feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/ssl/entraid_certs/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Provide commands for managing Entra ID certificates of Cloud SQL instances."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class EntraIdCerts(base.Group):
+  """Provide commands for managing Entra ID certificates of Cloud SQL instances.
+
+  Provide commands for managing Entra ID certificates of Cloud SQL instances,
+  including creating, listing, rotating in, and rolling back certificates.
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/ssl/entraid_certs/create.py

@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Create an Entra ID certificate for a Cloud SQL instance."""
+
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.api_lib.sql import validate
+from googlecloudsdk.api_lib.sql.ssl import entraid_certs
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+
+
+class _BaseAddCert(object):
+  """Base class for sql entraid-certs create."""
+
+  @staticmethod
+  def Args(parser):
+    """Declare flag and positional arguments for the command parser."""
+    base.ASYNC_FLAG.AddToParser(parser)
+    flags.AddInstance(parser)
+    parser.display_info.AddFormat(flags.ENTRAID_CERTS_FORMAT)
+
+  def Run(self, args):
+    """Create a Entra ID certificate for a Cloud SQL instance.
+
+    Args:
+      args: argparse.Namespace, The arguments that this command was invoked
+        with.
+
+    Returns:
+      The upcoming Entra ID Cert, if the operation was successful.
+    """
+
+    client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+    sql_client = client.sql_client
+    sql_messages = client.sql_messages
+
+    validate.ValidateInstanceName(args.instance)
+    instance_ref = client.resource_parser.Parse(
+        args.instance,
+        params={'project': properties.VALUES.core.project.GetOrFail},
+        collection='sql.instances')
+
+    result_operation = sql_client.instances.AddEntraIdCertificate(
+        sql_messages.SqlInstancesAddEntraIdCertificateRequest(
+            project=instance_ref.project, instance=instance_ref.instance
+        )
+    )
+
+    operation_ref = client.resource_parser.Create(
+        'sql.operations',
+        operation=result_operation.name,
+        project=instance_ref.project)
+
+    operations.OperationsV1Beta4.WaitForOperation(
+        sql_client, operation_ref, 'Creating Entra ID Certificate'
+    )
+
+    added_entraid_cert, status = entraid_certs.GetAddedEntraIdCertificate(
+        sql_client, sql_messages, instance_ref
+    )
+
+    return flags.EntraIdCertForPrint(
+        added_entraid_cert,
+        status,
+    )
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class AddCert(_BaseAddCert, base.CreateCommand):
+  """Create an Entra ID certificate for a Cloud SQL instance."""
+  pass
+

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/ssl/entraid_certs/list.py

@@ -0,0 +1,84 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""List Entra ID certificates for a Cloud SQL instance."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import validate
+from googlecloudsdk.api_lib.sql.ssl import entraid_certs
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+
+
+class _BaseList(object):
+  """Base class for sql ssl entraid_certs list."""
+
+  @staticmethod
+  def Args(parser):
+    flags.AddInstance(parser)
+    parser.display_info.AddFormat(flags.ENTRAID_CERTS_FORMAT)
+
+  def Run(self, args):
+    """List all Entra ID certificates for a Cloud SQL instance.
+
+    Args:
+      args: argparse.Namespace, The arguments that this command was invoked
+        with.
+
+    Returns:
+      A dict object that has the list of Entra ID Certs resources if the api
+      request was successful.
+    """
+    client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+    sql_client = client.sql_client
+    sql_messages = client.sql_messages
+
+    validate.ValidateInstanceName(args.instance)
+    instance_ref = client.resource_parser.Parse(
+        args.instance,
+        params={'project': properties.VALUES.core.project.GetOrFail},
+        collection='sql.instances')
+
+    resp = entraid_certs.ListEntraIdCertificates(
+        sql_client, sql_messages, instance_ref
+    )
+    if not resp.certs:
+      return iter([flags.EntraIdCertForPrint(None, None)])
+    entraid_cert_types = entraid_certs.GetEntraIdCertificateTypeDict(resp)
+    hash2status = {
+        cert.sha1Fingerprint: status
+        for status, cert in entraid_cert_types.items()
+    }
+    result = [
+        flags.EntraIdCertForPrint(
+            cert, hash2status[cert.sha1Fingerprint]
+        )
+        for cert in resp.certs
+    ]
+    return iter(result)
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class List(_BaseList, base.ListCommand):
+  """List all Entra ID certificates for a Cloud SQL instance."""
+  pass

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/ssl/entraid_certs/rollback.py

@@ -0,0 +1,107 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Roll back to the previous Entra ID certificate for a Cloud SQL instance."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import exceptions
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.api_lib.sql import validate
+from googlecloudsdk.api_lib.sql.ssl import entraid_certs
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+
+
+class _BaseRollbackCert(object):
+  """Base class for sql entraid_certs rollback."""
+
+  @staticmethod
+  def Args(parser):
+    """Declare flag and positional arguments for the command parser."""
+    base.ASYNC_FLAG.AddToParser(parser)
+    flags.AddInstance(parser)
+    parser.display_info.AddFormat(flags.ENTRAID_CERTS_FORMAT)
+
+  def Run(self, args):
+    """Roll back to the previous Entra ID certificate for a Cloud SQL instance.
+
+    Args:
+      args: argparse.Namespace, The arguments that this command was invoked
+        with.
+
+    Returns:
+      The Entra ID Cert that was rolled back to, if the operation was
+      successful.
+    """
+
+    client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+    sql_client = client.sql_client
+    sql_messages = client.sql_messages
+
+    validate.ValidateInstanceName(args.instance)
+    instance_ref = client.resource_parser.Parse(
+        args.instance,
+        params={'project': properties.VALUES.core.project.GetOrFail},
+        collection='sql.instances',
+    )
+
+    previous_entraid_cert, _ = entraid_certs.GetPreviousEntraIdCertificate(
+        sql_client, sql_messages, instance_ref
+    )
+
+    if not previous_entraid_cert:
+      raise exceptions.ResourceNotFoundError(
+          'No previous Entra ID Certificate exists.'
+      )
+
+    result_operation = sql_client.instances.RotateEntraIdCertificate(
+        sql_messages.SqlInstancesRotateEntraIdCertificateRequest(
+            project=instance_ref.project,
+            instance=instance_ref.instance,
+            instancesRotateEntraIdCertificateRequest=sql_messages.InstancesRotateEntraIdCertificateRequest(
+                rotateEntraIdCertificateContext=sql_messages.RotateEntraIdCertificateContext(
+                    nextVersion=previous_entraid_cert.sha1Fingerprint
+                )
+            ),
+        )
+    )
+
+    operation_ref = client.resource_parser.Create(
+        'sql.operations',
+        operation=result_operation.name,
+        project=instance_ref.project,
+    )
+
+    operations.OperationsV1Beta4.WaitForOperation(
+        sql_client,
+        operation_ref,
+        'Rolling back to previous Entra ID Certificate',
+    )
+
+    # The previous cert is now active after the rollback.
+    return flags.EntraIdCertForPrint(
+        previous_entraid_cert, entraid_certs.ACTIVE_CERT_LABEL
+    )
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class RollbackCert(_BaseRollbackCert, base.CreateCommand):
+  """Roll back to the previous Entra ID certificate for a Cloud SQL instance."""
+  pass

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/ssl/entraid_certs/rotate.py

@@ -0,0 +1,99 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Rotate in the next Entra ID certificate for a Cloud SQL instance."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import exceptions
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.api_lib.sql import validate
+from googlecloudsdk.api_lib.sql.ssl import entraid_certs
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+
+
+class _BaseRotateCert(object):
+  """Base class for sql ssl entraid_certs rotate."""
+
+  @staticmethod
+  def Args(parser):
+    """Declare flag and positional arguments for the command parser."""
+    base.ASYNC_FLAG.AddToParser(parser)
+    flags.AddInstance(parser)
+    parser.display_info.AddFormat(flags.ENTRAID_CERTS_FORMAT)
+
+  def Run(self, args):
+    """Rotate in the upcoming Entra ID certificate for a Cloud SQL instance.
+
+    Args:
+      args: argparse.Namespace, The arguments that this command was invoked
+        with.
+
+    Returns:
+      The Entra ID certificate that was rotated in, if the operation was
+      successful.
+    """
+
+    client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+    sql_client = client.sql_client
+    sql_messages = client.sql_messages
+
+    validate.ValidateInstanceName(args.instance)
+    instance_ref = client.resource_parser.Parse(
+        args.instance,
+        params={'project': properties.VALUES.core.project.GetOrFail},
+        collection='sql.instances')
+
+    next_entraid_cert, _ = entraid_certs.GetNextEntraIdCertificate(
+        sql_client, sql_messages, instance_ref
+    )
+
+    if next_entraid_cert is None:
+      raise exceptions.ResourceNotFoundError(
+          'No upcoming Entra ID Certificate exists.'
+      )
+
+    result_operation = sql_client.instances.RotateEntraIdCertificate(
+        sql_messages.SqlInstancesRotateEntraIdCertificateRequest(
+            project=instance_ref.project, instance=instance_ref.instance
+        )
+    )
+
+    operation_ref = client.resource_parser.Create(
+        'sql.operations',
+        operation=result_operation.name,
+        project=instance_ref.project)
+
+    operations.OperationsV1Beta4.WaitForOperation(
+        sql_client, operation_ref, 'Rotating to upcoming Entra ID Certificate'
+    )
+
+    # After the rotation, the next Entra ID certificate becomes the active one.
+    return flags.EntraIdCertForPrint(
+        next_entraid_cert, entraid_certs.ACTIVE_CERT_LABEL
+    )
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class RotateCert(_BaseRotateCert, base.CreateCommand):
+  """Rotate in the upcoming Entra ID certificate for a Cloud SQL instance."""
+  pass