Merge "Add resource option immutable"

Author: Zuul

doc/source/cli/command-objects/project.rst

@@ -16,6 +16,7 @@ Create new project
         [--domain <domain>]
         [--parent <project>]
         [--description <description>]
+        [--immutable | --no-immutable]
         [--enable | --disable]
         [--property <key=value>]
         [--or-show]
@@ -46,6 +47,15 @@ Create new project
 
     Disable project
 
+.. option:: --immutable
+
+    Make project immutable. An immutable project may not be deleted or
+    modified except to remove the immutable flag
+
+.. option:: --no-immutable
+
+    Make project mutable (default)
+
 .. option:: --property <key=value>
 
     Add a property to :ref:`\<name\> <project_create-name>`
@@ -180,6 +190,7 @@ Set project properties
         [--name <name>]
         [--domain <domain>]
         [--description <description>]
+        [--immutable | --no-immutable]
         [--enable | --disable]
         [--property <key=value>]
         [--tag <tag> | --clear-tags | --remove-tags <tag>]
@@ -199,6 +210,15 @@ Set project properties
 
     Set project description
 
+.. option:: --immutable
+
+    Make project immutable. An immutable project may not be deleted or
+    modified except to remove the immutable flag
+
+.. option:: --no-immutable
+
+    Make project mutable (default)
+
 .. option:: --enable
 
     Enable project (default)

doc/source/cli/command-objects/role.rst

@@ -97,6 +97,7 @@ Create new role
     openstack role create
         [--or-show]
         [--domain <domain>]
+        [--immutable | --no-immutable]
         <name>
 
 .. option:: --domain <domain>
@@ -119,6 +120,15 @@ Create new role
 
     Add description about the role
 
+.. option:: --immutable
+
+    Make role immutable. An immutable role may not be deleted or modified
+    except to remove the immutable flag
+
+.. option:: --no-immutable
+
+    Make role mutable (default)
+
 role delete
 -----------
 
@@ -253,6 +263,7 @@ Set role properties
     openstack role set
         [--name <name>]
         [--domain <domain>]
+        [--immutable | --no-immutable]
         <role>
 
 .. option:: --name <name>
@@ -269,6 +280,15 @@ Set role properties
 
     Role to modify (name or ID)
 
+.. option:: --immutable
+
+    Make role immutable. An immutable role may not be deleted or modified
+    except to remove the immutable flag
+
+.. option:: --no-immutable
+
+    Make role mutable (default)
+
 role show
 ---------
 

openstackclient/identity/common.py

@@ -213,6 +213,15 @@ def _find_identity_resource(identity_client_manager, name_or_id,
     return resource_type(None, {'id': name_or_id, 'name': name_or_id})
 
 
+def get_immutable_options(parsed_args):
+    options = {}
+    if parsed_args.immutable:
+        options['immutable'] = True
+    if parsed_args.no_immutable:
+        options['immutable'] = False
+    return options
+
+
 def add_user_domain_option_to_parser(parser):
     parser.add_argument(
         '--user-domain',
@@ -261,3 +270,18 @@ def add_inherited_option_to_parser(parser):
         help=_('Specifies if the role grant is inheritable to the sub '
                'projects'),
     )
+
+
+def add_resource_option_to_parser(parser):
+    enable_group = parser.add_mutually_exclusive_group()
+    enable_group.add_argument(
+        '--immutable',
+        action='store_true',
+        help=_('Make resource immutable. An immutable project may not '
+               'be deleted or modified except to remove the immutable flag'),
+    )
+    enable_group.add_argument(
+        '--no-immutable',
+        action='store_true',
+        help=_('Make resource mutable (default)'),
+    )

openstackclient/identity/v3/domain.py

@@ -60,6 +60,7 @@ def get_parser(self, prog_name):
             action='store_true',
             help=_('Return existing domain'),
         )
+        common.add_resource_option_to_parser(parser)
         return parser
 
     def take_action(self, parsed_args):
@@ -69,10 +70,13 @@ def take_action(self, parsed_args):
         if parsed_args.disable:
             enabled = False
 
+        options = common.get_immutable_options(parsed_args)
+
         try:
             domain = identity_client.domains.create(
                 name=parsed_args.name,
                 description=parsed_args.description,
+                options=options,
                 enabled=enabled,
             )
         except ks_exc.Conflict:
@@ -163,6 +167,7 @@ def get_parser(self, prog_name):
             action='store_true',
             help=_('Disable domain'),
         )
+        common.add_resource_option_to_parser(parser)
         return parser
 
     def take_action(self, parsed_args):
@@ -180,6 +185,10 @@ def take_action(self, parsed_args):
         if parsed_args.disable:
             kwargs['enabled'] = False
 
+        options = common.get_immutable_options(parsed_args)
+        if options:
+            kwargs['options'] = options
+
         identity_client.domains.update(domain.id, **kwargs)
 
 

openstackclient/identity/v3/project.py

@@ -78,6 +78,7 @@ def get_parser(self, prog_name):
             action='store_true',
             help=_('Return existing project'),
         )
+        common.add_resource_option_to_parser(parser)
         tag.add_tag_option_to_parser_for_create(parser, _('project'))
         return parser
 
@@ -99,6 +100,9 @@ def take_action(self, parsed_args):
         enabled = True
         if parsed_args.disable:
             enabled = False
+
+        options = common.get_immutable_options(parsed_args)
+
         kwargs = {}
         if parsed_args.property:
             kwargs = parsed_args.property.copy()
@@ -111,6 +115,7 @@ def take_action(self, parsed_args):
                 parent=parent,
                 description=parsed_args.description,
                 enabled=enabled,
+                options=options,
                 **kwargs
             )
         except ks_exc.Conflict:
@@ -317,6 +322,7 @@ def get_parser(self, prog_name):
             help=_('Set a property on <project> '
                    '(repeat option to set multiple properties)'),
         )
+        common.add_resource_option_to_parser(parser)
         tag.add_tag_option_to_parser_for_set(parser, _('project'))
         return parser
 
@@ -336,6 +342,9 @@ def take_action(self, parsed_args):
             kwargs['enabled'] = True
         if parsed_args.disable:
             kwargs['enabled'] = False
+        options = common.get_immutable_options(parsed_args)
+        if options:
+            kwargs['options'] = options
         if parsed_args.property:
             kwargs.update(parsed_args.property)
         tag.update_tags_in_args(parsed_args, project, kwargs)

openstackclient/identity/v3/role.py

@@ -191,6 +191,7 @@ def get_parser(self, prog_name):
             action='store_true',
             help=_('Return existing role'),
         )
+        common.add_resource_option_to_parser(parser)
         return parser
 
     def take_action(self, parsed_args):
@@ -201,10 +202,12 @@ def take_action(self, parsed_args):
             domain_id = common.find_domain(identity_client,
                                            parsed_args.domain).id
 
+        options = common.get_immutable_options(parsed_args)
+
         try:
             role = identity_client.roles.create(
                 name=parsed_args.name, domain=domain_id,
-                description=parsed_args.description)
+                description=parsed_args.description, options=options)
 
         except ks_exc.Conflict:
             if parsed_args.or_show:
@@ -366,6 +369,7 @@ def get_parser(self, prog_name):
             metavar='<name>',
             help=_('Set role name'),
         )
+        common.add_resource_option_to_parser(parser)
         return parser
 
     def take_action(self, parsed_args):
@@ -376,12 +380,14 @@ def take_action(self, parsed_args):
             domain_id = common.find_domain(identity_client,
                                            parsed_args.domain).id
 
+        options = common.get_immutable_options(parsed_args)
         role = utils.find_resource(identity_client.roles,
                                    parsed_args.role,
                                    domain_id=domain_id)
 
         identity_client.roles.update(role.id, name=parsed_args.name,
-                                     description=parsed_args.description)
+                                     description=parsed_args.description,
+                                     options=options)
 
 
 class ShowRole(command.ShowOne):