[j jddlZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z mZddlmZddlmZmZddlmZddlmZddlmZejd Zejd ejd z Z!e j"d krdndZ#dZ$ia%ej&e'Z(dZ)dZ*Gdde+Z,Gdde+Z-Gdde+Z.GddZ/ d%dZ0d&dZ1 d'dZ2 d(d Z3d)d"Z4 d*d#Z5 d(d$Z6dS)+N) ApiClient Configuration)ConfigException)UTC parse_rfc3339) ExecProvider)google_auth_credentials)OpenIDRequestor)minutes KUBECONFIGz .kube/configWindows;:oidcctD]'} tj|#t$rY$wxYwiadSN) _temp_filesvaluesosremoveOSError) temp_files b/var/www/FlaskApp/flask-venv/lib/python3.11/site-packages/kubernetes_asyncio/config/kube_config.py_cleanup_temp_filesr-s^ ''))   Ii     D KKKs 2 ??ct|tz tjt kS)N)tzinfo)rEXPIRY_SKEW_PREVENTION_DELAYdatetimeutcnowreplacer)expirys r _is_expiredr$7s@ 6 " "%A A ''))111== >?c2eZdZdZ d dZdZdZdZdS) FileOrDataaCUtility class to read content of obj[%data_key_name] or file's content of obj[%file_key_name] and represent it as file or data. Note that the data is preferred. The obj[%file_key_name] will be used iff obj['%data_key_name'] is not set or empty. Assumption is file content is raw data and data field is base64 string. The assumption can be changed with base64_file_content flag. If set to False, the content of the file will assumed to be base64 and read as is. The default True value will result in base64 encode of the file content after read.NTc>|s|dz}d|_d|_||_||_|rt j|d||vr|||_dS||vrJtjtj||||_dSdS)Nz-dataT)nameexist_ok) _file_data_base64_file_content_temp_file_pathrmakedirspathnormpathjoin)selfobj file_key_name data_key_namefile_base_pathbase64_file_contenttemp_file_paths r__init__zFileOrData.__init__Fs 4)G3M  $7!-  < K^d ; ; ; ; C  ]+DJJJ c ! !)) ^S-?@@BBDJJJ" !r%cttdkrtjtt |}|tvr t|St j|j\}}|t|<t|d5}| t|t r| n|dddn #1swxYwY|S)Nr)dirwb) lenratexitregisterrstrtempfilemkstempr/openwrite isinstanceencode)r4content content_key_r*fds r_create_temp_file_with_contentz)FileOrData._create_temp_file_with_contentWs {  q O/ 0 0 0'll + % %{+ +"t';<<<4#' K $   P HHGS)A)ANW^^%%%w O O O P P P P P P P P P P P P P P P s?CC Cc|j o|j}|r|jrht|jtr|j}n|j}|tj||_n||j|_|jr;tj |jstd|jz|jS)zIf obj[%data_key_name] exists, return name of a file with base64 decoded obj[%data_key_name] content otherwise obj[%file_key_name].zFile does not exists: %s) r,r-r.rGrBrHrMbase64standard_b64decoderr1isfiler)r4use_data_if_no_filerIs ras_filezFileOrData.as_filees#'*n;  M( Mdj#..)"j//11GG"jG!@@-g6688 "@@LL : KbgnnTZ88 K!"8< $BBBB"   $     r%r'ceZdZ ddZddZdZdZdZdZd Z d Z d Z d Z d Z dZdZdZdZedZdS)KubeConfigLoaderNr(ct|tr||_ntd||_d|_d|_d|_d|_||||_||_ ||_ |r ||_ dSd|_ dS)Nz kube-config) rG ConfigNode_config_current_context_user_clusterproviderset_active_context_config_base_path_config_persisterr/_get_google_credentials)r4 config_dictactive_contextget_google_credentialsconfig_base_pathconfig_persisterr:s rr;zKubeConfigLoader.__init__s k: . . B&DLL%m[AADL $    ///!1!1- ! 0+AD ( ( (+/D ( ( (r%c| |jd}|jd||_|jddre|jdrK|jd|jddd}|r|d|_nd|_nd|_|jd|jdd d |_|j0d |jvr'd |jd vr|jd d |_td ||jdd |jdd|jdS) Ncurrent-contextcontextscontextuserusersT)safeclusterscluster auth-providerr*zHkubeconfig loader - current-context %s, cluster %s, user %s, provider %s) re get_with_namerfsafe_getrgrhriloggerdebug)r4 context_namerws rrjz#KubeConfigLoader.set_active_contexts  <(9:L $ Z 8 F F !!  !) , 5 5f = =  %%g.. <(66%i08t7EED "!&\ ! DJ Z0>>  !) ,Y 7999BD : !o&C&CRVR\]lRmHmHm J7?DM _!*95i@*95>>vFF]  $ $ $ $ $r%c4K|jstddS|jdkr|d{VdS|jt kr|d{VdSd|jvr8td|d{V}|rdStd|rdStd| dS)aRead authentication from kube-config user section if exists. This function goes through various authentication methods in user section of kube-config and stops if it finds a valid authentication method. The order of authentication methods is: 1. GCP auth-provider 2. token field (point to a token file) 3. oidc auth-provider 4. exec provided plugin 5. username/password z#No user section in current context.NgcpexeczTry to use exec providerzTry to load user tokenz Try to use username and password) rgrrriload_gcp_tokenPROVIDER_TYPE_OIDC_load_oid_tokenload_from_exec_plugin_load_user_token_load_user_pass_token)r4res_exec_plugins r_load_authenticationz%KubeConfigLoader._load_authentications>z  LL> ? ? ? F =E ! !%%'' ' ' ' ' ' ' ' F =. . .&&(( ( ( ( ( ( ( ( F TZ   LL3 4 4 4$($>$>$@$@@@@@@@O  -...  " "  F 7888 ""$$$$$r%c.Kd|jdvri|jdjd<|jdd}d|vsd|vrt|dr|jIt j|jr|d{V}n*|}nt |d{V}|j|jd<|j|jd<|j r| |j jd|dz|_|jS)Nconfigr|z access-tokenr# Bearer %s) rgvaluer$rmasyncioiscoroutinefunctionr tokenr#rlre)r4r credentialss rrzKubeConfigLoader.load_gcp_tokens7 4:o6 6 6:">"@"@KK$;F$C$CCCCCCC +6+K|jd}d|vrtdd|dvrH||d{Vd|dd|_|jS|ddd}t |dkrtd|d }|d t |d zz d zz }tjtj | d }| d }|Gttj|r||d{Vd|dd|_|jS)Nr|rzoidc: missing configurationid-tokenz Bearer {}.z8oidc: JWT tokens should contain 3 period-delimited partsr=utf8exp)rg ValueError _refresh_oidcformatrsplitr?jsonloadsrO b64decoderVgetr$r utcfromtimestamp)r4ripartsid_tokenjwt_attributesexpiress rrz KubeConfigLoader._load_oid_tokens:o. 8 # #:;; ; Xh/ / /$$X.. . . . . . . .$++HX,>z,JKKDJ: ":.44S99 u::??WXX X8QX**c11F$4X$>$>$E$Ef$M$MNN $$U++   )::7CC D D $$X.. . . . . . . . ''(::(FGG zr%cKd|dvrtdtjd5}d}||}|0||||j}t|dd|dd|dd|}||ddd{V}|d |dj d <|d |dj d<|j r| |j j ddddS#1swxYwYdS) Nz refresh-tokenrzAoidc: No valid id-token, and cannot refresh without refresh-tokenT)deletez client-idz client-secretzidp-issuer-urlrr refresh_token) rrCNamedTemporaryFile_retrieve_oidc_cacertrFflushr*r rrrlre)r4ricertfile ssl_ca_certcert_auth_data requestorresps rrzKubeConfigLoader._refresh_oidcs (8"4 4 4!"eff f  ( 5 5 5 ;K!77AAN)~...   &m '";/"?3"#34 I#00(1CO1TUUUUUUUUD37 3CHX  $Z 08<_8MHX  $_ 5% ;&&t|'9:::+ ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;sC9D77D;>D;cZd|dvr tj|ddSdS)Nzidp-certificate-authority-datar)rOr)r4ris rrz&KubeConfigLoader._retrieve_oidc_cacert4s3 +x/A A A#HX$67W$XYY Ytr%c K t|drt|jsdS||jj}t |jdd{V}d|vr/d|dz|_ d|vrt|d|_nd|vrd|vrt d dSt|dd|d |j |_t|dd|d |j |_nt d dS#t$$r2}t t'|Yd}~dSd}~wwxYw) Nexec_plugin_expiryTrrrexpirationTimestampclientCertificateData clientKeyDataz2exec: missing clientKeyData field in plugin outputF)r7r8r9r:zCexec: missing token or clientCertificateData field in plugin output)hasattrr$r_get_base_pathrhr1r rgrunrrrerrorr'r/rS cert_filekey_file ExceptionrB)r4 base_pathstatuses rrz&KubeConfigLoader.load_from_exec_plugin:s! !t122 ;tG^;_;_ t++DM,>??I' 6(:;;??AAAAAAAAF&  (6'?: (F22.;FCXEWYYN%/ L'0'+';%=%=%=>EWYYM & 6 6"&-0J"KKDO  - -#'=1B#CD $- ' '{3DJJJ ( 'r%c d|jvr|j|jd<gd}|D]*}||jvrt||t ||+dS)Nr BearerToken)rrrrrrr)rrapi_keysetattrgetattr)r4client_configurationkeyskeys r _set_configzKubeConfigLoader._set_configsx dm # #:>* ( 7::: G GCdm##,c743E3EFFF G Gr%cK|d{V|||dSr)rrr)r4rs r load_and_setzKubeConfigLoader.load_and_setsW''))))))))) !!! -.....r%c0d|jdDS)Ncg|] }|j Sr`r).0rvs r z2KubeConfigLoader.list_contexts..sFFF' FFFr%ru)rer4s r list_contextszKubeConfigLoader.list_contextssFFT\*-EFFFFr%c|jjSr)rfrrs rcurrent_contextz KubeConfigLoader.current_contexts$**r%)NNr(NNr)r\r]r^r;rjrrrrrrrrrrrrrpropertyrr`r%rrbrbs237(,"$"& $ 00000$$$$4%%%%%%N2@;;;6 "!"!"!H4448 G G G/// GGG++X+++r%rbc:eZdZdZd dZdZdZdZdZd d Z dS) rdzRemembers each config key's path and construct a relevant exception message in case of missing keys. The assumption is all access keys are present in a well-formed kube-config.Nc0||_||_||_dSr)r*rr1)r4r*rr1s rr;zConfigNode.__init__s   r%c||jvSrrr4rs r __contains__zConfigNode.__contains__sdj  r%c*t|jSr)r?rrs r__len__zConfigNode.__len__s4:r%ct|jtrt|ts|jr||jvr|j|SdSdSr)rGrlistintrs rr~zConfigNode.safe_getsZ tz4 ( ( #ZS-A-A # # #tz 1 1:c? " # # 1 1r%c||}|td|d|jt|tst|t r t |jd|||jS|S)Nz'Invalid kube-config file. Expected key  in r)r~rr*rGdictrrdr1)r4rvs r __getitem__zConfigNode.__getitem__s MM#   9!/33 #$$ $ a   *Q"5"5 CC8!TYGG GHr%Fct|jtstd|jzd}|jD]I}d|vrtd|jz|d|kr ||}.td|d|jdJ|8t|t r|St |jd|d||jS|rdStd |d|jd) Nz2Invalid kube-config file. Expected %s to be a listr*zKInvalid kube-config file. Expected all values in %s list to have 'name' keyz=Invalid kube-config file. Expected only one object with name rz listz[name=]z4Invalid kube-config file. Expected object with name )rGrrrr*rdr1)r4r*ryresultrs rr}zConfigNode.get_with_namesK$*d++ !D)  - -AQ%Ji !!!yD  >FF)/ 44,--- !  &*-- : !YYY&'-ty:::  4o9=tyyy JKK Kr%rF) r\r]r^r_r;rrr~rr}r`r%rrdrds-- !!!###   KKKKKKr%rdcFeZdZdZdZedZdZdZdZ dZ dS) KubeConfigMergeraReads and merges configuration from one or more kube-config's. The propery `config` can be passed to the KubeConfigLoader as config_dict. It uses a path attribute from ConfigNode to store the path to kubeconfig. This path is required to load certs from relative paths. A method `save_changes` updates changed kubeconfig's (it compares current state of dicts with). cg|_i|_d|_d}|tD]s}|rot j|}t j|r1|j || |d}ttj |j|_ |std|dSdS)NFTzConfig not found: %s)paths config_files config_mergedrENV_KUBECONFIG_PATH_SEPARATORrr1 expanduserexistsappend load_configcopydeepcopy config_savedrwarning)r4r file_loadedr1s rr;zKubeConfigMerger.__init__s ! KK =>> ' 'D 'w))$//7>>$'''J%%d+++$$T***"&K M$*;<< : NN15 9 9 9 9 9 : :r%c|jSr)r rs rrzKubeConfigMerger.configs !!r%ct|5}tj|}dddn #1swxYwY|j4t j|}dD]}g||<t ||||_dD]/}||||gpg|0d|vr|d|jj d<||j |<dS)N)rzrurxrt) rEyaml safe_loadr rrrd_mergerrr)r4r1rZrr items rrzKubeConfigMerger.load_config s+ $ZZ '1^A&&F ' ' ' ' ' ' ' ' ' ' ' ' ' ' '   % M&11M9 ) )&( d##!+D-!F!FD 5 @ @D KKfjjr228b$ ? ? ? ?  & &:@AR:SD  $%6 7"($s 155c |D]s}|jj|D]}|d|dkrnI|jj|td||||tdS)Nr*z{}/{})r rr rdr)r4radd_cfgr1new_itemr s rrzKubeConfigMerger._merges E EH,248 E E&>Xf%555E6"(.55jNN422Hd7D7DEEE  E Er%c|jD]3}|j||j|kr||4t j|j|_dSr)rrr save_configrr)r4r1s r save_changeszKubeConfigMerger.save_changes's^J ' 'D &$*;D*AAA  &&& M$*;<<r%ct|d5}tj|j||dddddS#1swxYwYdS)NwF)default_flow_style)rEr safe_dumpr)r4r1rZs rrzKubeConfigMerger.save_config-s $__ 5 N4,T2A.3 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5s#AAAN) r\r]r^r_r;rrrrrrr`r%rrrs:::"""X")))$EEE=== 55555r%rFc t|}|rd|vr||d<td|jdd|S)Nrr)rnrqr`)rrrbr)filenamepersist_configkwargskcfgs r%_get_kube_config_loader_for_yaml_filer)3si H % %D9,F::%)%6%6%8%8!"  K     r%c|$tjt}t |}||jfSr)rr1r KUBE_CONFIG_DEFAULT_LOCATIONr)rr) config_fileloaders rlist_kube_config_contextsr.@sEg(()EFF 2; ? ?F    ! !6#9 99r%TcK|t}t||||}|Ott}||d{Vt j|n||d{V|S)a`Loads authentication and cluster information from kube-config file and stores them in kubernetes.client.configuration. :param config_file: Name of the kube-config file. :param context: set the active context. If is set to None, current_context from config file will be used. :param client_configuration: The kubernetes.client.Configuration to set configs to. :param persist_config: If True, config file will be updated when changed (e.g GCP token refresh). :param temp_file_path: directory where temp files are stored (default - system temp dir). N)ror&r:)r+r)type__call__rr set_default)r,rvrr&r:r-rs rload_kube_configr3Is$2 2G%%'''F#}--!!&)))))))))!&))))!!"6777777777 Mr%cKt|d||}|Ott}||d{Vtj|n||d{V|S)aLoads authentication and cluster information from config_dict and stores them in kubernetes.client.configuration. :param config_dict: Takes the config file as a dict. :param context: set the active context. If is set to None, current_context from config file will be used. :param client_configuration: The kubernetes_asyncio.client.Configuration to set configs to. :param temp_file_path: directory where temp files are stored (default - system temp dir). N)rnrqror:)rbr0r1rrr2)rnrvrr:r-rs rload_kube_config_from_dictr5ls% '''F #}--!!&)))))))))!&))))!!"6777777777 Mr%<cXK|t|jdkrE tj|d{V|d{V|j|jd<Dd|jvrE tj|d{V|d{V|j|jd<DdS)a-Refresh token if necessary, updates the token in client configurarion :param loader: KubeConfigLoader returned by load_kube_config :param client_configuration: The kubernetes.client.Configuration to set configs to. :param interval: how often check if token is up-to-date Nrrrr) NotImplementedErrorrirsleeprrrrgr)r-rintervals rrrs#!! % G-)) ) ) ) ) ) ) )'')) ) ) ) ) ) ) ):@, ( 7 G 6<   G-)) ) ) ) ) ) ) )..00 0 0 0 0 0 0 0:@, ( 7 G r%cKtt}t|||||d{Vt |S)zLoads configuration the same as load_kube_config but returns an ApiClient to be used with any API object. This will allow the caller to concurrently talk with multiple clusters.)r,rvrr&r:N configuration)r0r1rr3r)r,rvr&r: client_configs rnew_client_from_configr?sn MM-00M {G0=*8*8 : : :::::::: = 1 1 11r%cKtt}t||||d{Vt |S)zLoads configuration the same as load_kube_config_dict but returns an ApiClient to be used with any API object. This will allow the caller to concurrently talk with multiple clusters.)rnrvrr:Nr<)r0r1rr5r)rnrvr:r>s rnew_client_from_config_dictrAsu MM-00M $g:G4B D D DDDDDDDD = 1 1 11r%rr)NNNTN)NNN)Nr6)NNTN)7rr@rOrr rloggingrpathlibplatformrCrkubernetes_asyncio.clientrrconfig_exceptionrdateutilrr exec_providerr google_authr openidr timedeltarenvironrPathhomeas_posixr+systemr rr getLoggerr\rrr$objectr'rbrdrr)r.r3r5rr?rAr`r%rrSs'    >>>>>>>>------((((((((''''''000000######1x1!<<<!z~~lW\=N=N=P=PSa=a48>GGGG2QU04 2 2 2 2AE59 2 2 2 2 2 2r%