dQj7kzddlZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z mZddlmZddlmZmZddlmZddlmZddlmZej4d Zej8j;d ej<j?d z jAZ!e jDd k(rdndZ#dZ$ia%ejLe'Z(dZ)d#dZ*dZ+Gdde,Z-Gdde,Z.Gdde,Z/GddZ0 d$dZ1d%dZ2 d&dZ3 d'dZ4d(d Z5 d)d!Z6 d'd"Z7y)*N) ApiClient Configuration)ConfigException)UTC parse_rfc3339) ExecProvider)google_auth_credentials)OpenIDRequestor)minutes KUBECONFIGz .kube/configWindows;:oidcctjD]} tj|iay#t$rY)wxYwN) _temp_filesvaluesosremoveOSError) temp_files f/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/kubernetes/aio/config/kube_config.py_cleanup_temp_filesr-sF '')   IIi  K   s 3 ??cttdk(rtjtt |}|s|tvr t|S|r5t jj|st j|tj|\}}t j||t|<t|d5}|jt|t r|j!n|ddd|S#1swY|SxYw)Nr)name)dirwb)lenratexitregisterrstrrpathisdirmakedirstempfilemkstempcloseopenwrite isinstanceencode)contenttemp_file_pathforce_recreate content_keyfdrs r_create_temp_file_with_contentr47s ;1+,g,K k[8;''bggmmN; (N3HBHHRL#K  dD LR Z%=!7KL KL Ks 2DD ct|tz tjjj t kS)N)tzinfo)rEXPIRY_SKEW_PREVENTION_DELAYdatetimeutcnowreplacer)expirys r _is_expiredr<Ks: 6 "%A A  '')111= >?c0eZdZdZ ddZdZdZdZy) FileOrDataaCUtility class to read content of obj[%data_key_name] or file's content of obj[%file_key_name] and represent it as file or data. Note that the data is preferred. The obj[%file_key_name] will be used iff obj['%data_key_name'] is not set or empty. Assumption is file content is raw data and data field is base64 string. The assumption can be changed with base64_file_content flag. If set to False, the content of the file will assumed to be base64 and read as is. The default True value will result in base64 encode of the file content after read.Nc.|s|dz}d|_d|_||_||_|rt j |d||vr |||_y||vrFtj jtj j||||_yy)Nz-dataT)rexist_ok) _file_data_base64_file_content_temp_file_pathrr'r%normpathjoin)selfobj file_key_name data_key_namefile_base_pathbase64_file_contentr0s r__init__zFileOrData.__init__Zs)G3M  $7!-  KK^d ; C ]+DJ c !)) ^S-?@BDJ"r=c.t||jSr)r4rE)rHr/s rr4z)FileOrData._create_temp_file_with_contentks-gt7K7KLLr=c|j xr |j}|r|jrkt|jtr|jj }n |j}|j tj||_n |j |j|_|jrAtjj|jstd|jz|jS)zIf obj[%data_key_name] exists, return name of a file with base64 decoded obj[%data_key_name] content otherwise obj[%file_key_name].zFile does not exists: %s) rBrCrDr-r$r.r4base64standard_b64decoderr%isfiler)rHuse_data_if_no_filer/s ras_filezFileOrData.as_filens#'**n; ((djj#."jj//1G"jjG!@@--g68 "@@L ::bggnnTZZ8!"8< $B"M$ r=r?ceZdZ ddZddZdZdZdZdZdZ d Z d Z d Z d Z d ZdZdZdZedZy)KubeConfigLoaderNct|tr||_ntd||_d|_d|_d|_d|_|j|||_||_ ||_ |r||_ yd|_ y)Nz kube-config) r- ConfigNode_config_current_context_user_clusterproviderset_active_context_config_base_path_config_persisterrE_get_google_credentials)rH config_dictactive_contextget_google_credentialsconfig_base_pathconfig_persisterr0s rrNzKubeConfigLoader.__init__sy k: .&DL%m[ADL $    /!1!1- !+AD (+/D (r=c||jd}|jdj||_|jdjdr`|jjdrE|jdj|jddd}|r |d|_nd|_nd|_|jdj|jdd d |_|j6d |jvr(d |jd vr|jd d |_tjd ||jdd |jdjd|j y) Ncurrent-contextcontextscontextuserusersT)safeclusterscluster auth-providerrzHkubeconfig loader - current-context %s, cluster %s, user %s, provider %s) rh get_with_namerisafe_getrjrkrlloggerdebug)rH context_namerzs rrmz#KubeConfigLoader.set_active_contextsk  <<(9:L $ Z 8 F F !  ! !) , 5 5f = %%g.<<(66%%i08t7ED!&\ ! DJ Z0>>  ! !) ,Y 799BD :: !o&CRVR\R\]lRmHm JJ7?DM _!**95i@**95>>vF]]  $r=cK|jstjdy|jdk(r|j d{y|jt k(r|j d{yd|jvr0tjd|jd{}|rytjd|jrytjd|jy777Ww)aRead authentication from kube-config user section if exists. This function goes through various authentication methods in user section of kube-config and stops if it finds a valid authentication method. The order of authentication methods is: 1. GCP auth-provider 2. token field (point to a token file) 3. oidc auth-provider 4. exec provided plugin 5. username/password z#No user section in current context.NgcpexeczTry to use exec providerzTry to load user tokenz Try to use username and password) rjrrrlload_gcp_tokenPROVIDER_TYPE_OIDC_load_oid_tokenload_from_exec_plugin_load_user_token_load_user_pass_token)rHres_exec_plugins r_load_authenticationz%KubeConfigLoader._load_authenticationszz LL> ?  ==E !%%' ' '  ==. .&&( ( (  TZZ  LL3 4$($>$>$@@O -.  "  78 ""$% ( ) As7AD D+D 3D4;D /D0AD D D cKd|jdvri|jdjd<|jdd}d|vsd|vrt|dr|jIt j |jr|jd{}n$|j}nt |d{}|j|jd<|j|jd<|jr%|j|jjd|dz|_|jS77w)Nconfigrz access-tokenr; Bearer %s) rjvaluer<rpasyncioiscoroutinefunctionr tokenr;rorh)rHr credentialss rrzKubeConfigLoader.load_gcp_tokens 4::o6 6:">"@K$;F$CC +6+<+EcK|jd}d|vr tdd|dvrA|j|d{dj|dd|_|jS|ddj d}t |dk7r td|d }|d t |d zz d zz }tjtj|jd }|jd }|Attjj|r|j|d{dj|dd|_|jS7,7/w)Nrrzoidc: missing configurationid-tokenz Bearer {}.z8oidc: JWT tokens should contain 3 period-delimited partsr=utf8exp)rj ValueError _refresh_oidcformatrsplitr!jsonloadsrQ b64decoderXgetr<r8utcfromtimestamp)rHrlpartsid_tokenjwt_attributesexpiress rrz KubeConfigLoader._load_oid_tokens`::o. 8 #:; ; Xh/ /$$X. . .$++HX,>z,JKDJ:: ":.44S9 u:?WX X8QX**c11F$4$4X$>$E$Ef$MN $$U+   ))::7C D$$X. . . ''(::(FG zz/ /( /s":E-E(C>E-;E+<-E-+E-cKd|dvr tdd}|j|}| t|}t|dd|dd|dd|}|j |ddd{}|d|dj d<|d |dj d<|j r&|j |jj yy7aw) Nz refresh-tokenrzAoidc: No valid id-token, and cannot refresh without refresh-tokenz client-idz client-secretzidp-issuer-urlrr refresh_token)r_retrieve_oidc_cacertr4r rrrorh)rHrl ssl_ca_certcert_auth_data requestorresps rrzKubeConfigLoader._refresh_oidc"s (8"4 4!"ef f 33H=  %9HK# X { + X  / X / 0   ,,Xh-?-PQQ/3J/?  ,484I  1  ! !  " "4<<#5#5 6 " RsA-C/C0A"CcHd|dvrtj|ddSy)Nzidp-certificate-authority-datar)rQr)rHrls rrz&KubeConfigLoader._retrieve_oidc_cacert>s. +x/A A##HX$67W$XY Yr=cK t|drt|jsy|j|jj }t |jdjd{}d|vr%d|dz|_ d|vrt|d|_yd|vrwd|vrtjd yt|dd|d |j j|_t|dd|d |j j|_ytjd y7#t$$r(}tjt'|Yd}~yd}~wwxYww) Nexec_plugin_expiryTrrrexpirationTimestampclientCertificateData clientKeyDataz2exec: missing clientKeyData field in plugin outputF)rKrLrMr0zCexec: missing token or clientCertificateData field in plugin output)hasattrr<r_get_base_pathrkr%r rjrunrrrerrorr?rErU cert_filekey_file Exceptionr$)rH base_pathstatuses rrz&KubeConfigLoader.load_from_exec_pluginDsf! !t12;tG^G^;_++DMM,>,>?I' 6(:;??AAF& (6'?: (F2.;FCXE!E)!E&&E)c|j|jj}t|jdd|dj }|r d|z|_yy)N tokenFilerF)rLrMrT)rrjr%r?r]r)rHrrs rrz!KubeConfigLoader._load_user_tokenhsZ'' 8  JJ W$ %'(/wy  $u,DJ r=cd|jvrld|jvr]|jddz|jdz}dtj|jj dz|_yyy)NusernamepasswordrzBasic zutf-8T)rjrQ b64encoder.rXr)rH basic_auths rrz&KubeConfigLoader._load_user_pass_tokenrst  # djj(@J/#5 :8NNJ!F$4$4!!#%%%+VG_5DJ )A #r=c|j |jS|EWYN%/ L'0'+';';%=>EWYM & 6"&--0J"KKDO  -#'==1B#CD $-- '{3DJ (r=c d|jvr|j|jd<gd}|D](}||jvst||t ||*y)Nr BearerToken)rrrrrrr)rrapi_keysetattrgetattr)rHclient_configurationkeyskeys r _set_configzKubeConfigLoader._set_configs[ dmm #:>** ( ( 7: GCdmm#,c743EF Gr=cK|jd{|j|j|y7&wr)rrr)rHrs r load_and_setzKubeConfigLoader.load_and_sets8''))) ! -. *s ?='?cZ|jdDcgc]}|jc}Scc}w)Nrx)rhr)rHrys r list_contextszKubeConfigLoader.list_contextss#-1\\*-EF' FFFs(c.|jjSr)rirrHs rcurrent_contextz KubeConfigLoader.current_contexts$$***r=)NNr^NNr)r_r`rarNrmrrrrrrrrrrrrrpropertyrrcr=rreresu37(,"$"& $ 00$4%%N2@78 "!H48 G/ G++r=rec8eZdZdZd dZdZdZdZdZd dZ y) rgzRemembers each config key's path and construct a relevant exception message in case of missing keys. The assumption is all access keys are present in a well-formed kube-config.Nc.||_||_||_yr)rrr%)rHrrr%s rrNzConfigNode.__init__s   r=c||jvSr)rrHrs r __contains__zConfigNode.__contains__sdjj  r=c,t|jSr)r!rrs r__len__zConfigNode.__len__s4::r=ct|jtrt|ts|jr||jvr|j|Syyr)r-rlistintrs rrzConfigNode.safe_gets@ tzz4 (ZS-Atzz 1::c? "!2r=c|j|}|td|d|jt|tst|t r&t |jd|||jS|S)Nz'Invalid kube-config file. Expected key  in r)rrrr-dictrrgr%)rHrvs r __getitem__zConfigNode.__getitem__sf MM#  9! #$ $ a *Q"5C8!TYYG GHr=ct|jtstd|jzd}|jD]G}d|vrtd|jz|d|k(s(||}-td|d|jd|9t|t r|St |jd|d||j S|rytd |d|jd) Nz2Invalid kube-config file. Expected %s to be a listrzKInvalid kube-config file. Expected all values in %s list to have 'name' keyz=Invalid kube-config file. Expected only one object with name rz listz[name=]z4Invalid kube-config file. Expected object with name )r-rrrrrgr%)rHrr|resultrs rrzConfigNode.get_with_names$**d+!D))  -AQ%Jii !!yD >F) ,-- -  &*- !YY&'-tyy:: 9=tyy JK Kr=rF) r_r`rarbrNrrrrrrcr=rrgrgs&- !# Kr=rgc>eZdZdZdZedZdZdZdZ dZ y) KubeConfigMergeraReads and merges configuration from one or more kube-config's. The propery `config` can be passed to the KubeConfigLoader as config_dict. It uses a path attribute from ConfigNode to store the path to kubeconfig. This path is required to load certs from relative paths. A method `save_changes` updates changed kubeconfig's (it compares current state of dicts with). cg|_i|_d|_d}|jtD]r}|st j j|}t j j|sE|jj||j|d}ttj|j|_ |stjd|yy)NFTzConfig not found: %s)paths config_files config_mergedrENV_KUBECONFIG_PATH_SEPARATORrr% expanduserexistsappend load_configcopydeepcopy config_savedrwarning)rHr file_loadedr%s rrNzKubeConfigMerger.__init__s ! KK => 'Dww))$/77>>$'JJ%%d+$$T*"&K  '!MM$*;*;< NN15 9r=c|jSr)rrs rrzKubeConfigMerger.configs!!!r=ct|5}tj|}ddd|j3t j }dD]}g||< t ||||_dD])}|j|j|gxsg|+dvr|d|jjd<||j|<y#1swYxYw)N)r}rxr{rw) r+yaml safe_loadrr r rg_mergerrr)rHr%r\rritems rr zKubeConfigMerger.load_configs $Z '1^^A&F '    % MM&1M9 )&( d# )!+D-!FD 5 @D KKfjjr28b$ ? @  &:@AR:SD   $ $%6 7"($ ' 's CCc |D]p}|jj|D]}|d|dk(s-|jj|jtdj ||||ry)Nrz{}/{})rrrrgr)rHradd_cfgr%new_itemrs rrzKubeConfigMerger._merge(s EH,,2248 E&>Xf%55 E""((.55jNN42Hd7DE  Er=c|jD]3}|j||j|k7s#|j|5t j |j|_yr)rr r save_configr r )rHr%s r save_changeszKubeConfigMerger.save_changes1sZJJ 'D  &$*;*;D*AA  & '!MM$*;*;<r=ct|d5}tj|j||ddddy#1swYyxYw)NwF)default_flow_style)r+r safe_dumpr)rHr%r\s rrzKubeConfigMerger.save_config7s@ $_ 5 NN4,,T2A.3 5 5 5 5s &<AN) r_r`rarbrNrrr rrrrcr=rrrs5:""")$E= 5r=rc zt|}|rd|vr|j|d<td|jdd|S)Nru)rqrtrc)rrrer)filenamepersist_configkwargskcfgs r%_get_kube_config_loader_for_yaml_filer$=sS H %D,F:%)%6%6%8!"  KK   r=c|#tjjt}t |}|j |j fSr)rr%rKUBE_CONFIG_DEFAULT_LOCATIONr$rr) config_fileloaders rlist_kube_config_contextsr)JsAgg(()EF 2; ?F    !6#9#9 99r=c K|t}t||||}|Itjt}|j |d{t j ||S|j |d{|S767w)a`Loads authentication and cluster information from kube-config file and stores them in kubernetes.client.configuration. :param config_file: Name of the kube-config file. :param context: set the active context. If is set to None, current_context from config file will be used. :param client_configuration: The kubernetes.client.Configuration to set configs to. :param persist_config: If True, config file will be updated when changed (e.g GCP token refresh). :param temp_file_path: directory where temp files are stored (default - system temp dir). N)rrr!r0)r&r$type__call__rr set_default)r'ryrr!r0r(rs rload_kube_configr.Ss$2 2G%%'F#}-!!&)))!!&) M!!"6777 M * 8s$AB B /B9B:BBcKt|d||}|Itjt}|j |d{tj ||S|j |d{|S767w)aLoads authentication and cluster information from config_dict and stores them in kubernetes.client.configuration. :param config_dict: Takes the config file as a dict. :param context: set the active context. If is set to None, current_context from config file will be used. :param client_configuration: The kubernetes.aio.client.Configuration to set configs to. :param temp_file_path: directory where temp files are stored (default - system temp dir). N)rqrtrrr0)rer+r,rrr-)rqryrr0r(rs rload_kube_config_from_dictr0vs% 'F #}-!!&)))!!&) M!!"6777 M * 8s#?A<A8/A<1A:2A<:A<cK|t|jdk(rP tj|d{|j d{|j |j d<Od|jvrP tj|d{|jd{|j |j d<Oy777;7%w)a-Refresh token if necessary, updates the token in client configurarion :param loader: KubeConfigLoader returned by load_kube_config :param client_configuration: The kubernetes.client.Configuration to set configs to. :param interval: how often check if token is up-to-date Nrrr) NotImplementedErrorrlrsleeprrrrjr)r(rintervals rrrs#!! %--) ) )'') ) ):@,, ( ( 7 6<< --) ) )..0 0 0:@,, ( ( 7  * ) * 0sF1CC C C  ACC C)C* C C CCcKtjt}t|||||d{t |S7w)zLoads configuration the same as load_kube_config but returns an ApiClient to be used with any API object. This will allow the caller to concurrently talk with multiple clusters.)r'ryrr!r0N configuration)r+r,rr.r)r'ryr!r0 client_configs rnew_client_from_configr9sG MM-0M {G0=*8*8 ::: = 11 :s-AAAcKtjt}t||||d{t |S7w)zLoads configuration the same as load_kube_config_dict but returns an ApiClient to be used with any API object. This will allow the caller to concurrently talk with multiple clusters.)rqryrr0Nr6)r+r,rr0r)rqryr0r8s rnew_client_from_config_dictr;sH MM-0M $g:G4B DDD = 11 Ds,A?A)NFrr)NNNTN)NNN)N<)NNTN)8rr"rQr r8rloggingrpathlibplatformr(rkubernetes.aio.clientrrconfig_exceptionrdateutilrr exec_providerr google_authr openidr timedeltar7environrPathhomeas_posixr&systemrrr getLoggerr_rrr4r<objectr?rergrr$r)r.r0rr9r;rcr=rrNsT    :-('0#1x11!<!zz~~lW\\=N=N=PSa=a48>G2QU04 2AE59 2r=