
    .                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK	Jr  SSK
Jr  SSK
Jr  SS	K
Jr  SS
KJr  SSKJr  \R$                  " \R&                  R(                  5       " S S\R*                  5      5       rg)"Create a new certificate template.    )absolute_import)division)unicode_literals)base)request_utils)flags)
operations)resource_args)labels_util)logc                   8    \ rS rSrSrSSS.r\S 5       rS rSr	g	)
Create   r   a            Create a certificate template that enforces policy restrictions on
          certificate requestors. Using a certificate template, you can define
          restrictions on the kinds of Subjects/SANs and x509 extensions allowed
          from certificate requestors as well as a default set of x509
          extensions that should be applied to all certificates using that
          template. These templates can be binded to IAM identities such that
          certain groups of requestors must use particular templates, allowing
          for fine-grained policy enforcements based on identity.

          For more information and examples, see https://cloud.google.com/certificate-authority-service/docs/creating-certificate-template.
          a          To create a template that prohibits any x509 extension from a requester,
        but permits custom subjects/SANs and defines the default x509
        extensions, run:

          $ {command} restricted-template --location=us-west1 --copy-subject --copy-sans --predefined-values-file=x509_parameters.yaml

        To create a template that allows requesters to specify only DNS names
        from requesters, use a custom CEL expression with a SAN only restriction:

          $ {command} dns-only-template --location=us-west1 --description="Restricts certificates to DNS SANs." --no-copy-subject --copy-sans --identity-cel-expression="subject_alt_names.all(san, san.type == DNS)"

        To create a template that permits a requestor to specify extensions by
        OIDs, and subjects (but not SANs), with default x509 exensions:

          $ {command} mtls-only-extensions --location=us-west1 --copy-subject --no-copy-sans --predefined-values-file=mtls_cert_exts.yaml --copy-extensions-by-oid=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.1
       )DESCRIPTIONEXAMPLESc                 V   [         R                  " U S5        [        R                  " SSS9R	                  U 5        [
        R                  " U 5        [
        R                  " U 5        [
        R                  " U 5        [
        R                  " U 5        [        R                  " U 5        g )Nz	to createz--descriptionz0A text description for the Certificate Template.)help)r   +AddCertificateTemplatePositionalResourceArgr   ArgumentAddToParserr	   AddPredefinedValuesFileFlagAddIdentityConstraintsFlagsAddExtensionConstraintsFlagsAddMaximumLifetimeFlagr   AddCreateLabelsFlags)parsers    )lib/surface/privateca/templates/create.pyArgsCreate.ArgsE   s}    ==f>IKMM?AALB	%%f-	%%f-	&&v.	  ($$V,    c           	         [         R                  " S5      n[         R                  " S5      nUR                  R                  R                  5       n[        R                  " U5        UR                  [        R                  " U5      [        R                  " U5      [        R                  " U5      UR                  S5      (       a  UR                  OS [        R                  " U5      S9nUR                  R!                  UR#                  UR%                  5       R'                  5       UR)                  5       U[*        R,                  " 5       S95      n[.        R0                  " USSS9n[.        R2                  " XsR                  5      n[4        R6                  R9                  SR;                  UR<                  5      5        g )Nv1description)predefinedValuesidentityConstraintspassthroughExtensionsr$   maximumLifetime)parentcertificateTemplateIdcertificateTemplate	requestIdzCreating Certificate Template.)api_versionz"Created Certificate Template [{}].)privateca_baseGetClientInstanceGetMessagesModuleCONCEPTScertificate_templateParser	   ValidateIdentityConstraintsCertificateTemplateParsePredefinedValuesParseIdentityConstraintsParseExtensionConstraintsIsSpecifiedr$   ParseMaximumLifetime'projects_locations_certificateTemplatesr   ;PrivatecaProjectsLocationsCertificateTemplatesCreateRequestParentRelativeNameNamer   GenerateRequestIdr
   AwaitGetMessageFromResponser   statusPrintformatname)	selfargsclientmessagescert_template_refnew_cert_template	operationcert_template_responsecert_templates	            r   Run
Create.RunS   sr   --d3F//5H::@@B	%%d+ 4444T:!::4@#==dCM** $$2248 5  >>EELL$++-::<"3"8"8": 1#557	 	M 	9:I (--3G55 < <>M JJ9@@ r!    N)
__name__
__module____qualname____firstlineno____doc__detailed_helpstaticmethodr   rP   __static_attributes__rR   r!   r   r   r      s0    + -D - -r!   r   N)rW   
__future__r   r   r    googlecloudsdk.api_lib.privatecar   r.   r   googlecloudsdk.calliope$googlecloudsdk.command_lib.privatecar	   r
   r   $googlecloudsdk.command_lib.util.argsr   googlecloudsdk.corer   ReleaseTracksReleaseTrackGACreateCommandr   rR   r!   r   <module>re      sf    ) &  ' C : ( 6 ; > < # D%%(()RT R *Rr!   