
    >                     l    d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ  G d d      Z G d	 d
      Z	y)z/Utilities for setting up GKE workload identity.    )absolute_import)division)unicode_literals)compute_helpers)iam_helpersc                        e Zd ZdZed        Zy)GkeWorkloadIdentityzSets up GKE Workload Identity.c                     dj                  |      }|D cg c]  }dj                  | ||       }}t        j                  ||d       yc c}w )zFAllow the k8s_service_accounts to use gsa_email via Workload Identity.z&projects/-/serviceAccounts/{gsa_email})	gsa_emailz>serviceAccount:{project_id}.svc.id.goog[{k8s_namespace}/{ksa}])
project_idk8s_namespaceksazroles/iam.workloadIdentityUserN)formatr   AddIamPolicyBindings)r   r   r   k8s_service_accountsresourcer   memberss          @lib/googlecloudsdk/command_lib/dataproc/gke_workload_identity.pyUpdateGsaIamPolicyz&GkeWorkloadIdentity.UpdateGsaIamPolicy   sw     8>> ? H
 ( (C 	IOO!C 	P 	I'  
 $$Xw%EGs   AN)__name__
__module____qualname____doc__staticmethodr        r   r	   r	      s    &G Gr   r	   c                        e Zd ZdZed        Zy)&DefaultDataprocDataPlaneServiceAccountzHFind the default Google Service Account used by the Dataproc data plane.c                 ,    t        j                  |       S )N)r   GetDefaultServiceAccount)r   s    r   Getz*DefaultDataprocDataPlaneServiceAccount.Get.   s    33J??r   N)r   r   r   r   r   r!   r   r   r   r   r   +   s    P@ @r   r   N)
r   
__future__r   r   r   googlecloudsdk.api_lib.dataprocr   r   r	   r   r   r   r   <module>r$      s1    6 &  ' ; 7G G$@ @r   