
    "                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK	Jr  SSK
Jr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  \R:                  \R<                  " \R>                  R@                  5       " S S\RB                  5      5       5       r"g)z(Create a new root certificate authority.    )absolute_import)division)unicode_literals)base)request_utils)deps)create_utils)flags)iam)
operations)p4sa)resource_args)storage)labels_util)concept_parsers)presentation_specs)log)
console_ioc                   N   ^  \ rS rSrSrU 4S jr\S 5       rS rS r	S r
SrU =r$ )	Create'   aD  Create a new root certificate authority.

TIP: Consider setting a [project lien](https://cloud.google.com/resource-manager/docs/project-liens) on the project to prevent it from accidental deletion.

## EXAMPLES

To create a root CA that supports one layer of subordinates:

    $ {command} prod-root \
        --location=us-west1 --pool=my-pool \
        --kms-key-version="projects/my-project-pki/locations/us-west1/keyRings/kr1/cryptoKeys/k1/cryptoKeyVersions/1" \
        --subject="CN=Example Production Root CA, O=Google" \
        --max-chain-length=1

To create a root CA that is based on an existing CA:

    $ {command} prod-root \
        --location=us-west1 --pool=my-pool \
        --kms-key-version="projects/my-project-pki/locations/us-west1/keyRings/kr1/cryptoKeys/k1/cryptoKeyVersions/1" \
        --from-ca=source-root
c                    > [         [        U ]
  " U0 UD6  [        R                  " SS9U l        [        R                  " SS9U l        g )Nv1api_version)superr   __init__privateca_baseGetClientInstanceclientGetMessagesModulemessages)selfargskwargs	__class__s      %lib/surface/privateca/roots/create.pyr   Create.__init__A   s;    	&$ $1&1 22tDDK"44FDM    c                    U R                  SSS9nU R                  SSSS9n[        R                  " [        R                  " S[
        R                  " S5      S	SS
9[        R                  " S[
        R                  " 5       SUS9[        R                  " S[
        R                  " S[        R                  " S5      [
        R                  /[        R                  " S5      /S9SSSSS.SS9/5      R                  U 5        [        R                  " U SS9  [        R                  " USS9  [        R                  " U SSSS9  [         R"                  " U 5        [        R$                  " U 5        [        R&                  " U5        [        R(                  " USS S9  [        R*                  " U 5        [        R,                  " U 5        [        R.                  " U 5        g )NTz^The key configuration used for the CA certificate. Defaults to a managed key if not specified.)mutexhelpFz4The X.509 configuration used for the CA certificate.)r+   requiredr,   CERTIFICATE_AUTHORITYzCertificate Authorityz"The name of the root CA to create.)r-   z--kms-key-versionz,An existing KMS key version to back this CA.)groupz	--from-caz	source CAz
--locationz--pool)location_fallthroughspool_id_fallthroughszAn existing CA from which to copy configuration values for the new CA. You can still override any of those values by explicitly providing the appropriate flags. The specified existing CA must be part of the same pool as the one being created. )projectlocationpool)flag_name_overridesprefixes)subject_requiredzrsa-pkcs1-4096-sha256)defaultCAP10Yz10 years)resource_namedefault_valuedefault_value_text)is_ca_commanddefault_max_chain_length)	add_groupr   ConceptParserr   ResourcePresentationSpecr   CreateCertAuthorityResourceSpecCreateKmsKeyVersionResourceSpecr   ArgFallthroughLOCATION_PROPERTY_FALLTHROUGHAddToParserr
   AddSubjectFlagsAddKeyAlgorithmFlagAddValidityFlagr   AddCreateLabelsFlagsAddBucketFlagAddUsePresetProfilesFlagAddInlineX509ParametersFlagsAddAutoEnableFlagAddSubjectKeyIdFlagAddUserDefinedAccessUrlsFlags)parserkey_spec_groupx509_config_groups      r'   ArgsCreate.ArgsF   s   %%( & )N ((C ) E
 !!33#99')0	 	3399;: 		"
 	3399''5!??' '+&9&9(&C%DF6
 !
 %	# > {6	&59	 79	%	'
 $$V,		""#45 
&&N	F#	f%	''/r)   c                     U R                   R                  UU R                   R                  [        R                  " 5       S9S9nU R
                  R                  R                  U5      n[        R                  " USSS9$ )zEnables the given CA.)	requestId)name!enableCertificateAuthorityRequestzEnabling CA.r   r   )
r"   DPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesEnableRequest!EnableCertificateAuthorityRequestr   GenerateRequestIdr    1projects_locations_caPools_certificateAuthoritiesEnabler   Await)r#   ca_nameenable_request	operations       r'   _EnableCertificateAuthority"Create._EnableCertificateAuthority   sv    ]]gg*.--	*	*#557 
+ 
9 h :N
 MMTTII~4HHr)   c                    UR                   (       a  gUR                  5       R                  5       nU R                  R                  R                  U R                  R                  US95      n[        R                  " UR                  U R                  5      (       a  g[        R                  " SR                  UR                  5       R                  5       5      SS9$ )z3Determines whether the CA should be enabled or not.T)parentFzThe CaPool [{}] has no enabled CAs and cannot issue any certificates until at least one CA is enabled. Would you like to also enable this CA?)messager9   )auto_enableParentRelativeNamer    r_   Listr"   BPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesListRequestr	   HasEnabledCacertificateAuthoritiesr   PromptContinueformatName)r#   r$   ca_refca_pool_namelist_responses        r'   _ShouldEnableCaCreate._ShouldEnableCa   s     ==?//1LKKQQVV	K	K 
L 
!"M   ,,dmm= = $$%vfmmo&:&:&<=uN Nr)   c           	         [         R                  " USS9u  p#nUR                  5       nUR                  5       R                  5       nUR                  R                  R                  5       nU(       a  UR                  5       OS n[        R                  " Xh5        S n	UR                  S5      (       a1  [        R                  " UR                  5      n	U	R                  Ul        U	(       d  U(       a+  [        R                  " [        R                  " U5      X5        U R                   R"                  R%                  U R&                  R)                  UUR+                  5       UR-                  5       [.        R0                  " 5       S95      n
[2        R4                  " U
SSS9n[2        R6                  " UU R&                  R8                  5      n[:        R<                  R?                  SRA                  URB                  5      5        [:        R<                  R?                  S	5        U RE                  X5      (       a   U RG                  UR-                  5       5        g g )
NF)is_subordinatebucket)certificateAuthoritycertificateAuthorityIdrh   rY   zCreating Certificate Authority.r   r   z#Created Certificate Authority [{}].zTIP: To avoid accidental deletion, please consider adding a project lien on this project. To find out more, see the following doc: https://cloud.google.com/resource-manager/docs/project-liens.)$r	   CreateCAFromArgsrk   CONCEPTSkms_key_versionParser   *CheckCreateCertificateAuthorityPermissionsIsSpecifiedr   %ValidateBucketForCertificateAuthorityr{   	gcsBucketr   AddResourceRoleBindingsGetOrCreater    r_   r   r"   DPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesCreateRequestrs   rl   r   r^   r   ra   GetMessageFromResponseCertificateAuthorityr   statusPrintrr   rZ   rw   re   )r#   r$   new_cart   _pool_refproject_refkey_version_refkms_key_ref
bucket_refrd   ca_responsecas                r'   Run
Create.Run   s   $55U$FA}}H//#**,Kmm3399;O.=/((*4K22;LJ!!@@Mj#**f [
""


;
'B MMTT	M	M!'#);;=((*#557	 
N 
9:I ""9.O]abK		*	*;+/==+M+M
OB JJ:AA"''JKJJ	H D))
&&v':':'<= *r)   )r    r"   )__name__
__module____qualname____firstlineno____doc__r   staticmethodrV   re   rw   r   __static_attributes____classcell__)r&   s   @r'   r   r   '   s9    ,G
 ;0 ;0z	IN*)> )>r)   r   N)#r   
__future__r   r   r    googlecloudsdk.api_lib.privatecar   r   r   googlecloudsdk.calliope googlecloudsdk.calliope.conceptsr   $googlecloudsdk.command_lib.privatecar	   r
   r   r   r   r   r   $googlecloudsdk.command_lib.util.argsr   (googlecloudsdk.command_lib.util.conceptsr   r   googlecloudsdk.corer   googlecloudsdk.core.consoler   DefaultUniverseOnlyReleaseTracksReleaseTrackGACreateCommandr    r)   r'   <module>r      s    / &  ' C : ( 1 = 6 4 ; 5 > 8 < D G # 2 D%%(()d>T d> * d>r)   