
                         n    S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK	J
r
  SSKJr  S	 rS
 rS rg)zBUtility function for OS Config Troubleshooter to service accounts.    )absolute_import)division)unicode_literals)
exceptions)projects_api)utils)utilc                 \    SR                  [        R                  " U 5      5      nSU-   S-   $ )N2service-{}@gcp-sa-osconfig.iam.gserviceaccount.coma%  No
No OS Config service account is present and enabled for this instance. To create an OS Config service account for this instance, visit https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#createanewserviceaccount to create a service account of the name zf, grant it the "Cloud OS Config Service Agent" IAM role, then disable and re-enable the OS Config API.)formatr	   GetProjectNumber)
project_idservice_accounts     Plib/googlecloudsdk/command_lib/compute/os_config/troubleshoot/service_account.py_FailEnablementMessager      sA    HOO
J')/2 5D	DG%	%    c                     SnU R                   (       d  US-  n[        R                  " SU5      $ US-  n[        R                  " SU5      $ )z8Checks whether a service account exists on the instance.z0> Is a service account present on the instance? zNo
No service account is present on the instance. Visit https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances on how to create a service account for an instance.FYesT)serviceAccountsr   Response)instanceresponse_messages     r   CheckExistencer   )   sR    G		!	!	?
 >>%!122e	.	//r   c                 
   SnSnSn[         R                  " U R                  5      n [        R                  " U5      nUR                   H  nUR                  S:X  d  M  UR                  (       d    O[        [         R                  " U R                  5      5      nUR                   H)  nXx;   d  M
  US-  nSn[        R                  " X!5      s  s  $    SR                  U5      n	USU	-   -  n[        R                  " X!5      s  $    U[!        U R                  5      -  n[        R                  " X!5      $ ! [
        R                   a9  nU[        R                  " U5      -  n[        R                  " X!5      s SnA$ SnAff = f)	z=Checks whether there is an enabled OS Config service account.z>> Is the OS Config Service account present for this instance? FNzroles/osconfig.serviceAgentr   Tr   z|Yes
However, the service account name does not contain a matching project number. The service account should be of the name )r	   ParseProjectnamer   GetIamPolicyr   	HttpErrorr   UnknownMessager   bindingsrolemembersstrr   r   r   )
projectr   continue_flag
iam_policyproject_refebindingproject_numbermemberr   s
             r   CheckEnablementr,   8   s\   # -*!!',,/+;**;7J
 $$g||44__T227<<@AooF%% M>>-BB	 &
 OUU > APP 	Q ~~m>># %& ,W\\::		881 
		 ;,,Q//>>-::;s   D5 5F	.E=7F=FN)__doc__
__future__r   r   r   apitools.base.pyr   +googlecloudsdk.api_lib.cloudresourcemanagerr   9googlecloudsdk.command_lib.compute.os_config.troubleshootr   #googlecloudsdk.command_lib.projectsr	   r   r   r,    r   r   <module>r4      s/    I &  ' ' D K 40#9r   