Add update commands role attributes and roles. When showing roles, convert ids to names. Fixes GH-94

doc/release-notes.md

@@ -3,8 +3,40 @@
 Ziti 0.14.2 includes the following:
 
   * [can't create service policy with @ identity name](https://github.com/netfoundry/ziti-cmd/issues/93) 
+  * [Add CLI commands to allow updating policies and role attributes](https://github.com/netfoundry/ziti-cmd/issues/94)
   * Fixes to connection setup timing 
-  
+
+## CLI Updates
+### Names in Policy Roles
+Polices can now be created from the CLI using @name. This was previously supported natively in the REST APIs, however it was stripped out for consistency. The CLI now supports this by looking up names and replacing them with IDS when they are entered. When policies are listed they will show names instead of IDs now as well.
+
+```shell script
+$ ziti edge controller create service-policy test-names Dial -i '#all' -s '@ssh'
+Found services with id db9488ba-d0af-455b-9503-c6df88f228ff for name ssh
+ba233791-8fde-44ba-9509-948275e3e3bb
+
+$ ziti edge controller list service-policies 'name="test-names"'
+id: ba233791-8fde-44ba-9509-948275e3e3bb    name: test-names    type: Dial    service roles: [@ssh]    identity roles: [#all]
+results: 1-1 of 1 
+```
+
+### New Update Commands
+There are now update commands which allow updating role attributes on edge-routers, identities and services and roles on all three policy types.
+
+All the update commands also allow changing the entity and policy names.
+
+```shell script
+$ ziti edge controller update identity jsmith-laptop -a us-east,sales
+$ ziti edge controller update service-policy sales-na -s o365,mattermost
+```
+
+### Breaking Change to CLI commands
+The shorthands for some policy flags have changed
+
+  * The shorthand for create edge-router-policy `--edge-router-roles` is now `-e`. It was `-r`
+  * The shorthand for create service-edge-router-policy `--edge-router-roles` is now `-e`. It was `-r`
+  * The shorthand for create service-policy `--service-roles` is now `-s`. It was `-r`
+
 # Release 0.14.1
 ## Theme
 Ziti 0.14.1 includes the following:

ziti/cmd/ziti/cmd/edge_controller/create_edge_router_policy.go

@@ -57,7 +57,7 @@ func newCreateEdgeRouterPolicyCmd(f cmdutil.Factory, out io.Writer, errOut io.Wr
 
 	// allow interspersing positional args and flags
 	cmd.Flags().SetInterspersed(true)
-	cmd.Flags().StringSliceVarP(&options.edgeRouterRoles, "edge-router-roles", "r", nil, "Edge router roles of the new edge router policy")
+	cmd.Flags().StringSliceVarP(&options.edgeRouterRoles, "edge-router-roles", "e", nil, "Edge router roles of the new edge router policy")
 	cmd.Flags().StringSliceVarP(&options.identityRoles, "identity-roles", "i", nil, "Identity roles of the new edge router policy")
 	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
 

ziti/cmd/ziti/cmd/edge_controller/create_service_edge_router_policy.go

@@ -57,7 +57,7 @@ func newCreateServiceEdgeRouterPolicyCmd(f cmdutil.Factory, out io.Writer, errOu
 
 	// allow interspersing positional args and flags
 	cmd.Flags().SetInterspersed(true)
-	cmd.Flags().StringSliceVarP(&options.edgeRouterRoles, "edge-router-roles", "r", nil, "Edge router roles of the new service edge router policy")
+	cmd.Flags().StringSliceVarP(&options.edgeRouterRoles, "edge-router-roles", "e", nil, "Edge router roles of the new service edge router policy")
 	cmd.Flags().StringSliceVarP(&options.serviceRoles, "service-roles", "s", nil, "Identity roles of the new service edge router policy")
 	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
 

ziti/cmd/ziti/cmd/edge_controller/create_service_policy.go

@@ -60,7 +60,7 @@ func newCreateServicePolicyCmd(f cmdutil.Factory, out io.Writer, errOut io.Write
 
 	// allow interspersing positional args and flags
 	cmd.Flags().SetInterspersed(true)
-	cmd.Flags().StringSliceVarP(&options.serviceRoles, "service-roles", "r", nil, "Service roles of the new service policy")
+	cmd.Flags().StringSliceVarP(&options.serviceRoles, "service-roles", "s", nil, "Service roles of the new service policy")
 	cmd.Flags().StringSliceVarP(&options.identityRoles, "identity-roles", "i", nil, "Identity roles of the new service policy")
 	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
 

ziti/cmd/ziti/cmd/edge_controller/list.go

@@ -24,6 +24,7 @@ import (
 	"io"
 	"net/url"
 	"reflect"
+	"strings"
 
 	"github.com/Jeffail/gabs"
 	"github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/common"
@@ -414,9 +415,18 @@ func outputEdgeRouterPolicies(o *commonOptions, children []*gabs.Container, pagi
 	for _, entity := range children {
 		id, _ := entity.Path("id").Data().(string)
 		name, _ := entity.Path("name").Data().(string)
-		edgeRouterRoles := entity.Path("edgeRouterRoles").String()
-		identityRoles := entity.Path("identityRoles").String()
-		_, err := fmt.Fprintf(o.Out, "id: %v    name: %v    edge router roles: %v    identity roles: %v\n", id, name, edgeRouterRoles, identityRoles)
+
+		identityRoles, err := mapRoleIdsToNames(entity, "identityRoles", "identities")
+		if err != nil {
+			return err
+		}
+
+		edgeRouterRoles, err := mapRoleIdsToNames(entity, "edgeRouterRoles", "edge-routers")
+		if err != nil {
+			return err
+		}
+
+		_, err = fmt.Fprintf(o.Out, "id: %v    name: %v    edge router roles: %v    identity roles: %v\n", id, name, edgeRouterRoles, identityRoles)
 		if err != nil {
 			return err
 		}
@@ -516,9 +526,15 @@ func outputServiceEdgeRouterPolicies(o *commonOptions, children []*gabs.Containe
 	for _, entity := range children {
 		id, _ := entity.Path("id").Data().(string)
 		name, _ := entity.Path("name").Data().(string)
-		edgeRouterRoles := entity.Path("edgeRouterRoles").String()
-		serviceRoles := entity.Path("serviceRoles").String()
-		_, err := fmt.Fprintf(o.Out, "id: %v    name: %v    edge router roles: %v    service roles: %v\n", id, name, edgeRouterRoles, serviceRoles)
+		edgeRouterRoles, err := mapRoleIdsToNames(entity, "edgeRouterRoles", "edge-routers")
+		if err != nil {
+			return err
+		}
+		serviceRoles, err := mapRoleIdsToNames(entity, "serviceRoles", "services")
+		if err != nil {
+			return err
+		}
+		_, err = fmt.Fprintf(o.Out, "id: %v    name: %v    edge router roles: %v    service roles: %v\n", id, name, edgeRouterRoles, serviceRoles)
 		if err != nil {
 			return err
 		}
@@ -544,9 +560,18 @@ func outputServicePolicies(o *commonOptions, children []*gabs.Container, pagingI
 		id, _ := entity.Path("id").Data().(string)
 		name, _ := entity.Path("name").Data().(string)
 		policyType, _ := entity.Path("type").Data().(string)
-		identityRoles := entity.Path("identityRoles").String()
-		serviceRoles := entity.Path("serviceRoles").String()
-		_, err := fmt.Fprintf(o.Out, "id: %v    name: %v    type: %v    service roles: %v    identity roles: %v\n", id, name, policyType, serviceRoles, identityRoles)
+
+		identityRoles, err := mapRoleIdsToNames(entity, "identityRoles", "identities")
+		if err != nil {
+			return err
+		}
+
+		serviceRoles, err := mapRoleIdsToNames(entity, "serviceRoles", "services")
+		if err != nil {
+			return err
+		}
+
+		_, err = fmt.Fprintf(o.Out, "id: %v    name: %v    type: %v    service roles: %v    identity roles: %v\n", id, name, policyType, serviceRoles, identityRoles)
 		if err != nil {
 			return err
 		}
@@ -555,6 +580,26 @@ func outputServicePolicies(o *commonOptions, children []*gabs.Container, pagingI
 	return nil
 }
 
+func mapRoleIdsToNames(c *gabs.Container, path string, entityType string) ([]string, error) {
+	values := c.Path(path).Data().([]interface{})
+
+	var result []string
+	for _, val := range values {
+		str := val.(string)
+		if strings.HasPrefix(str, "@") {
+			id := strings.TrimPrefix(str, "@")
+			name, err := mapIdToName(entityType, id)
+			if err != nil {
+				return nil, err
+			}
+			result = append(result, "@"+name)
+		} else {
+			result = append(result, str)
+		}
+	}
+	return result, nil
+}
+
 // runListIdentities implements the command to list identities
 func runListIdentities(roleFilters []string, roleSemantic string, options *commonOptions) error {
 	params := url.Values{}

ziti/cmd/ziti/cmd/edge_controller/update.go

@@ -41,7 +41,12 @@ func newUpdateCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Com
 	cmd.AddCommand(newUpdateAuthenticatorCmd(f, out, errOut))
 	cmd.AddCommand(newUpdateConfigCmd(f, out, errOut))
 	cmd.AddCommand(newUpdateCaCmd(f, out, errOut))
+	cmd.AddCommand(newUpdateEdgeRouterCmd(f, out, errOut))
+	cmd.AddCommand(newUpdateEdgeRouterPolicyCmd(f, out, errOut))
 	cmd.AddCommand(newUpdateIdentityCmd(f, out, errOut))
+	cmd.AddCommand(newUpdateServiceCmd(f, out, errOut))
+	cmd.AddCommand(newUpdateServicePolicyCmd(f, out, errOut))
+	cmd.AddCommand(newUpdateServiceEdgeRouterPolicyCmd(f, out, errOut))
 
 	return cmd
 }

ziti/cmd/ziti/cmd/edge_controller/update_edge_router.go

@@ -0,0 +1,94 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package edge_controller
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/pkg/errors"
+
+	"github.com/Jeffail/gabs"
+	"github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/common"
+	cmdutil "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/factory"
+	cmdhelper "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/helpers"
+	"github.com/spf13/cobra"
+)
+
+type updateEdgeRouterOptions struct {
+	commonOptions
+	name           string
+	roleAttributes []string
+}
+
+func newUpdateEdgeRouterCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &updateEdgeRouterOptions{
+		commonOptions: commonOptions{
+			CommonOptions: common.CommonOptions{Factory: f, Out: out, Err: errOut},
+		},
+	}
+
+	cmd := &cobra.Command{
+		Use:   "edge-router <idOrName>",
+		Short: "updates an edge router managed by the Ziti Edge Controller",
+		Long:  "updates an edge router managed by the Ziti Edge Controller",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			options.Cmd = cmd
+			options.Args = args
+			err := runUpdateEdgeRouter(options)
+			cmdhelper.CheckErr(err)
+		},
+		SuggestFor: []string{},
+	}
+
+	// allow interspersing positional args and flags
+	cmd.Flags().SetInterspersed(true)
+	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the edge router")
+	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
+	cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil,
+		"Set role attributes of the edge router. Use --role-attributes '' to set an empty list")
+
+	return cmd
+}
+
+// runUpdateEdgeRouter update a new edgeRouter on the Ziti Edge Controller
+func runUpdateEdgeRouter(o *updateEdgeRouterOptions) error {
+	id, err := mapNameToID("edge-routers", o.Args[0])
+	if err != nil {
+		return err
+	}
+	entityData := gabs.New()
+	change := false
+
+	if o.Cmd.Flags().Changed("name") {
+		setJSONValue(entityData, o.name, "name")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("role-attributes") {
+		setJSONValue(entityData, o.roleAttributes, "roleAttributes")
+		change = true
+	}
+
+	if !change {
+		return errors.New("no change specified. must specify at least one attribute to change")
+	}
+
+	_, err = patchEntityOfType(fmt.Sprintf("edge-routers/%v", id), entityData.String(), &o.commonOptions)
+	return err
+}

ziti/cmd/ziti/cmd/edge_controller/update_edge_router_policy.go

@@ -0,0 +1,110 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package edge_controller
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/pkg/errors"
+
+	"github.com/Jeffail/gabs"
+	"github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/common"
+	cmdutil "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/factory"
+	cmdhelper "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/helpers"
+	"github.com/spf13/cobra"
+)
+
+type updateEdgeRouterPolicyOptions struct {
+	commonOptions
+	name            string
+	edgeRouterRoles []string
+	identityRoles   []string
+}
+
+func newUpdateEdgeRouterPolicyCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &updateEdgeRouterPolicyOptions{
+		commonOptions: commonOptions{
+			CommonOptions: common.CommonOptions{Factory: f, Out: out, Err: errOut},
+		},
+	}
+
+	cmd := &cobra.Command{
+		Use:   "edge-router-policy <idOrName>",
+		Short: "updates an edge router policy managed by the Ziti Edge Controller",
+		Long:  "updates an edge router policy managed by the Ziti Edge Controller",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			options.Cmd = cmd
+			options.Args = args
+			err := runUpdateEdgeRouterPolicy(options)
+			cmdhelper.CheckErr(err)
+		},
+		SuggestFor: []string{},
+	}
+
+	// allow interspersing positional args and flags
+	cmd.Flags().SetInterspersed(true)
+	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the edge router policy")
+	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
+	cmd.Flags().StringSliceVarP(&options.edgeRouterRoles, "edge-router-roles", "e", nil, "Edge router roles of the edge router policy")
+	cmd.Flags().StringSliceVarP(&options.identityRoles, "identity-roles", "i", nil, "Identity roles of the edge router policy")
+
+	return cmd
+}
+
+func runUpdateEdgeRouterPolicy(o *updateEdgeRouterPolicyOptions) error {
+	id, err := mapNameToID("edge-router-policies", o.Args[0])
+	if err != nil {
+		return err
+	}
+
+	edgeRouterRoles, err := convertNamesToIds(o.edgeRouterRoles, "edge-routers")
+	if err != nil {
+		return err
+	}
+
+	identityRoles, err := convertNamesToIds(o.identityRoles, "identities")
+	if err != nil {
+		return err
+	}
+
+	entityData := gabs.New()
+	change := false
+
+	if o.Cmd.Flags().Changed("name") {
+		setJSONValue(entityData, o.name, "name")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("edge-router-roles") {
+		setJSONValue(entityData, edgeRouterRoles, "edgeRouterRoles")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("identity-roles") {
+		setJSONValue(entityData, identityRoles, "identityRoles")
+		change = true
+	}
+
+	if !change {
+		return errors.New("no change specified. must specify at least one attribute to change")
+	}
+
+	_, err = patchEntityOfType(fmt.Sprintf("edge-router-policies/%v", id), entityData.String(), &o.commonOptions)
+	return err
+}

ziti/cmd/ziti/cmd/edge_controller/update_identity.go

@@ -31,10 +31,10 @@ import (
 
 type updateIdentityOptions struct {
 	commonOptions
-	name string
+	name           string
+	roleAttributes []string
 }
 
-// newUpdateIdentityCmd updates the 'edge controller update service-policy' command
 func newUpdateIdentityCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &updateIdentityOptions{
 		commonOptions: commonOptions{
@@ -60,6 +60,8 @@ func newUpdateIdentityCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *c
 	cmd.Flags().SetInterspersed(true)
 	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the identity")
 	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
+	cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil,
+		"Set role attributes of the identity. Use --role-attributes '' to set an empty list")
 
 	return cmd
 }
@@ -73,20 +75,20 @@ func runUpdateIdentity(o *updateIdentityOptions) error {
 	entityData := gabs.New()
 	change := false
 
-	if len(o.name) > 0 {
+	if o.Cmd.Flags().Changed("name") {
 		setJSONValue(entityData, o.name, "name")
 		change = true
 	}
 
+	if o.Cmd.Flags().Changed("role-attributes") {
+		setJSONValue(entityData, o.roleAttributes, "roleAttributes")
+		change = true
+	}
+
 	if !change {
 		return errors.New("no change specified. must specify at least one attribute to change")
 	}
 
 	_, err = patchEntityOfType(fmt.Sprintf("identities/%v", id), entityData.String(), &o.commonOptions)
-
-	if err != nil {
-		panic(err)
-	}
-
 	return err
 }

ziti/cmd/ziti/cmd/edge_controller/update_service.go

@@ -0,0 +1,101 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package edge_controller
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/pkg/errors"
+
+	"github.com/Jeffail/gabs"
+	"github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/common"
+	cmdutil "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/factory"
+	cmdhelper "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/helpers"
+	"github.com/spf13/cobra"
+)
+
+type updateServiceOptions struct {
+	commonOptions
+	name               string
+	terminatorStrategy string
+	roleAttributes     []string
+}
+
+func newUpdateServiceCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &updateServiceOptions{
+		commonOptions: commonOptions{
+			CommonOptions: common.CommonOptions{Factory: f, Out: out, Err: errOut},
+		},
+	}
+
+	cmd := &cobra.Command{
+		Use:   "service <idOrName>",
+		Short: "updates a service managed by the Ziti Edge Controller",
+		Long:  "updates a service managed by the Ziti Edge Controller",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			options.Cmd = cmd
+			options.Args = args
+			err := runUpdateService(options)
+			cmdhelper.CheckErr(err)
+		},
+		SuggestFor: []string{},
+	}
+
+	// allow interspersing positional args and flags
+	cmd.Flags().SetInterspersed(true)
+	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the service")
+	cmd.Flags().StringVar(&options.terminatorStrategy, "terminator-strategy", "", "Specifies the terminator strategy for the service")
+	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
+	cmd.Flags().StringSliceVarP(&options.roleAttributes, "role-attributes", "a", nil,
+		"Set role attributes of the service. Use --role-attributes '' to set an empty list")
+
+	return cmd
+}
+
+// runUpdateService update a new service on the Ziti Edge Controller
+func runUpdateService(o *updateServiceOptions) error {
+	id, err := mapNameToID("services", o.Args[0])
+	if err != nil {
+		return err
+	}
+	entityData := gabs.New()
+	change := false
+
+	if o.Cmd.Flags().Changed("name") {
+		setJSONValue(entityData, o.name, "name")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("role-attributes") {
+		setJSONValue(entityData, o.roleAttributes, "roleAttributes")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("terminator-strategy") {
+		setJSONValue(entityData, o.terminatorStrategy, "terminatorStrategy")
+		change = true
+	}
+
+	if !change {
+		return errors.New("no change specified. must specify at least one attribute to change")
+	}
+
+	_, err = patchEntityOfType(fmt.Sprintf("services/%v", id), entityData.String(), &o.commonOptions)
+	return err
+}

ziti/cmd/ziti/cmd/edge_controller/update_service_edge_router_policy.go

@@ -0,0 +1,110 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package edge_controller
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/pkg/errors"
+
+	"github.com/Jeffail/gabs"
+	"github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/common"
+	cmdutil "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/factory"
+	cmdhelper "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/helpers"
+	"github.com/spf13/cobra"
+)
+
+type updateServiceEdgeRouterPolicyOptions struct {
+	commonOptions
+	name            string
+	edgeRouterRoles []string
+	serviceRoles    []string
+}
+
+func newUpdateServiceEdgeRouterPolicyCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &updateServiceEdgeRouterPolicyOptions{
+		commonOptions: commonOptions{
+			CommonOptions: common.CommonOptions{Factory: f, Out: out, Err: errOut},
+		},
+	}
+
+	cmd := &cobra.Command{
+		Use:   "service-edge-router-policy <idOrName>",
+		Short: "updates a service edge router policy managed by the Ziti Edge Controller",
+		Long:  "updates a service edge router policy managed by the Ziti Edge Controller",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			options.Cmd = cmd
+			options.Args = args
+			err := runUpdateServiceEdgeRouterPolicy(options)
+			cmdhelper.CheckErr(err)
+		},
+		SuggestFor: []string{},
+	}
+
+	// allow interspersing positional args and flags
+	cmd.Flags().SetInterspersed(true)
+	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the edge router policy")
+	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
+	cmd.Flags().StringSliceVarP(&options.edgeRouterRoles, "edge-router-roles", "e", nil, "Edge router roles of the service edge router policy")
+	cmd.Flags().StringSliceVarP(&options.serviceRoles, "service-roles", "s", nil, "Service roles of the service edge router policy")
+
+	return cmd
+}
+
+func runUpdateServiceEdgeRouterPolicy(o *updateServiceEdgeRouterPolicyOptions) error {
+	id, err := mapNameToID("service-edge-router-policies", o.Args[0])
+	if err != nil {
+		return err
+	}
+
+	edgeRouterRoles, err := convertNamesToIds(o.edgeRouterRoles, "edge-routers")
+	if err != nil {
+		return err
+	}
+
+	serviceRoles, err := convertNamesToIds(o.serviceRoles, "services")
+	if err != nil {
+		return err
+	}
+
+	entityData := gabs.New()
+	change := false
+
+	if o.Cmd.Flags().Changed("name") {
+		setJSONValue(entityData, o.name, "name")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("edge-router-roles") {
+		setJSONValue(entityData, edgeRouterRoles, "edgeRouterRoles")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("service-roles") {
+		setJSONValue(entityData, serviceRoles, "serviceRoles")
+		change = true
+	}
+
+	if !change {
+		return errors.New("no change specified. must specify at least one attribute to change")
+	}
+
+	_, err = patchEntityOfType(fmt.Sprintf("service-edge-router-policies/%v", id), entityData.String(), &o.commonOptions)
+	return err
+}

ziti/cmd/ziti/cmd/edge_controller/update_service_policy.go

@@ -0,0 +1,110 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package edge_controller
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/pkg/errors"
+
+	"github.com/Jeffail/gabs"
+	"github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/common"
+	cmdutil "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/factory"
+	cmdhelper "github.com/netfoundry/ziti-cmd/ziti/cmd/ziti/cmd/helpers"
+	"github.com/spf13/cobra"
+)
+
+type updateServicePolicyOptions struct {
+	commonOptions
+	name          string
+	serviceRoles  []string
+	identityRoles []string
+}
+
+func newUpdateServicePolicyCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &updateServicePolicyOptions{
+		commonOptions: commonOptions{
+			CommonOptions: common.CommonOptions{Factory: f, Out: out, Err: errOut},
+		},
+	}
+
+	cmd := &cobra.Command{
+		Use:   "service-policy <idOrName>",
+		Short: "updates a service-policy managed by the Ziti Edge Controller",
+		Long:  "updates a service-policy managed by the Ziti Edge Controller",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			options.Cmd = cmd
+			options.Args = args
+			err := runUpdateServicePolicy(options)
+			cmdhelper.CheckErr(err)
+		},
+		SuggestFor: []string{},
+	}
+
+	// allow interspersing positional args and flags
+	cmd.Flags().SetInterspersed(true)
+	cmd.Flags().StringVarP(&options.name, "name", "n", "", "Set the name of the service policy")
+	cmd.Flags().BoolVarP(&options.OutputJSONResponse, "output-json", "j", false, "Output the full JSON response from the Ziti Edge Controller")
+	cmd.Flags().StringSliceVarP(&options.serviceRoles, "service-roles", "s", nil, "Service roles of the service policy")
+	cmd.Flags().StringSliceVarP(&options.identityRoles, "identity-roles", "i", nil, "Identity roles of the service policy")
+
+	return cmd
+}
+
+func runUpdateServicePolicy(o *updateServicePolicyOptions) error {
+	id, err := mapNameToID("service-policies", o.Args[0])
+	if err != nil {
+		return err
+	}
+
+	serviceRoles, err := convertNamesToIds(o.serviceRoles, "services")
+	if err != nil {
+		return err
+	}
+
+	identityRoles, err := convertNamesToIds(o.identityRoles, "identities")
+	if err != nil {
+		return err
+	}
+
+	entityData := gabs.New()
+	change := false
+
+	if o.Cmd.Flags().Changed("name") {
+		setJSONValue(entityData, o.name, "name")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("service-roles") {
+		setJSONValue(entityData, serviceRoles, "serviceRoles")
+		change = true
+	}
+
+	if o.Cmd.Flags().Changed("identity-roles") {
+		setJSONValue(entityData, identityRoles, "identityRoles")
+		change = true
+	}
+
+	if !change {
+		return errors.New("no change specified. must specify at least one attribute to change")
+	}
+
+	_, err = patchEntityOfType(fmt.Sprintf("service-policies/%v", id), entityData.String(), &o.commonOptions)
+	return err
+}