
    h                         S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSK
Jr  SS	K
Jr  SS
KJr  SSKJr  \	R"                  " \	R$                  R&                  5       " S S\	R(                  5      5       rg)zCCommand to set service account and scopes for an instance resource.    )absolute_import)division)unicode_literals)base_classes)	constants)base)flags)scope)
exceptionsc                   p   ^  \ rS rSrSrSSS.rU 4S jr\S 5       rS r	S	 r
S
 rS rS rS rS rSrU =r$ )SetServiceAccount   zLSet a service account and access scopes for a Compute Engine VM instance.
  a        `{command}` lets you configure a service account and access scopes for a
      Compute Engine VM instance.

      As a best practice, grant the ``cloud-platform'' access scope on your
      VM instance. Then, to restrict resource access, grant only the required
      IAM roles to the VM instance's service account. For more information,
      see [](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes#best_practices).
        z
  To set a service account with the ``cloud-platform'' scope, run:

    $ {command} example-instance --scopes=cloud-platform --zone=us-central1-b --service-account=example-account
  )DESCRIPTIONEXAMPLESc                 H   > [         U R                  U ]
  " U0 UD6  S U l        g )N)super	__class____init__	_instance)selfargskwargsr   s      4lib/surface/compute/instances/set_service_account.pyr   SetServiceAccount.__init__4   s"    	$..$($9&9DN    c                 p    [         R                  R                  U 5        [         R                  " U S5        g )NT)r	   INSTANCE_ARGAddArgumentAddServiceAccountAndScopeArgs)parsers    r   ArgsSetServiceAccount.Args8   s&    	""6*	''5r   c                     U R                   (       d[  UR                  R                  SUR                  R                  " S0 UR                  5       D64nUR                  U/S9nUS   U l         U R                   $ )z@Return cached instance if there isn't one fetch referrenced one.Get)requestsr    )r   apitools_client	instancesmessagesComputeInstancesGetRequestAsDictMakeRequests)r   instance_refclientrequestinstances        r   _get_instanceSetServiceAccount._get_instance=   sp    >>''115;; .#**,./g $$wi$8h{dn>>r   c                 r    U R                  X5      nUc  gUR                  nU(       a  US   R                  $ g)z2Return email of service account instance is using.Nr   )r1   serviceAccountsemail)r   r-   r.   r0   orignal_service_accountss        r   _original_email!SetServiceAccount._original_emailI   s>    !!,7H'77%a(...r   c                 |    U R                  X5      nUc  / $ UR                  n/ nU H  nXVR                  -  nM     U$ )z Return scopes instance is using.)r1   r4   scopes)r   r-   r.   r0   r6   resultaccountss          r   _original_scopes"SetServiceAccount._original_scopesS   sI    !!,7Hi'77F,f -Mr   c                     UR                   (       a  gUR                  (       a  UR                  $ U R                  X#5      $ )z8Return email to set as service account for the instance.N)no_service_accountservice_accountr7   r   r   r-   r.   s       r   _emailSetServiceAccount._email^   s4    !!!55r   c                 |    UR                   (       a  / $ UR                  b  UR                  $ U R                  X#5      $ )z&Return scopes to set for the instance.)	no_scopesr:   r=   rB   s       r   _unprocessed_scopes%SetServiceAccount._unprocessed_scopesf   s3    ~~i{{[[  66r   c                     / nU R                  UX#5       H4  n[        R                  R                  XU/5      nUR	                  U5        M6     U$ )a*  Get list of scopes to be assigned to the instance.

Args:
  args: parsed command  line arguments.
  instance_ref: reference to the instance to which scopes will be assigned.
  client: a compute_holder.client instance

Returns:
  List of scope urls extracted from args, with scope aliases expanded.
)rG   r   SCOPESgetextend)r   r   r-   r.   r;   unprocessed_scoper
   s          r   _scopesSetServiceAccount._scopesn   sS     F!55d6BL""#46IJemmEL Mr   c                    [         R                  " U R                  5       5      nUR                  n[        R
                  " U5        [        R                  R                  XR                  [        R                  R                  [        R                  " U5      S9nU R                  XU5      nU R                  XU5      nU(       a  U(       d  [         R"                  " S5      eUR$                  R'                  UR$                  R)                  UUS9UR*                  UR,                  UR/                  5       S9nUR1                  UR2                  R4                  SU4/5      $ )N)default_scopescope_listerz4Can not set scopes when there is no service acoount.)r5   r:   )!instancesSetServiceAccountRequestprojectzoner0   r   )r   ComputeApiHolderReleaseTrackr.   r	   "ValidateServiceAccountAndScopeArgsr   ResolveAsResource	resourcescompute_scope	ScopeEnumZONEcompute_flagsGetDefaultScopeListerrC   rN   r   $ScopesWithoutServiceAccountExceptionr)   (ComputeInstancesSetServiceAccountRequest!InstancesSetServiceAccountRequestrT   rU   Namer,   r'   r(   )r   r   compute_holderr.   r-   r5   r:   r/   s           r   RunSetServiceAccount.Run   sB   !2243D3D3FGN""F	,,T2%%77&&#--22"88@ 8 BL
 KKF3E\\$f5Fe;;
@B B ooFFOO== > 
 $$""$ G 
G ((!    r   )r   )__name__
__module____qualname____firstlineno____doc__detailed_helpr   staticmethodr!   r1   r7   r=   rC   rG   rN   re   __static_attributes____classcell__)r   s   @r   r   r      sZ    
-" 6 6
	67$! !r   r   N)rk   
__future__r   r   r   googlecloudsdk.api_lib.computer   r   googlecloudsdk.callioper   "googlecloudsdk.command_lib.computer	   r^   r
   r[   ,googlecloudsdk.command_lib.compute.instancesr   ReleaseTracksrW   GASilentCommandr   r&   r   r   <module>rx      sd    J &  ' 7 4 ( E E C > D%%(()B** B *Br   