gcloud-help/gcloud/privateca/templates/create

NAME
    gcloud privateca templates create - create a new certificate template

SYNOPSIS
    gcloud privateca templates create
        (CERTIFICATE_TEMPLATE : --location=LOCATION) --copy-sans --copy-subject
        [--description=DESCRIPTION]
        [--identity-cel-expression=IDENTITY_CEL_EXPRESSION]
        [--labels=[KEY=VALUE,...]] [--maximum-lifetime=MAXIMUM_LIFETIME]
        [--predefined-values-file=PREDEFINED_VALUES_FILE]
        [--copy-all-requested-extensions
          | --copy-extensions-by-oid=[OBJECT_ID,...]
          --copy-known-extensions=[KNOWN_EXTENSIONS,...]]
        [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    Create a certificate template that enforces policy restrictions on
    certificate requestors. Using a certificate template, you can define
    restrictions on the kinds of Subjects/SANs and x509 extensions allowed from
    certificate requestors as well as a default set of x509 extensions that
    should be applied to all certificates using that template. These templates
    can be binded to IAM identities such that certain groups of requestors must
    use particular templates, allowing for fine-grained policy enforcements
    based on identity.

    For more information and examples, see
    https://cloud.google.com/certificate-authority-service/docs/creating-certificate-template.

EXAMPLES
    To create a template that prohibits any x509 extension from a requester,
    but permits custom subjects/SANs and defines the default x509 extensions,
    run:

        $ gcloud privateca templates create restricted-template \
            --location=us-west1 --copy-subject --copy-sans \
            --predefined-values-file=x509_parameters.yaml

    To create a template that allows requesters to specify only DNS names from
    requesters, use a custom CEL expression with a SAN only restriction:

        $ gcloud privateca templates create dns-only-template \
            --location=us-west1 \
            --description="Restricts certificates to DNS SANs." \
            --no-copy-subject --copy-sans \
            --identity-cel-expression="subject_alt_names.all(san, san.type \
        == DNS)"

    To create a template that permits a requestor to specify extensions by
    OIDs, and subjects (but not SANs), with default x509 exensions:

        $ gcloud privateca templates create mtls-only-extensions \
            --location=us-west1 --copy-subject --no-copy-sans \
            --predefined-values-file=mtls_cert_exts.yaml \
            --copy-extensions-by-oid=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.1

POSITIONAL ARGUMENTS
     CERTIFICATE TEMPLATE resource - The template to create. The arguments in
     this group can be used to specify the attributes of this resource. (NOTE)
     Some attributes are not given arguments in this group but can be set in
     other ways.

     To set the project attribute:
      ◆ provide the argument CERTIFICATE_TEMPLATE on the command line with a
        fully specified name;
      ◆ provide the argument --project on the command line;
      ◆ set the property core/project.

     This must be specified.

       CERTIFICATE_TEMPLATE
          ID of the CERTIFICATE_TEMPLATE or fully qualified identifier for the
          CERTIFICATE_TEMPLATE.

          To set the certificate template attribute:
          ▸ provide the argument CERTIFICATE_TEMPLATE on the command line.

          This positional argument must be specified if any of the other
          arguments in this group are specified.

       --location=LOCATION
          The location of the CERTIFICATE_TEMPLATE.

          To set the location attribute:
          ▸ provide the argument CERTIFICATE_TEMPLATE on the command line
            with a fully specified name;
          ▸ provide the argument --location on the command line;
          ▸ set the property privateca/location.

REQUIRED FLAGS
     --copy-sans
        If this is specified, the Subject Alternative Name extension from the
        certificate request will be copied into the signed certificate. Specify
        --no-copy-sans to drop any caller-specified SANs in the certificate
        request.

     --copy-subject
        If this is specified, the Subject from the certificate request will be
        copied into the signed certificate. Specify --no-copy-subject to drop
        any caller-specified subjects from the certificate request.

OPTIONAL FLAGS
     --description=DESCRIPTION
        A text description for the Certificate Template.

     --identity-cel-expression=IDENTITY_CEL_EXPRESSION
        A CEL expression that will be evaluated against the identity in the
        certificate before it is issued, and returns a boolean signifying
        whether the request should be allowed.

     --labels=[KEY=VALUE,...]
        List of label KEY=VALUE pairs to add.

        Keys must start with a lowercase character and contain only hyphens
        (-), underscores (_), lowercase characters, and numbers. Values must
        contain only hyphens (-), underscores (_), lowercase characters, and
        numbers.

     --maximum-lifetime=MAXIMUM_LIFETIME
        If this is set, then issued certificate's lifetime will be truncated to
        the value provided. If the issuing CaPool's IssuancePolicy specifies a
        maximum lifetime the minimum of the two durations will be the maximum
        lifetime for the issued certificate. Note that if the issuing
        CertificateAuthority expires before a Certificate's requested
        maximum_lifetime, the effective lifetime will be explicitly truncated
        to match it.

     --predefined-values-file=PREDEFINED_VALUES_FILE
        A YAML file describing any predefined X.509 values set by this
        template. The provided extensions will be copied over to any
        certificate requests that use this template, taking precedent over any
        allowed extensions in the certificate request. The format of this file
        should be a YAML representation of the X509Parameters message, which is
        defined here:
        https://cloud.google.com/certificate-authority-service/docs/reference/rest/v1/X509Parameters.
        Some examples can be found here:
        https://cloud.google.com/certificate-authority-service/docs/creating-certificate-template

     Constraints on requested X.509 extensions. If unspecified, all extensions
     from certificate request will be ignored when signing the certificate.

     At most one of these can be specified:

       --copy-all-requested-extensions
          If this is set, all extensions specified in the certificate request
          will be copied into the signed certificate.

       Specify exact x509 extensions to copy by OID or known extension.

         --copy-extensions-by-oid=[OBJECT_ID,...]
            If this is set, then extensions with the given OIDs will be copied
            from the certificate request into the signed certificate.

         --copy-known-extensions=[KNOWN_EXTENSIONS,...]
            If this is set, then the given extensions will be copied from the
            certificate request into the signed certificate. KNOWN_EXTENSIONS
            must be one of: base-key-usage, extended-key-usage, ca-options,
            policy-ids, aia-ocsp-servers.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.