111 lines
4.3 KiB
Python
111 lines
4.3 KiB
Python
# -*- coding: utf-8 -*- #
|
|
# Copyright 2016 Google LLC. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
"""Command to create a custom role for a project or an organization."""
|
|
|
|
from __future__ import absolute_import
|
|
from __future__ import division
|
|
from __future__ import unicode_literals
|
|
|
|
from googlecloudsdk.api_lib.iam import util
|
|
from googlecloudsdk.calliope import base
|
|
from googlecloudsdk.command_lib.iam import flags
|
|
from googlecloudsdk.command_lib.iam import iam_util
|
|
from googlecloudsdk.core import log
|
|
|
|
|
|
DETAILED_HELP = {
|
|
'EXAMPLES':
|
|
"""\
|
|
To create a custom role ``ProjectUpdater'' from a YAML file, run:
|
|
|
|
$ {command} ProjectUpdater --organization=12345 --file=role_file_path
|
|
|
|
To create a custom role ``ProjectUpdater'' with flags, run:
|
|
|
|
$ {command} ProjectUpdater --project=myproject --title=ProjectUpdater --description="Have access to get and update the project" --permissions=resourcemanager.projects.get,resourcemanager.projects.update
|
|
"""
|
|
}
|
|
|
|
|
|
@base.UniverseCompatible
|
|
class Create(base.Command):
|
|
r"""Create a custom role for a project or an organization.
|
|
|
|
This command creates a custom role with the provided information.
|
|
"""
|
|
|
|
detailed_help = DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
roles_group = parser.add_group(mutex=True)
|
|
settings_flags_group = roles_group.add_group('Roles Settings')
|
|
settings_flags_group.add_argument(
|
|
'--title', help='The title of the role you want to create.')
|
|
settings_flags_group.add_argument(
|
|
'--description', help='The description of the role you want to create.')
|
|
settings_flags_group.add_argument(
|
|
'--stage', help='The state of the role you want to create. '
|
|
'This represents a role\'s lifecycle phase: `ALPHA`, `BETA`, `GA`, '
|
|
'`DEPRECATED`, `DISABLED`, `EAP`.')
|
|
settings_flags_group.add_argument(
|
|
'--permissions',
|
|
help='The permissions of the role you want to create. '
|
|
'Use commas to separate them.')
|
|
roles_group.add_argument(
|
|
'--file',
|
|
help='The JSON or YAML file with the IAM Role to create. See '
|
|
'https://cloud.google.com/iam/reference/rest/v1/projects.roles.')
|
|
flags.AddParentFlags(parser, 'create')
|
|
flags.GetCustomRoleFlag('create').AddToParser(parser)
|
|
|
|
def Run(self, args):
|
|
client, messages = util.GetClientAndMessages()
|
|
parent_name = iam_util.GetParentName(args.organization, args.project)
|
|
if args.file:
|
|
role = iam_util.ParseYamlToRole(args.file, messages.Role)
|
|
role.name = None
|
|
role.etag = None
|
|
else:
|
|
role = messages.Role(title=args.title, description=args.description)
|
|
if args.permissions:
|
|
role.includedPermissions = args.permissions.split(',')
|
|
if args.stage:
|
|
role.stage = iam_util.StageTypeFromString(args.stage)
|
|
|
|
if not role.title:
|
|
role.title = args.role
|
|
|
|
if not args.quiet:
|
|
permissions_helper = util.PermissionsHelper(client, messages,
|
|
iam_util.GetResourceReference(
|
|
args.project,
|
|
args.organization),
|
|
role.includedPermissions)
|
|
api_diabled_permissions = permissions_helper.GetApiDisabledPermissons()
|
|
iam_util.ApiDisabledPermissionsWarning(api_diabled_permissions)
|
|
testing_permissions = permissions_helper.GetTestingPermissions()
|
|
iam_util.TestingPermissionsWarning(testing_permissions)
|
|
|
|
result = client.organizations_roles.Create(
|
|
messages.IamOrganizationsRolesCreateRequest(
|
|
createRoleRequest=messages.CreateRoleRequest(
|
|
role=role, roleId=args.role),
|
|
parent=parent_name))
|
|
log.CreatedResource(args.role, kind='role')
|
|
iam_util.SetRoleStageIfAlpha(result)
|
|
return result
|