deepblue/GoogleDriveManagement
1
0
Fork 0
mirror of https://github.com/GAM-team/GAM.git synced 2025-07-09 14:13:35 +00:00
Code Issues Actions 19 Packages Projects Releases Wiki Activity

retry a few more key operations

Browse Source
This commit is contained in:
Jay Lee
2021-05-25 11:49:44 -04:00
parent 6f987958e8
commit 2ea80c41ab
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/gam/__init__.py
View File

@ -7251,19 +7251,19 @@ def enableGAMProjectAPIs(GAMProjectAPIs,
return status return status
def _grantSARotateRights(iam, sa_email): def _grantRotateRights(iam, service_account, email, account_type='serviceAccount'):
print(f'Giving service account {sa_email} rights to rotate own private key') print(f'Giving account {email} rights to rotate {service_account} private key')
body = { body = {
'policy': { 'policy': {
'bindings': [{ 'bindings': [{
'role': 'roles/iam.serviceAccountKeyAdmin', 'role': 'roles/iam.serviceAccountKeyAdmin',
'members': [f'serviceAccount:{sa_email}'] 'members': [f'{account_type}:{email}']
}] }]
} }
} }
gapi.call(iam.projects().serviceAccounts(), gapi.call(iam.projects().serviceAccounts(),
'setIamPolicy', 'setIamPolicy',
resource=f'projects/-/serviceAccounts/{sa_email}', resource=f'projects/-/serviceAccounts/{service_account}',
body=body) body=body)
@ -7355,11 +7355,12 @@ def _createClientSecretsOauth2service(httpObj, projectId, login_hint):
}) })
GM_Globals[GM_OAUTH2SERVICE_ACCOUNT_CLIENT_ID] = service_account[ GM_Globals[GM_OAUTH2SERVICE_ACCOUNT_CLIENT_ID] = service_account[
'uniqueId'] 'uniqueId']
sa_email = service_account['name'].rsplit('/', 1)[-1]
doCreateOrRotateServiceAccountKeys(iam, doCreateOrRotateServiceAccountKeys(iam,
project_id=service_account['projectId'], project_id=service_account['projectId'],
client_email=service_account['email'], client_email=service_account['email'],
client_id=service_account['uniqueId']) client_id=service_account['uniqueId'])
_grantSARotateRights(iam, service_account['name'].rsplit('/', 1)[-1]) _grantRotateRights(iam, sa_email, sa_email)
console_url = f'https://console.cloud.google.com/apis/credentials/oauthclient?project={projectId}' console_url = f'https://console.cloud.google.com/apis/credentials/oauthclient?project={projectId}'
while True: while True:
print(f'''Please go to: print(f'''Please go to:
@ -7740,7 +7741,7 @@ def doUpdateProjects():
iam = getService('iam', httpObj) iam = getService('iam', httpObj)
_getSvcAcctData() # needed to read in GM_OAUTH2SERVICE_JSON_DATA _getSvcAcctData() # needed to read in GM_OAUTH2SERVICE_JSON_DATA
sa_email = GM_Globals[GM_OAUTH2SERVICE_JSON_DATA]['client_email'] sa_email = GM_Globals[GM_OAUTH2SERVICE_JSON_DATA]['client_email']
_grantSARotateRights(iam, sa_email) _grantRotateRights(iam, sa_email, sa_email)
def _generatePrivateKeyAndPublicCert(client_id, key_size): def _generatePrivateKeyAndPublicCert(client_id, key_size):
@ -7938,6 +7939,7 @@ def doCreateOrRotateServiceAccountKeys(iam=None,
iam.projects().serviceAccounts().keys(), iam.projects().serviceAccounts().keys(),
'upload', 'upload',
throw_reasons=throw_reasons, throw_reasons=throw_reasons,
retry_reasons=[gapi_errors.ErrorReason.FOUR_O_THREE],
name=sa_name, name=sa_name,
body={'publicKeyData': publicKeyData}) body={'publicKeyData': publicKeyData})
break break
@ -7962,6 +7964,7 @@ def doCreateOrRotateServiceAccountKeys(iam=None,
result = gapi.call(iam.projects().serviceAccounts().keys(), result = gapi.call(iam.projects().serviceAccounts().keys(),
'create', 'create',
name=sa_name, name=sa_name,
retry_reasons=[gapi_errors.ErrorReason.FOUR_O_THREE],
body=body) body=body)
new_data_str = base64.b64decode( new_data_str = base64.b64decode(
result['privateKeyData']).decode(UTF8) result['privateKeyData']).decode(UTF8)
@ -7987,6 +7990,7 @@ def doCreateOrRotateServiceAccountKeys(iam=None,
print(f' Revoking existing key {keyName} for service account') print(f' Revoking existing key {keyName} for service account')
gapi.call(iam.projects().serviceAccounts().keys(), gapi.call(iam.projects().serviceAccounts().keys(),
'delete', 'delete',
retry_reasons=[gapi_errors.ErrorReason.FOUR_O_THREE],
name=key['name']) name=key['name'])
if mode != 'retainnone': if mode != 'retainnone':
break break