.ProjectionSpec(
+          symbols=display_info.transforms, aliases=display_info.aliases
+      )
+      _, server_filter = rewriter.Rewrite(args.filter, defaults=defaults)
+
+    return secrets_api.Versions(api_version=api_version).ListWithPager(
+        secret_ref=secret_ref,
+        limit=args.limit,
+        request_filter=server_filter,
+        secret_location=args.location,
+    )