
    6                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK	Jr  SSK	J
r
  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  \R@                  \RB                  " \RD                  RF                  5       " S S\RH                  5      5       5       r%g)z/Create a new subordinate certificate authority.    )absolute_import)division)unicode_literals)base)request_utils)
exceptions)deps)create_utils)flags)iam)
operations)p4sa)resource_args)storage)labels_util)concept_parsers)presentation_specs)log)
console_io)filesc                   T   ^  \ rS rSrSrU 4S jr\S 5       rS rS r	S r
S rS	rU =r$ )
Create)   a  Create a new subordinate certificate authority.

## EXAMPLES
To create a subordinate CA named 'server-tls-1' whose issuer is on Private CA:

  $ {command} server-tls-1 \
      --location=us-west1 --pool=my-pool \
      --subject="CN=Example TLS CA, O=Google" \
      --issuer-pool=other-pool --issuer-location=us-west1 \
      --kms-key-version="projects/my-project-pki/locations/us-west1/keyRings/kr1/cryptoKeys/key2/cryptoKeyVersions/1"

To create a subordinate CA named 'server-tls-1' whose issuer is located
elsewhere:

  $ {command} server-tls-1 \
      --location=us-west1 --pool=my-pool \
      --subject="CN=Example TLS CA, O=Google" \
      --create-csr \
      --csr-output-file=./csr.pem \
      --kms-key-version="projects/my-project-pki/locations/us-west1/keyRings/kr1/cryptoKeys/key2/cryptoKeyVersions/1"

To create a subordinate CA named 'server-tls-1' chaining up to a root CA
named 'prod-root' based on an existing CA:

  $ {command} server-tls-1 \
      --location=us-west1 --pool=my-pool \
      --issuer-pool=other-pool --issuer-location=us-west1 \
      --from-ca=source-ca \
      --kms-key-version="projects/my-project-pki/locations/us-west1/keyRings/kr1/cryptoKeys/key2/cryptoKeyVersions/1"
c                    > [         [        U ]
  " U0 UD6  [        R                  " SS9U l        [        R                  " SS9U l        g )Nv1api_version)superr   __init__privateca_baseGetClientInstanceclientGetMessagesModulemessages)selfargskwargs	__class__s      ,lib/surface/privateca/subordinates/create.pyr   Create.__init__K   s;    	&$ $1&1 22tDDK"44FDM    c                 `   U R                  SSS9nU R                  SSSS9nU R                  SSSS9nUR                  SSSS9n[        R                  " S	S
SS9R                  U 5        [        R
                  " [        R                  " S[        R                  " S5      SSS9[        R                  " S[        R                  " S5      SSSSS0US9[        R                  " S[        R                  " 5       SUS9[        R                  " S[        R                  " S[        R                  " S5      [        R                  /[        R                  " S5      /S9SSSSS .SS!9/5      R                  U 5        [        R                   " U SS"9  [        R"                  " US#S$9  [        R$                  " U5        [        R&                  " USS%S&9  [        R(                  " U S'S(S)S*9  [*        R,                  " U 5        [        R.                  " U 5        [        R0                  " U 5        UR                  S+S,9n[        R                  " S-S.S/SSSS09R                  U5        [        R                  " S1S2SS9R                  U5        [        R2                  " U 5        [        R4                  " U 5        g )3NTz^The key configuration used for the CA certificate. Defaults to a managed key if not specified.)mutexhelpFz4The X.509 configuration used for the CA certificate.)r-   requiredr.   z6The issuer configuration used for this CA certificate.z2The issuing resource used for this CA certificate.z--issuer-cazThe Certificate Authority ID of the CA to issue the subordinate CA certificate from. This ID is optional. If ommitted, any available ENABLED CA in the issuing CA pool will be chosen.)r.   r/   CERTIFICATE_AUTHORITYzCertificate Authorityz)The name of the subordinate CA to create.)r/   z--issuer-poolIssuerz3The issuing CA Pool to use, if it is on Private CA.locationz--issuer-location)prefixesr/   flag_name_overridesgroupz--kms-key-versionz$The KMS key version backing this CA.)r5   z	--from-caz	source CAz
--locationz--pool)location_fallthroughspool_id_fallthroughszAn existing CA from which to copy configuration values for the new CA. You can still override any of those values by explicitly providing the appropriate flags. The specified existing CA must be part of the same pool as the one being created. )projectr2   pool)r4   r3   )subject_requiredzrsa-pkcs1-2048-sha256)defaultr   )is_ca_commanddefault_max_chain_lengthCAP3Yz3 years)resource_namedefault_valuedefault_value_textzOIf the issuing CA is not hosted on Private CA, you must provide these settings:)r.   z--create-csrz}Indicates that a CSR should be generated which can be signed by the issuing CA. This must be set if --issuer is not provided.store_const)r.   actionconstr<   r/   z--csr-output-filezDThe path where the resulting PEM-encoded CSR file should be written.)	add_groupr   ArgumentAddToParserr   ConceptParserr   ResourcePresentationSpecr   CreateCertAuthorityResourceSpecCreateCaPoolResourceSpecCreateKmsKeyVersionResourceSpecr	   ArgFallthroughLOCATION_PROPERTY_FALLTHROUGHr   AddSubjectFlagsAddKeyAlgorithmFlagAddUsePresetProfilesFlagAddInlineX509ParametersFlagsAddValidityFlagr   AddCreateLabelsFlagsAddBucketFlagAddSubjectKeyIdFlagAddAutoEnableFlagAddUserDefinedAccessUrlsFlags)parserkey_spec_groupx509_config_groupissuer_configuration_groupissuing_resource_groupoffline_issuer_groups         r)   ArgsCreate.ArgsP   s   %%, & N ((C ) 
 "(!1!1E "2 "
 8AAA B 
 	MMN  k&!!33#99' 8	
 	33228<A/! )
	
 	3399;2 		
 	3399''5!??' '+&9&9(&C%DA
 !
 '	
5/# /^ {6	&59	n6MN	""#45	&& 
$	 $$V,		f%5?? @  	MML 
 k&'MM  k&'	F#	''/r+   c                     U R                   R                  UU R                   R                  [        R                  " 5       S9S9nU R
                  R                  R                  U5      n[        R                  " USSS9$ )zEnable the given CA.)	requestId)name!enableCertificateAuthorityRequestzEnabling CA.r   r   )
r$   DPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesEnableRequest!EnableCertificateAuthorityRequestr   GenerateRequestIdr"   1projects_locations_caPools_certificateAuthoritiesEnabler   Await)r%   ca_nameenable_request	operations       r)   _EnableCertificateAuthority"Create._EnableCertificateAuthority   s|    ]]gg*.--*Y*Y#557 +Z +
 h N 	EELL	
 
 I~4HHr+   c                    UR                   (       a  gUR                  5       R                  5       nU R                  R                  R                  U R                  R                  US95      n[        R                  " UR                  U R                  5      (       a  g[        R                  " SR                  UR                  5       R                  5       5      SS9$ )z3Determines whether the CA should be enabled or not.T)parentFzThe CaPool [{}] has no enabled CAs and cannot issue any certificates until at least one CA is enabled. Would you like to also enable this CA?messager<   )auto_enableParentRelativeNamer"   rj   Listr$   BPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesListRequestr
   HasEnabledCacertificateAuthoritiesr   PromptContinueformatName)r%   r&   ca_refca_pool_namelist_responses        r)   _ShouldEnableCaCreate._ShouldEnableCa   s     ==?//1LKKQQVVXX 	Y 	
M
   ,,dmm   $$##)6&--/*>*>*@#A r+   c                 8   U R                   R                  UU R                   R                  UU R                   R                  U R                   R	                  US9S9S9S9nU R
                  R                  R                  U5      n[        R                  " USSS9$ )zHActivates the given CA using the given certificate and issuing CA chain.)pemCertificates)pemIssuerChain)pemCaCertificatesubordinateConfig)re   #activateCertificateAuthorityRequestzActivating CA.r   r   )
r$   FPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesActivateRequest#ActivateCertificateAuthorityRequestSubordinateConfigSubordinateConfigChainr"   rj   Activater   rl   )r%   rm   pem_certissuer_chainactivate_requestro   s         r)   _ActivateCertificateAuthority$Create._ActivateCertificateAuthority   s    }}kk,0MM,],]%"mm==#}}CC$0  D   >  -^ -
 l 
 	EENN	
 
 I'7TJJr+   c                    [         R                  " USS9u  p#nUR                  5       R                  5       R                  5       nUR                  R                  R                  5       nU(       a  UR                  5       OS nUR                  S5      (       d.  UR                  S5      (       a  [        R                  " S/S5      eUR                  UR                  :X  a:  [        R                  " SSS9(       d   [        R                  R                  S	5        g [         R"                  " XW5        U(       a_  [         R$                  " U5        UR                  S
5      (       a  UR&                  OS n[         R(                  " UR+                  5       U5        S n	UR                  S5      (       a1  [,        R.                  " UR0                  5      n	U	R0                  Ul        [4        R6                  " U5      n
[4        R8                  " XU	5        [:        R<                  " U R>                  R@                  RC                  U RD                  RG                  UURI                  5       UR                  5       R+                  5       [J        RL                  " 5       S95      SSS9  U R>                  R@                  RO                  U RD                  RQ                  UR+                  5       S95      nURR                  nURT                  (       ai  [V        RX                  " URZ                  U5        [        R                  R                  SR]                  UR+                  5       URZ                  5      5        g U(       a  UR                  S
5      (       a  UR&                  OS n[         R^                  " XLX5      nU Ra                  UR+                  5       URb                  URd                  5        [        R                  R                  SR]                  UR+                  5       5      5        U Rg                  X5      (       a  U Ri                  UR+                  5       5        g g )NT)is_subordinateissuer_poolrv   z--auto-enablezThe '--auto-enable' is only supported in the create command if an issuer resource is specified. You can use the '--auto-enable' command in the subordinate CA activate command.zThe new CA will be in the same CA pool as the issuer CA. All certificate authorities within a CA pool should be interchangeable. Do you want to continue?rt   zAborted by user.	issuer_cabucket)certificateAuthoritycertificateAuthorityIdrs   rd   zCreating Certificate Authority.r   r   )re   z9Created Certificate Authority [{}] and saved CSR to '{}'.z#Created Certificate Authority [{}].)5r
   CreateCAFromArgsrw   CONCEPTSkms_key_versionParseIsSpecifiedr   InvalidArgumentExceptionr   r:   r   r}   r   statusPrintr   *CheckCreateCertificateAuthorityPermissions!CheckCreateCertificatePermissionsr   ValidateIssuingPoolrx   r   %ValidateBucketForCertificateAuthorityr   	gcsBucketr   GetOrCreateAddResourceRoleBindingsr   rl   r"   rj   r   r$   DPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesCreateRequestr   r   ri   FetchCPrivatecaProjectsLocationsCaPoolsCertificateAuthoritiesFetchRequestpemCsr
create_csrr   WriteFileContentscsr_output_filer~   SignCsrr   pemCertificatepemCertificateChainr   rp   )r%   r&   new_car   
issuer_refproject_refkey_version_refkms_key_refr   
bucket_ref
p4sa_emailcsr_responsecsrca_certificates                 r)   Run
Create.Run  sb   !-!>!>T"FJ
 --/((*113Kmm3399;O.=/((*4KM**t/?/?/N/N//
Q  499$&&;  	

+,22;L	++J7 %)$4$4[$A$A$..ti&&z'>'>'@)LJ!!@@Mj#**f!!+.J  *EEELLMM^^%+'-{{}}}335'99;	 _ 	
 	* ;;PPVVYY$$& 	Z 	
L
 

Cd22C8	jj
E
L
L!!#T%9%9
 $($4$4[$A$A$..ti#++JYOn
((





'
'

,
,
 
jj
/
6
6v7J7J7L
M 
		d	+	+(()<)<)>? r+   )r"   r$   )__name__
__module____qualname____firstlineno____doc__r   staticmethodra   rp   r   r   r   __static_attributes____classcell__)r(   s   @r)   r   r   )   sB    >G
 }0 }0~I6K(X Xr+   r   N)&r   
__future__r   r   r    googlecloudsdk.api_lib.privatecar   r    r   googlecloudsdk.callioper    googlecloudsdk.calliope.conceptsr	   $googlecloudsdk.command_lib.privatecar
   r   r   r   r   r   r   $googlecloudsdk.command_lib.util.argsr   (googlecloudsdk.command_lib.util.conceptsr   r   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   DefaultUniverseOnlyReleaseTracksReleaseTrackGACreateCommandr    r+   r)   <module>r      s    6 &  ' C : ( . 1 = 6 4 ; 5 > 8 < D G # 2 * D%%((){T { * {r+   