
    h                         d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	l
mZ dd
lmZ ddlmZ  e	j"                  e	j$                  j&                         G d de	j(                               Zy)zCCommand to set service account and scopes for an instance resource.    )absolute_import)division)unicode_literals)base_classes)	constants)base)flags)scope)
exceptionsc                   f     e Zd ZdZdddZ fdZed        Zd Zd Z	d	 Z
d
 Zd Zd Zd Z xZS )SetServiceAccountzLSet a service account and access scopes for a Compute Engine VM instance.
  a        `{command}` lets you configure a service account and access scopes for a
      Compute Engine VM instance.

      As a best practice, grant the ``cloud-platform'' access scope on your
      VM instance. Then, to restrict resource access, grant only the required
      IAM roles to the VM instance's service account. For more information,
      see [](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes#best_practices).
        z
  To set a service account with the ``cloud-platform'' scope, run:

    $ {command} example-instance --scopes=cloud-platform --zone=us-central1-b --service-account=example-account
  )DESCRIPTIONEXAMPLESc                 F    t        | j                  | 
  |i | d | _        y )N)super	__class____init__	_instance)selfargskwargsr   s      4lib/surface/compute/instances/set_service_account.pyr   zSetServiceAccount.__init__4   s"    	$..$($9&9DN    c                 n    t         j                  j                  |        t        j                  | d       y )NT)r	   INSTANCE_ARGAddArgumentAddServiceAccountAndScopeArgs)parsers    r   ArgszSetServiceAccount.Args8   s&    	""6*	''5r   c                     | j                   s^|j                  j                  d |j                  j                  di |j                         f}|j                  |g      }|d   | _         | j                   S )z@Return cached instance if there isn't one fetch referrenced one.Get)requestsr    )r   apitools_client	instancesmessagesComputeInstancesGetRequestAsDictMakeRequests)r   instance_refclientrequestinstances        r   _get_instancezSetServiceAccount._get_instance=   sr    >>''115;;; .#**,./g $$wi$8h{dn>>r   c                 h    | j                  ||      }|y|j                  }|r|d   j                  S y)z2Return email of service account instance is using.Nr   )r.   serviceAccountsemail)r   r*   r+   r-   orignal_service_accountss        r   _original_emailz!SetServiceAccount._original_emailI   s@    !!,7H'77%a(...r   c                 z    | j                  ||      }|g S |j                  }g }|D ]  }||j                  z  } |S )z Return scopes instance is using.)r.   r0   scopes)r   r*   r+   r-   r2   resultaccountss          r   _original_scopesz"SetServiceAccount._original_scopesS   sM    !!,7Hi'77F,f -Mr   c                 p    |j                   ry|j                  r|j                  S | j                  ||      S )z8Return email to set as service account for the instance.N)no_service_accountservice_accountr3   r   r   r*   r+   s       r   _emailzSetServiceAccount._email^   s6    !!!f55r   c                 r    |j                   rg S |j                  |j                  S | j                  ||      S )z&Return scopes to set for the instance.)	no_scopesr5   r8   r<   s       r   _unprocessed_scopesz%SetServiceAccount._unprocessed_scopesf   s5    ~~i{{[[  v66r   c                     g }| j                  |||      D ]4  }t        j                  j                  ||g      }|j	                  |       6 |S )aF  Get list of scopes to be assigned to the instance.

    Args:
      args: parsed command  line arguments.
      instance_ref: reference to the instance to which scopes will be assigned.
      client: a compute_holder.client instance

    Returns:
      List of scope urls extracted from args, with scope aliases expanded.
    )r@   r   SCOPESgetextend)r   r   r*   r+   r6   unprocessed_scoper
   s          r   _scopeszSetServiceAccount._scopesn   sX     F!55d6BFL""#47H6IJemmEL Mr   c                    t        j                  | j                               }|j                  }t	        j
                  |       t        j                  j                  ||j                  t        j                  j                  t        j                  |            }| j                  |||      }| j                  |||      }|r|st!        j"                  d      |j$                  j'                  |j$                  j)                  ||      |j*                  |j,                  |j/                               }|j1                  |j2                  j4                  d|fg      S )N)default_scopescope_listerz4Can not set scopes when there is no service acoount.)r1   r5   )!instancesSetServiceAccountRequestprojectzoner-   r   )r   ComputeApiHolderReleaseTrackr+   r	   "ValidateServiceAccountAndScopeArgsr   ResolveAsResource	resourcescompute_scope	ScopeEnumZONEcompute_flagsGetDefaultScopeListerr=   rF   r   $ScopesWithoutServiceAccountExceptionr&   (ComputeInstancesSetServiceAccountRequest!InstancesSetServiceAccountRequestrK   rL   Namer)   r$   r%   )r   r   compute_holderr+   r*   r1   r5   r,   s           r   RunzSetServiceAccount.Run   sH   !2243D3D3FGN""F	,,T2%%77n&&#--22"88@ 8 BL
 KKlF3E\\$f5Fe;;
@B B ooFFOO== > 
 $$""$ G 
G ((!    r   )__name__
__module____qualname____doc__detailed_helpr   staticmethodr   r.   r3   r8   r=   r@   rF   r\   __classcell__)r   s   @r   r   r      sU    
-" 6 6
	67$!r   r   N)r`   
__future__r   r   r   googlecloudsdk.api_lib.computer   r   googlecloudsdk.callioper   "googlecloudsdk.command_lib.computer	   rU   r
   rR   ,googlecloudsdk.command_lib.compute.instancesr   ReleaseTracksrN   GASilentCommandr   r#   r   r   <module>rl      sf    J &  ' 7 4 ( E E C > D%%(()B** B *Br   