gcloud key file

Author: twratl

src/pybritive/britive_cli.py

@@ -255,7 +255,7 @@ def _get_app_type(self, application_id):
         raise click.ClickException(f'Application {application_id} not found')
 
     def __get_cloud_credential_printer(self, app_type, console, mode, profile, silent, credentials,
-                                       aws_credentials_file):
+                                       aws_credentials_file, gcloud_key_file):
         if app_type in ['AWS', 'AWS Standalone']:
             return printer.AwsCloudCredentialPrinter(
                 console=console,
@@ -282,7 +282,8 @@ def __get_cloud_credential_printer(self, app_type, console, mode, profile, silen
                 profile=profile,
                 credentials=credentials,
                 silent=silent,
-                cli=self
+                cli=self,
+                gcloud_key_file=gcloud_key_file
             )
         else:
             return printer.GenericCloudCredentialPrinter(
@@ -348,7 +349,7 @@ def _split_profile_into_parts(self, profile):
         return parts_dict
 
     def checkout(self, alias, blocktime, console, justification, mode, maxpolltime, profile, passphrase,
-                 force_renew, aws_credentials_file):
+                 force_renew, aws_credentials_file, gcloud_key_file):
         credentials = None
         app_type = None
         credential_process_creds_found = False
@@ -418,7 +419,8 @@ def checkout(self, alias, blocktime, console, justification, mode, maxpolltime,
             alias or profile,
             self.silent,
             credentials,
-            aws_credentials_file
+            aws_credentials_file,
+            gcloud_key_file
         ).print()
 
     def import_existing_npm_config(self):
@@ -559,6 +561,9 @@ def request_withdraw(self, profile):
             application_name=parts['app']
         )
 
+    def clear_gcloud_auth_key_files(self):
+        self.config.clear_gcloud_auth_key_files()
+
 
 
 

src/pybritive/choices/mode.py

@@ -14,7 +14,8 @@
         'awscredentialprocess',     # aws credential process output with additional caching to make the credential process more performant
         'azlogin',                  # azure az login command with all fields populated (suitable for eval)
         'azps',                     # azure powershell script
-        'browser'                   # when console access is checked out open the browser to the URL provided
+        'browser',                  # when console access is checked out open the browser to the URL provided
+        'gcloudauth'                # gcloud auth activate-service-account with all fields populated (suitable for eval)
     ],
     case_sensitive=False
 )

src/pybritive/cli_interface.py

@@ -10,6 +10,7 @@
 from .commands.secret import secret as group_secret
 from .commands.cache import cache as group_cache
 from .commands.request import request as group_request
+from .commands.clear import clear as group_clear
 import sys
 import os
 
@@ -46,6 +47,7 @@ def cli(version):
 cli.add_command(group_secret)
 cli.add_command(group_cache)
 cli.add_command(group_request)
+cli.add_command(group_clear)
 
 
 if __name__ == "__main__":

src/pybritive/commands/checkout.py

@@ -7,10 +7,10 @@
 @click.command()
 @build_britive
 @britive_options(names='alias,blocktime,console,justification,mode,maxpolltime,silent,force_renew,aws_credentials_file,'
-                       'tenant,token,passphrase,federation_provider')
+                       'gcloud_key_file,tenant,token,passphrase,federation_provider')
 @click.argument('profile', shell_complete=profile_completer)
 def checkout(ctx, alias, blocktime, console, justification, mode, maxpolltime, silent, force_renew,
-             aws_credentials_file, tenant, token, passphrase, federation_provider, profile):
+             aws_credentials_file, gcloud_key_file, tenant, token, passphrase, federation_provider, profile):
     """Checkout a profile.
 
     This command takes 1 required argument `PROFILE`. This should be a string representation of the profile
@@ -28,5 +28,6 @@ def checkout(ctx, alias, blocktime, console, justification, mode, maxpolltime, s
         profile=profile,
         passphrase=passphrase,
         force_renew=force_renew,
-        aws_credentials_file=aws_credentials_file
+        aws_credentials_file=aws_credentials_file,
+        gcloud_key_file=gcloud_key_file
     )

src/pybritive/commands/clear.py

@@ -0,0 +1,25 @@
+import click
+from ..helpers.build_britive import build_britive
+from ..options.britive_options import britive_options
+
+
+@click.group()
+def clear():
+    """Manage local cache settings."""
+    pass
+
+
+@clear.command()
+@build_britive
+def cache(ctx):
+    """Clears the local cache."""
+    ctx.obj.britive.cache_clear()
+
+
+@clear.command(name='gcloud-auth-key-files')
+@build_britive
+def gcloud_auth_key_files(ctx):
+    """Clears the local gcloud auth key files."""
+    ctx.obj.britive.clear_gcloud_auth_key_files()
+
+

src/pybritive/helpers/cloud_credential_printer.py

@@ -1,4 +1,5 @@
 import json
+import uuid
 import click
 import platform
 import configparser
@@ -50,6 +51,8 @@ def print(self):
             self.print_awscredentialprocess()
         if mode_prefix == 'azps':
             self.print_azps()
+        if mode_prefix == 'gcloudauth':
+            self.print_gcloudauth()
 
     def print_console(self):
         if self.mode == 'browser':
@@ -81,6 +84,9 @@ def print_azlogin(self):
     def print_azps(self):
         self._not_implemented()
 
+    def print_gcloudauth(self):
+        self._not_implemented()
+
     def _not_implemented(self):
         raise click.ClickException(f'Application type {self.app_type} does not support the specified mode.')
 
@@ -210,10 +216,11 @@ def print_azps(self):
 
 
 class GcpCloudCredentialPrinter(CloudCredentialPrinter):
-    def __init__(self, console, mode, profile, silent, credentials, cli):
+    def __init__(self, console, mode, profile, silent, credentials, cli, gcloud_key_file):
         key = list(credentials.keys())[0]
         credentials = json.loads(credentials[key])
         super().__init__('GCP', console, mode, profile, silent, credentials, cli)
+        self.gcloud_key_file = gcloud_key_file
 
     def print_json(self):
         self.cli.print(json.dumps(self.credentials, indent=2), ignore_silent=True)
@@ -223,3 +230,18 @@ def print_json(self):
             "--key-file <path-where-above-json-is-stored>", ignore_silent=True
         )
 
+    def print_gcloudauth(self):
+        # get path to gcloud key file
+        if not self.gcloud_key_file:  # if --gcloud-key-file not provided
+            path = Path(self.cli.config.path).parent / 'pybritive-gcloud-key-files' / f'{uuid.uuid4().hex}.json'
+        else:  # we need to parse out/sanitize what was provided
+            path = Path(self.gcloud_key_file).expanduser().absolute()
+
+        # key file does not yet exist, create it as an empty file
+        path.parent.mkdir(exist_ok=True, parents=True)
+        path.write_text(json.dumps(self.credentials, indent=2))
+
+        self.cli.print(
+            f"gcloud auth activate-service-account {self.credentials['client_email']} --key-file {str(path)}",
+            ignore_silent=True
+        )

src/pybritive/helpers/config.py

@@ -1,4 +1,5 @@
 import os
+import shutil
 from pathlib import Path
 import click
 import configparser
@@ -65,6 +66,10 @@ def __init__(self, cli: object, tenant_name: str = None):
         self.loaded = False
         self.validation_error_messages = []
 
+    def clear_gcloud_auth_key_files(self):
+        path = Path(self.path).parent / 'pybritive-gcloud-key-files'
+        shutil.rmtree(str(path), ignore_errors=True)
+
     def get_output_format(self, output_format: str = None):
         return coalesce(
             output_format,

src/pybritive/options/britive_options.py

@@ -20,6 +20,7 @@
 from ..options.force_renew import option as force_renew
 from ..options.aws_credentials_file import option as aws_credentials_file
 from ..options.federation_provider import option as federation_provider
+from ..options.gcloud_key_file import option as gcloud_key_file
 
 options_map = {
     'tenant': tenant,
@@ -43,7 +44,8 @@
     'passphrase': passphrase,
     'force_renew': force_renew,
     'aws_credentials_file': aws_credentials_file,
-    'federation_provider': federation_provider
+    'federation_provider': federation_provider,
+    'gcloud_key_file': gcloud_key_file
 }
 
 

src/pybritive/options/gcloud_key_file.py

@@ -0,0 +1,9 @@
+import click
+
+
+option = click.option(
+    '--gcloud-key-file',
+    default=None,
+    help='GCP Programmatic Only - When mode is `gcloudauth` specify a non-default location for storing the key file.',
+    show_default=True
+)

src/pybritive/options/mode.py

@@ -12,5 +12,7 @@
          'the cloud providers local credential file (AWS only). Value `env` can optionally include terminal specific '
          'options for setting environment variables '
          '(example: env-nix for Linux/Mac, env-wincmd for Windows Command Prompt, env-winps for Windows PowerShell).'
+         '`gcloudauth` will save the generated key file/credentials to the pybritive config directory  and generate a '
+         'gcloud auth command which can be directly evaluated.'
 )