diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-biglake-iceberg-catalogs-create.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-biglake-iceberg-catalogs-create.txt new file mode 100644 index 00000000000..d87c7039c5b --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-biglake-iceberg-catalogs-create.txt @@ -0,0 +1,166 @@ +NAME + gcloud biglake iceberg catalogs create - create a BigLake Iceberg REST + catalog + +SYNOPSIS + gcloud biglake iceberg catalogs create CATALOG --catalog-type=CATALOG_TYPE + [--credential-mode=CREDENTIAL_MODE; default="end-user"] + [--cross-cloud-cache=MODE] [--default-location=DEFAULT_LOCATION] + [--description=DESCRIPTION] [--primary-location=PRIMARY_LOCATION] + [--restricted-locations=[LOCATION,...]] + [--kms-key=KMS_KEY : --kms-keyring=KMS_KEYRING + --kms-location=KMS_LOCATION --kms-project=KMS_PROJECT] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + Create a BigLake Iceberg REST catalog. + +EXAMPLES + To add a catalog using a Cloud Storage bucket my-catalog-bucket, run: + + $ gcloud biglake iceberg catalogs create my-catalog-bucket \ + --catalog-type=gcs-bucket + + To create a catalog using a Cloud Storage bucket my-catalog-bucket with + vended credentials, run: + + $ gcloud biglake iceberg catalogs create my-catalog-bucket \ + --catalog-type=gcs-bucket --credential-mode=vended-credentials + + To create a catalog my-lakehouse-catalog with catalog type lakehouse, run: + + $ gcloud biglake iceberg catalogs create my-lakehouse-catalog \ + --catalog-type=lakehouse --default-location=gs://my-bucket + + To create a catalog my-lakehouse-catalog with cross-cloud cache enabled, + run: + + $ gcloud biglake iceberg catalogs create my-lakehouse-catalog \ + --catalog-type=lakehouse --default-location=gs://my-bucket \ + --cross-cloud-cache=enabled + + To create a catalog my-lakehouse-catalog with CMEK encryption, run: + + $ gcloud biglake iceberg catalogs create my-lakehouse-catalog \ + --catalog-type=lakehouse --default-location=gs://my-bucket \ + --kms-key=projects/my-project/locations/us-central1/keyRings/\ + my-ring/cryptoKeys/my-key + +POSITIONAL ARGUMENTS + Catalog resource - The Iceberg Catalog to create. This represents a Cloud + resource. (NOTE) Some attributes are not given arguments in this group but + can be set in other ways. + + To set the project attribute: + * provide the argument catalog on the command line with a fully + specified name; + * provide the argument --project on the command line; + * set the property core/project. + + This must be specified. + + CATALOG + ID of the catalog or fully qualified identifier for the catalog. + + To set the catalog attribute: + + provide the argument catalog on the command line. + +REQUIRED FLAGS + --catalog-type=CATALOG_TYPE + Catalog type to create the catalog with. CATALOG_TYPE must be one of: + + biglake + BigLake Iceberg catalog. Catalog type which allows namespaces and + tables within a catalog to be mapped to locations beyond the + catalog's designated default. Note: biglake and lakehouse catalog + types are the same. + gcs-bucket + A catalog backed by a Cloud Storage bucket. + lakehouse + BigLake Iceberg catalog. Catalog type which allows namespaces and + tables within a catalog to be mapped to locations beyond the + catalog's designated default. Note: biglake and lakehouse catalog + types are the same. + +OPTIONAL FLAGS + --credential-mode=CREDENTIAL_MODE; default="end-user" + Credential mode to create the catalog with. CREDENTIAL_MODE must be one + of: + + end-user + Use end user credentials to access the catalog. + vended-credentials + Use vended credentials to access the catalog. + + --cross-cloud-cache=MODE + Whether to enable caching of remote data on Google Cloud. This may + result in data being temporarily persisted on Google Cloud. MODE must + be one of: enabled, disabled. + + --default-location=DEFAULT_LOCATION + Can only be used with BigLake catalogs. The default storage location + for the catalog, e.g., gs://my-bucket/.... + + --description=DESCRIPTION + Description of the resource. + + --primary-location=PRIMARY_LOCATION + Primary location for mirroring the remote catalog metadata. It must be + a BigLake-supported location, and it should be proximate to the remote + catalog's location for better performance and lower cost. + + --restricted-locations=[LOCATION,...] + Additional Google Cloud Storage buckets and locations (e.g., + gs://my-other-bucket/...) that are permitted for use by resources + within a catalog. This field is currently only used for BigLake + catalogs.If restricted_locations is empty and unrestricted catalog + creation is enabled, all accessible locations are allowed. Otherwise, + only default_location and locations in this list are allowed. + + Key resource - The Cloud KMS (Key Management Service) cryptokey that will + be used to protect the catalog. The BigQuery encryption service account + (bq-@bigquery-encryption.iam.gserviceaccount.com) must + hold permission 'Cloud KMS CryptoKey Encrypter/Decrypter'. The arguments + in this group can be used to specify the attributes of this resource. + + --kms-key=KMS_KEY + ID of the key or fully qualified identifier for the key. + + To set the kms-key attribute: + * provide the argument --kms-key on the command line. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --kms-keyring=KMS_KEYRING + The KMS keyring of the key. + + To set the kms-keyring attribute: + * provide the argument --kms-key on the command line with a fully + specified name; + * provide the argument --kms-keyring on the command line. + + --kms-location=KMS_LOCATION + The Google Cloud location for the key. + + To set the kms-location attribute: + * provide the argument --kms-key on the command line with a fully + specified name; + * provide the argument --kms-location on the command line. + + --kms-project=KMS_PROJECT + The Google Cloud project for the key. + + To set the kms-project attribute: + * provide the argument --kms-key on the command line with a fully + specified name; + * provide the argument --kms-project on the command line; + * set the property core/project. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-container-ai-profiles-list.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-container-ai-profiles-list.txt new file mode 100644 index 00000000000..d3a74b0521a --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-container-ai-profiles-list.txt @@ -0,0 +1,145 @@ +NAME + gcloud container ai profiles list - list compatible accelerator profiles + +SYNOPSIS + gcloud container ai profiles list [--format=FORMAT] [--model=MODEL] + [--model-server=MODEL_SERVER] + [--model-server-version=MODEL_SERVER_VERSION] + [--pricing-model=PRICING_MODEL] [--serving-stack=SERVING_STACK] + [--serving-stack-version=SERVING_STACK_VERSION] + [--target-cost-per-million-input-tokens=TARGET_COST_PER_MILLION_INPUT_TOKENS] + [--target-cost-per-million-output-tokens=TARGET_COST_PER_MILLION_OUTPUT_TOKENS] + [--target-input-length=TARGET_INPUT_LENGTH] + [--target-itl-milliseconds=TARGET_ITL_MILLISECONDS] + [--target-ntpot-milliseconds=TARGET_NTPOT_MILLISECONDS] + [--target-output-length=TARGET_OUTPUT_LENGTH] + [--target-ttft-milliseconds=TARGET_TTFT_MILLISECONDS] + [--use-case=USE_CASE] [--filter=EXPRESSION] [--limit=LIMIT] + [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + This command lists all supported accelerators with their performance + details. By default, the supported accelerators are displayed in a table + format with select information for each accelerator. To see all details, + use --format=yaml or --format=csvprofile. + + To get supported model, model servers, and model server versions, run + gcloud container ai profiles models list, gcloud container ai profiles + model-servers list, and gcloud container ai profiles model-server-versions + list. + +FLAGS + --format=FORMAT + The output format. Default is profile, which displays the profile + information in a table format, including cost conversions. csvprofile + displays the profile information in a CSV format.Options include + csvprofile, profile, and yaml. + + --model=MODEL + The model. + + --model-server=MODEL_SERVER + The model server. + + --model-server-version=MODEL_SERVER_VERSION + The model server version. If omitted, the most recently benchmarked + version is used. Other options include the model server version of a + profile, or 'all' to return all versions. + + --pricing-model=PRICING_MODEL + The pricing model to use to calculate token cost. Currently, this + supports on-demand, spot, 3-years-cud, 1-year-cud + + --serving-stack=SERVING_STACK + The serving stack to filter profiles by. If not provided, profiles for + all serving stacks that support the given model and model server will + be returned. + + --serving-stack-version=SERVING_STACK_VERSION + The serving stack version. If omitted, the most recently benchmarked + version is used. Other options include the serving stack version of a + profile, or 'all' to return all versions. + + --target-cost-per-million-input-tokens=TARGET_COST_PER_MILLION_INPUT_TOKENS + The target cost per million input tokens to filter profiles by, unit is + 1 USD up to 5 decimal places. + + --target-cost-per-million-output-tokens=TARGET_COST_PER_MILLION_OUTPUT_TOKENS + The target cost per million output tokens to filter profiles by, unit + is 1 USD up to 5 decimal places. + + --target-input-length=TARGET_INPUT_LENGTH + If specified, results will only show profiles that have an input length + within 20% of the specified one. Only works alongside output length. + + --target-itl-milliseconds=TARGET_ITL_MILLISECONDS + If specified, results will only show profiles with instance types that + can meet the latency target and will show their throughput performances + at the target inter-token latency (ITL). + + --target-ntpot-milliseconds=TARGET_NTPOT_MILLISECONDS + The target normalized time per output token (NTPOT) in milliseconds. + NTPOT is measured as the request_latency / output_tokens. If this field + is set, the command will only return accelerators that can meet the + target ntpot milliseconds and display their throughput performance at + the target latency. Otherwise, the command will return all accelerators + and display their highest throughput performance. + + --target-output-length=TARGET_OUTPUT_LENGTH + If specified, results will only show profiles that have an output + length within 20% of the specified one. Only works alongside input + length. + + --target-ttft-milliseconds=TARGET_TTFT_MILLISECONDS + The target time to first token (TTFT) in milliseconds. TTFT is measured + as the request_latency / output_tokens. If this field is set, the + command will only return profiles that can meet the target ttft + milliseconds and display their throughput performance at the target + latency. Otherwise, the command will return all profiles and display + their highest throughput performance. + + --use-case=USE_CASE + If specified, results will only show profiles that match the provided + use case. Options are: Advanced Customer Support, Code Completion, Text + Summarization, Chatbot (ShareGPT), Text Generation, Deep Research + +LIST COMMAND FLAGS + --filter=EXPRESSION + Apply a Boolean filter EXPRESSION to each resource item to be listed. + If the expression evaluates True, then that item is listed. For more + details and examples of filter expressions, run $ gcloud topic filters. + This flag interacts with other flags that are applied in this order: + --flatten, --sort-by, --filter, --limit. + + --limit=LIMIT + Maximum number of resources to list. The default is unlimited. This + flag interacts with other flags that are applied in this order: + --flatten, --sort-by, --filter, --limit. + + --page-size=PAGE_SIZE + Some services group resource list output into pages. This flag + specifies the maximum number of resources per page. The default is + determined by the service if it supports paging, otherwise it is + unlimited (no paging). Paging may be applied before or after --filter + and --limit depending on the service. + + --sort-by=[FIELD,...] + Comma-separated list of resource field key names to sort by. The + default order is ascending. Prefix a field with ``~'' for descending + order on that field. This flag interacts with other flags that are + applied in this order: --flatten, --sort-by, --filter, --limit. + + --uri + Print a list of resource URIs instead of the default output, and change + the command output to a list of URIs. If this flag is used with + --format, the formatting is applied on this URI list. To display URIs + alongside other keys instead, use the uri() transform. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-container-aws-clusters-create.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-container-aws-clusters-create.txt new file mode 100644 index 00000000000..407e3f9340e --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-container-aws-clusters-create.txt @@ -0,0 +1,263 @@ +NAME + gcloud container aws clusters create - create an Anthos cluster on AWS + +SYNOPSIS + gcloud container aws clusters create (CLUSTER : --location=LOCATION) + --aws-region=AWS_REGION --cluster-version=CLUSTER_VERSION + --config-encryption-kms-key-arn=CONFIG_ENCRYPTION_KMS_KEY_ARN + --database-encryption-kms-key-arn=DATABASE_ENCRYPTION_KMS_KEY_ARN + --fleet-project=FLEET_PROJECT + --iam-instance-profile=IAM_INSTANCE_PROFILE + --pod-address-cidr-blocks=POD_ADDRESS_CIDR_BLOCKS --role-arn=ROLE_ARN + --service-address-cidr-blocks=SERVICE_ADDRESS_CIDR_BLOCKS + --subnet-ids=[SUBNET_ID,...] --vpc-id=VPC_ID + [--admin-groups=[GROUP,...]] [--admin-users=USER,[USER,...]] + [--annotations=ANNOTATION,[ANNOTATION,...]] [--async] + [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE] + [--description=DESCRIPTION] [--disable-per-node-pool-sg-rules] + [--enable-managed-prometheus] [--instance-type=INSTANCE_TYPE] + [--logging=COMPONENT,[COMPONENT,...]] + [--main-volume-iops=MAIN_VOLUME_IOPS] + [--main-volume-kms-key-arn=MAIN_VOLUME_KMS_KEY_ARN] + [--main-volume-size=MAIN_VOLUME_SIZE] + [--main-volume-throughput=MAIN_VOLUME_THROUGHPUT] + [--main-volume-type=MAIN_VOLUME_TYPE] + [--role-session-name=ROLE_SESSION_NAME] + [--root-volume-iops=ROOT_VOLUME_IOPS] + [--root-volume-kms-key-arn=ROOT_VOLUME_KMS_KEY_ARN] + [--root-volume-size=ROOT_VOLUME_SIZE] + [--root-volume-throughput=ROOT_VOLUME_THROUGHPUT] + [--root-volume-type=ROOT_VOLUME_TYPE] + [--security-group-ids=[SECURITY_GROUP_ID,...]] + [--ssh-ec2-key-pair=SSH_EC2_KEY_PAIR] [--tags=TAG,[TAG,...]] + [--validate-only] + [--proxy-secret-arn=PROXY_SECRET_ARN + --proxy-secret-version-id=PROXY_SECRET_VERSION_ID] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + (DEPRECATED) Create an Anthos cluster on AWS. + + This command is deprecated. See + https://cloud.google.com/kubernetes-engine/multi-cloud/docs/aws/deprecations/deprecation-announcement + for more details. + +EXAMPLES + To create a cluster named my-cluster managed in location us-west1, run: + + $ gcloud container aws clusters create my-cluster \ + --location=us-west1 --aws-region=AWS_REGION \ + --cluster-version=CLUSTER_VERSION \ + --database-encryption-kms-key-arn=KMS_KEY_ARN \ + --iam-instance-profile=IAM_INSTANCE_PROFILE \ + --pod-address-cidr-blocks=POD_ADDRESS_CIDR_BLOCKS \ + --role-arn=ROLE_ARN \ + --service-address-cidr-blocks=SERVICE_ADDRESS_CIDR_BLOCKS \ + --subnet-ids=SUBNET_ID --vpc-id=VPC_ID + +POSITIONAL ARGUMENTS + Cluster resource - cluster to create. The arguments in this group can be + used to specify the attributes of this resource. (NOTE) Some attributes + are not given arguments in this group but can be set in other ways. + + To set the project attribute: + * provide the argument cluster on the command line with a fully + specified name; + * provide the argument --project on the command line; + * set the property core/project. + + This must be specified. + + CLUSTER + ID of the cluster or fully qualified identifier for the cluster. + + To set the cluster attribute: + + provide the argument cluster on the command line. + + This positional argument must be specified if any of the other + arguments in this group are specified. + + --location=LOCATION + Google Cloud location for the cluster. + + To set the location attribute: + + provide the argument cluster on the command line with a fully + specified name; + + provide the argument --location on the command line; + + set the property container_aws/location. + +REQUIRED FLAGS + --aws-region=AWS_REGION + AWS region to deploy the cluster. + + --cluster-version=CLUSTER_VERSION + Kubernetes version to use for the cluster. + + --config-encryption-kms-key-arn=CONFIG_ENCRYPTION_KMS_KEY_ARN + Amazon Resource Name (ARN) of the AWS KMS key to encrypt the user data. + + --database-encryption-kms-key-arn=DATABASE_ENCRYPTION_KMS_KEY_ARN + Amazon Resource Name (ARN) of the AWS KMS key to encrypt the cluster + secrets. + + --fleet-project=FLEET_PROJECT + ID or number of the Fleet host project where the cluster is registered. + + --iam-instance-profile=IAM_INSTANCE_PROFILE + Name or ARN of the IAM instance profile associated with the cluster. + + --pod-address-cidr-blocks=POD_ADDRESS_CIDR_BLOCKS + IP address range for the pods in this cluster in CIDR notation (e.g. + 10.0.0.0/8). + + --role-arn=ROLE_ARN + Amazon Resource Name (ARN) of the IAM role to assume when managing AWS + resources. + + --service-address-cidr-blocks=SERVICE_ADDRESS_CIDR_BLOCKS + IP address range for the services IPs in CIDR notation (e.g. + 10.0.0.0/8). + + --subnet-ids=[SUBNET_ID,...] + Subnet ID of an existing VNET to use for the cluster control plane. + + --vpc-id=VPC_ID + VPC associated with the cluster. + +OPTIONAL FLAGS + --admin-groups=[GROUP,...] + Groups of users that can perform operations as a cluster administrator. + + --admin-users=USER,[USER,...] + Users that can perform operations as a cluster administrator. If not + specified, the value of property core/account is used. + + --annotations=ANNOTATION,[ANNOTATION,...] + Annotations for the cluster. + + --async + Return immediately, without waiting for the operation in progress to + complete. + + --binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE + Set Binary Authorization evaluation mode for this cluster. + BINAUTHZ_EVALUATION_MODE must be one of: DISABLED, + PROJECT_SINGLETON_POLICY_ENFORCE. + + --description=DESCRIPTION + Description for the cluster. + + --disable-per-node-pool-sg-rules + Disable the default per node pool subnet security group rules on the + control plane security group. When disabled, at least one security + group that allows node pools to send traffic to the control plane on + ports TCP/443 and TCP/8132 must be provided. + + --enable-managed-prometheus + Enables managed collection for Managed Service for Prometheus in the + cluster. + + See + https://cloud.google.com/stackdriver/docs/managed-prometheus/setup-managed#enable-mgdcoll-gke + for more info. + + Managed Prometheus is enabled by default for cluster versions 1.27 or + greater, use --no-enable-managed-prometheus to disable. + + --instance-type=INSTANCE_TYPE + AWS EC2 instance type for the control plane's nodes. + + --logging=COMPONENT,[COMPONENT,...] + Set the components that have logging enabled. + + Examples: + + $ gcloud container aws clusters create --logging=SYSTEM + $ gcloud container aws clusters create --logging=SYSTEM,WORKLOAD + + COMPONENT must be one of: SYSTEM, WORKLOAD. + + --main-volume-iops=MAIN_VOLUME_IOPS + Number of I/O operations per second (IOPS) to provision for the main + volume. + + --main-volume-kms-key-arn=MAIN_VOLUME_KMS_KEY_ARN + Amazon Resource Name (ARN) of the AWS KMS key to encrypt the main + volume. + + --main-volume-size=MAIN_VOLUME_SIZE + Size of the main volume. The value must be a whole number followed by a + size unit of GB for gigabyte, or TB for terabyte. If no size unit is + specified, GB is assumed. + + --main-volume-throughput=MAIN_VOLUME_THROUGHPUT + Throughput to provision for the main volume, in MiB/s. Only valid if + the volume type is GP3. If volume type is GP3 and throughput is not + provided, it defaults to 125. + + --main-volume-type=MAIN_VOLUME_TYPE + Type of the main volume. MAIN_VOLUME_TYPE must be one of: gp2, gp3. + + --role-session-name=ROLE_SESSION_NAME + Identifier for the assumed role session. + + --root-volume-iops=ROOT_VOLUME_IOPS + Number of I/O operations per second (IOPS) to provision for the root + volume. + + --root-volume-kms-key-arn=ROOT_VOLUME_KMS_KEY_ARN + Amazon Resource Name (ARN) of the AWS KMS key to encrypt the root + volume. + + --root-volume-size=ROOT_VOLUME_SIZE + Size of the root volume. The value must be a whole number followed by a + size unit of GB for gigabyte, or TB for terabyte. If no size unit is + specified, GB is assumed. + + --root-volume-throughput=ROOT_VOLUME_THROUGHPUT + Throughput to provision for the root volume, in MiB/s. Only valid if + the volume type is GP3. If volume type is GP3 and throughput is not + provided, it defaults to 125. + + --root-volume-type=ROOT_VOLUME_TYPE + Type of the root volume. ROOT_VOLUME_TYPE must be one of: gp2, gp3. + + --security-group-ids=[SECURITY_GROUP_ID,...] + IDs of additional security groups to add to the control plane's nodes. + + --ssh-ec2-key-pair=SSH_EC2_KEY_PAIR + Name of the EC2 key pair authorized to login to the control plane's + nodes. + + --tags=TAG,[TAG,...] + Applies the given tags (comma separated) on the cluster. Example: + + $ gcloud container aws clusters create EXAMPLE_CLUSTER \ + --tags=tag1=one,tag2=two + + --validate-only + Validate the cluster to create, but don't actually perform it. + + Proxy config + + --proxy-secret-arn=PROXY_SECRET_ARN + ARN of the AWS Secrets Manager secret that contains a proxy + configuration. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --proxy-secret-version-id=PROXY_SECRET_VERSION_ID + Version ID string of the AWS Secrets Manager secret that contains a + proxy configuration. + + This flag argument must be specified if any of the other arguments in + this group are specified. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-functions-deploy.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-functions-deploy.txt new file mode 100644 index 00000000000..47a65cf1728 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-functions-deploy.txt @@ -0,0 +1,752 @@ +NAME + gcloud functions deploy - create or update a Google Cloud Function + +SYNOPSIS + gcloud functions deploy (NAME : --region=REGION) + [--[no-]allow-unauthenticated] [--concurrency=CONCURRENCY] + [--direct-vpc-egress=DIRECT_VPC_EGRESS] + [--docker-registry=DOCKER_REGISTRY] [--egress-settings=EGRESS_SETTINGS] + [--entry-point=ENTRY_POINT] [--gen2] [--ignore-file=IGNORE_FILE] + [--ingress-settings=INGRESS_SETTINGS] [--retry] + [--run-service-account=RUN_SERVICE_ACCOUNT] [--runtime=RUNTIME] + [--runtime-update-policy=RUNTIME_UPDATE_POLICY] + [--security-level=SECURITY_LEVEL; default="secure-always"] + [--serve-all-traffic-latest-revision] + [--service-account=SERVICE_ACCOUNT] [--source=SOURCE] + [--stage-bucket=STAGE_BUCKET] [--timeout=TIMEOUT] + [--trigger-location=TRIGGER_LOCATION] + [--trigger-service-account=TRIGGER_SERVICE_ACCOUNT] + [--update-labels=[KEY=VALUE,...]] + [--binary-authorization=BINARY_AUTHORIZATION + | --clear-binary-authorization] + [--build-env-vars-file=FILE_PATH | --clear-build-env-vars + | --set-build-env-vars=[KEY=VALUE,...] + | --remove-build-env-vars=[KEY,...] + --update-build-env-vars=[KEY=VALUE,...]] + [--build-service-account=BUILD_SERVICE_ACCOUNT + | --clear-build-service-account] + [--build-worker-pool=BUILD_WORKER_POOL | --clear-build-worker-pool] + [--clear-docker-repository | --docker-repository=DOCKER_REPOSITORY] + [--clear-env-vars | --env-vars-file=FILE_PATH + | --set-env-vars=[KEY=VALUE,...] + | --remove-env-vars=[KEY,...] --update-env-vars=[KEY=VALUE,...]] + [--clear-kms-key | --kms-key=KMS_KEY] + [--clear-labels | --remove-labels=[KEY,...]] + [--clear-max-instances | --max-instances=MAX_INSTANCES] + [--clear-min-instances | --min-instances=MIN_INSTANCES] + [--clear-network + | --network=NETWORK --subnet=SUBNET --clear-network-tags + | --network-tags=[TAGS,...]] + [--clear-secrets + | --set-secrets=[SECRET_ENV_VAR=SECRET_VALUE_REF, + /secret_path=SECRET_VALUE_REF, + /mount_path:/secret_file_path=SECRET_VALUE_REF,...] + | --remove-secrets=[SECRET_ENV_VAR, + /secret_path,/mount_path:/secret_file_path,...] + --update-secrets=[SECRET_ENV_VAR=SECRET_VALUE_REF, + /secret_path=SECRET_VALUE_REF, + /mount_path:/secret_file_path=SECRET_VALUE_REF,...]] + [--clear-vpc-connector | --vpc-connector=VPC_CONNECTOR] + [--memory=MEMORY : --cpu=CPU] + [--trigger-bucket=TRIGGER_BUCKET | --trigger-http + | --trigger-topic=TRIGGER_TOPIC + | --trigger-event=EVENT_TYPE --trigger-resource=RESOURCE + | --trigger-event-filters=[ATTRIBUTE=VALUE,...] + --trigger-event-filters-path-pattern=[ATTRIBUTE=PATH_PATTERN,...]] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + Create or update a Google Cloud Function. + +EXAMPLES + To deploy a function that is triggered by write events on the document + /messages/{pushId}, run: + + $ gcloud functions deploy my_function --runtime=python37 \ + --trigger-event=providers/cloud.firestore/eventTypes/\ + document.write \ + --trigger-resource=projects/project_id/databases/(default)/\ + documents/messages/{pushId} + + See https://cloud.google.com/functions/docs/calling for more details of + using other types of resource as triggers. + +POSITIONAL ARGUMENTS + Function resource - The Cloud Function name to deploy. The arguments in + this group can be used to specify the attributes of this resource. (NOTE) + Some attributes are not given arguments in this group but can be set in + other ways. + + To set the project attribute: + * provide the argument NAME on the command line with a fully specified + name; + * provide the argument --project on the command line; + * set the property core/project. + + This must be specified. + + NAME + ID of the function or fully qualified identifier for the function. + + To set the function attribute: + + provide the argument NAME on the command line. + + This positional argument must be specified if any of the other + arguments in this group are specified. + + --region=REGION + The Cloud region for the function. Overrides the default + functions/region property value for this command invocation. + + To set the region attribute: + + provide the argument NAME on the command line with a fully + specified name; + + provide the argument --region on the command line; + + set the property functions/region. + +FLAGS + --[no-]allow-unauthenticated + If set, makes this a public function. This will allow all callers, + without checking authentication. Use --allow-unauthenticated to enable + and --no-allow-unauthenticated to disable. + + --concurrency=CONCURRENCY + Set the maximum number of concurrent requests allowed per container + instance. Leave concurrency unspecified to receive the server default + value. + + --direct-vpc-egress=DIRECT_VPC_EGRESS + Specify which of the outbound traffic to send through Direct VPC + egress. Configuring Direct VPC network is required to use this flag. + DIRECT_VPC_EGRESS must be one of: private-ranges-only, all, + all-traffic. + + --docker-registry=DOCKER_REGISTRY + (DEPRECATED) Docker Registry to use for storing the function's Docker + images. The option artifact-registry is used by default. + + With the general transition from Container Registry to + Artifact Registry, the option to specify docker registry is deprecated. + All container image storage and management will automatically + transition to Artifact Registry. + For more information, see + https://cloud.google.com/artifact-registry/docs/transition/transition-from-gcr + + DOCKER_REGISTRY must be one of: artifact-registry, container-registry. + + --egress-settings=EGRESS_SETTINGS + Egress settings controls what traffic is diverted through the VPC + Access Connector resource. By default private-ranges-only will be used. + EGRESS_SETTINGS must be one of: private-ranges-only, all. + + --entry-point=ENTRY_POINT + Name of a Google Cloud Function (as defined in source code) that will + be executed. Defaults to the resource name suffix (ID of the function), + if not specified. + + --gen2 + If enabled, this command will use Cloud Functions (Second generation). + If disabled with --no-gen2, Cloud Functions (First generation) will be + used. If not specified, the value of this flag will be taken from the + functions/gen2 configuration property. If the functions/gen2 + configuration property is not set, defaults to looking up the given + function and using its generation. + + --ignore-file=IGNORE_FILE + Override the .gcloudignore file in the source directory and use the + specified file instead. By default, the source directory is your + current directory. Note that it could be changed by the --source flag, + in which case your .gcloudignore file will be searched in the + overridden directory. For example, --ignore-file=.mygcloudignore + combined with --source=./mydir would point to ./mydir/.mygcloudignore + + --ingress-settings=INGRESS_SETTINGS + Ingress settings controls what traffic can reach the function. By + default all will be used. INGRESS_SETTINGS must be one of: all, + internal-only, internal-and-gclb. + + --retry + If specified, then the function will be retried in case of a failure. + + --run-service-account=RUN_SERVICE_ACCOUNT + The email address of the IAM service account associated with the Cloud + Run service for the function. The service account represents the + identity of the running function, and determines what permissions the + function has. + + If not provided, the function will use the project's default service + account for Compute Engine. + + --runtime=RUNTIME + Runtime in which to run the function. + + Required when deploying a new function; optional when updating an + existing function. + + For a list of available runtimes, run gcloud functions runtimes list. + + --runtime-update-policy=RUNTIME_UPDATE_POLICY + Runtime update policy for the function being deployed. The option + automatic is used by default. RUNTIME_UPDATE_POLICY must be one of: + automatic, on-deploy. + + --security-level=SECURITY_LEVEL; default="secure-always" + Security level controls whether a function's URL supports HTTPS only or + both HTTP and HTTPS. By default, secure-always will be used, meaning + only HTTPS is supported. SECURITY_LEVEL must be one of: secure-always, + secure-optional. + + --serve-all-traffic-latest-revision + If specified, latest function revision will be served all traffic. + + --service-account=SERVICE_ACCOUNT + The email address of the IAM service account associated with the + function at runtime. The service account represents the identity of the + running function, and determines what permissions the function has. + + If not provided, the function will use the project's default service + account for Compute Engine. + + --source=SOURCE + Location of source code to deploy. + + Location of the source can be one of the following three options: + + * Source code in Google Cloud Storage (must be a .zip archive), + * Reference to source repository or, + * Local filesystem path (root directory of function source). + + Note that, depending on your runtime type, Cloud Functions will look + for files with specific names for deployable functions. For Node.js, + these filenames are index.js or function.js. For Python, this is + main.py. + + If you do not specify the --source flag: + + * The current directory will be used for new function deployments. + * If the function was previously deployed using a local filesystem + path, then the function's source code will be updated using the + current directory. + * If the function was previously deployed using a Google Cloud + Storage location or a source repository, then the function's source + code will not be updated. + + The value of the flag will be interpreted as a Cloud Storage location, + if it starts with gs://. + + The value will be interpreted as a reference to a source repository, if + it starts with https://. + + Otherwise, it will be interpreted as the local filesystem path. When + deploying source from the local filesystem, this command skips files + specified in the .gcloudignore file (see gcloud topic gcloudignore for + more information). If the .gcloudignore file doesn't exist, the command + will try to create it. + + The minimal source repository URL is: + https://source.developers.google.com/projects/${PROJECT}/repos/${REPO} + + By using the URL above, sources from the root directory of the + repository on the revision tagged master will be used. + + If you want to deploy from a revision different from master, append one + of the following three sources to the URL: + + * /revisions/${REVISION}, + * /moveable-aliases/${MOVEABLE_ALIAS}, + * /fixed-aliases/${FIXED_ALIAS}. + + If you'd like to deploy sources from a directory different from the + root, you must specify a revision, a moveable alias, or a fixed alias, + as above, and append /paths/${PATH_TO_SOURCES_DIRECTORY} to the URL. + + Overall, the URL should match the following regular expression: + + ^https://source\.developers\.google\.com/projects/ + (?[^/]+)/repos/(?[^/]+) + (((/revisions/(?[^/]+))|(/moveable-aliases/(?[^/]+))| + (/fixed-aliases/(?[^/]+)))(/paths/(?.*))?)?$ + + An example of a validly formatted source repository URL is: + + https://source.developers.google.com/projects/123456789/repos/testrepo/ + moveable-aliases/alternate-branch/paths/path-to=source + + --stage-bucket=STAGE_BUCKET + When deploying a function from a local directory, this flag's value is + the name of the Google Cloud Storage bucket in which source code will + be stored. Note that if you set the --stage-bucket flag when deploying + a function, you will need to specify --source or --stage-bucket in + subsequent deployments to update your source code. To use this flag + successfully, the account in use must have permissions to write to this + bucket. For help granting access, refer to this guide: + https://cloud.google.com/storage/docs/access-control/ + + --timeout=TIMEOUT + The function execution timeout, e.g. 30s for 30 seconds. Defaults to + original value for existing function or 60 seconds for new functions. + + For GCF 1st gen functions, cannot be more than 540s. + + For GCF 2nd gen functions, cannot be more than 3600s. + + See $ gcloud topic datetimes for information on duration formats. + + --trigger-location=TRIGGER_LOCATION + The location of the trigger, which must be a region or multi-region + where the relevant events originate. + + --trigger-service-account=TRIGGER_SERVICE_ACCOUNT + The email address of the IAM service account associated with the + Eventarc trigger for the function. This is used for authenticated + invocation. + + If not provided, the function will use the project's default service + account for Compute Engine. + + --update-labels=[KEY=VALUE,...] + List of label KEY=VALUE pairs to update. If a label exists, its value + is modified. Otherwise, a new label is created. + + Keys must start with a lowercase character and contain only hyphens + (-), underscores (_), lowercase characters, and numbers. Values must + contain only hyphens (-), underscores (_), lowercase characters, and + numbers. + + Label keys starting with deployment are reserved for use by deployment + tools and cannot be specified manually. + + At most one of these can be specified: + + --binary-authorization=BINARY_AUTHORIZATION + Name of the Binary Authorization policy that the function image + should be checked against when deploying to Cloud Run. + + Example: default + + The flag is only applicable to 2nd gen functions. + + --clear-binary-authorization + Clears the Binary Authorization policy field. + + At most one of these can be specified: + + --build-env-vars-file=FILE_PATH + Path to a local YAML file with definitions for all build environment + variables. All existing build environment variables will be removed + before the new build environment variables are added. + + --clear-build-env-vars + Remove all build environment variables. + + --set-build-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as build environment variables. All + existing build environment variables will be removed first. + + Or at least one of these can be specified: + + Only --update-build-env-vars and --remove-build-env-vars can be used + together. If both are specified, --remove-build-env-vars will be + applied first. + + --remove-build-env-vars=[KEY,...] + List of build environment variables to be removed. + + --update-build-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as build environment variables. + + At most one of these can be specified: + + --build-service-account=BUILD_SERVICE_ACCOUNT + IAM service account whose credentials will be used for the build + step. Must be of the format + projects/${PROJECT_ID}/serviceAccounts/${ACCOUNT_EMAIL_ADDRESS}. + + If not provided, the function will use the project's default service + account for Cloud Build. + + --clear-build-service-account + Clears the build service account field. + + At most one of these can be specified: + + --build-worker-pool=BUILD_WORKER_POOL + Name of the Cloud Build Custom Worker Pool that should be used to + build the function. The format of this field is + projects/${PROJECT}/locations/${LOCATION}/workerPools/${WORKERPOOL} + where ${PROJECT} is the project id and ${LOCATION} is the location + where the worker pool is defined and ${WORKERPOOL} is the short name + of the worker pool. + + --clear-build-worker-pool + Clears the Cloud Build Custom Worker Pool field. + + At most one of these can be specified: + + --clear-docker-repository + Clears the Docker repository configuration of the function. + + --docker-repository=DOCKER_REPOSITORY + Sets the Docker repository to be used for storing the Cloud + Function's Docker images while the function is being deployed. + DOCKER_REPOSITORY must be an Artifact Registry Docker repository + present in the same project and location as the Cloud Function. + + **Preview:** for 2nd gen functions, a Docker Artifact registry + repository in a different project and/or location may be used. + Additional requirements apply, see + https://cloud.google.com/functions/docs/building#image_registry + + The repository name should match one of these patterns: + + + projects/${PROJECT}/locations/${LOCATION}/repositories/${REPOSITORY}, + + {LOCATION}-docker.pkg.dev/{PROJECT}/{REPOSITORY}. + + where ${PROJECT} is the project, ${LOCATION} is the location of the + repository and ${REPOSITORY} is a valid repository ID. + + At most one of these can be specified: + + --clear-env-vars + Remove all environment variables. + + --env-vars-file=FILE_PATH + Path to a local YAML file with definitions for all environment + variables. All existing environment variables will be removed before + the new environment variables are added. + + --set-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as environment variables. All existing + environment variables will be removed first. + + Or at least one of these can be specified: + + Only --update-env-vars and --remove-env-vars can be used together. If + both are specified, --remove-env-vars will be applied first. + + --remove-env-vars=[KEY,...] + List of environment variables to be removed. + + --update-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as environment variables. + + At most one of these can be specified: + + --clear-kms-key + Clears the KMS crypto key used to encrypt the function. + + --kms-key=KMS_KEY + Sets the user managed KMS crypto key used to encrypt the Cloud + Function and its resources. + + The KMS crypto key name should match the pattern + projects/${PROJECT}/locations/${LOCATION}/keyRings/${KEYRING}/cryptoKeys/${CRYPTOKEY} + where ${PROJECT} is the project, ${LOCATION} is the location of the + key ring, and ${KEYRING} is the key ring that contains the + ${CRYPTOKEY} crypto key. + + If this flag is set, then a Docker repository created in Artifact + Registry must be specified using the --docker-repository flag and the + repository must be encrypted using the same KMS key. + + At most one of these can be specified: + + --clear-labels + Remove all labels. If --update-labels is also specified then + --clear-labels is applied first. + + For example, to remove all labels: + + $ gcloud functions deploy --clear-labels + + To remove all existing labels and create two new labels, foo and baz: + + $ gcloud functions deploy --clear-labels \ + --update-labels foo=bar,baz=qux + + --remove-labels=[KEY,...] + List of label keys to remove. If a label does not exist it is + silently ignored. If --update-labels is also specified then + --update-labels is applied first.Label keys starting with deployment + are reserved for use by deployment tools and cannot be specified + manually. + + At most one of these can be specified: + + --clear-max-instances + Clears the maximum instances setting for the function. + + If it's any 2nd gen function or a 1st gen HTTP function, this flag + sets maximum instances to 0, which means there is no limit to maximum + instances. If it's an event-driven 1st gen function, this flag sets + maximum instances to 3000, which is the default value for 1st gen + functions. + + --max-instances=MAX_INSTANCES + Sets the maximum number of instances for the function. A function + execution that would exceed max-instances times out. + + At most one of these can be specified: + + --clear-min-instances + Clears the minimum instances setting for the function. + + --min-instances=MIN_INSTANCES + Sets the minimum number of instances for the function. This is + helpful for reducing cold start times. Defaults to zero. + + At most one of these can be specified: + + --clear-network + Disconnect this Cloud Function from the Direct VPC network it is + connected to. + + Or at least one of these can be specified: + + Direct VPC egress setting flags group. + + --network=NETWORK + The VPC network that the Cloud Function will be able to send + traffic to. If --subnet is also specified, subnet must be a + subnetwork of the network specified by this --network flag. To + clear existing VPC network settings, use --clear-network. + + --subnet=SUBNET + The VPC subnetwork that the Cloud Function will get IPs from. The + subnetwork must be /26 or larger. If --network is also specified, + subnet must be a subnetwork of the network specified by the + --network flag. If --network is not specified, network will be + looked up from this subnetwork. To clear existing VPC network + settings, use --clear-network. + + At most one of these can be specified: + + --clear-network-tags + Clears all existing network tags from the Cloud Function. + + --network-tags=[TAGS,...] + Applies the given network tags (comma separated) to the Cloud + Function. To clear existing tags, use --clear-network-tags. + + At most one of these can be specified: + + --clear-secrets + Remove all secret environment variables and volumes. + + --set-secrets=[SECRET_ENV_VAR=SECRET_VALUE_REF,/secret_path=SECRET_VALUE_REF,/mount_path:/secret_file_path=SECRET_VALUE_REF,...] + List of secret environment variables and secret volumes to configure. + Existing secrets configuration will be overwritten. + + You can reference a secret value referred to as SECRET_VALUE_REF in + the help text in the following ways. + + + Use ${SECRET}:${VERSION} if you are referencing a secret in the + same project, where ${SECRET} is the name of the secret in secret + manager (not the full resource name) and ${VERSION} is the version + of the secret which is either a positive integer or the label + latest. For example, use SECRET_FOO:1 to reference version 1 of the + secret SECRET_FOO which exists in the same project as the function. + + + Use projects/${PROJECT}/secrets/${SECRET}/versions/${VERSION} or + projects/${PROJECT}/secrets/${SECRET}:${VERSION} to reference a + secret version using the full resource name, where ${PROJECT} is + either the project number (preferred) or the project ID of the + project which contains the secret, ${SECRET} is the name of the + secret in secret manager (not the full resource name) and + ${VERSION} is the version of the secret which is either a positive + integer or the label latest. For example, use + projects/1234567890/secrets/SECRET_FOO/versions/1 or + projects/project_id/secrets/SECRET_FOO/versions/1 to reference + version 1 of the secret SECRET_FOO that exists in the project + 1234567890 or project_id respectively. This format is useful when + the secret exists in a different project. + + To configure the secret as an environment variable, use + SECRET_ENV_VAR=SECRET_VALUE_REF. To use the value of the secret, read + the environment variable SECRET_ENV_VAR as you would normally do in + the function's programming language. + + We recommend using a numeric version for secret environment variables + as any updates to the secret value are not reflected until new clones + start. + + To mount the secret within a volume use /secret_path=SECRET_VALUE_REF + or /mount_path:/secret_file_path=SECRET_VALUE_REF. To use the value + of the secret, read the file at /secret_path as you would normally do + in the function's programming language. + + For example, /etc/secrets/secret_foo=SECRET_FOO:latest or + /etc/secrets:/secret_foo=SECRET_FOO:latest will make the value of the + latest version of the secret SECRET_FOO available in a file + secret_foo under the directory /etc/secrets. /etc/secrets will be + considered as the mount path and will not be available for any other + volume. + + We recommend referencing the latest version when using secret volumes + so that the secret's value changes are reflected immediately. + + Or at least one of these can be specified: + + Only --update-secrets and --remove-secrets can be used together. If + both are specified, then --remove-secrets will be applied first. + + --remove-secrets=[SECRET_ENV_VAR,/secret_path,/mount_path:/secret_file_path,...] + List of secret environment variable names and secret paths to + remove. + + Existing secrets configuration of secret environment variable names + and secret paths not specified in this list will be preserved. + + To remove a secret environment variable, use the name of the + environment variable SECRET_ENV_VAR. + + To remove a file within a secret volume or the volume itself, use + the secret path as the key (either /secret_path or + /mount_path:/secret_file_path). + + --update-secrets=[SECRET_ENV_VAR=SECRET_VALUE_REF,/secret_path=SECRET_VALUE_REF,/mount_path:/secret_file_path=SECRET_VALUE_REF,...] + List of secret environment variables and secret volumes to update. + Existing secrets configuration not specified in this list will be + preserved. + + At most one of these can be specified: + + --clear-vpc-connector + Clears the VPC connector field. + + Or at least one of these can be specified: + + Connector resource - The VPC Access connector that the function can + connect to. It can be either the fully-qualified URI, or the short + name of the VPC Access connector resource. If the short name is used, + the connector must belong to the same project. The format of this + field is either + projects/${PROJECT}/locations/${LOCATION}/connectors/${CONNECTOR} or + ${CONNECTOR}, where ${CONNECTOR} is the short name of the VPC Access + connector. This represents a Cloud resource. (NOTE) Some attributes + are not given arguments in this group but can be set in other ways. + + To set the project attribute: + - provide the argument --vpc-connector on the command line with a + fully specified name; + - provide the argument --project on the command line; + - set the property core/project. + + To set the region attribute: + - provide the argument --vpc-connector on the command line with a + fully specified name; + - provide the argument --region on the command line; + - set the property functions/region. + + --vpc-connector=VPC_CONNECTOR + ID of the connector or fully qualified identifier for the + connector. + + To set the connector attribute: + - provide the argument --vpc-connector on the command line. + + --memory=MEMORY + Limit on the amount of memory the function can use. + + Allowed values for v1 are: 128MB, 256MB, 512MB, 1024MB, 2048MB, 4096MB, + and 8192MB. + + Allowed values for GCF 2nd gen are in the format: with + allowed units of "k", "M", "G", "Ki", "Mi", "Gi". Ending 'b' or 'B' is + allowed, but both are interpreted as bytes as opposed to bits. + + Examples: 1000000K, 1000000Ki, 256Mb, 512M, 1024Mi, 2G, 4Gi. + + By default, a new function is limited to 256MB of memory. When + deploying an update to an existing function, the function keeps its old + memory limit unless you specify this flag. + + --cpu=CPU + The number of available CPUs to set. Only valid when --memory=MEMORY is + specified. + + Examples: .5, 2, 2.0, 2000m. + + By default, a new function's available CPUs is determined based on its + memory value. + + When deploying an update that includes memory changes to an existing + function, the function's available CPUs will be recalculated based on + the new memory unless this flag is specified. When deploying an update + that does not include memory changes to an existing function, the + function's "available CPUs" setting will keep its old value unless you + use this flag to change the setting. + + If you don't specify a trigger when deploying an update to an existing + function it will keep its current trigger. You must specify one of the + following when deploying a new function: + * --trigger-topic, + * --trigger-bucket, + * --trigger-http, + * --trigger-event AND --trigger-resource, + * --trigger-event-filters and optionally + --trigger-event-filters-path-pattern. + + At most one of these can be specified: + + --trigger-bucket=TRIGGER_BUCKET + Google Cloud Storage bucket name. Trigger the function when an object + is created or overwritten in the specified Cloud Storage bucket. + + --trigger-http + Function will be assigned an endpoint, which you can view by using + the describe command. Any HTTP request (of a supported type) to the + endpoint will trigger function execution. Supported HTTP request + types are: POST, PUT, GET, DELETE, and OPTIONS. + + --trigger-topic=TRIGGER_TOPIC + Name of Pub/Sub topic. Every message published in this topic will + trigger function execution with message contents passed as input + data. Note that this flag does not accept the format of + projects/PROJECT_ID/topics/TOPIC_ID. Use this flag to specify the + final element TOPIC_ID. The PROJECT_ID will be read from the active + configuration. + + Or at least one of these can be specified: + + --trigger-event=EVENT_TYPE + Specifies which action should trigger the function. For a list of + acceptable values, call gcloud functions event-types list. + + --trigger-resource=RESOURCE + Specifies which resource from --trigger-event is being observed. + E.g. if --trigger-event is + providers/cloud.storage/eventTypes/object.change, + --trigger-resource must be a bucket name. For a list of expected + resources, call gcloud functions event-types list. + + Or at least one of these can be specified: + + --trigger-event-filters=[ATTRIBUTE=VALUE,...] + The Eventarc matching criteria for the trigger. The criteria can be + specified either as a single comma-separated argument or as + multiple arguments. The filters must include the type attribute, as + well as any other attributes that are expected for the chosen type. + + --trigger-event-filters-path-pattern=[ATTRIBUTE=PATH_PATTERN,...] + The Eventarc matching criteria for the trigger in path pattern + format. The criteria can be specified as a single comma-separated + argument or as multiple arguments. + + The provided attribute/value pair will be used with the + match-path-pattern operator to configure the trigger, see + https://cloud.google.com/eventarc/docs/reference/rest/v1/projects.locations.triggers#eventfilter + and https://cloud.google.com/eventarc/docs/path-patterns for more + details about on how to construct path patterns. + + For example, to filter on events for Compute Engine VMs in a given + zone: + --trigger-event-filters-path-pattern=resourceName='/projects/*/zones/us-central1-a/instances/*' + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-iam-workforce-pools-create-cred-config.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-iam-workforce-pools-create-cred-config.txt new file mode 100644 index 00000000000..8a8dc6adbc9 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-iam-workforce-pools-create-cred-config.txt @@ -0,0 +1,147 @@ +NAME + gcloud iam workforce-pools create-cred-config - create a configuration file + for generated credentials + +SYNOPSIS + gcloud iam workforce-pools create-cred-config AUDIENCE + --output-file=OUTPUT_FILE + --workforce-pool-user-project=WORKFORCE_POOL_USER_PROJECT + (--credential-source-file=CREDENTIAL_SOURCE_FILE + | --credential-source-url=CREDENTIAL_SOURCE_URL + | --executable-command=EXECUTABLE_COMMAND) + [--credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME] + [--credential-source-headers=[key=value,...]] + [--credential-source-type=CREDENTIAL_SOURCE_TYPE] + [--subject-token-type=SUBJECT_TOKEN_TYPE] + [--executable-interactive-timeout-millis=EXECUTABLE_INTERACTIVE_TIMEOUT_MILLIS --executable-output-file=EXECUTABLE_OUTPUT_FILE --executable-timeout-millis=EXECUTABLE_TIMEOUT_MILLIS] + [--service-account=SERVICE_ACCOUNT + : --service-account-token-lifetime-seconds=SERVICE_ACCOUNT_TOKEN_LIFETIME_SECONDS] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + This command creates a configuration file to allow access to authenticated + Google Cloud actions from a variety of external user accounts. + +EXAMPLES + To create a file-sourced credential configuration by using the short-format + audience, run: + + $ gcloud iam workforce-pools create-cred-config \ + $WORKFORCE_POOL_ID/$PROVIDER_ID \ + --credential-source-file=$PATH_TO_OIDC_ID_TOKEN \ + --workforce-pool-user-project=$PROJECT_NUMBER \ + --output-file=credentials.json + + To create a file-sourced credential configuration by using the full + resource name audience, run: + + $ gcloud iam workforce-pools create-cred-config \ + locations/$REGION/workforcePools/$WORKFORCE_POOL_ID/providers/\ + $PROVIDER_ID --credential-source-file=$PATH_TO_OIDC_ID_TOKEN \ + --workforce-pool-user-project=$PROJECT_NUMBER \ + --output-file=credentials.json + + To create a URL-sourced credential configuration for your project, run: + + $ gcloud iam workforce-pools create-cred-config \ + $WORKFORCE_POOL_ID/$PROVIDER_ID \ + --credential-source-url=$URL_FOR_OIDC_TOKEN \ + --credential-source-headers=Key=Value \ + --workforce-pool-user-project=$PROJECT_NUMBER \ + --output-file=credentials.json + + To create an executable-source credential configuration for your project, + run the following command: + + $ gcloud iam workforce-pools create-cred-config \ + $WORKFORCE_POOL_ID/$PROVIDER_ID \ + --executable-command=$EXECUTABLE_COMMAND \ + --executable-timeout-millis=30000 \ + --executable-output-file=$CACHE_FILE \ + --workforce-pool-user-project=$PROJECT_NUMBER \ + --output-file=credentials.json + + To use the resulting file for any of these commands, set the + GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the + generated file. + +POSITIONAL ARGUMENTS + AUDIENCE + The workforce pool provider resource name in the format + "/" or + "locations//workforcePools//providers/". + +REQUIRED FLAGS + --output-file=OUTPUT_FILE + Location to store the generated credential configuration file. + + --workforce-pool-user-project=WORKFORCE_POOL_USER_PROJECT + The client project number used to identify the application (client + project) to the server when calling Google APIs. The user principal + must have serviceusage.services.use IAM permission to use the specified + project. + + Credential types. + + Exactly one of these must be specified: + + --credential-source-file=CREDENTIAL_SOURCE_FILE + The location of the file which stores the credential. + + --credential-source-url=CREDENTIAL_SOURCE_URL + The URL to obtain the credential from. + + --executable-command=EXECUTABLE_COMMAND + The full command to run to retrieve the credential. Must be an + absolute path for the program including arguments. + +OPTIONAL FLAGS + --credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME + Subject token field name (key) in a JSON credential source. + + --credential-source-headers=[key=value,...] + Headers to use when querying the credential-source-url. + + --credential-source-type=CREDENTIAL_SOURCE_TYPE + Format of the credential source (JSON or text). + + --subject-token-type=SUBJECT_TOKEN_TYPE + The type of token being used for authorization. This defaults to + urn:ietf:params:oauth:token-type:id_token. + + Arguments for an executable type credential source. + + --executable-interactive-timeout-millis=EXECUTABLE_INTERACTIVE_TIMEOUT_MILLIS + Timeout duration, in milliseconds, to wait for the executable to finish + when the command is running in interactive mode. + + --executable-output-file=EXECUTABLE_OUTPUT_FILE + Absolute path to the file storing the executable response. + + --executable-timeout-millis=EXECUTABLE_TIMEOUT_MILLIS + Timeout duration, in milliseconds, to wait for the executable to + finish. + + Service account impersonation options. + + --service-account=SERVICE_ACCOUNT + Email of the service account to impersonate. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --service-account-token-lifetime-seconds=SERVICE_ACCOUNT_TOKEN_LIFETIME_SECONDS + Lifetime duration of the service account access token in seconds. + Defaults to one hour if not specified. If a lifetime greater than one + hour is required, the service account must be added as an allowed value + in an Organization Policy that enforces the + constraints/iam.allowServiceAccountCredentialLifetimeExtension + constraint. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-iam-workload-identity-pools-create-cred-config.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-iam-workload-identity-pools-create-cred-config.txt new file mode 100644 index 00000000000..e670cd87c29 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-iam-workload-identity-pools-create-cred-config.txt @@ -0,0 +1,201 @@ +NAME + gcloud iam workload-identity-pools create-cred-config - create a + configuration file for generated credentials + +SYNOPSIS + gcloud iam workload-identity-pools create-cred-config AUDIENCE + --output-file=OUTPUT_FILE + (--aws | --azure | --credential-cert-path=CREDENTIAL_CERT_PATH + | --credential-source-file=CREDENTIAL_SOURCE_FILE + | --credential-source-url=CREDENTIAL_SOURCE_URL + | --executable-command=EXECUTABLE_COMMAND) [--app-id-uri=APP_ID_URI] + [--credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME] + [--credential-source-headers=[key=value,...]] + [--credential-source-type=CREDENTIAL_SOURCE_TYPE] [--enable-imdsv2] + [--sts-location=STS_LOCATION] [--subject-token-type=SUBJECT_TOKEN_TYPE] + [--credential-cert-private-key-path=CREDENTIAL_CERT_PRIVATE_KEY_PATH + : --credential-cert-configuration-output-file=CREDENTIAL_CERT_CONFIGURATION_OUTPUT_FILE --credential-cert-trust-chain-path=CREDENTIAL_CERT_TRUST_CHAIN_PATH] + [--executable-output-file=EXECUTABLE_OUTPUT_FILE + --executable-timeout-millis=EXECUTABLE_TIMEOUT_MILLIS] + [--service-account=SERVICE_ACCOUNT + : --service-account-token-lifetime-seconds=SERVICE_ACCOUNT_TOKEN_LIFETIME_SECONDS] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + This command creates a configuration file to allow access to authenticated + Google Cloud actions from a variety of external accounts. + +EXAMPLES + To create a file-sourced credential configuration for your project, run: + + $ gcloud iam workload-identity-pools create-cred-config \ + projects/$PROJECT_NUMBER/locations/$REGION/\ + workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \ + --service-account=$EMAIL \ + --credential-source-file=$PATH_TO_OIDC_ID_TOKEN \ + --output-file=credentials.json + + To create a URL-sourced credential configuration for your project, run: + + $ gcloud iam workload-identity-pools create-cred-config \ + projects/$PROJECT_NUMBER/locations/$REGION/\ + workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \ + --service-account=$EMAIL \ + --credential-source-url=$URL_FOR_OIDC_TOKEN \ + --credential-source-headers=Key=Value \ + --output-file=credentials.json + + To create an executable-source credential configuration for your project, + run the following command: + + $ gcloud iam workload-identity-pools create-cred-config \ + projects/$PROJECT_NUMBER/locations/$REGION/\ + workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \ + --executable-command=$EXECUTABLE_COMMAND \ + --executable-timeout-millis=30000 \ + --executable-output-file=$CACHE_FILE \ + --output-file=credentials.json + + To create an AWS-based credential configuration for your project, run: + + $ gcloud iam workload-identity-pools create-cred-config \ + projects/$PROJECT_NUMBER/locations/$REGION/\ + workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \ + --service-account=$EMAIL --aws --enable-imdsv2 \ + --output-file=credentials.json + + To create an Azure-based credential configuration for your project, run: + + $ gcloud iam workload-identity-pools create-cred-config \ + projects/$PROJECT_NUMBER/locations/$REGION/\ + workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \ + --service-account=$EMAIL --azure \ + --app-id-uri=$URI_FOR_AZURE_APP_ID \ + --output-file=credentials.json + + To create an X.509 certificate-based credential configuration for your + project, run: + + $ gcloud iam workload-identity-pools create-cred-config \ + projects/$PROJECT_NUMBER/locations/$REGION/\ + workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \ + --service-account=$EMAIL \ + --credential-cert-path=$PATH_TO_CERTIFICATE_FILE \ + --credential-cert-private-key-path=$PATH_TO_PRIVATE_KEY_FILE \ + --output-file=credentials.json + + To use the resulting file for any of these commands, set the + GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the + generated file + +POSITIONAL ARGUMENTS + AUDIENCE + The workload identity pool provider fully qualified identifier. + +REQUIRED FLAGS + --output-file=OUTPUT_FILE + Location to store the generated credential configuration file. + + Credential types. + + Exactly one of these must be specified: + + --aws + Use AWS. + + --azure + Use Azure. + + --credential-cert-path=CREDENTIAL_CERT_PATH + Path of the X.509 certificate file. + + --credential-source-file=CREDENTIAL_SOURCE_FILE + Location of the credential source file. + + --credential-source-url=CREDENTIAL_SOURCE_URL + URL to obtain the credential from. + + --executable-command=EXECUTABLE_COMMAND + The full command to run to retrieve the credential. Must be an + absolute path for the program including arguments. + +OPTIONAL FLAGS + --app-id-uri=APP_ID_URI + The custom Application ID URI for the Azure access token. + + --credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME + Subject token field name (key) in a JSON credential source. + + --credential-source-headers=[key=value,...] + Headers to use when querying the credential-source-url. + + --credential-source-type=CREDENTIAL_SOURCE_TYPE + Format of the credential source (JSON or text). + + --enable-imdsv2 + Adds the AWS IMDSv2 session token Url to the credential source to + enforce the AWS IMDSv2 flow. + + --sts-location=STS_LOCATION + The location to use for the Security Token Service token endpoint. For + example, specifying us-central1 will configure the client to use the + regional endpoint sts.us-central1.rep.googleapis.com. If not specified, + the global endpoint sts.googleapis.com is used. + + --subject-token-type=SUBJECT_TOKEN_TYPE + The type of token being used for authorization. This defaults to + urn:ietf:params:oauth:token-type:jwt. + + Arguments for an X.509 certificate type credential source. + + --credential-cert-private-key-path=CREDENTIAL_CERT_PRIVATE_KEY_PATH + Path of the X.509 private key file. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --credential-cert-configuration-output-file=CREDENTIAL_CERT_CONFIGURATION_OUTPUT_FILE + Path for the certificate configuration file. If specified, a + certificate configuration file will be created at the specified path. + If not specified, the certificate configuration will be created at the + default gcloud location. + + --credential-cert-trust-chain-path=CREDENTIAL_CERT_TRUST_CHAIN_PATH + Path for the trust chain file. A trust chain file is required if there + are intermediate certificates in the certificate chain in between the + root certificate stored in the workload identity pool provider trust + store. This trust chain file should be a list of PEM certificates, with + the leaf certificate at the top. + + Arguments for an executable type credential source. + + --executable-output-file=EXECUTABLE_OUTPUT_FILE + Absolute path to the file storing the executable response. + + --executable-timeout-millis=EXECUTABLE_TIMEOUT_MILLIS + Timeout duration, in milliseconds, to wait for the executable to + finish. + + Service account impersonation options. + + --service-account=SERVICE_ACCOUNT + Email of the service account to impersonate. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --service-account-token-lifetime-seconds=SERVICE_ACCOUNT_TOKEN_LIFETIME_SECONDS + Lifetime duration of the service account access token in seconds. + Defaults to one hour if not specified. If a lifetime greater than one + hour is required, the service account must be added as an allowed value + in an Organization Policy that enforces the + constraints/iam.allowServiceAccountCredentialLifetimeExtension + constraint. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-managed-kafka-connect-clusters-create.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-managed-kafka-connect-clusters-create.txt new file mode 100644 index 00000000000..44d3b6b5600 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-managed-kafka-connect-clusters-create.txt @@ -0,0 +1,147 @@ +NAME + gcloud managed-kafka connect-clusters create - create a Managed Service for + Apache Kafka connect cluster + +SYNOPSIS + gcloud managed-kafka connect-clusters create + (CONNECT_CLUSTER : --location=LOCATION) --cpu=CPU + --kafka-cluster=KAFKA_CLUSTER --memory=MEMORY + --primary-subnet=PRIMARY_SUBNET [--additional-subnet=ADDITIONAL_SUBNET] + [--async] [--dns-name=DNS_NAME] [--labels=[KEY=VALUE,...]] + [--secret=SECRET] + [--config-file=JSON|YAML|FILE | --configs=[KEY=VALUE,...]] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + Create a Managed Service for Apache Kafka connect cluster. + +EXAMPLES + To create a connector cluster, run the following: + + $ gcloud managed-kafka connect-clusters create myconnectorCluster \ + --location=us-central1 --cpu=3 --memory=3GiB \ + --primary-subnet=projects/PROJECT_ID/regions/us-central1/\ + subnetworks/default --kafka-cluster=my-kafka-cluster OR \ + --kafka-cluster=projects/PROJECT_ID/locations/us-central1/\ + clusters/my-kafka-cluster + +POSITIONAL ARGUMENTS + Connect cluster resource - Identifies the connect cluster that is created. + The arguments in this group can be used to specify the attributes of this + resource. (NOTE) Some attributes are not given arguments in this group but + can be set in other ways. + + To set the project attribute: + * provide the argument connect_cluster on the command line with a fully + specified name; + * provide the argument --project on the command line; + * set the property core/project. + + This must be specified. + + CONNECT_CLUSTER + ID of the connect_cluster or fully qualified identifier for the + connect_cluster. + + To set the connect_cluster attribute: + + provide the argument connect_cluster on the command line. + + This positional argument must be specified if any of the other + arguments in this group are specified. + + --location=LOCATION + ID of the location of the Managed Service for Apache Kafka resource. + See + https://cloud.google.com/managed-service-for-apache-kafka/docs/locations + for a list of supported locations. + + To set the location attribute: + + provide the argument connect_cluster on the command line with a + fully specified name; + + provide the argument --location on the command line. + +REQUIRED FLAGS + --cpu=CPU + The number of vCPUs to provision for the cluster. The minimum is 3. + + --kafka-cluster=KAFKA_CLUSTER + The resource path of the Kafka cluster to connect to, or the name of + the Kafka cluster to connect to if the cluster is in the same project + as the Connect cluster. + + --memory=MEMORY + The memory to provision for the cluster in bytes. The value must be + between 1 GiB and 8 GiB per vCPU. Ex. 1024Mi, 4Gi. + + --primary-subnet=PRIMARY_SUBNET + VPC subnet to make available to the Kafka Connect cluster. Structured + like: projects/{project}/regions/{region}/subnetworks/{subnet_id}. The + primary subnet is used to create a Private Service Connect (PSC) + interface for the Kafka Connect workers. It must be located in the same + region as the Connect cluster. + +OPTIONAL FLAGS + --additional-subnet=ADDITIONAL_SUBNET + (DEPRECATED) Additional subnet to make available to the Kafka Connect + cluster. Structured like: + projects/{project}/regions/{region}/subnetworks/{subnet_id}. + + The --additional-subnet flag is deprecated and will be removed in a + future version. Managed Kafka Connect clusters can now reach any + endpoint accessible from the primary subnet without the need to define + additional subnets. Please see + https://cloud.google.com/managed-service-for-apache-kafka/docs/connect-cluster/create-connect-cluster#worker-subnet + for more information. + + --async + Return immediately, without waiting for the operation in progress to + complete. + + --dns-name=DNS_NAME + DNS domain name from the subnet's network to be made visible to the + Connect Cluster. + + --labels=[KEY=VALUE,...] + List of label KEY=VALUE pairs to add. Keys must start with a lowercase + character and contain only hyphens (-), underscores (_), lowercase + characters, and numbers. Values must contain only hyphens (-), + underscores (_), lowercase characters, and numbers. + + --secret=SECRET + Secrets to load into workers. Exact SecretVersions from Secret Manager + must be provided -- aliases are not supported. Up to 32 secrets may be + loaded into one cluster. Format: + projects//secrets//versions/ + + At most one of these can be specified: + + --config-file=JSON|YAML|FILE + The path to the JSON or YAML file containing the configuration that + are overridden from the cluster or connector defaults. This also + supports inline JSON or YAML. Sets config_file value. + + Input Example: + + --config-file=string + + File Example: + + --config-file=path_to_file.(yaml|json) + + --configs=[KEY=VALUE,...] + Configuration for the connect cluster that are overridden from the + cluster defaults. The key of the map is a Kafka topic property name, + for example: cleanup.policy=compact,compression.type=producer. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. + +API REFERENCE + This command uses the managedkafka/v1 API. The full documentation for this + API can be found at: + https://cloud.google.com/managed-service-for-apache-kafka/docs diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-run-deploy.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-run-deploy.txt new file mode 100644 index 00000000000..e0effccfd49 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-run-deploy.txt @@ -0,0 +1,799 @@ +NAME + gcloud run deploy - create or update a Cloud Run service + +SYNOPSIS + gcloud run deploy [[SERVICE] --namespace=NAMESPACE] + [--[no-]allow-unauthenticated] [--async] [--breakglass=JUSTIFICATION] + [--clear-vpc-connector] [--concurrency=CONCURRENCY] + [--container=CONTAINER] [--[no-]cpu-boost] [--[no-]cpu-throttling] + [--[no-]default-url] [--[no-]deploy-health-check] + [--description=DESCRIPTION] + [--execution-environment=EXECUTION_ENVIRONMENT] [--gpu-type=GPU_TYPE] + [--[no-]gpu-zonal-redundancy] [--[no-]iap] + [--ingress=INGRESS; default="all"] [--[no-]invoker-iam-check] + [--max=MAX] [--max-instances=MAX_INSTANCES] [--min=MIN] + [--min-instances=MIN_INSTANCES] [--region=REGION] [--regions=REGIONS] + [--remove-containers=[CONTAINER,...]] + [--revision-suffix=REVISION_SUFFIX] [--scaling=SCALING] + [--service-account=SERVICE_ACCOUNT] [--[no-]session-affinity] + [--tag=TAG] [--timeout=TIMEOUT] [--no-traffic] + [--vpc-connector=VPC_CONNECTOR] [--vpc-egress=VPC_EGRESS] + [--add-cloudsql-instances=[CLOUDSQL-INSTANCES,...] + | --clear-cloudsql-instances + | --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...] + | --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]] + [--add-custom-audiences=[CUSTOM-AUDIENCES,...] + | --clear-custom-audiences + | --remove-custom-audiences=[CUSTOM-AUDIENCES,...] + | --set-custom-audiences=[CUSTOM-AUDIENCES,...]] + [--add-volume=[KEY=VALUE,...] + --clear-volumes --remove-volume=[VOLUME,...]] + [--add-volume-mount=[volume=NAME,mount-path=MOUNT_PATH,...] + --args=[ARG,...] --[no-]automatic-updates --clear-volume-mounts + --cpu=CPU --depends-on=[CONTAINER,...] --gpu=GPU + --liveness-probe=[KEY=VALUE,...] --memory=MEMORY --port=PORT + --readiness-probe=[KEY=VALUE,...] + --remove-volume-mount=[MOUNT_PATH,...] + --startup-probe=[KEY=VALUE,...] + --[no-]use-http2 --workdir=WORKDIR --base-image=BASE_IMAGE + | --clear-base-image --build-env-vars-file=FILE_PATH + | --clear-build-env-vars | --set-build-env-vars=[KEY=VALUE,...] + | --remove-build-env-vars=[KEY,...] + --update-build-env-vars=[KEY=VALUE,...] + --build-service-account=BUILD_SERVICE_ACCOUNT + | --clear-build-service-account --build-worker-pool=BUILD_WORKER_POOL + | --clear-build-worker-pool --clear-env-vars + | --env-vars-file=FILE_PATH | --set-env-vars=[KEY=VALUE,...] + | --remove-env-vars=[KEY,...] + --update-env-vars=[KEY=VALUE,...] --clear-secrets + | --set-secrets=[KEY=VALUE,...] | --remove-secrets=[KEY,...] + --update-secrets=[KEY=VALUE,...] --command=[COMMAND,...] + | --function=FUNCTION --image=IMAGE --source=SOURCE] + [--binary-authorization=POLICY | --clear-binary-authorization] + [--clear-encryption-key-shutdown-hours + | --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS] + [--clear-key | --key=KEY] + [--clear-labels | --remove-labels=[KEY,...] --labels=[KEY=VALUE,...] + | --update-labels=[KEY=VALUE,...]] + [--clear-network + | --network=NETWORK --subnet=SUBNET --clear-network-tags + | --network-tags=[TAG,...]] + [--clear-post-key-revocation-action-type + | --post-key-revocation-action-type=POST_KEY_REVOCATION_ACTION_TYPE] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + Creates or updates a Cloud Run service. + +EXAMPLES + To deploy a container to the service my-backend on Cloud Run: + + $ gcloud run deploy my-backend \ + --image=us-docker.pkg.dev/project/image + + You may also omit the service name. Then a prompt will be displayed with a + suggested default value: + + $ gcloud run deploy --image=us-docker.pkg.dev/project/image + + To deploy to Cloud Run on Kubernetes Engine, you need to specify a cluster: + + $ gcloud run deploy --image=us-docker.pkg.dev/project/image \ + --cluster=my-cluster + +POSITIONAL ARGUMENTS + Service resource - Service to deploy to. The arguments in this group can + be used to specify the attributes of this resource. + + [SERVICE] + ID of the service or fully qualified identifier for the service. + + To set the service attribute: + * provide the argument SERVICE on the command line; + * specify the service name from an interactive prompt. + + --namespace=NAMESPACE + Specific to Cloud Run for Anthos: Kubernetes namespace for the service. + + To set the namespace attribute: + * provide the argument SERVICE on the command line with a fully + specified name; + * specify the service name from an interactive prompt with a fully + specified name; + * provide the argument --namespace on the command line; + * set the property run/namespace; + * For Cloud Run on Kubernetes Engine, defaults to "default". + Otherwise, defaults to project ID.; + * provide the argument project on the command line; + * set the property core/project; + * specify the project ID from an interactive prompt. + +FLAGS + --[no-]allow-unauthenticated + Whether to enable allowing unauthenticated access to the service. This + may take a few moments to take effect. Use --allow-unauthenticated to + enable and --no-allow-unauthenticated to disable. + + --async + Return immediately, without waiting for the operation in progress to + complete. + + --breakglass=JUSTIFICATION + Justification to bypass Binary Authorization policy constraints and + allow the operation. See + https://cloud.google.com/binary-authorization/docs/using-breakglass for + more information. Next update or deploy command will automatically + clear existing breakglass justification. + + --clear-vpc-connector + Remove the VPC connector for this resource. + + --concurrency=CONCURRENCY + Set the maximum number of concurrent requests allowed per container + instance. Leave concurrency unspecified or provide the special value + 'default' to receive the server default value. + + --container=CONTAINER + Specifies a container by name. Flags following --container will apply + to the specified container. + + Flags that are not container-specific must be specified before + --container. + + --[no-]cpu-boost + Whether to allocate extra CPU to containers on startup to reduce the + perceived latency of a cold start request. Enabled by default when + unspecified on new services. Use --cpu-boost to enable and + --no-cpu-boost to disable. + + --[no-]cpu-throttling + Whether to throttle the CPU when the container is not actively serving + requests. Use --cpu-throttling to enable and --no-cpu-throttling to + disable. + + --[no-]default-url + Toggles the default url for a run service. This is enabled by default + if not specified. Use --default-url to enable and --no-default-url to + disable. + + --[no-]deploy-health-check + Schedules a single instance of the Revision and waits for it to pass + its startup probe for the deployment to succeed. If disabled, the + startup probe runs only when the revision is first started via + invocation or by setting min-instances. This check is enabled by + default when unspecified. Use --deploy-health-check to enable and + --no-deploy-health-check to disable. + + --description=DESCRIPTION + Provides an optional, human-readable description of the service. + + --execution-environment=EXECUTION_ENVIRONMENT + Selects the execution environment where the application will run. + EXECUTION_ENVIRONMENT must be one of: + + gen1 + Run the application in a first generation execution environment. + gen2 + Run the application in a second generation execution environment. + + --gpu-type=GPU_TYPE + The GPU type to use. + + --[no-]gpu-zonal-redundancy + Set GPU zonal redundancy. Use --gpu-zonal-redundancy to enable and + --no-gpu-zonal-redundancy to disable. + + --[no-]iap + Whether to enable IAP for the Service. Use --iap to enable and --no-iap + to disable. + + --ingress=INGRESS; default="all" + Set the ingress traffic sources allowed to call the service. For Cloud + Run the --[no-]allow-unauthenticated flag separately controls the + identities allowed to call the service. INGRESS must be one of: + + all + Inbound requests from all sources are allowed. + internal + For Cloud Run, only inbound requests from VPC networks in the same + project or VPC Service Controls perimeter, as well as Pub/Sub + subscriptions and Eventarc events in the same project or VPC + Service Controls perimeter are allowed. All other requests are + rejected. See https://cloud.google.com/run/docs/securing/ingress + for full details on the definition of internal traffic for Cloud + Run. + + internal-and-cloud-load-balancing + Only inbound requests from Google Cloud Load Balancing or a traffic + source allowed by the internal option are allowed. + + --[no-]invoker-iam-check + Optionally disable invoker IAM checks. More info at + https://cloud.google.com/run/docs/securing/managing-access#invoker_check. + Use --invoker-iam-check to enable and --no-invoker-iam-check to + disable. + + --max=MAX + The maximum number of container instances to run for this Service. This + instance limit will be divided among all Revisions receiving a + percentage of traffic and can be modified without deploying a new + Revision. + + --max-instances=MAX_INSTANCES + The maximum number of container instances for this Revision to run or + 'default' to remove. This setting is immutably set on each new Revision + and modifying its value will deploy another Revision. + + --min=MIN + The minimum number of container instances to run for this Service or + 'default' to remove. These instances will be divided among all + Revisions receiving a percentage of traffic and can be modified without + deploying a new Revision. + + --min-instances=MIN_INSTANCES + The minimum number of container instances to run for this Revision or + 'default' to remove. This setting is immutably set on each new Revision + and modifying its value will deploy a another Revision. Consider using + --min to set the minimum number of instances across all revisions of + the Service which may be modified dynamically. + + --region=REGION + Region in which the resource can be found. Alternatively, set the + property [run/region]. + + --regions=REGIONS + Comma-separated list of regions in which the multi-region Service can + be found. + + --remove-containers=[CONTAINER,...] + List of containers to remove. + + --revision-suffix=REVISION_SUFFIX + Specify the suffix of the revision name. Revision names always start + with the service name automatically. For example, specifying + [--revision-suffix=v1] for a service named 'helloworld', would lead to + a revision named 'helloworld-v1'. Set empty string to clear the suffix + and resume server-assigned naming. + + --scaling=SCALING + The scaling mode to use for this service. Flag value could be either + "auto" for automatic scaling, or a positive integer to configure manual + scaling with the given integer as a fixed instance count. + + --service-account=SERVICE_ACCOUNT + the email address of an IAM service account associated with the + revision of the service. The service account represents the identity of + the running revision, and determines what permissions the revision has. + + --[no-]session-affinity + Whether to enable session affinity for connections to the service. Use + --session-affinity to enable and --no-session-affinity to disable. + + --tag=TAG + Traffic tag to assign to the newly created revision. + + --timeout=TIMEOUT + Set the maximum request execution time (timeout). It is specified as a + duration; for example, "10m5s" is ten minutes, and five seconds. If you + don't specify a unit, seconds is assumed. For example, "10" is 10 + seconds. + + --no-traffic + True to avoid sending traffic to the revision being deployed. Setting + this flag assigns any traffic assigned to the LATEST revision to the + specific revision bound to LATEST before the deployment. The effect is + that the revision being deployed will not receive traffic. + + After a deployment with this flag the LATEST revision will not receive + traffic on future deployments. To restore sending traffic to the LATEST + revision by default, run the gcloud run services update-traffic command + with --to-latest. + + --vpc-connector=VPC_CONNECTOR + Set a VPC connector for this resource. + + --vpc-egress=VPC_EGRESS + Specify which of the outbound traffic to send through Direct VPC egress + or the VPC connector for this resource. This resource must have Direct + VPC egress enabled or a VPC connector to set this flag. VPC_EGRESS must + be one of: + + all + (DEPRECATED) Sends all outbound traffic through Direct VPC egress + or the VPC connector. Provides the same functionality as + 'all-traffic'. Prefer to use 'all-traffic' instead. + all-traffic + Sends all outbound traffic through Direct VPC egress or the VPC + connector. + private-ranges-only + Default option. Sends outbound traffic to private IP addresses (RFC + 1918 and Private Google Access IPs) through Direct VPC egress or + the VPC connector. + + Traffic to other Cloud Run services might require additional + configuration. See + https://cloud.google.com/run/docs/securing/private-networking#send_requests_to_other_services_and_services + for more information. + + These flags modify the Cloud SQL instances this Service connects to. You + can specify a name of a Cloud SQL instance if it's in the same project and + region as your Cloud Run service; otherwise specify + :: for the instance. + + At most one of these can be specified: + + --add-cloudsql-instances=[CLOUDSQL-INSTANCES,...] + Append the given values to the current Cloud SQL instances. + + --clear-cloudsql-instances + Empty the current Cloud SQL instances. + + --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...] + Remove the given values from the current Cloud SQL instances. + + --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...] + Completely replace the current Cloud SQL instances with the given + values. + + These flags modify the custom audiences that can be used in the audience + field of ID token for authenticated requests. + + At most one of these can be specified: + + --add-custom-audiences=[CUSTOM-AUDIENCES,...] + Append the given values to the current custom audiences. + + --clear-custom-audiences + Empty the current custom audiences. + + --remove-custom-audiences=[CUSTOM-AUDIENCES,...] + Remove the given values from the current custom audiences. + + --set-custom-audiences=[CUSTOM-AUDIENCES,...] + Completely replace the current custom audiences with the given + values. + + --add-volume=[KEY=VALUE,...] + Adds a volume to the Cloud Run resource. To add more than one volume, + specify this flag multiple times. Volumes must have a type key. Volumes + must have a name key if mount-path is not specified. A name key is + optional if mount-path is specified.Only certain values are supported + for type. Depending on the provided type, other keys will be required. + The following types are supported with the specified additional keys: + + cloud-storage: A volume representing a Cloud Storage bucket. This + volume type is mounted using Cloud Storage FUSE. See + https://cloud.google.com/storage/docs/gcs-fuse for the details and + limitations of this filesystem. Additional keys: + * bucket: (required) the name of the bucket to use as the source of + this volume + * readonly: (optional) A boolean. If true, this volume will be + read-only from all mounts. + * mount-options: (optional) A list of flags to pass to GCSFuse. Flags + should be specified without leading dashes and separated by + semicolons. + * mount-path: (optional) The path at which the volume should be + mounted. The mount-path parameter is only supported for single + container services which do not make use of the --container flag. For + multi-container services, specify the mount-path parameter under the + --add-volume-mount flag. + + in-memory: An ephemeral volume that stores data in the instance's + memory. With this type of volume, data is not shared between instances + and all data will be lost when the instance it is on is terminated. + Additional keys: + * mount-path: (optional) The path at which the volume should be + mounted. The mount-path parameter is only supported for single + container services which do not make use of the --container flag. For + multi-container services, specify the mount-path parameter under the + --add-volume-mount flag. + * size-limit: (optional) A quantity representing the maximum amount + of memory allocated to this volume, such as "512Mi" or "3G". Data + stored in an in-memory volume consumes the memory allocation of the + container that wrote the data. If size-limit is not specified, the + maximum size will be half the total memory limit of all containers. + + nfs: Represents a volume backed by an NFS server. Additional keys: + * location: (required) The location of the NFS Server, in the form + SERVER:/PATH + * mount-path: (optional) The path at which the volume should be + mounted. The mount-path parameter is only supported for single + container services which do not make use of the --container flag. For + multi-container services, specify the mount-path parameter under the + --add-volume-mount flag. + * readonly: (optional) A boolean. If true, this volume will be + read-only from all mounts. + + --clear-volumes + Remove all existing volumes from the Cloud Run resource, including + volumes mounted as secrets + + --remove-volume=[VOLUME,...] + Removes volumes from the Cloud Run resource. + + Container Flags + + The following flags apply to a single container. If the --container flag is + specified these flags may only be specified after a --container flag. + Otherwise they will apply to the primary ingress container. + + --add-volume-mount=[volume=NAME,mount-path=MOUNT_PATH,...] + Adds a mount to the current container. Must contain the keys + volume=NAME and mount-path=/PATH where NAME is the name of a volume on + this resource and PATH is the path within the container's filesystem to + mount this volume. + + --args=[ARG,...] + Comma-separated arguments passed to the command run by the container + image. If not specified and no '--command' is provided, the container + image's default Cmd is used. Otherwise, if not specified, no arguments + are passed. To reset this field to its default, pass an empty string. + + --[no-]automatic-updates + Indicates whether automatic base image updates should be enabled for an + image built from source. Use --automatic-updates to enable and + --no-automatic-updates to disable. + + --clear-volume-mounts + Remove all existing mounts from the current container. + + --cpu=CPU + Set a CPU limit in Kubernetes cpu units. + + Cloud Run supports values fractional values below 1, 1, 2, 4, and 8. + Some CPU values requires a minimum Memory --memory value. + + --depends-on=[CONTAINER,...] + List of container dependencies to add to the current container. + + --gpu=GPU + Cloud Run supports values 0 or 1. 1 gpu also requires a minimum 4 --cpu + value and a minimum 16Gi --memory value. + + --liveness-probe=[KEY=VALUE,...] + Comma separated settings for liveness probe in the form KEY=VALUE. Each + key stands for a field of the probe described in + https://cloud.google.com/run/docs/reference/rest/v1/Container#Probe. + Currently supported keys are: initialDelaySeconds, timeoutSeconds, + periodSeconds, failureThreshold, httpGet.port, httpGet.path, grpc.port, + grpc.service. + + For example, to set a probe with 10s timeout and HTTP probe requests + sent to 8080 port of the container: + + $ --liveness-probe=timeoutSeconds=10,httpGet.port=8080 + + To remove existing probe: + + $ --liveness-probe="" + + --memory=MEMORY + Set a memory limit. Ex: 1024Mi, 4Gi. + + --port=PORT + Container port to receive requests at. Also sets the $PORT environment + variable. Must be a number between 1 and 65535, inclusive. To unset + this field, pass the special value "default". If updating an existing + service with a TCP startup probe pointing to the previous container + port, this will also update the probe port. + + --readiness-probe=[KEY=VALUE,...] + Comma separated settings for readiness probe in the form KEY=VALUE. + Each key stands for a field of the probe described in + https://cloud.google.com/run/docs/reference/rest/v1/Container#Probe. + Currently supported keys are: timeoutSeconds, periodSeconds, + failureThreshold, successThreshold, httpGet.port, httpGet.path, + grpc.port, grpc.service. + + For example, to set a probe with 10s timeout and HTTP probe requests + sent to 8080 port of the container: + + $ --readiness-probe=timeoutSeconds=10,httpGet.port=8080 + + To remove existing probe: + + $ --readiness-probe="" + + --remove-volume-mount=[MOUNT_PATH,...] + Removes the volume mounted at the specified path from the current + container. + + --startup-probe=[KEY=VALUE,...] + Comma separated settings for startup probe in the form KEY=VALUE. Each + key stands for a field of the probe described in + https://cloud.google.com/run/docs/reference/rest/v1/Container#Probe. + Currently supported keys are: initialDelaySeconds, timeoutSeconds, + periodSeconds, failureThreshold, httpGet.port, httpGet.path, grpc.port, + grpc.service, tcpSocket.port. + + For example, to set a probe with 10s timeout and HTTP probe requests + sent to 8080 port of the container: + + $ --startup-probe=timeoutSeconds=10,httpGet.port=8080 + + To remove existing probe: + + $ --startup-probe="" + + --[no-]use-http2 + Whether to use HTTP/2 for connections to the service. Use --use-http2 + to enable and --no-use-http2 to disable. + + --workdir=WORKDIR + Working directory of the container process. If not specified, the + container image's default working directory is used. To reset this + field to its default, pass an empty string. + + At most one of these can be specified: + + --base-image=BASE_IMAGE + Specifies the base image to be used for automatic base image updates. + When deploying from source using the Google Cloud buildpacks, this + flag will also override the base image used for the application + image. See + https://cloud.google.com/run/docs/configuring/services/automatic-base-image-updates + for more details. + + --clear-base-image + Opts out of automatic base image updates. + + At most one of these can be specified: + + --build-env-vars-file=FILE_PATH + Path to a local YAML file with definitions for all build environment + variables. All existing build environment variables will be removed + before the new build environment variables are added. Example YAML + content: + + KEY_1: "value1" + KEY_2: "value 2" + + --clear-build-env-vars + Remove all build environment variables. + + --set-build-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as build environment variables. All + existing build environment variables will be removed first. + + Or at least one of these can be specified: + + Only --update-build-env-vars and --remove-build-env-vars can be used + together. If both are specified, --remove-build-env-vars will be + applied first. + + --remove-build-env-vars=[KEY,...] + List of build environment variables to be removed. + + --update-build-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as build environment variables. + + At most one of these can be specified: + + --build-service-account=BUILD_SERVICE_ACCOUNT + Specifies the service account to use to execute the build. Applies + only to source deploy builds using the Build API. + + --clear-build-service-account + Clears the Cloud Build service account field. + + At most one of these can be specified: + + --build-worker-pool=BUILD_WORKER_POOL + Name of the Cloud Build Custom Worker Pool that should be used to + build the function. The format of this field is + projects/${PROJECT}/locations/${LOCATION}/workerPools/${WORKERPOOL} + where ${PROJECT} is the project id and ${LOCATION} is the location + where the worker pool is defined and ${WORKERPOOL} is the short name + of the worker pool. + + --clear-build-worker-pool + Clears the Cloud Build Custom Worker Pool field. + + At most one of these can be specified: + + --clear-env-vars + Remove all environment variables. + + --env-vars-file=FILE_PATH + Path to a local YAML or ENV file with definitions for all environment + variables. All existing environment variables will be removed before + the new environment variables are added. Example YAML content: + + KEY_1: "value1" + KEY_2: "value 2" + + Example ENV content: + + KEY_1="value1" + KEY_2="value 2" + + --set-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as environment variables. All existing + environment variables will be removed first. + + Or at least one of these can be specified: + + Only --update-env-vars and --remove-env-vars can be used together. If + both are specified, --remove-env-vars will be applied first. + + --remove-env-vars=[KEY,...] + List of environment variables to be removed. + + --update-env-vars=[KEY=VALUE,...] + List of key-value pairs to set as environment variables. + + Specify secrets to mount or provide as environment variables. Keys + starting with a forward slash '/' are mount paths. All other keys + correspond to environment variables. Values should be in the form + SECRET_NAME:SECRET_VERSION. For example: + '--update-secrets=/secrets/api/key=mysecret:latest,ENV=othersecret:1' will + mount a volume at '/secrets/api' containing a file 'key' with the latest + version of secret 'mysecret'. An environment variable named ENV will also + be created whose value is version 1 of secret 'othersecret'. + + At most one of these can be specified: + + --clear-secrets + Remove all secrets. + + --set-secrets=[KEY=VALUE,...] + List of key-value pairs to set as secrets. All existing secrets will + be removed first. + + Or at least one of these can be specified: + + Only --update-secrets and --remove-secrets can be used together. If + both are specified, --remove-secrets will be applied first. + + --remove-secrets=[KEY,...] + List of secrets to be removed. + + --update-secrets=[KEY=VALUE,...] + List of key-value pairs to set as secrets. + + At most one of these can be specified: + + --command=[COMMAND,...] + Entrypoint for the container image. If not specified, the container + image's default Entrypoint is run. To reset this field to its + default, pass an empty string. + + --function=FUNCTION + Specifies that the deployed object is a function. If a value is + provided, that value is used as the entrypoint. + + --image=IMAGE + Name of the container image to deploy (e.g. + us-docker.pkg.dev/cloudrun/container/hello:latest). When used with + --source, the image must be the URI of an Artifact Registry Docker + repository in the Docker format + ($REGION-docker.pkg.dev/$PROJECT/$REPOSITORY") or + ($REGION-docker.pkg.dev/$PROJECT/$REPOSITORY/$IMAGE_NAME"). The image + name must be the same as the name of the service. + + --source=SOURCE + The location of the source to build. If a Dockerfile is present in the + source code directory, it will be built using that Dockerfile, + otherwise it will use Google Cloud buildpacks. See + https://cloud.google.com/run/docs/deploying-source-code for more + details. The location can be a directory on a local disk or a gzipped + archive file (.tar.gz) in Google Cloud Storage. If the source is a + local directory, this command skips the files specified in the + --ignore-file. If --ignore-file is not specified, use .gcloudignore + file. If a .gcloudignore file is absent and a .gitignore file is + present in the local source directory, gcloud will use a generated + Git-compatible .gcloudignore file that respects your .gitignored files. + The global .gitignore is not respected. For more information on + .gcloudignore, see gcloud topic gcloudignore. + + At most one of these can be specified: + + --binary-authorization=POLICY + Binary Authorization policy to check against. This must be set to + "default". + + --clear-binary-authorization + Remove any previously set Binary Authorization policy. + + At most one of these can be specified: + + --clear-encryption-key-shutdown-hours + Remove any previously set CMEK key shutdown hours setting. + + --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS + The number of hours to wait before an automatic shutdown server after + CMEK key revocation is detected. + + At most one of these can be specified: + + --clear-key + Remove any previously set CMEK key reference. + + --key=KEY + CMEK key reference to encrypt the container with. + + At most one of these can be specified: + + --clear-labels + Remove all labels. If --update-labels is also specified then + --clear-labels is applied first. + + For example, to remove all labels: + + $ gcloud run deploy --clear-labels + + To remove all existing labels and create two new labels, foo and baz: + + $ gcloud run deploy --clear-labels --update-labels foo=bar,baz=qux + + --remove-labels=[KEY,...] + List of label keys to remove. If a label does not exist it is + silently ignored. If --update-labels is also specified then + --update-labels is applied first. + + At most one of these can be specified: + + --labels=[KEY=VALUE,...] + List of label KEY=VALUE pairs to add. + + An alias to --update-labels. + + --update-labels=[KEY=VALUE,...] + List of label KEY=VALUE pairs to update. If a label exists, its value + is modified. Otherwise, a new label is created. + + At most one of these can be specified: + + --clear-network + Disconnect this Cloud Run service from the VPC network it is + connected to. + + Or at least one of these can be specified: + + Direct VPC egress setting flags group. + + --network=NETWORK + The VPC network that the Cloud Run service will be able to send + traffic to. If --subnet is also specified, subnet must be a + subnetwork of the network specified by this --network flag. To + clear existing VPC network settings, use --clear-network. + + --subnet=SUBNET + The VPC subnetwork that the Cloud Run service will get IPs from. + The subnetwork must be /26 or larger. If --network is also + specified, subnet must be a subnetwork of the network specified by + the --network flag. If --network is not specified, network will be + looked up from this subnetwork. To clear existing VPC network + settings, use --clear-network. + + At most one of these can be specified: + + --clear-network-tags + Clears all existing network tags from the Cloud Run service. + + --network-tags=[TAG,...] + Applies the given network tags (comma separated) to the Cloud Run + service. To clear existing tags, use --clear-network-tags. + + At most one of these can be specified: + + --clear-post-key-revocation-action-type + Remove any previously set post CMEK key revocation action type. + + --post-key-revocation-action-type=POST_KEY_REVOCATION_ACTION_TYPE + Action type after CMEK key revocation. + POST_KEY_REVOCATION_ACTION_TYPE must be one of: + + prevent-new + No new instances will be started after CMEK key revocation. + shut-down + No new instances will be started and the existing instances will + be shut down after CMEK key revocation. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-scheduler-jobs-create-http.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-scheduler-jobs-create-http.txt new file mode 100644 index 00000000000..075e2d92eb2 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-scheduler-jobs-create-http.txt @@ -0,0 +1,211 @@ +NAME + gcloud scheduler jobs create http - create a Cloud Scheduler job that + triggers an action via HTTP + +SYNOPSIS + gcloud scheduler jobs create http (JOB : --location=LOCATION) + --schedule=SCHEDULE --uri=URI [--attempt-deadline=ATTEMPT_DEADLINE] + [--description=DESCRIPTION] [--headers=[KEY=VALUE,...]] + [--http-method=HTTP_METHOD; default="post"] + [--max-backoff=MAX_BACKOFF; default="3600s"] + [--max-doublings=MAX_DOUBLINGS; default=5] + [--max-retry-attempts=MAX_RETRY_ATTEMPTS] + [--max-retry-duration=MAX_RETRY_DURATION] + [--min-backoff=MIN_BACKOFF; default="5s"] + [--time-zone=TIME_ZONE; default="Etc/UTC"] + [--message-body=MESSAGE_BODY | --message-body-from-file=PATH_TO_FILE] + [[--oauth-service-account-email=OAUTH_SERVICE_ACCOUNT_EMAIL + : --oauth-token-scope=OAUTH_TOKEN_SCOPE] + | [--oidc-service-account-email=OIDC_SERVICE_ACCOUNT_EMAIL + : --oidc-token-audience=OIDC_TOKEN_AUDIENCE]] [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + Create a Cloud Scheduler job that triggers an action via HTTP. + +EXAMPLES + The following command creates a job that sends a HTTP GET request to + 'http://example.com/path' every 3 hours: + + $ gcloud scheduler jobs create http my-job \ + --schedule="0 */3 * * *" --uri="http://example.com/path" \ + --http-method=GET + +POSITIONAL ARGUMENTS + Job resource - Job to create. The arguments in this group can be used to + specify the attributes of this resource. (NOTE) Some attributes are not + given arguments in this group but can be set in other ways. + + To set the project attribute: + * provide the argument job on the command line with a fully specified + name; + * provide the argument --project on the command line; + * set the property core/project. + + This must be specified. + + JOB + ID of the job or fully qualified identifier for the job. + + To set the job attribute: + + provide the argument job on the command line. + + This positional argument must be specified if any of the other + arguments in this group are specified. + + --location=LOCATION + The location of the job. By default, uses the location of the current + project's App Engine app if there is an associated app. + + To set the location attribute: + + provide the argument job on the command line with a fully + specified name; + + provide the argument --location on the command line; + + defaults to App Engine's app location if not provided & an app + exists. + +REQUIRED FLAGS + --schedule=SCHEDULE + Schedule on which the job will be executed. + + As a general rule, execution n + 1 of a job will not begin until + execution n has finished. Cloud Scheduler will never allow two + simultaneously outstanding executions. For example, this implies that + if the n+1 execution is scheduled to run at 16:00 but the n execution + takes until 16:15, the n+1 execution will not start until 16:15. A + scheduled start time will be delayed if the previous execution has not + ended when its scheduled time occurs. Learn more about the cron job + format + (https://cloud.google.com/scheduler/docs/configuring/cron-job-schedules). + + If --retry-count > 0 and a job attempt fails, the job will be tried a + total of --retry-count times, with exponential backoff, until the job + succeeds or the number of retries is exhausted. Note that the next + scheduled execution time might be skipped if the retries continue + through that time. For more information, see Retry jobs + (https://cloud.google.com/scheduler/docs/configuring/retry-jobs). + + --uri=URI + The full URI path that the request will be sent to. This string must + begin with either "http://" or "https://". For example, http://acme.com + or https://acme.com/sales:8080. Cloud Scheduler will encode some + characters for safety and compatibility. The maximum allowed URL length + is 2083 characters after encoding. + +OPTIONAL FLAGS + --attempt-deadline=ATTEMPT_DEADLINE + The deadline for job attempts. If the request handler doesn't respond + by this dealine, the request is cancelled and the attempt is marked as + failed. For example, 20s. + + --description=DESCRIPTION + Human-readable description of the job. + + --headers=[KEY=VALUE,...] + KEY=VALUE pairs of HTTP headers to include in the request. Cannot be + repeated. For example: --headers + Accept-Language=en-us,Accept=text/plain + + --http-method=HTTP_METHOD; default="post" + HTTP method to use for the request. HTTP_METHOD must be one of: delete, + get, head, post, put. + + --max-backoff=MAX_BACKOFF; default="3600s" + Maximum amount of time to wait before retrying a job after it fails. + For example, 60s. Default is 3600s (1 hour). + + --max-doublings=MAX_DOUBLINGS; default=5 + Maximum number of times that the interval between failed job retries + will be doubled before the increase becomes constant. + + --max-retry-attempts=MAX_RETRY_ATTEMPTS + Number of times to retry the request if it fails or times out. Must be + in range 0-5 inclusive. Default is 0. + + --max-retry-duration=MAX_RETRY_DURATION + Time limit for retrying a failed job, measured from when the job was + first run. If specified with --max-retry-attempts greater than 0, the + job will be retried until both limits are reached. Default is 0 seconds + (which means unlimited); however, if --max-retry-attempts is also 0, a + job attempt won't be retried if it fails. + + --min-backoff=MIN_BACKOFF; default="5s" + Minimum amount of time to wait before retrying a job after it fails. + For example, 10s. Default is 5s. + + --time-zone=TIME_ZONE; default="Etc/UTC" + Specifies the time zone to be used in interpreting --schedule. The + value of this field must be a time zone name from the tz database + (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). + + Note that some time zones include a provision for daylight savings + time. The rules for daylight saving time are determined by the chosen + time zone. + + For UTC use the string "utc". Default is "utc". + + At most one of these can be specified: + + --message-body=MESSAGE_BODY + Data payload to be included as the body of the HTTP request. May only + be given with compatible HTTP methods (PUT or POST). + + --message-body-from-file=PATH_TO_FILE + Path to file containing the data payload to be included as the body + of the HTTP request. May only be given with compatible HTTP methods + (PUT or POST). Use a full or relative path to a local file containing + the value of message_body. + + How the request sent to the target when executing the job should be + authenticated. + + At most one of these can be specified: + + OAuth2 + + --oauth-service-account-email=OAUTH_SERVICE_ACCOUNT_EMAIL + The service account email to be used for generating an OAuth2 access + token to be included in the request sent to the target when executing + the job. The service account must be within the same project as the + job. The caller must have iam.serviceAccounts.actAs permission for + the service account. The token must be OAuth if the target is a + Google APIs service with URL *.googleapis.com. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --oauth-token-scope=OAUTH_TOKEN_SCOPE + The scope to be used when generating an OAuth2 access token to be + included in the request sent to the target when executing the job. If + not specified, "https://www.googleapis.com/auth/cloud-platform" will + be used. + + OpenId Connect + + --oidc-service-account-email=OIDC_SERVICE_ACCOUNT_EMAIL + The service account email to be used for generating an OpenId Connect + token to be included in the request sent to the target when executing + the job. The service account must be within the same project as the + job. The caller must have iam.serviceAccounts.actAs permission for + the service account. The OIDC token is generally used except for + Google APIs hosted on *.googleapis.com: these APIs expect an OAuth + token. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --oidc-token-audience=OIDC_TOKEN_AUDIENCE + The audience to be used when generating an OpenId Connect token to be + included in the request sent to the target when executing the job. If + not specified, the URI specified in target will be used. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. + +API REFERENCE + This command uses the cloudscheduler/v1 API. The full documentation for + this API can be found at: https://cloud.google.com/scheduler/ diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-secrets-versions-access.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-secrets-versions-access.txt new file mode 100644 index 00000000000..4ff4376aea5 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-secrets-versions-access.txt @@ -0,0 +1,89 @@ +NAME + gcloud secrets versions access - access a secret version's data + +SYNOPSIS + gcloud secrets versions access (VERSION : --secret=SECRET) + [--location=LOCATION] [--out-file=OUT-FILE-PATH] [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + Access the data for the specified secret version. + +EXAMPLES + Access the data for version 123 of the secret 'my-secret': + + $ gcloud secrets versions access 123 --secret=my-secret + + Note: The output will be formatted as UTF-8 which can corrupt binary + secrets. + + To write raw bytes to a file use --out-file flag: + + $ gcloud secrets versions access 123 --secret=my-secret \ + --out-file=/tmp/secret + + To get the raw bytes, have Google Cloud CLI print the response as + base64-encoded and decode: + + $ gcloud secrets versions access 123 --secret=my-secret \ + --format='get(payload.data)' | tr '_-' '/+' | base64 -d + +POSITIONAL ARGUMENTS + Version resource - Numeric secret version to access or a configured alias + (including 'latest' to use the latest version). The arguments in this + group can be used to specify the attributes of this resource. (NOTE) Some + attributes are not given arguments in this group but can be set in other + ways. + + To set the project attribute: + * provide the argument VERSION on the command line with a fully + specified name; + * provide the argument --project on the command line; + * set the property core/project. + + This must be specified. + + VERSION + ID of the version or fully qualified identifier for the version. + + To set the version attribute: + + provide the argument VERSION on the command line. + + This positional argument must be specified if any of the other + arguments in this group are specified. + + --secret=SECRET + The secret of the version. + + To set the secret attribute: + + provide the argument VERSION on the command line with a fully + specified name; + + provide the argument --secret on the command line. + +FLAGS + Location resource - The location to access secret. This represents a Cloud + resource. (NOTE) Some attributes are not given arguments in this group but + can be set in other ways. + + To set the project attribute: + * provide the argument --location on the command line with a fully + specified name; + * provide the argument --project on the command line; + * set the property core/project. + + --location=LOCATION + ID of the location or fully qualified identifier for the location. + + To set the location attribute: + * provide the argument --location on the command line. + + --out-file=OUT-FILE-PATH + File path to which secret data is written. If this flag is not provided + secret data will be written to stdout in UTF-8 format. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-sql-backups-restore.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-sql-backups-restore.txt new file mode 100644 index 00000000000..b08cfd619cf --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-sql-backups-restore.txt @@ -0,0 +1,506 @@ +NAME + gcloud sql backups restore - restores a backup of a Cloud SQL instance + +SYNOPSIS + gcloud sql backups restore ID --restore-instance=RESTORE_INSTANCE + [--activation-policy=ACTIVATION_POLICY] + [--active-directory-dns-servers=[DNS_SERVER_IP_ADDRESS,...]] + [--active-directory-domain=ACTIVE_DIRECTORY_DOMAIN] + [--active-directory-mode=ACTIVE_DIRECTORY_MODE] + [--active-directory-organizational-unit=ACTIVE_DIRECTORY_ORGANIZATIONAL_UNIT] + [--active-directory-secret-manager-key=ACTIVE_DIRECTORY_SECRET_MANAGER_KEY] + [--[no-]assign-ip] [--async] [--audit-bucket-path=AUDIT_BUCKET_PATH] + [--audit-retention-interval=AUDIT_RETENTION_INTERVAL] + [--audit-upload-interval=AUDIT_UPLOAD_INTERVAL] + [--authorized-networks=NETWORK,[NETWORK,...]] + [--availability-type=AVAILABILITY_TYPE] [--no-backup] + [--backup-instance=BACKUP_INSTANCE] [--backup-location=BACKUP_LOCATION] + [--backup-project=BACKUP_PROJECT] + [--backup-start-time=BACKUP_START_TIME] [--clear-active-directory] + [--clear-active-directory-dns-servers] + [--clear-disk-encryption=CLEAR_DISK_ENCRYPTION] [--clear-network] + [--collation=COLLATION] [--connector-enforcement=CONNECTOR_ENFORCEMENT] + [--cpu=CPU] [--database-version=DATABASE_VERSION] + [--[no-]deletion-protection] + [--deny-maintenance-period-end-date=DENY_MAINTENANCE_PERIOD_END_DATE] + [--deny-maintenance-period-start-date=DENY_MAINTENANCE_PERIOD_START_DATE] + [--deny-maintenance-period-time=DENY_MAINTENANCE_PERIOD_TIME] + [--edition=EDITION] [--enable-bin-log] [--enable-google-private-path] + [--enable-point-in-time-recovery] [--[no-]final-backup] + [--final-backup-retention-days=FINAL_BACKUP_RETENTION_DAYS] + [--insights-config-enhanced-query-insights-enabled] + [--insights-config-query-insights-enabled] + [--insights-config-query-plans-per-minute=INSIGHTS_CONFIG_QUERY_PLANS_PER_MINUTE] + [--insights-config-query-string-length=INSIGHTS_CONFIG_QUERY_STRING_LENGTH] + [--insights-config-record-application-tags] + [--insights-config-record-client-address] + [--maintenance-release-channel=MAINTENANCE_RELEASE_CHANNEL] + [--maintenance-window-day=MAINTENANCE_WINDOW_DAY] + [--maintenance-window-hour=MAINTENANCE_WINDOW_HOUR] [--memory=MEMORY] + [--network=NETWORK] [--require-ssl] + [--retained-backups-count=RETAINED_BACKUPS_COUNT] + [--retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS] + [--ssl-mode=SSL_MODE] [--[no-]storage-auto-increase] + [--storage-provisioned-iops=STORAGE_PROVISIONED_IOPS] + [--storage-provisioned-throughput=STORAGE_PROVISIONED_THROUGHPUT] + [--storage-size=STORAGE_SIZE] [--storage-type=STORAGE_TYPE] + [--tier=TIER, -t TIER] [--time-zone=TIME_ZONE] + [--timeout=TIMEOUT; default=3600] + [--allowed-psc-projects=PROJECT,[PROJECT,...] + --enable-private-service-connect] + [--disk-encryption-key=DISK_ENCRYPTION_KEY + : --disk-encryption-key-keyring=DISK_ENCRYPTION_KEY_KEYRING + --disk-encryption-key-location=DISK_ENCRYPTION_KEY_LOCATION + --disk-encryption-key-project=DISK_ENCRYPTION_KEY_PROJECT] + [--region=REGION | --gce-zone=GCE_ZONE + | --secondary-zone=SECONDARY_ZONE --zone=ZONE] [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + The command lets you restore to an existing instance using ID. To restore + using a backupDR backup, use the backupDR ID. When backup Name is used to + restore it lets you restore to an existing instance or a new instance. When + restoring to new instance, optional flags can be used to customize the new + instance. + +POSITIONAL ARGUMENTS + ID + The ID of the backup run to restore from or the backup NAME for restore + to existing/new instance. To find the NAME, run the following command: + $ gcloud sql backups list --filter=instance:{instance} + +REQUIRED FLAGS + --restore-instance=RESTORE_INSTANCE + The ID of the target Cloud SQL instance that the backup is restored to. + +OPTIONAL FLAGS + --activation-policy=ACTIVATION_POLICY + Activation policy for this instance. This specifies when the instance + should be activated and is applicable only when the instance state is + RUNNABLE. The default is always. More information on activation + policies can be found here: + https://cloud.google.com/sql/docs/mysql/start-stop-restart-instance#activation_policy. + ACTIVATION_POLICY must be one of: always, never. + + --active-directory-dns-servers=[DNS_SERVER_IP_ADDRESS,...] + A comma-separated list of the DNS servers to be used for Active + Directory. Only available for SQL Server instances. E.g: + 10.0.0.1,10.0.0.2 + + --active-directory-domain=ACTIVE_DIRECTORY_DOMAIN + Managed Service for Microsoft Active Directory domain this instance is + joined to. Only available for SQL Server instances. + + --active-directory-mode=ACTIVE_DIRECTORY_MODE + Defines the Active Directory mode. Only available for SQL Server + instances. ACTIVE_DIRECTORY_MODE must be one of: + MANAGED_ACTIVE_DIRECTORY, CUSTOMER_MANAGED_ACTIVE_DIRECTORY. + + --active-directory-organizational-unit=ACTIVE_DIRECTORY_ORGANIZATIONAL_UNIT + Defines the organizational unit to be used for Active Directory. Only + available for SQL Server instances. E.g: + OU=Cloud,DC=ad,DC=example,DC=com + + --active-directory-secret-manager-key=ACTIVE_DIRECTORY_SECRET_MANAGER_KEY + The secret manager key storing administrator credentials. Only + available for SQL Server instances. + + --[no-]assign-ip + Assign a public IP address to the instance. This is a public, + externally available IPv4 address that you can use to connect to your + instance when properly authorized. Use --assign-ip to enable and + --no-assign-ip to disable. + + --async + Return immediately, without waiting for the operation in progress to + complete. + + --audit-bucket-path=AUDIT_BUCKET_PATH + The location, as a Cloud Storage bucket, to which audit files are + uploaded. The URI is in the form gs://bucketName/folderName. Only + available for SQL Server instances. + + --audit-retention-interval=AUDIT_RETENTION_INTERVAL + The number of days for audit log retention on disk, for example, 3dfor + 3 days. Only available for SQL Server instances. + + --audit-upload-interval=AUDIT_UPLOAD_INTERVAL + How often to upload audit logs (audit files), for example, 30mfor 30 + minutes. Only available for SQL Server instances. + + --authorized-networks=NETWORK,[NETWORK,...] + The list of external networks that are allowed to connect to the + instance. Specified in CIDR notation, also known as 'slash' notation + (e.g. 192.168.100.0/24). + + --availability-type=AVAILABILITY_TYPE + Specifies level of availability. AVAILABILITY_TYPE must be one of: + + regional + Provides high availability and is recommended for production + instances; instance automatically fails over to another zone within + your selected region. + zonal + Provides no failover capability. This is the default. + + --backup + Enables daily backup. Enabled by default, use --no-backup to disable. + + --backup-instance=BACKUP_INSTANCE + The ID of the instance that the backup was taken from. This argument + must be specified when the backup instance is different from the + restore instance. If it is not specified, the backup instance is + considered the same as the restore instance. This flag is not supported + when restore happens from backup name, only supported when restore + happens from backup ID in timestamp format. + + --backup-location=BACKUP_LOCATION + Choose where to store your backups. Backups are stored in the closest + multi-region location to you by default. Only customize if needed. + + --backup-project=BACKUP_PROJECT + The project of the instance to which the backup belongs. If it isn't + specified, backup and restore instances are in the same project. This + flag is not supported when restore happens from backup name, only + supported when restore happens from backup ID in timestamp format. + + --backup-start-time=BACKUP_START_TIME + Start time of daily backups, specified in the HH:MM format, in the UTC + timezone. + + --clear-active-directory + Clears the Active Directory configuration. + + --clear-active-directory-dns-servers + Removes the list of DNS Servers from the Active Directory Config. + + --clear-disk-encryption=CLEAR_DISK_ENCRYPTION + Disables CMEK in the restored instance. + + --clear-network + Clears the network setting. This is useful to restore a backup to a + different project or region where the original network configuration + isn't available. + + --collation=COLLATION + Cloud SQL server-level collation setting, which specifies the set of + rules for comparing characters in a character set. + + --connector-enforcement=CONNECTOR_ENFORCEMENT + Cloud SQL Connector enforcement mode. It determines how Cloud SQL + Connectors are used in the connection. See the list of modes here + (https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances#connectorenforcement). + CONNECTOR_ENFORCEMENT must be one of: + + CONNECTOR_ENFORCEMENT_UNSPECIFIED + The requirement for Cloud SQL connectors is unknown. + NOT_REQUIRED + Does not require Cloud SQL connectors. + REQUIRED + Requires all connections to use Cloud SQL connectors, including the + Cloud SQL Auth Proxy and Cloud SQL Java, Python, and Go connectors. + Note: This disables all existing authorized networks. + + --cpu=CPU + Whole number value indicating how many cores are desired in the + machine. Both --cpu and --memory must be specified if a custom machine + type is desired, and the --tier flag must be omitted.--cpu and --memory + flags are not compatible with the Enterprise Plus edition. These flags + should not be used when creating an Enterprise Plus edition, as the + machine configuration is determined by the --tier flag instead. + + --database-version=DATABASE_VERSION + The database engine type and versions. If left unspecified, no changes + occur. See the list of database versions at + https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/SqlDatabaseVersion. + Note for restore to new instance major version upgrades are not + supported. Only minor version upgrades are allowed. + + --[no-]deletion-protection + Enable deletion protection on a Cloud SQL instance. Use + --deletion-protection to enable and --no-deletion-protection to + disable. + + --deny-maintenance-period-end-date=DENY_MAINTENANCE_PERIOD_END_DATE + Date when the deny maintenance period ends, that is 2021-01-10. + + --deny-maintenance-period-start-date=DENY_MAINTENANCE_PERIOD_START_DATE + Date when the deny maintenance period begins, that is 2020-11-01. + + --deny-maintenance-period-time=DENY_MAINTENANCE_PERIOD_TIME + Time when the deny maintenance period starts or ends, that is 05:00:00. + + --edition=EDITION + Specifies the edition of Cloud SQL instance. EDITION must be one of: + enterprise, enterprise-plus. + + --enable-bin-log + Allows for data recovery from a specific point in time, down to a + fraction of a second. Must have automatic backups enabled to use. Make + sure storage can support at least 7 days of logs. + + --enable-google-private-path + Enable a private path for Google Cloud services. This flag specifies + whether the instance is accessible to internal Google Cloud services + such as BigQuery. This is only applicable to MySQL and PostgreSQL + instances that don't use public IP. Currently, SQL Server isn't + supported. + + --enable-point-in-time-recovery + Allows for data recovery from a specific point in time, down to a + fraction of a second, using write-ahead logs. Must have automatic + backups enabled to use. Make sure storage can support at least 7 days + of logs. + + --[no-]final-backup + Enables the final backup to be taken at the time of instance deletion. + Use --final-backup to enable and --no-final-backup to disable. + + --final-backup-retention-days=FINAL_BACKUP_RETENTION_DAYS + Specifies number of days to retain final backup. The valid range is + between 1 and 365. For instances managed by BackupDR, the valid range + is between 1 day and 10 years (3653 days). Default value is 30 days. + + --insights-config-enhanced-query-insights-enabled + Enable enhanced query insights for Enterprise Plus edition to provide + more detailed query analytics. + + --insights-config-query-insights-enabled + Enable query insights feature to provide query and query plan + analytics. + + --insights-config-query-plans-per-minute=INSIGHTS_CONFIG_QUERY_PLANS_PER_MINUTE + Number of query plans to sample every minute. Default value is 5. + Allowed range: 0 to 20. + + --insights-config-query-string-length=INSIGHTS_CONFIG_QUERY_STRING_LENGTH + Sets the default query length limit. For Cloud SQL Enterprise edition, + the range is from 256 to 4500 (in bytes) and the default query length + is 1024 bytes. For Cloud SQL Enterprise Plus edition, the range is from + 1024 to 100,000 (in bytes) and the default query length is 10,000 + bytes. + + --insights-config-record-application-tags + Allow application tags to be recorded by the query insights feature. + + --insights-config-record-client-address + Allow the client address to be recorded by the query insights feature. + + --maintenance-release-channel=MAINTENANCE_RELEASE_CHANNEL + Which channel's updates to apply during the maintenance window. If not + specified, Cloud SQL chooses the timing of updates to your instance. + MAINTENANCE_RELEASE_CHANNEL must be one of: + + preview + Preview updates release prior to production updates. You may wish + to use the preview channel for dev/test applications so that you + can preview their compatibility with your application prior to the + production release. + production + Production updates are stable and recommended for applications in + production. + week5 + week5 updates release after the production updates. Use the week5 + channel to receive a 5 week advance notification about the upcoming + maintenance, so you can prepare your application for the release. + + --maintenance-window-day=MAINTENANCE_WINDOW_DAY + Day of week for maintenance window, in UTC time zone. + MAINTENANCE_WINDOW_DAY must be one of: SUN, MON, TUE, WED, THU, FRI, + SAT. + + --maintenance-window-hour=MAINTENANCE_WINDOW_HOUR + Hour of day for maintenance window, in UTC time zone. + + --memory=MEMORY + Whole number value indicating how much memory is desired in the + machine. A size unit should be provided (eg. 3072MiB or 9GiB) - if no + units are specified, GiB is assumed. Both --cpu and --memory must be + specified if a custom machine type is desired, and the --tier flag must + be omitted. --cpu and --memory flags are not compatible with the + Enterprise Plus edition. These flags should not be used when creating + an Enterprise Plus edition, as the machine configuration is determined + by the --tier flag instead. + + --network=NETWORK + Network in the current project that the instance will be part of. To + specify using a network with a shared VPC, use the full URL of the + network. For an example host project, 'testproject', and shared + network, 'testsharednetwork', this would use the form: + --network=projects/testproject/global/networks/testsharednetwork + + --require-ssl + Specified if users connecting over IP must use SSL. + + --retained-backups-count=RETAINED_BACKUPS_COUNT + How many backups to keep. The valid range is between 1 and 365. Default + value is 7 for Enterprise edition instances. For Enterprise_Plus, + default value is 15. Applicable only if --no-backups is not specified. + + --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS + How many days of transaction logs to keep. The valid range is between 1 + and 35. Only use this option when point-in-time recovery is enabled. If + logs are stored on disk, storage size for transaction logs could + increase when the number of days for log retention increases. For + Enterprise, default and max retention values are 7 and 7 respectively. + For Enterprise_Plus, default and max retention values are 14 and 35. + + --ssl-mode=SSL_MODE + Set the SSL mode of the instance. SSL_MODE must be one of: + + ALLOW_UNENCRYPTED_AND_ENCRYPTED + Allow non-SSL and SSL connections. For SSL connections, client + certificate will not be verified. + ENCRYPTED_ONLY + Only allow connections encrypted with SSL/TLS. + TRUSTED_CLIENT_CERTIFICATE_REQUIRED + Only allow connections encrypted with SSL/TLS and with valid client + certificates. + + --[no-]storage-auto-increase + Storage size can be increased, but it cannot be decreased; storage + increases are permanent for the life of the instance. With this setting + enabled, a spike in storage requirements can result in permanently + increased storage costs for your instance. However, if an instance runs + out of available space, it can result in the instance going offline, + dropping existing connections. This setting is enabled by default. Use + --storage-auto-increase to enable and --no-storage-auto-increase to + disable. + + --storage-provisioned-iops=STORAGE_PROVISIONED_IOPS + Indicates how many IOPS to provision for the data disk. This sets the + number of I/O operations per second that the disk can handle. + + --storage-provisioned-throughput=STORAGE_PROVISIONED_THROUGHPUT + Indicates how much throughput to provision for the data disk. This sets + the throughput in MB per second that the disk can handle. + + --storage-size=STORAGE_SIZE + Amount of storage allocated to the instance. Must be an integer number + of GB. The default is 10GB. Information on storage limits can be found + here: https://cloud.google.com/sql/docs/quotas#storage_limits + + --storage-type=STORAGE_TYPE + The storage type for the instance, determined by the selected machine + type. STORAGE_TYPE must be one of: SSD, HDD, HYPERDISK_BALANCED. + + --tier=TIER, -t TIER + Specifies the machine type for the instance. The usage of this flag + depends on the selected --edition. + + Enterprise Edition: Use --tier for shared-core instances (e.g., + db-f1-micro, db-g1-small). For dedicated-core instances, do not use + --tier; instead, customize your instance by specifying its CPU and + memory with the --cpu and --memory flags. + + Enterprise Plus Edition: --tier is required to specify the predefined + machine type. The --cpu and --memory flags are not supported for + Enterprise Plus. Examples include db-perf-optimized-N-2 (N2 series) or + db-c4a-highmem-2 (C4A series). + + For a detailed list of available machine types and series, refer to the + documentation for your database engine: + + * MySQL: + https://cloud.google.com/sql/docs/mysql/machine-series-overview + * PostgreSQL: + https://cloud.google.com/sql/docs/postgres/machine-series-overview + * SQL Server: + https://cloud.google.com/sql/docs/sqlserver/machine-series-overview + + Learn more about how machine types, CPU, and memory affect pricing: + https://cloud.google.com/sql/pricing + + --time-zone=TIME_ZONE + Set a non-default time zone. Only available for SQL Server instances. + + --timeout=TIMEOUT; default=3600 + Time to synchronously wait for the operation to complete, after which + the operation continues asynchronously. Ignored if --async flag is + specified. By default, set to 3600s. To wait indefinitely, set to + unlimited. + + --allowed-psc-projects=PROJECT,[PROJECT,...] + A comma-separated list of projects. Each project in this list might be + represented by a project number (numeric) or by a project ID + (alphanumeric). This allows Private Service Connect connections to be + established from specified consumer projects. + + --enable-private-service-connect + Enable connecting to the Cloud SQL instance with Private Service + Connect. + + Key resource - The Cloud KMS (Key Management Service) cryptokey that will + be used to protect the instance. The 'Compute Engine Service Agent' + service account must hold permission 'Cloud KMS CryptoKey + Encrypter/Decrypter'. The arguments in this group can be used to specify + the attributes of this resource. + + --disk-encryption-key=DISK_ENCRYPTION_KEY + ID of the key or fully qualified identifier for the key. + + To set the kms-key attribute: + * provide the argument --disk-encryption-key on the command line. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --disk-encryption-key-keyring=DISK_ENCRYPTION_KEY_KEYRING + The KMS keyring of the key. + + To set the kms-keyring attribute: + * provide the argument --disk-encryption-key on the command line with + a fully specified name; + * provide the argument --disk-encryption-key-keyring on the command + line. + + --disk-encryption-key-location=DISK_ENCRYPTION_KEY_LOCATION + The Google Cloud location for the key. + + To set the kms-location attribute: + * provide the argument --disk-encryption-key on the command line with + a fully specified name; + * provide the argument --disk-encryption-key-location on the command + line. + + --disk-encryption-key-project=DISK_ENCRYPTION_KEY_PROJECT + The Google Cloud project for the key. + + To set the kms-project attribute: + * provide the argument --disk-encryption-key on the command line with + a fully specified name; + * provide the argument --disk-encryption-key-project on the command + line; + * set the property core/project. + + At most one of these can be specified: + + --region=REGION + Regional location (e.g. asia-east1, us-east1). See the full list of + regions at https://cloud.google.com/sql/docs/instance-locations. + + Or at most one of these can be specified: + + --gce-zone=GCE_ZONE + (DEPRECATED) Preferred Compute Engine zone (e.g. us-central1-a, + us-central1-b, etc.). + + Flag --gce-zone is deprecated and will be removed by release + 255.0.0. Use --zone instead. + + Or at least one of these can be specified: + + --secondary-zone=SECONDARY_ZONE + Preferred secondary Compute Engine zone (e.g. us-central1-a, + us-central1-b, etc.). + + --zone=ZONE + Preferred Compute Engine zone (e.g. us-central1-a, us-central1-b, + etc.). + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-tasks-queues-create.txt b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-tasks-queues-create.txt new file mode 100644 index 00000000000..051bac90496 --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Fixtures/Gcloud/585.0.0/gcloud-tasks-queues-create.txt @@ -0,0 +1,163 @@ +NAME + gcloud tasks queues create - create a Cloud Tasks queue + +SYNOPSIS + gcloud tasks queues create QUEUE + [--http-header-override=HEADER_FIELD: HEADER_VALUE] + [--http-method-override=HTTP_METHOD_OVERRIDE] + [--http-uri-override=KEY:VALUE,[KEY:VALUE,...]] [--location=LOCATION] + [--log-sampling-ratio=LOG_SAMPLING_RATIO] [--max-attempts=MAX_ATTEMPTS] + [--max-backoff=MAX_BACKOFF] + [--max-concurrent-dispatches=MAX_CONCURRENT_DISPATCHES] + [--max-dispatches-per-second=MAX_DISPATCHES_PER_SECOND] + [--max-doublings=MAX_DOUBLINGS] + [--max-retry-duration=MAX_RETRY_DURATION] [--min-backoff=MIN_BACKOFF] + [--routing-override=KEY:VALUE,[...]] + [[--http-oauth-service-account-email-override=HTTP_OAUTH_SERVICE_ACCOUNT_EMAIL_OVERRIDE : --http-oauth-token-scope-override=HTTP_OAUTH_TOKEN_SCOPE_OVERRIDE] | [--http-oidc-service-account-email-override=HTTP_OIDC_SERVICE_ACCOUNT_EMAIL_OVERRIDE : --http-oidc-token-audience-override=HTTP_OIDC_TOKEN_AUDIENCE_OVERRIDE]] + [GCLOUD_WIDE_FLAG ...] + +DESCRIPTION + The flags available to this command represent the fields of a queue that + are mutable. + +EXAMPLES + To create a Cloud Tasks queue: + + $ gcloud tasks queues create my-queue --max-attempts=10 \ + --max-retry-duration=5s --max-doublings=4 --min-backoff=1s \ + --max-backoff=10s --max-dispatches-per-second=100 \ + --max-concurrent-dispatches=10 --routing-override=service:abc + +POSITIONAL ARGUMENTS + QUEUE + The queue to create. + +FLAGS + --http-header-override=HEADER_FIELD: HEADER_VALUE + If provided, the specified HTTP headers override the existing headers + for all tasks in the queue. If a task has a header with the same Key as + a queue-level header override, then the value of the task header will + be overriden with the value of the queue-level header. Otherwise, the + queue-level header will be added to the task headers. Header values can + contain commas. This flag can be repeated. Repeated header fields will + have their values overridden. + + --http-method-override=HTTP_METHOD_OVERRIDE + If provided, the specified HTTP method type override is used for all + tasks in the queue, no matter what is set at the task-level. + + --http-uri-override=KEY:VALUE,[KEY:VALUE,...] + If provided, the specified HTTP target URI override is used for all + tasks in the queue depending on what is set as the mode. Allowed values + for mode are: ALWAYS, IF_NOT_EXISTS. If not set, mode defaults to + ALWAYS. + + KEY must be at least one of: [scheme, host, port, path, query, mode]. + Any missing keys will use the default. + + --location=LOCATION + The location where we want to manage the queue or task. If not + specified, uses the location of the current project's App Engine app if + there is an associated app. + + --log-sampling-ratio=LOG_SAMPLING_RATIO + Specifies the fraction of operations to write to Cloud Logging. This + field may contain any value between 0.0 and 1.0, inclusive. 0.0 is the + default and means that no operations are logged. + + --max-attempts=MAX_ATTEMPTS + The maximum number of attempts per task in the queue. + + --max-backoff=MAX_BACKOFF + The maximum amount of time to wait before retrying a task after it + fails. Must be a string that ends in 's', such as "5s". + + --max-concurrent-dispatches=MAX_CONCURRENT_DISPATCHES + The maximum number of concurrent tasks that Cloud Tasks allows to be + dispatched for this queue. After this threshold has been reached, Cloud + Tasks stops dispatching tasks until the number of outstanding requests + decreases. + + --max-dispatches-per-second=MAX_DISPATCHES_PER_SECOND + The maximum rate at which tasks are dispatched from this queue. + + --max-doublings=MAX_DOUBLINGS + The time between retries will double maxDoublings times. + + A tasks retry interval starts at minBackoff, then doubles maxDoublings + times, then increases linearly, and finally retries retries at + intervals of maxBackoff up to maxAttempts times. + + For example, if minBackoff is 10s, maxBackoff is 300s, and maxDoublings + is 3, then the a task will first be retried in 10s. The retry interval + will double three times, and then increase linearly by 2^3 * 10s. + Finally, the task will retry at intervals of maxBackoff until the task + has been attempted maxAttempts times. Thus, the requests will retry at + 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s. + + --max-retry-duration=MAX_RETRY_DURATION + The time limit for retrying a failed task, measured from when the task + was first run. Once the --max-retry-duration time has passed and the + task has been attempted --max-attempts times, no further attempts will + be made and the task will be deleted. + + Must be a string that ends in 's', such as "5s". + + --min-backoff=MIN_BACKOFF + The minimum amount of time to wait before retrying a task after it + fails. Must be a string that ends in 's', such as "5s". + + --routing-override=KEY:VALUE,[...] + If provided, the specified App Engine route is used for all tasks in + the queue, no matter what is set is at the task-level. + + KEY must be at least one of: [service, version, instance]. Any missing + keys will use the default. + + If specified, all Authorization headers in the HttpRequest.headers field + will be overridden for any tasks executed on this queue. + + At most one of these can be specified: + + OAuth2 + + --http-oauth-service-account-email-override=HTTP_OAUTH_SERVICE_ACCOUNT_EMAIL_OVERRIDE + The service account email to be used for generating an OAuth2 access + token to be included in the request sent to the target when executing + the task. The service account must be within the same project as the + queue. The caller must have 'iam.serviceAccounts.actAs' permission + for the service account. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --http-oauth-token-scope-override=HTTP_OAUTH_TOKEN_SCOPE_OVERRIDE + The scope to be used when generating an OAuth2 access token to be + included in the request sent to the target when executing the task. + If not specified, 'https://www.googleapis.com/auth/cloud-platform' + will be used. + + OpenId Connect + + --http-oidc-service-account-email-override=HTTP_OIDC_SERVICE_ACCOUNT_EMAIL_OVERRIDE + The service account email to be used for generating an OpenID Connect + token to be included in the request sent to the target when executing + the task. The service account must be within the same project as the + queue. The caller must have 'iam.serviceAccounts.actAs' permission + for the service account. + + This flag argument must be specified if any of the other arguments in + this group are specified. + + --http-oidc-token-audience-override=HTTP_OIDC_TOKEN_AUDIENCE_OVERRIDE + The audience to be used when generating an OpenID Connect token to be + included in the request sent to the target when executing the task. + If not specified, the URI specified in the target will be used. + +GCLOUD WIDE FLAGS + These flags are available to all commands: --access-token-file, --account, + --billing-project, --configuration, --flags-file, --flatten, --format, + --help, --impersonate-service-account, --log-http, --project, --quiet, + --trace-token, --user-output-enabled, --verbosity. + + Run $ gcloud help for details. diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Generators/GeneratorUtilsTests.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Generators/GeneratorUtilsTests.cs index 95757546983..ea738818842 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Generators/GeneratorUtilsTests.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Generators/GeneratorUtilsTests.cs @@ -954,12 +954,60 @@ public async Task IsSecretOption_Returns_False_When_Description_Identifies_A_Pat [Arguments("Credential", "ID of the oauth-client credential or fully qualified identifier for the oauth-client credential.", false)] [Arguments("Credential", "The oauth client credential id of the oauth client resource.", false)] [Arguments("Credential", "The credential value for the oauth client resource.", true)] + [Arguments("CredentialSourceType", "Format of the credential source (JSON or text).", false)] + [Arguments("SubjectTokenType", "The type of token being used for authorization.", false)] + [Arguments("CredentialMode", "Credential mode to create the catalog with.", false)] + [Arguments("TokenFormat", "The format of the token.", false)] + [Arguments("TokenEncoding", "The encoding used for tokens.", false)] + [Arguments("TokenAlgorithm", "The signature algorithm used for tokens.", false)] + [Arguments("OauthTokenScope", "The scope to be used when generating an OAuth2 access token.", false)] + [Arguments("OidcTokenAudience", "The audience to be used when generating an OpenID Connect token.", false)] + [Arguments("HttpOauthTokenScopeOverride", "The scope to be used when generating an OAuth2 access token.", false)] + [Arguments("HttpOidcTokenAudienceOverride", "The audience to be used when generating an OpenID Connect token.", false)] + [Arguments("ProxySecretNamespace", "Namespace of the Kubernetes secret containing the proxy configuration.", false)] + [Arguments("ProxySecretArn", "ARN of the AWS Secrets Manager secret.", false)] + [Arguments("PrivateKeySecretVersion", "Secret containing the private key of the GitHub App.", false)] + [Arguments("SecuritySettingsAwsV4AccessKeyVersion", "The optional version identifier for the AWS access key.", false)] + [Arguments("SecretManagerRotationInterval", "Set the rotation period for secrets.", false)] + [Arguments("PasswordPolicyPasswordChangeInterval", "Minimum interval after which the password can be changed.", false)] + [Arguments("PasswordPolicyComplexity", "The complexity of the password.", false)] + [Arguments("TargetCostPerMillionInputTokens", "The target cost per million input tokens to filter profiles by, unit is 1 USD.", false)] + [Arguments("TargetCostPerMillionOutputTokens", "The target cost per million output tokens to filter profiles by, unit is 1 USD.", false)] + [Arguments("ThreeLeggedOauthTokenUrl", "The token endpoint for requesting tokens on behalf of an end user.", false)] + [Arguments("CustomOauthConfigTokenUri", "The OAuth2 token request URL.", false)] + [Arguments("CredentialSourceUrl", "The URL to obtain the credential from.", false)] + [Arguments("KerberosRootPrincipalPasswordUri", "Google Cloud Storage URI of a KMS encrypted file containing the root principal password.", false)] + [Arguments("ActiveDirectorySecretManagerKey", "The secret manager key storing administrator credentials.", false)] + [Arguments("Secret", "The resource name of the secret version.", false)] + [Arguments("CredentialSourceHeaders", "Headers to use when querying the credential-source-url.", true)] + [Arguments("CredentialType", "The credential value to send.", true)] + [Arguments("TokenFormat", "The token contents to send.", true)] + [Arguments("SecretVersion", "The secret value to send.", true)] + [Arguments("TokenUrl", "The token value to send as a URL.", true)] + [Arguments("TokenOverride", "The token value to send.", true)] + [Arguments("Token", "The token used to query the target cost per million tokens.", true)] public async Task IsSecretOption_Distinguishes_Material_From_Resource_Identifiers_And_Paths( string propertyName, string description, bool secret) { await Assert.That(GeneratorUtils.IsSecretOption(propertyName, false, description)).IsEqualTo(secret); } + [Test] + [Arguments("[SECRET_ENV_VAR=SECRET_VALUE_REF,...]", "Secret bindings.", true)] + [Arguments("CREDENTIAL_REFERENCE", "Credential reference.", true)] + [Arguments("SECRET_VALUE_REF", "You can reference a secret value. To use the value of the secret, read the environment variable.", true)] + [Arguments("PASSWORD", "The password value to send.", false)] + [Arguments("SECRET_VALUE_REF", "The password value to send.", false)] + [Arguments("KEY=VALUE", "Values should be in the form SECRET_NAME:SECRET_VERSION. The password value to send.", false)] + [Arguments("KEY=VALUE", "Group details. Values should be in the form SECRET_NAME:SECRET_VERSION.", true)] + [Arguments("KEY=VALUE", "Example resource: SECRET_NAME:SECRET_VERSION. The password value to send.", false)] + [Arguments("SECRET_ENV_VAR", "List of secret environment variable names and secret paths to remove.", true)] + [Arguments("KEY=VALUE", "List of secret environment variables and their password values.", false)] + public async Task Secret_References_Require_Explicit_Reference_Syntax(string syntax, string description, bool reference) + { + await Assert.That(GeneratorUtils.IsSecretReference(syntax, description)).IsEqualTo(reference); + } + [Test] public async Task IsSecretOption_Returns_False_For_Flags_Even_With_Secret_Name() { diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudCapturedSemanticsTests.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudCapturedSemanticsTests.cs index 4f58415f82c..0ccf5f3a897 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudCapturedSemanticsTests.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudCapturedSemanticsTests.cs @@ -43,6 +43,7 @@ public async Task Captured_Inline_Credentials_Are_Secret_While_Public_Material_A ("KafkaConnectionPropertiesConsumerFile", false), ("KafkaConnectionPropertiesProducerFile", false), ("Db2ConnectionPropertiesSslClientKeystashFile", false), + ("Secret", false), ]; foreach (var (propertyName, secret) in cases) { diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudSecretMetadataTests.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudSecretMetadataTests.cs new file mode 100644 index 00000000000..fa6255ca01c --- /dev/null +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/GcloudSecretMetadataTests.cs @@ -0,0 +1,115 @@ +using Microsoft.Extensions.Logging.Abstractions; +using ModularPipelines.OptionsGenerator.Generators; +using ModularPipelines.OptionsGenerator.Models; +using ModularPipelines.OptionsGenerator.TypeDetection; + +namespace ModularPipelines.OptionsGenerator.Tests.Scrapers.Cli; + +public class GcloudSecretMetadataTests +{ + [Test] + [Arguments("iam workforce-pools create-cred-config", "CredentialSourceType,SubjectTokenType,CredentialSourceUrl", "CredentialSourceHeaders")] + [Arguments("iam workload-identity-pools create-cred-config", "CredentialSourceType,SubjectTokenType,CredentialSourceUrl", "CredentialSourceHeaders")] + [Arguments("biglake iceberg catalogs create", "CredentialMode", "")] + [Arguments("scheduler jobs create http", "OauthTokenScope,OidcTokenAudience", "")] + [Arguments("tasks queues create", "HttpOauthTokenScopeOverride,HttpOidcTokenAudienceOverride", "")] + [Arguments("container ai profiles list", "TargetCostPerMillionInputTokens,TargetCostPerMillionOutputTokens", "")] + [Arguments("functions deploy", "SetSecrets,UpdateSecrets,RemoveSecrets", "")] + [Arguments("run deploy", "SetSecrets,UpdateSecrets,RemoveSecrets", "")] + [Arguments("agent-identity auth-providers create", "ThreeLeggedOauthTokenUrl,TwoLeggedOauthTokenUrl", "ThreeLeggedOauthClientSecret,TwoLeggedOauthClientSecret")] + [Arguments("container aws clusters create", "ProxySecretArn", "")] + [Arguments("sql backups restore", "ActiveDirectorySecretManagerKey", "")] + [Arguments("sql instances create", "PasswordPolicyComplexity,PasswordPolicyPasswordChangeInterval", "RootPassword")] + [Arguments("apihub plugins instances create", "ApiKeyConfigSecretVersion,Oauth2ClientCredentialsConfigSecretVersion,UserPasswordConfigSecretVersion", "")] + [Arguments("secrets versions access", "Secret", "")] + [Arguments("builds triggers create webhook", "Secret", "")] + [Arguments("managed-kafka connect-clusters create", "Secret", "")] + [Arguments("developer-connect connections create", "Secret", "")] + public async Task Captured_Metadata_And_References_Are_Visible_While_Credentials_Stay_Secret( + string commandName, string metadataNames, string secretNames) + { + var command = await GcloudCapturedSemanticsTests.Scrape(commandName); + await AssertClassificationsBeforeAndAfterEnhancement(command, metadataNames, secretNames); + } + + [Test] + [Arguments("password", "PASSWORD", "Password", "The password value to send for authentication.")] + [Arguments("password", "SECRET_VALUE_REF", "Password", "The password value to send for authentication.")] + [Arguments("password", "KEY=VALUE", "Password", "Values should be in the form SECRET_NAME:SECRET_VERSION. The password value to send.")] + [Arguments("password", "PASSWORD", "Password", "Password for authentication.")] + [Arguments("token", "TOKEN", "Token", "The token contents to send for authentication.")] + [Arguments("token", "TOKEN", "Token", "Token for authentication.")] + [Arguments("service-account-key-file", "FILE", "ServiceAccountKeyFile", "The base64 encoded content of the service account key file.")] + public async Task Inherited_Reference_Documentation_Does_Not_Unmask_Literal_Credentials( + string switchName, string valueHint, string propertyName, string description) + { + var commands = await GcloudResourceArgumentTests.ScrapeFixture("example authenticate", $$""" + NAME + gcloud example authenticate - authenticate with a credential + SYNOPSIS + gcloud example authenticate [--secret-bindings=[KEY=VALUE,...] | --{{switchName}}={{valueHint}}] + FLAGS + At most one of these can be specified: + + Secret bindings values should be in the form SECRET_NAME:SECRET_VERSION. + + --secret-bindings=[KEY=VALUE,...] + The bindings to use. + + --{{switchName}}={{valueHint}} + {{description}} + """); + var command = commands.Single(); + await Assert.That(command.Options.Single(option => option.PropertyName == propertyName).Description!) + .Contains("SECRET_NAME:SECRET_VERSION"); + await AssertClassificationsBeforeAndAfterEnhancement(command, "SecretBindings", propertyName); + } + + private static async Task AssertClassificationsBeforeAndAfterEnhancement( + CliCommandDefinition command, string metadataNames, string secretNames) + { + await AssertClassifications(command, metadataNames, false); + await AssertClassifications(command, secretNames, true); + + var enhancer = new OptionTypeEnhancer( + new OptionTypeDetectorPipeline([], NullLogger.Instance), + NullLogger.Instance); + var tool = await enhancer.EnhanceAsync(new CliToolDefinition + { + ToolName = "gcloud", + NamespacePrefix = "Gcloud", + TargetNamespace = "ModularPipelines.Google", + OutputDirectory = "src/ModularPipelines.Google", + Commands = [command], + }); + await AssertClassifications(tool.Commands.Single(), metadataNames, false); + await AssertClassifications(tool.Commands.Single(), secretNames, true); + } + + [Test] + public async Task Positional_Credentials_Use_Their_Own_Prose_For_Secret_Classification() + { + var commands = await GcloudResourceArgumentTests.ScrapeFixture("example authenticate", """ + NAME + gcloud example authenticate - authenticate with a credential + SYNOPSIS + gcloud example authenticate CREDENTIAL + POSITIONAL ARGUMENTS + Credential resource - Authentication settings. To set the project attribute: + provide the project argument with a fully specified name. + + CREDENTIAL + The credential value to send for authentication. + """); + await Assert.That(commands.Single().PositionalArguments.Single().IsSecret).IsTrue(); + } + + private static async Task AssertClassifications(CliCommandDefinition command, string names, bool secret) + { + foreach (var name in names.Split(',', StringSplitOptions.RemoveEmptyEntries)) + { + await Assert.That(command.Options.Single(option => option.PropertyName == name).IsSecret) + .IsEqualTo(secret).Because($"{command.FullCommand}: {name}"); + } + } +} diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/NestedArgumentGroupParsingTests.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/NestedArgumentGroupParsingTests.cs index 174e8eef9e0..0d80921f3d5 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/NestedArgumentGroupParsingTests.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/Scrapers/Cli/NestedArgumentGroupParsingTests.cs @@ -1811,7 +1811,7 @@ await Assert.That(command.Options.Single(option => option.SwitchName == "--three } [Test] - public async Task GcloudDeveloperConnectCreate_Emits_Nested_Resource_And_Secret_Flags() + public async Task GcloudDeveloperConnectCreate_Emits_Nested_Resource_And_Secret_References() { const string helpText = """ NAME @@ -1870,10 +1870,11 @@ await Assert.That(switches) .Contains("--http-config-basic-authentication-password-secret-version"); await Assert.That(command.Options.Single(option => option.SwitchName == "--validate-only").Description!) .DoesNotContain("--crypto-key-config-reference"); - await Assert.That(command.Options - .Single(option => option.SwitchName == "--http-config-basic-authentication-password-secret-version") - .IsSecret) - .IsTrue(); + foreach (var option in command.Options.Where(option => option.SwitchName.EndsWith("-secret-version", StringComparison.Ordinal))) + { + await Assert.That(option.IsSecret).IsFalse() + .Because("SecretManager version identifiers reference credentials without containing their values."); + } await Assert.That(command.ArgumentGroups.Single().Groups) .Contains(group => group.Kind.HasFlag(CliArgumentGroupKind.Resource)); } diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/TypeDetection/OptionTypeEnhancerTests.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/TypeDetection/OptionTypeEnhancerTests.cs index 1bdf096d7f6..091313658d8 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/TypeDetection/OptionTypeEnhancerTests.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator.Tests/TypeDetection/OptionTypeEnhancerTests.cs @@ -504,6 +504,10 @@ public async Task EnhanceAsync_Removes_Inferred_Secret_From_Boolean_Value_Option [Arguments(true, "TokenAuthUser", "The tokenAuthUser id of the authToken resource.")] [Arguments(false, "ApiKeyConfigHttpElementLocation", "The location of the API key. The default value is QUERY.")] [Arguments(true, "ApiKeyConfigHttpElementLocation", "The location of the API key. The default value is QUERY.")] + [Arguments(false, "CredentialSourceType", "Format of the credential source (JSON or text).")] + [Arguments(true, "CredentialSourceType", "Format of the credential source (JSON or text).")] + [Arguments(false, "PrivateKeySecretVersion", "Secret containing the private key of the GitHub App.")] + [Arguments(true, "PrivateKeySecretVersion", "Secret containing the private key of the GitHub App.")] public async Task Credential_Metadata_Clears_Inferred_Secrets_But_Respects_Overrides( bool explicitSecret, string propertyName, string description) { @@ -525,6 +529,29 @@ public async Task Credential_Metadata_Clears_Inferred_Secrets_But_Respects_Overr await Assert.That(enhanced.Commands.Single().Options.Single().IsSecret).IsEqualTo(explicitSecret); } + [Test] + [Arguments(false)] + [Arguments(true)] + public async Task Secret_References_Respect_Explicit_Masking_Overrides(bool explicitSecret) + { + var pipeline = new OptionTypeDetectorPipeline( + explicitSecret ? [new FixedDetector(new OptionTypeDetectionResult + { + Type = CliOptionType.Unknown, Confidence = 100, Source = "ManualOverride", IsSecret = true, + })] : [], NullLogger.Instance); + var enhancer = new OptionTypeEnhancer(pipeline, NullLogger.Instance); + var tool = CreateTool(new CliOptionDefinition + { + SwitchName = "--set-secrets", + PropertyName = "SetSecrets", + CSharpType = "string?", + IsSecret = true, + IsResourceReference = true, + }); + var enhanced = await enhancer.EnhanceAsync(tool); + await Assert.That(enhanced.Commands.Single().Options.Single().IsSecret).IsEqualTo(explicitSecret); + } + [Test] [Arguments("ServiceAccountKeyFile", "The base64 encoded content of the service account key file.", true)] [Arguments("ServiceAccountKeyFile", "Specify the base64 encoded content of the service account key file.", true)] @@ -547,6 +574,38 @@ public async Task Credential_Metadata_Clears_Inferred_Secrets_But_Respects_Overr [Arguments("Credential", "ID of the oauth-client credential or fully qualified identifier for the oauth-client credential.", false)] [Arguments("Credential", "The oauth client credential id of the oauth client resource.", false)] [Arguments("Credential", "The credential value for the oauth client resource.", true)] + [Arguments("CredentialSourceType", "Format of the credential source (JSON or text).", false)] + [Arguments("SubjectTokenType", "The type of token being used for authorization.", false)] + [Arguments("CredentialMode", "Credential mode to create the catalog with.", false)] + [Arguments("TokenFormat", "The format of the token.", false)] + [Arguments("TokenEncoding", "The encoding used for tokens.", false)] + [Arguments("TokenAlgorithm", "The signature algorithm used for tokens.", false)] + [Arguments("OauthTokenScope", "The scope to be used when generating an OAuth2 access token.", false)] + [Arguments("OidcTokenAudience", "The audience to be used when generating an OpenID Connect token.", false)] + [Arguments("HttpOauthTokenScopeOverride", "The scope to be used when generating an OAuth2 access token.", false)] + [Arguments("HttpOidcTokenAudienceOverride", "The audience to be used when generating an OpenID Connect token.", false)] + [Arguments("ProxySecretNamespace", "Namespace of the Kubernetes secret containing the proxy configuration.", false)] + [Arguments("ProxySecretArn", "ARN of the AWS Secrets Manager secret.", false)] + [Arguments("PrivateKeySecretVersion", "Secret containing the private key of the GitHub App.", false)] + [Arguments("SecuritySettingsAwsV4AccessKeyVersion", "The optional version identifier for the AWS access key.", false)] + [Arguments("SecretManagerRotationInterval", "Set the rotation period for secrets.", false)] + [Arguments("PasswordPolicyPasswordChangeInterval", "Minimum interval after which the password can be changed.", false)] + [Arguments("PasswordPolicyComplexity", "The complexity of the password.", false)] + [Arguments("TargetCostPerMillionInputTokens", "The target cost per million input tokens to filter profiles by, unit is 1 USD.", false)] + [Arguments("TargetCostPerMillionOutputTokens", "The target cost per million output tokens to filter profiles by, unit is 1 USD.", false)] + [Arguments("ThreeLeggedOauthTokenUrl", "The token endpoint for requesting tokens on behalf of an end user.", false)] + [Arguments("CustomOauthConfigTokenUri", "The OAuth2 token request URL.", false)] + [Arguments("CredentialSourceUrl", "The URL to obtain the credential from.", false)] + [Arguments("KerberosRootPrincipalPasswordUri", "Google Cloud Storage URI of a KMS encrypted file containing the root principal password.", false)] + [Arguments("ActiveDirectorySecretManagerKey", "The secret manager key storing administrator credentials.", false)] + [Arguments("Secret", "The resource name of the secret version.", false)] + [Arguments("CredentialSourceHeaders", "Headers to use when querying the credential-source-url.", true)] + [Arguments("CredentialType", "The credential value to send.", true)] + [Arguments("TokenFormat", "The token contents to send.", true)] + [Arguments("SecretVersion", "The secret value to send.", true)] + [Arguments("TokenUrl", "The token value to send as a URL.", true)] + [Arguments("TokenOverride", "The token value to send.", true)] + [Arguments("Token", "The token used to query the target cost per million tokens.", true)] public async Task Secret_Inference_Uses_Option_Local_Prose(string propertyName, string localDescription, bool secret) { var pipeline = new OptionTypeDetectorPipeline([], NullLogger.Instance); diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Generators/GeneratorUtils.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Generators/GeneratorUtils.cs index 45a945e41ef..a7c95ce58e7 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Generators/GeneratorUtils.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Generators/GeneratorUtils.cs @@ -939,6 +939,10 @@ public static string EnsureAsyncSuffix(string methodName) private static readonly string[] SecretMetadataSuffixes = ["Count", "Length", "Size", "Age", "Duration", "Validity", "Lifetime", "Seconds", "Minutes", "Hours", "Days"]; + private static readonly string[] CredentialMetadataSuffixes = + ["Type", "Format", "Encoding", "Mode", "Method", "Algorithm", "Protocol", "Audience", "Scope", "Scopes", + "Issuer", "Endpoint", "Version", "Namespace", "Arn", "Interval", "Complexity", "Location"]; + private const string SecretDescriptionKeywordPattern = @"secret|password|passphrase|token|credential|api[\s-]*key|private[\s-]*key|access[\s-]*key|secret[\s-]*key|service[\s-]*account[\s-]*key|one[\s-]*time[\s-]*password|otp|key[\s-]*store|wallet"; @@ -1012,11 +1016,77 @@ internal static bool IsSecretMetadataOption(string propertyName, string? descrip return false; } - return SecretMetadataSuffixes.Any(suffix => EndsWithIdentifierSegment(propertyName, suffix)) - || (EndsWithIdentifierSegment(propertyName, "Location") && !DescriptionIdentifiesSecretValue(description)) - || (!string.IsNullOrWhiteSpace(description) && CountDescriptionPattern().IsMatch(description)); + if (SecretMetadataSuffixes.Any(suffix => EndsWithIdentifierSegment(propertyName, suffix)) + || (!string.IsNullOrWhiteSpace(description) + && (CountDescriptionPattern().IsMatch(description) || CostDescriptionPattern().IsMatch(description)))) + { + return true; + } + + if (DescriptionIdentifiesSecretValue(description)) + { + return false; + } + + var metadataName = propertyName.EndsWith("Override", StringComparison.OrdinalIgnoreCase) + ? propertyName[..^"Override".Length] + : propertyName; + return CredentialMetadataSuffixes.Any(suffix => EndsWithIdentifierSegment(metadataName, suffix)) + || (description is not null && CredentialEndpointDescriptionPattern().IsMatch(description)); } + [GeneratedRegex(@"\A\s*(?:the\s+)?(?:token\s+endpoint\b|OAuth2?\s+token\s+request\s+URL\b|URL\s+to\s+obtain\s+(?:the\s+)?credential\s+from\b)", + RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] + private static partial Regex CredentialEndpointDescriptionPattern(); + + [GeneratedRegex(@"\A\s*(?:the\s+)?(?:(?:target|maximum|minimum)\s+)?(?:cost|price)\s+(?:of|per)\b", + RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] + private static partial Regex CostDescriptionPattern(); + + internal static bool IsSecretReference(string? valueSyntax, string? description, string? groupDescription = null) + { + if (DescriptionDeclaresSecretInput(description)) + { + return false; + } + + if ((valueSyntax is not null && SecretReferenceSyntaxPattern().IsMatch(valueSyntax)) + || DescriptionIdentifiesSecretReference(description)) + { + return true; + } + + return !DescriptionIdentifiesSecretValue(description) + && (valueSyntax is null || !SecretKeywordDescriptionPattern().IsMatch(valueSyntax)) + && DescriptionIdentifiesSecretReference(groupDescription); + } + + // Reference documentation can discuss the resolved secret without accepting its literal value. + private static bool DescriptionDeclaresSecretInput(string? description) => + description is not null + && (SecretInputDescriptionPattern().IsMatch(description) + || (InlineFileContentDescriptionPattern().IsMatch(description) + && SecretKeywordDescriptionPattern().IsMatch(description))); + + private static bool DescriptionIdentifiesSecretReference(string? description) => + description is not null && SecretReferenceDescriptionPattern().IsMatch(description); + + [GeneratedRegex(@"(?:\A|[.!?]\s+)\s*(?:(?:sets?|specifies?|provides?|supplies?)\s+)?(?:the\s+)?(?:" + + @"(?:" + SecretDescriptionKeywordPattern + @")\s+(?:" + SecretMaterialTermPattern + @")\b" + + @"|(?:" + SecretMaterialTermPattern + @")\s+(?:for|of)\s+(?:the\s+)?(?:" + SecretDescriptionKeywordPattern + @")\b)", + RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] + private static partial Regex SecretInputDescriptionPattern(); + + [GeneratedRegex(@"\b(?:SECRET|PASSWORD|CREDENTIAL|TOKEN)(?:_VALUE)?_REF(?:ERENCE)?\b", + RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] + private static partial Regex SecretReferenceSyntaxPattern(); + + [GeneratedRegex(@"\bvalues\s+should\s+be\s+in\s+the\s+form\s+SECRET_NAME:SECRET_VERSION\b" + + @"|\blist\s+of\s+secret\s+environment\s+variable\s+names\s+and\s+secret\s+paths\s+to\s+remove\b" + + @"|\bsecret\s*versions?\s+from\s+secret\s+manager\s+must\s+be\s+provided\b", + RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] + private static partial Regex SecretReferenceDescriptionPattern(); + private static bool EndsWithIdentifierSegment(string propertyName, string suffix) { var start = propertyName.Length - suffix.Length; @@ -1077,7 +1147,11 @@ internal static bool IsResourceIdentifierOption(string? description) => private static partial Regex FilePathDescriptionPattern(); [GeneratedRegex(@"\bID\s+of\s+the\s+[\w-]+(?:\s+[\w-]+)*?\s+or\s+fully\s+qualified\s+identifier\b|\bthe\s+[\w-]+(?:\s+[\w-]+)*?\s+id\s+of\s+the\s+[\w-]+(?:\s+[\w-]+)*?\s+resource\b" - + @"|^(?:the\s+)?name of (?:the\s+)?[\w -]+?\s+to (?:create|update|delete)\b", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] + + @"|^(?:the\s+)?name of (?:the\s+)?[\w -]+?\s+to (?:create|update|delete)\b" + + @"|\A\s*(?:the\s+)?(?:(?:full\s+)?resource\s+name\s+of\b|(?:full\s+)?path\s+of\s+(?:the\s+)?secret\s+version\b|(?:Google\s+Cloud\s+Storage\s+)?URI\s+of\b|secret\s+manager\s+key\s+storing\b)" + + @"|\bprovides\s+fallback\s+value\s+for\s+resource\s+[\w-]+\s+attribute\b" + + @"|\bTo\s+set\s+the\s+[\w-]+\s+attribute:[\s\S]*?\bfully\s+specified\s+name\b", + RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)] private static partial Regex ResourceIdentifierDescriptionPattern(); private static bool ContainsIdentifierSegment(string propertyName, string segment) diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Models/CliOptionDefinition.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Models/CliOptionDefinition.cs index 2ab8e5fc296..6c639957793 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Models/CliOptionDefinition.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Models/CliOptionDefinition.cs @@ -14,6 +14,9 @@ public record CliOptionDefinition /// Option-local prose for value classification, excluding inherited group documentation. internal string? ValueShapeDescription { get; init; } + /// Whether the documented value identifies resources instead of carrying credential contents. + internal bool IsResourceReference { get; init; } + private const string CollectionProbeTypeName = "CollectionShapeProbe.Probe"; private static readonly ConcurrentDictionary CollectionShapes = new(StringComparer.Ordinal); private static readonly Lazy CollectionProbeCompilation = new(CreateCollectionProbeCompilation); diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Scrapers/Cli/GcloudCliScraper.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Scrapers/Cli/GcloudCliScraper.cs index 584a08144c9..259b1b420d6 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Scrapers/Cli/GcloudCliScraper.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Scrapers/Cli/GcloudCliScraper.cs @@ -401,7 +401,7 @@ private static void ReconcileRequiredSynopsisChoices(string? synopsis, IReadOnly if (index >= 0) { var previous = constraints[index]; - replacement = PreserveDocumentedChoices(replacement, EnumerateConstraints(previous).ToArray()); + replacement = PreserveDocumentedChoices(replacement, [.. EnumerateConstraints(previous)]); constraints[index] = replacement with { IsRequired = previous.IsRequired }; } } @@ -796,6 +796,8 @@ private CliOptionDefinition CreateOptionDefinition( { var valueHint = argument.ValueHint ?? string.Empty; var description = argument.Documentation; + // Inherited binding documentation must not override an option's own credential syntax or prose. + var isResourceReference = GeneratorUtils.IsSecretReference(valueHint, argument.Description, description); var isFlag = string.IsNullOrEmpty(valueHint) || argument.IsNegatable; var hasCompositeSyntax = IsCompositeValueHint(valueHint); var isStructuredValue = hasCompositeSyntax @@ -828,7 +830,8 @@ private CliOptionDefinition CreateOptionDefinition( IsNumeric = isNumeric, ValueSeparator = isFlag ? " " : "=", EnumDefinition = enumDefinition, - IsSecret = GeneratorUtils.IsSecretOption(propertyName, isFlag, argument.Description) + IsResourceReference = isResourceReference, + IsSecret = !isResourceReference && GeneratorUtils.IsSecretOption(propertyName, isFlag, argument.Description) }; } @@ -1038,7 +1041,7 @@ private IReadOnlyList ParsePositionalArguments( }) with { Description = argument.Documentation, - IsSecret = GeneratorUtils.IsSecretOption(propertyName, false, argument.Documentation), + IsSecret = GeneratorUtils.IsSecretOption(propertyName, false, argument.Description), }; }) .OrderBy(argument => argument.PositionIndex); diff --git a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/TypeDetection/OptionTypeEnhancer.cs b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/TypeDetection/OptionTypeEnhancer.cs index 8a7cce124cd..ef983f5b943 100644 --- a/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/TypeDetection/OptionTypeEnhancer.cs +++ b/tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/TypeDetection/OptionTypeEnhancer.cs @@ -251,8 +251,8 @@ private CliOptionDefinition ApplySecretMetadata( private static bool IsInferredSecret(CliOptionDefinition option) { - // Documented enum choices are public metadata, not credential material. - if (option.EnumDefinition is not null) + // Documented enum choices and resource references do not contain credential material. + if (option.EnumDefinition is not null || option.IsResourceReference) { return false; }