feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/__init__.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from .config_exception import ConfigException
+from .incluster_config import load_incluster_config
+from .kube_config import (list_kube_config_contexts, load_kube_config,
+                          new_client_from_config)

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/config_exception.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+class ConfigException(Exception):
+  pass

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/dateutil.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import datetime
+import math
+import re
+
+
+class TimezoneInfo(datetime.tzinfo):
+
+  def __init__(self, h, m):
+    self._name = "UTC"
+    if h != 0 and m != 0:
+      self._name += "%+03d:%2d" % (h, m)
+    self._delta = datetime.timedelta(hours=h, minutes=math.copysign(m, h))
+
+  def utcoffset(self, dt):
+    return self._delta
+
+  def tzname(self, dt):
+    return self._name
+
+  def dst(self, dt):
+    return datetime.timedelta(0)
+
+
+UTC = TimezoneInfo(0, 0)
+
+# ref https://www.ietf.org/rfc/rfc3339.txt
+_re_rfc3339 = re.compile(
+    r"(\d\d\d\d)-(\d\d)-(\d\d)"  # full-date
+    r"[ Tt]"  # Separator
+    r"(\d\d):(\d\d):(\d\d)([.,]\d+)?"  # partial-time
+    r"([zZ ]|[-+]\d\d?:\d\d)?",  # time-offset
+    re.VERBOSE + re.IGNORECASE)
+_re_timezone = re.compile(r"([-+])(\d\d?):?(\d\d)?")
+
+
+def parse_rfc3339(s):
+  if isinstance(s, datetime.datetime):
+    # no need to parse it, just make sure it has a timezone.
+    if not s.tzinfo:
+      return s.replace(tzinfo=UTC)
+    return s
+  groups = _re_rfc3339.search(s).groups()
+  dt = [0] * 7
+  for x in range(6):
+    dt[x] = int(groups[x])
+  if groups[6] is not None:
+    dt[6] = int(groups[6])
+  tz = UTC
+  if groups[7] is not None and groups[7] != "Z" and groups[7] != "z":
+    tz_groups = _re_timezone.search(groups[7]).groups()
+    hour = int(tz_groups[1])
+    minute = 0
+    if tz_groups[0] == "-":
+      hour *= -1
+    if tz_groups[2]:
+      minute = int(tz_groups[2])
+    tz = TimezoneInfo(hour, minute)
+  return datetime.datetime(
+      year=dt[0],
+      month=dt[1],
+      day=dt[2],
+      hour=dt[3],
+      minute=dt[4],
+      second=dt[5],
+      microsecond=dt[6],
+      tzinfo=tz)
+
+
+def format_rfc3339(date_time):
+  if date_time.tzinfo is None:
+    date_time = date_time.replace(tzinfo=UTC)
+  date_time = date_time.astimezone(UTC)
+  return date_time.strftime("%Y-%m-%dT%H:%M:%SZ")

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/dateutil_test.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import unittest
+from datetime import datetime
+
+from .dateutil import UTC, TimezoneInfo, format_rfc3339, parse_rfc3339
+
+
+class DateUtilTest(unittest.TestCase):
+
+  def _parse_rfc3339_test(self, st, y, m, d, h, mn, s):
+    actual = parse_rfc3339(st)
+    expected = datetime(y, m, d, h, mn, s, 0, UTC)
+    self.assertEqual(expected, actual)
+
+  def test_parse_rfc3339(self):
+    self._parse_rfc3339_test("2017-07-25T04:44:21Z", 2017, 7, 25, 4, 44, 21)
+    self._parse_rfc3339_test("2017-07-25 04:44:21Z", 2017, 7, 25, 4, 44, 21)
+    self._parse_rfc3339_test("2017-07-25T04:44:21", 2017, 7, 25, 4, 44, 21)
+    self._parse_rfc3339_test("2017-07-25T04:44:21z", 2017, 7, 25, 4, 44, 21)
+    self._parse_rfc3339_test("2017-07-25T04:44:21+03:00", 2017, 7, 25, 1, 44,
+                             21)
+    self._parse_rfc3339_test("2017-07-25T04:44:21-03:00", 2017, 7, 25, 7, 44,
+                             21)
+
+  def test_format_rfc3339(self):
+    self.assertEqual(
+        format_rfc3339(datetime(2017, 7, 25, 4, 44, 21, 0, UTC)),
+        "2017-07-25T04:44:21Z")
+    self.assertEqual(
+        format_rfc3339(datetime(2017, 7, 25, 4, 44, 21, 0, TimezoneInfo(2, 0))),
+        "2017-07-25T02:44:21Z")
+    self.assertEqual(
+        format_rfc3339(
+            datetime(2017, 7, 25, 4, 44, 21, 0, TimezoneInfo(-2, 30))),
+        "2017-07-25T07:14:21Z")

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/exec_provider.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python
+
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import json
+import os
+import subprocess
+import sys
+
+from .config_exception import ConfigException
+
+
+class ExecProvider(object):
+  """
+    Implementation of the proposal for out-of-tree client
+    authentication providers as described here --
+    https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/kubectl-exec-plugins.md
+
+    Missing from implementation:
+
+    * TLS cert support
+    * caching
+    """
+
+  def __init__(self, exec_config):
+    """
+        exec_config must be of type ConfigNode because we depend on
+        safe_get(self, key) to correctly handle optional exec provider
+        config parameters.
+        """
+    for key in ['command', 'apiVersion']:
+      if key not in exec_config:
+        raise ConfigException('exec: malformed request. missing key \'%s\'' %
+                              key)
+    self.api_version = exec_config['apiVersion']
+    self.args = [exec_config['command']]
+    if exec_config.safe_get('args'):
+      self.args.extend(exec_config['args'])
+    self.env = os.environ.copy()
+    if exec_config.safe_get('env'):
+      additional_vars = {}
+      for item in exec_config['env']:
+        name = item['name']
+        value = item['value']
+        additional_vars[name] = value
+      self.env.update(additional_vars)
+
+  def run(self, previous_response=None):
+    kubernetes_exec_info = {
+        'apiVersion': self.api_version,
+        'kind': 'ExecCredential',
+        'spec': {
+            'interactive': sys.stdout.isatty()
+        }
+    }
+    if previous_response:
+      kubernetes_exec_info['spec']['response'] = previous_response
+    self.env['KUBERNETES_EXEC_INFO'] = json.dumps(kubernetes_exec_info)
+    process = subprocess.Popen(
+        self.args,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=self.env,
+        universal_newlines=True)
+    (stdout, stderr) = process.communicate()
+    exit_code = process.wait()
+    if exit_code != 0:
+      msg = 'exec: process returned %d' % exit_code
+      stderr = stderr.strip()
+      if stderr:
+        msg += '. %s' % stderr
+      raise ConfigException(msg)
+    try:
+      data = json.loads(stdout)
+    except ValueError as de:
+      raise ConfigException('exec: failed to decode process output: %s' % de)
+    for key in ('apiVersion', 'kind', 'status'):
+      if key not in data:
+        raise ConfigException('exec: malformed response. missing key \'%s\'' %
+                              key)
+    if data['apiVersion'] != self.api_version:
+      raise ConfigException('exec: plugin api version %s does not match %s' %
+                            (data['apiVersion'], self.api_version))
+    return data['status']

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/exec_provider_test.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python
+
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import unittest
+
+import mock
+
+from .config_exception import ConfigException
+from .exec_provider import ExecProvider
+from .kube_config import ConfigNode
+
+
+class ExecProviderTest(unittest.TestCase):
+
+  def setUp(self):
+    self.input_ok = ConfigNode(
+        'test', {
+            'command': 'aws-iam-authenticator',
+            'args': ['token', '-i', 'dummy'],
+            'apiVersion': 'client.authentication.k8s.io/v1beta1',
+            'env': None
+        })
+    self.output_ok = """
+        {
+            "apiVersion": "client.authentication.k8s.io/v1beta1",
+            "kind": "ExecCredential",
+            "status": {
+                "token": "dummy"
+            }
+        }
+        """
+
+  def test_missing_input_keys(self):
+    exec_configs = [
+        ConfigNode('test1', {}),
+        ConfigNode('test2', {'command': ''}),
+        ConfigNode('test3', {'apiVersion': ''})
+    ]
+    for exec_config in exec_configs:
+      with self.assertRaises(ConfigException) as context:
+        ExecProvider(exec_config)
+      self.assertIn('exec: malformed request. missing key',
+                    context.exception.args[0])
+
+  @mock.patch('subprocess.Popen')
+  def test_error_code_returned(self, mock):
+    instance = mock.return_value
+    instance.wait.return_value = 1
+    instance.communicate.return_value = ('', '')
+    with self.assertRaises(ConfigException) as context:
+      ep = ExecProvider(self.input_ok)
+      ep.run()
+    self.assertIn('exec: process returned %d' % instance.wait.return_value,
+                  context.exception.args[0])
+
+  @mock.patch('subprocess.Popen')
+  def test_nonjson_output_returned(self, mock):
+    instance = mock.return_value
+    instance.wait.return_value = 0
+    instance.communicate.return_value = ('', '')
+    with self.assertRaises(ConfigException) as context:
+      ep = ExecProvider(self.input_ok)
+      ep.run()
+    self.assertIn('exec: failed to decode process output',
+                  context.exception.args[0])
+
+  @mock.patch('subprocess.Popen')
+  def test_missing_output_keys(self, mock):
+    instance = mock.return_value
+    instance.wait.return_value = 0
+    outputs = [
+        """
+            {
+                "kind": "ExecCredential",
+                "status": {
+                    "token": "dummy"
+                }
+            }
+            """, """
+            {
+                "apiVersion": "client.authentication.k8s.io/v1beta1",
+                "status": {
+                    "token": "dummy"
+                }
+            }
+            """, """
+            {
+                "apiVersion": "client.authentication.k8s.io/v1beta1",
+                "kind": "ExecCredential"
+            }
+            """
+    ]
+    for output in outputs:
+      instance.communicate.return_value = (output, '')
+      with self.assertRaises(ConfigException) as context:
+        ep = ExecProvider(self.input_ok)
+        ep.run()
+      self.assertIn('exec: malformed response. missing key',
+                    context.exception.args[0])
+
+  @mock.patch('subprocess.Popen')
+  def test_mismatched_api_version(self, mock):
+    instance = mock.return_value
+    instance.wait.return_value = 0
+    wrong_api_version = 'client.authentication.k8s.io/v1'
+    output = """
+        {
+            "apiVersion": "%s",
+            "kind": "ExecCredential",
+            "status": {
+                "token": "dummy"
+            }
+        }
+        """ % wrong_api_version
+    instance.communicate.return_value = (output, '')
+    with self.assertRaises(ConfigException) as context:
+      ep = ExecProvider(self.input_ok)
+      ep.run()
+    self.assertIn(
+        'exec: plugin api version %s does not match' % wrong_api_version,
+        context.exception.args[0])
+
+  @mock.patch('subprocess.Popen')
+  def test_ok_01(self, mock):
+    instance = mock.return_value
+    instance.wait.return_value = 0
+    instance.communicate.return_value = (self.output_ok, '')
+    ep = ExecProvider(self.input_ok)
+    result = ep.run()
+    self.assertTrue(isinstance(result, dict))
+    self.assertTrue('token' in result)
+
+
+if __name__ == '__main__':
+  unittest.main()

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/incluster_config.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+
+from kubernetes.client import Configuration
+
+from .config_exception import ConfigException
+
+SERVICE_HOST_ENV_NAME = "KUBERNETES_SERVICE_HOST"
+SERVICE_PORT_ENV_NAME = "KUBERNETES_SERVICE_PORT"
+SERVICE_TOKEN_FILENAME = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+SERVICE_CERT_FILENAME = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+
+
+def _join_host_port(host, port):
+  """Adapted golang's net.JoinHostPort"""
+  template = "%s:%s"
+  host_requires_bracketing = ":" in host or "%" in host
+  if host_requires_bracketing:
+    template = "[%s]:%s"
+  return template % (host, port)
+
+
+class InClusterConfigLoader(object):
+
+  def __init__(self, token_filename, cert_filename, environ=os.environ):
+    self._token_filename = token_filename
+    self._cert_filename = cert_filename
+    self._environ = environ
+
+  def load_and_set(self):
+    self._load_config()
+    self._set_config()
+
+  def _load_config(self):
+    if (SERVICE_HOST_ENV_NAME not in self._environ or
+        SERVICE_PORT_ENV_NAME not in self._environ):
+      raise ConfigException("Service host/port is not set.")
+
+    if (not self._environ[SERVICE_HOST_ENV_NAME] or
+        not self._environ[SERVICE_PORT_ENV_NAME]):
+      raise ConfigException("Service host/port is set but empty.")
+
+    self.host = ("https://" +
+                 _join_host_port(self._environ[SERVICE_HOST_ENV_NAME],
+                                 self._environ[SERVICE_PORT_ENV_NAME]))
+
+    if not os.path.isfile(self._token_filename):
+      raise ConfigException("Service token file does not exists.")
+
+    with open(self._token_filename) as f:
+      self.token = f.read()
+      if not self.token:
+        raise ConfigException("Token file exists but empty.")
+
+    if not os.path.isfile(self._cert_filename):
+      raise ConfigException("Service certification file does not exists.")
+
+    with open(self._cert_filename) as f:
+      if not f.read():
+        raise ConfigException("Cert file exists but empty.")
+
+    self.ssl_ca_cert = self._cert_filename
+
+  def _set_config(self):
+    configuration = Configuration()
+    configuration.host = self.host
+    configuration.ssl_ca_cert = self.ssl_ca_cert
+    configuration.api_key["authorization"] = "bearer " + self.token
+    Configuration.set_default(configuration)
+
+
+def load_incluster_config():
+  """
+    Use the service account kubernetes gives to pods to connect to kubernetes
+    cluster. It's intended for clients that expect to be running inside a pod
+    running on kubernetes. It will raise an exception if called from a process
+    not running in a kubernetes environment.
+  """
+  InClusterConfigLoader(
+      token_filename=SERVICE_TOKEN_FILENAME,
+      cert_filename=SERVICE_CERT_FILENAME).load_and_set()

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/incluster_config_test.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import tempfile
+import unittest
+
+from .config_exception import ConfigException
+from .incluster_config import (SERVICE_HOST_ENV_NAME, SERVICE_PORT_ENV_NAME,
+                               InClusterConfigLoader, _join_host_port)
+
+_TEST_TOKEN = "temp_token"
+_TEST_CERT = "temp_cert"
+_TEST_HOST = "127.0.0.1"
+_TEST_PORT = "80"
+_TEST_HOST_PORT = "127.0.0.1:80"
+_TEST_IPV6_HOST = "::1"
+_TEST_IPV6_HOST_PORT = "[::1]:80"
+
+_TEST_ENVIRON = {
+    SERVICE_HOST_ENV_NAME: _TEST_HOST,
+    SERVICE_PORT_ENV_NAME: _TEST_PORT
+}
+_TEST_IPV6_ENVIRON = {
+    SERVICE_HOST_ENV_NAME: _TEST_IPV6_HOST,
+    SERVICE_PORT_ENV_NAME: _TEST_PORT
+}
+
+
+class InClusterConfigTest(unittest.TestCase):
+
+  def setUp(self):
+    self._temp_files = []
+
+  def tearDown(self):
+    for f in self._temp_files:
+      os.remove(f)
+
+  def _create_file_with_temp_content(self, content=""):
+    handler, name = tempfile.mkstemp()
+    self._temp_files.append(name)
+    os.write(handler, str.encode(content))
+    os.close(handler)
+    return name
+
+  def get_test_loader(self,
+                      token_filename=None,
+                      cert_filename=None,
+                      environ=_TEST_ENVIRON):
+    if not token_filename:
+      token_filename = self._create_file_with_temp_content(_TEST_TOKEN)
+    if not cert_filename:
+      cert_filename = self._create_file_with_temp_content(_TEST_CERT)
+    return InClusterConfigLoader(
+        token_filename=token_filename,
+        cert_filename=cert_filename,
+        environ=environ)
+
+  def test_join_host_port(self):
+    self.assertEqual(_TEST_HOST_PORT, _join_host_port(_TEST_HOST, _TEST_PORT))
+    self.assertEqual(_TEST_IPV6_HOST_PORT,
+                     _join_host_port(_TEST_IPV6_HOST, _TEST_PORT))
+
+  def test_load_config(self):
+    cert_filename = self._create_file_with_temp_content(_TEST_CERT)
+    loader = self.get_test_loader(cert_filename=cert_filename)
+    loader._load_config()
+    self.assertEqual("https://" + _TEST_HOST_PORT, loader.host)
+    self.assertEqual(cert_filename, loader.ssl_ca_cert)
+    self.assertEqual(_TEST_TOKEN, loader.token)
+
+  def _should_fail_load(self, config_loader, reason):
+    try:
+      config_loader.load_and_set()
+      self.fail("Should fail because %s" % reason)
+    except ConfigException:
+      # expected
+      pass
+
+  def test_no_port(self):
+    loader = self.get_test_loader(environ={SERVICE_HOST_ENV_NAME: _TEST_HOST})
+    self._should_fail_load(loader, "no port specified")
+
+  def test_empty_port(self):
+    loader = self.get_test_loader(environ={
+        SERVICE_HOST_ENV_NAME: _TEST_HOST,
+        SERVICE_PORT_ENV_NAME: ""
+    })
+    self._should_fail_load(loader, "empty port specified")
+
+  def test_no_host(self):
+    loader = self.get_test_loader(environ={SERVICE_PORT_ENV_NAME: _TEST_PORT})
+    self._should_fail_load(loader, "no host specified")
+
+  def test_empty_host(self):
+    loader = self.get_test_loader(environ={
+        SERVICE_HOST_ENV_NAME: "",
+        SERVICE_PORT_ENV_NAME: _TEST_PORT
+    })
+    self._should_fail_load(loader, "empty host specified")
+
+  def test_no_cert_file(self):
+    loader = self.get_test_loader(cert_filename="not_exists_file_1123")
+    self._should_fail_load(loader, "cert file does not exists")
+
+  def test_empty_cert_file(self):
+    loader = self.get_test_loader(
+        cert_filename=self._create_file_with_temp_content())
+    self._should_fail_load(loader, "empty cert file provided")
+
+  def test_no_token_file(self):
+    loader = self.get_test_loader(token_filename="not_exists_file_1123")
+    self._should_fail_load(loader, "token file does not exists")
+
+  def test_empty_token_file(self):
+    loader = self.get_test_loader(
+        token_filename=self._create_file_with_temp_content())
+    self._should_fail_load(loader, "empty token file provided")
+
+
+if __name__ == "__main__":
+  unittest.main()

gcloud auth application-default login/google-cloud-sdk/lib/third_party/kubernetes/config/kube_config.py

@@ -0,0 +1,669 @@
+#!/usr/bin/env python
+
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import atexit
+import base64
+import copy
+import datetime
+import json
+import logging
+import os
+import platform
+import tempfile
+import time
+
+import google.auth
+import google.auth.transport.requests
+import oauthlib.oauth2
+import urllib3
+from ruamel import yaml
+from requests_oauthlib import OAuth2Session
+from six import PY3
+
+from kubernetes.client import ApiClient, Configuration
+from kubernetes.config.exec_provider import ExecProvider
+
+from .config_exception import ConfigException
+from .dateutil import UTC, format_rfc3339, parse_rfc3339
+
+try:
+  import adal
+except ImportError:
+  pass
+
+EXPIRY_SKEW_PREVENTION_DELAY = datetime.timedelta(minutes=5)
+KUBE_CONFIG_DEFAULT_LOCATION = os.environ.get('KUBECONFIG', '~/.kube/config')
+ENV_KUBECONFIG_PATH_SEPARATOR = ';' if platform.system() == 'Windows' else ':'
+_temp_files = {}
+
+
+def _cleanup_temp_files():
+  global _temp_files
+  for temp_file in _temp_files.values():
+    try:
+      os.remove(temp_file)
+    except OSError:
+      pass
+  _temp_files = {}
+
+
+def _create_temp_file_with_content(content):
+  if len(_temp_files) == 0:
+    atexit.register(_cleanup_temp_files)
+  # Because we may change context several times, try to remember files we
+  # created and reuse them at a small memory cost.
+  content_key = str(content)
+  if content_key in _temp_files:
+    return _temp_files[content_key]
+  _, name = tempfile.mkstemp()
+  _temp_files[content_key] = name
+  with open(name, 'wb') as fd:
+    fd.write(content.encode() if isinstance(content, str) else content)
+  return name
+
+
+def _is_expired(expiry):
+  return ((parse_rfc3339(expiry) - EXPIRY_SKEW_PREVENTION_DELAY) <=
+          datetime.datetime.utcnow().replace(tzinfo=UTC))
+
+
+class FileOrData(object):
+  """Utility class to read content of obj[%data_key_name] or file's
+
+     content of obj[%file_key_name] and represent it as file or data.
+     Note that the data is preferred. The obj[%file_key_name] will be used iff
+     obj['%data_key_name'] is not set or empty. Assumption is file content is
+     raw data and data field is base64 string. The assumption can be changed
+     with base64_file_content flag. If set to False, the content of the file
+     will assumed to be base64 and read as is. The default True value will
+     result in base64 encode of the file content after read.
+  """
+
+  def __init__(self,
+               obj,
+               file_key_name,
+               data_key_name=None,
+               file_base_path='',
+               base64_file_content=True):
+    if not data_key_name:
+      data_key_name = file_key_name + '-data'
+    self._file = None
+    self._data = None
+    self._base64_file_content = base64_file_content
+    if data_key_name in obj:
+      self._data = obj[data_key_name]
+    elif file_key_name in obj:
+      self._file = os.path.normpath(
+          os.path.join(file_base_path, obj[file_key_name]))
+
+  def as_file(self):
+    """If obj[%data_key_name] exists, return name of a file with base64
+
+        decoded obj[%data_key_name] content otherwise obj[%file_key_name].
+    """
+    use_data_if_no_file = not self._file and self._data
+    if use_data_if_no_file:
+      if self._base64_file_content:
+        if isinstance(self._data, str):
+          content = self._data.encode()
+        else:
+          content = self._data
+        self._file = _create_temp_file_with_content(
+            base64.standard_b64decode(content))
+      else:
+        self._file = _create_temp_file_with_content(self._data)
+    if self._file and not os.path.isfile(self._file):
+      raise ConfigException('File does not exists: %s' % self._file)
+    return self._file
+
+  def as_data(self):
+    """If obj[%data_key_name] exists, Return obj[%data_key_name] otherwise
+
+        base64 encoded string of obj[%file_key_name] file content.
+    """
+    use_file_if_no_data = not self._data and self._file
+    if use_file_if_no_data:
+      with open(self._file) as f:
+        if self._base64_file_content:
+          self._data = bytes.decode(
+              base64.standard_b64encode(str.encode(f.read())))
+        else:
+          self._data = f.read()
+    return self._data
+
+
+class KubeConfigLoader(object):
+
+  def __init__(self,
+               config_dict,
+               active_context=None,
+               get_google_credentials=None,
+               config_base_path='',
+               config_persister=None):
+
+    if isinstance(config_dict, ConfigNode):
+      self._config = config_dict
+    else:
+      self._config = ConfigNode('kube-config', config_dict)
+
+    self._current_context = None
+    self._user = None
+    self._cluster = None
+    self.set_active_context(active_context)
+    self._config_base_path = config_base_path
+    self._config_persister = config_persister
+
+    def _refresh_credentials():
+      credentials, project_id = google.auth.default(scopes=[
+          'https://www.googleapis.com/auth/cloud-platform',
+          'https://www.googleapis.com/auth/userinfo.email'
+      ])
+      request = google.auth.transport.requests.Request()
+      credentials.refresh(request)
+      return credentials
+
+    if get_google_credentials:
+      self._get_google_credentials = get_google_credentials
+    else:
+      self._get_google_credentials = _refresh_credentials
+
+  def set_active_context(self, context_name=None):
+    if context_name is None:
+      context_name = self._config['current-context']
+    self._current_context = self._config['contexts'].get_with_name(context_name)
+    if (self._current_context['context'].safe_get('user') and
+        self._config.safe_get('users')):
+      user = self._config['users'].get_with_name(
+          self._current_context['context']['user'], safe=True)
+      if user:
+        self._user = user['user']
+      else:
+        self._user = None
+    else:
+      self._user = None
+    self._cluster = self._config['clusters'].get_with_name(
+        self._current_context['context']['cluster'])['cluster']
+
+  def _load_authentication(self):
+    """Read authentication from kube-config user section if exists.
+
+        This function goes through various authentication methods in user
+        section of kube-config and stops if it finds a valid authentication
+        method. The order of authentication methods is:
+
+            1. auth-provider (gcp, azure, oidc)
+            2. token field (point to a token file)
+            3. exec provided plugin
+            4. username/password
+        """
+    if not self._user:
+      return
+    if self._load_auth_provider_token():
+      return
+    if self._load_user_token():
+      return
+    if self._load_from_exec_plugin():
+      return
+    self._load_user_pass_token()
+
+  def _load_auth_provider_token(self):
+    if 'auth-provider' not in self._user:
+      return
+    provider = self._user['auth-provider']
+    if 'name' not in provider:
+      return
+    if provider['name'] == 'gcp':
+      return self._load_gcp_token(provider)
+    if provider['name'] == 'azure':
+      return self._load_azure_token(provider)
+    if provider['name'] == 'oidc':
+      return self._load_oid_token(provider)
+
+  def _load_azure_token(self, provider):
+    if 'config' not in provider:
+      return
+    if 'access-token' not in provider['config']:
+      return
+    if 'expires-on' in provider['config']:
+      if int(provider['config']['expires-on']) < time.gmtime():
+        self._refresh_azure_token(provider['config'])
+    self.token = 'Bearer %s' % provider['config']['access-token']
+    return self.token
+
+  def _refresh_azure_token(self, config):
+    if 'adal' not in globals():
+      raise ImportError('refresh token error, adal library not imported')
+
+    tenant = config['tenant-id']
+    authority = 'https://login.microsoftonline.com/{}'.format(tenant)
+    context = adal.AuthenticationContext(
+        authority,
+        validate_authority=True,
+    )
+    refresh_token = config['refresh-token']
+    client_id = config['client-id']
+    token_response = context.acquire_token_with_refresh_token(
+        refresh_token, client_id, '00000002-0000-0000-c000-000000000000')
+
+    provider = self._user['auth-provider']['config']
+    provider.value['access-token'] = token_response['accessToken']
+    provider.value['expires-on'] = token_response['expiresOn']
+    if self._config_persister:
+      self._config_persister(self._config.value)
+
+  def _load_gcp_token(self, provider):
+    if (('config' not in provider) or
+        ('access-token' not in provider['config']) or
+        ('expiry' in provider['config'] and
+         _is_expired(provider['config']['expiry']))):
+      # token is not available or expired, refresh it
+      self._refresh_gcp_token()
+
+    self.token = 'Bearer %s' % provider['config']['access-token']
+    return self.token
+
+  def _refresh_gcp_token(self):
+    if 'config' not in self._user['auth-provider']:
+      self._user['auth-provider'].value['config'] = {}
+    provider = self._user['auth-provider']['config']
+    credentials = self._get_google_credentials()
+    provider.value['access-token'] = credentials.token
+    provider.value['expiry'] = format_rfc3339(credentials.expiry)
+    if self._config_persister:
+      self._config_persister(self._config.value)
+
+  def _load_oid_token(self, provider):
+    if 'config' not in provider:
+      return
+
+    reserved_characters = frozenset(['=', '+', '/'])
+    token = provider['config']['id-token']
+
+    if any(char in token for char in reserved_characters):
+      # Invalid jwt, as it contains url-unsafe chars
+      return
+
+    parts = token.split('.')
+    if len(parts) != 3:  # Not a valid JWT
+      return
+
+    padding = (4 - len(parts[1]) % 4) * '='
+    if len(padding) == 3:
+      # According to spec, 3 padding characters cannot occur
+      # in a valid jwt
+      # https://tools.ietf.org/html/rfc7515#appendix-C
+      return
+
+    if PY3:
+      jwt_attributes = json.loads(
+          base64.b64decode(parts[1] + padding).decode('utf-8'))
+    else:
+      jwt_attributes = json.loads(base64.b64decode(parts[1] + padding))
+
+    expire = jwt_attributes.get('exp')
+
+    if ((expire is not None) and
+        (_is_expired(datetime.datetime.fromtimestamp(expire, tz=UTC)))):
+      self._refresh_oidc(provider)
+
+      if self._config_persister:
+        self._config_persister(self._config.value)
+
+    self.token = 'Bearer %s' % provider['config']['id-token']
+
+    return self.token
+
+  def _refresh_oidc(self, provider):
+    config = Configuration()
+
+    if 'idp-certificate-authority-data' in provider['config']:
+      ca_cert = tempfile.NamedTemporaryFile(delete=True)
+
+      if PY3:
+        cert = base64.b64decode(
+            provider['config']['idp-certificate-authority-data']).decode(
+                'utf-8')
+      else:
+        cert = base64.b64decode(
+            provider['config']['idp-certificate-authority-data'] + '==')
+
+      with open(ca_cert.name, 'w') as fh:
+        fh.write(cert)
+
+      config.ssl_ca_cert = ca_cert.name
+
+    else:
+      config.verify_ssl = False
+
+    client = ApiClient(configuration=config)
+
+    response = client.request(
+        method='GET',
+        url='%s/.well-known/openid-configuration' %
+        provider['config']['idp-issuer-url'])
+
+    if response.status != 200:
+      return
+
+    response = json.loads(response.data)
+
+    request = OAuth2Session(
+        client_id=provider['config']['client-id'],
+        token=provider['config']['refresh-token'],
+        auto_refresh_kwargs={
+            'client_id': provider['config']['client-id'],
+            'client_secret': provider['config']['client-secret']
+        },
+        auto_refresh_url=response['token_endpoint'])
+
+    try:
+      refresh = request.refresh_token(
+          token_url=response['token_endpoint'],
+          refresh_token=provider['config']['refresh-token'],
+          auth=(provider['config']['client-id'],
+                provider['config']['client-secret']),
+          verify=config.ssl_ca_cert if config.verify_ssl else None)
+    except oauthlib.oauth2.rfc6749.errors.InvalidClientIdError:
+      return
+
+    provider['config'].value['id-token'] = refresh['id_token']
+    provider['config'].value['refresh-token'] = refresh['refresh_token']
+
+  def _load_from_exec_plugin(self):
+    if 'exec' not in self._user:
+      return
+    try:
+      status = ExecProvider(self._user['exec']).run()
+      if 'token' not in status:
+        logging.error('exec: missing token field in plugin output')
+        return None
+      self.token = 'Bearer %s' % status['token']
+      return True
+    except Exception as e:
+      logging.error(str(e))
+
+  def _load_user_token(self):
+    base_path = self._get_base_path(self._user.path)
+    token = FileOrData(
+        self._user,
+        'tokenFile',
+        'token',
+        file_base_path=base_path,
+        base64_file_content=False).as_data()
+    if token:
+      self.token = 'Bearer %s' % token
+      return True
+
+  def _load_user_pass_token(self):
+    if 'username' in self._user and 'password' in self._user:
+      self.token = urllib3.util.make_headers(
+          basic_auth=(self._user['username'] + ':' +
+                      self._user['password'])).get('authorization')
+      return True
+
+  def _get_base_path(self, config_path):
+    if self._config_base_path is not None:
+      return self._config_base_path
+    if config_path is not None:
+      return os.path.abspath(os.path.dirname(config_path))
+    return ''
+
+  def _load_cluster_info(self):
+    if 'server' in self._cluster:
+      self.host = self._cluster['server'].rstrip('/')
+      if self.host.startswith('https'):
+        base_path = self._get_base_path(self._cluster.path)
+        self.ssl_ca_cert = FileOrData(
+            self._cluster, 'certificate-authority',
+            file_base_path=base_path).as_file()
+        self.cert_file = FileOrData(
+            self._user, 'client-certificate',
+            file_base_path=base_path).as_file()
+        self.key_file = FileOrData(
+            self._user, 'client-key', file_base_path=base_path).as_file()
+    if 'insecure-skip-tls-verify' in self._cluster:
+      self.verify_ssl = not self._cluster['insecure-skip-tls-verify']
+
+  def _using_gcp_auth_provider(self):
+    return self._user and \
+        'auth-provider' in self._user and \
+        'name' in self._user['auth-provider'] and \
+        self._user['auth-provider']['name'] == 'gcp'
+
+  def _set_config(self, client_configuration):
+    if self._using_gcp_auth_provider():
+      # GCP auth tokens must be refreshed regularly, but swagger expects
+      # a constant token. Replace the swagger-generated client config's
+      # get_api_key_with_prefix method with our own to allow automatic
+      # token refresh.
+      def _gcp_get_api_key(*args):
+        return self._load_gcp_token(self._user['auth-provider'])
+
+      client_configuration.get_api_key_with_prefix = _gcp_get_api_key
+    if 'token' in self.__dict__:
+      # Note: this line runs for GCP auth tokens as well, but this entry
+      # will not be updated upon GCP token refresh.
+      client_configuration.api_key['authorization'] = self.token
+    # copy these keys directly from self to configuration object
+    keys = ['host', 'ssl_ca_cert', 'cert_file', 'key_file', 'verify_ssl']
+    for key in keys:
+      if key in self.__dict__:
+        setattr(client_configuration, key, getattr(self, key))
+
+  def load_and_set(self, client_configuration):
+    self._load_authentication()
+    self._load_cluster_info()
+    self._set_config(client_configuration)
+
+  def list_contexts(self):
+    return [context.value for context in self._config['contexts']]
+
+  @property
+  def current_context(self):
+    return self._current_context.value
+
+
+class ConfigNode(object):
+  """Remembers each config key's path and construct a relevant exception
+
+    message in case of missing keys. The assumption is all access keys are
+    present in a well-formed kube-config.
+  """
+
+  def __init__(self, name, value, path=None):
+    self.name = name
+    self.value = value
+    self.path = path
+
+  def __contains__(self, key):
+    return key in self.value
+
+  def __len__(self):
+    return len(self.value)
+
+  def safe_get(self, key):
+    if (isinstance(self.value, list) and isinstance(key, int) or
+        key in self.value):
+      return self.value[key]
+
+  def __getitem__(self, key):
+    v = self.safe_get(key)
+    if not v:
+      raise ConfigException('Invalid kube-config file. Expected key %s in %s' %
+                            (key, self.name))
+    if isinstance(v, dict) or isinstance(v, list):
+      return ConfigNode('%s/%s' % (self.name, key), v, self.path)
+    else:
+      return v
+
+  def get_with_name(self, name, safe=False):
+    if not isinstance(self.value, list):
+      raise ConfigException(
+          'Invalid kube-config file. Expected %s to be a list' % self.name)
+    result = None
+    for v in self.value:
+      if 'name' not in v:
+        raise ConfigException(
+            'Invalid kube-config file. '
+            'Expected all values in %s list to have \'name\' key' % self.name)
+      if v['name'] == name:
+        if result is None:
+          result = v
+        else:
+          raise ConfigException(
+              'Invalid kube-config file. '
+              'Expected only one object with name %s in %s list' %
+              (name, self.name))
+    if result is not None:
+      if isinstance(result, ConfigNode):
+        return result
+      else:
+        return ConfigNode('%s[name=%s]' % (self.name, name), result, self.path)
+    if safe:
+      return None
+    raise ConfigException('Invalid kube-config file. '
+                          'Expected object with name %s in %s list' %
+                          (name, self.name))
+
+
+class KubeConfigMerger:
+  """Reads and merges configuration from one or more kube-config's.
+
+    The propery `config` can be passed to the KubeConfigLoader as config_dict.
+
+    It uses a path attribute from ConfigNode to store the path to kubeconfig.
+    This path is required to load certs from relative paths.
+
+    A method `save_changes` updates changed kubeconfig's (it compares current
+    state of dicts with).
+    """
+
+  def __init__(self, paths):
+    self.paths = []
+    self.config_files = {}
+    self.config_merged = None
+
+    for path in paths.split(ENV_KUBECONFIG_PATH_SEPARATOR):
+      if path:
+        path = os.path.expanduser(path)
+        if os.path.exists(path):
+          self.paths.append(path)
+          self.load_config(path)
+    self.config_saved = copy.deepcopy(self.config_files)
+
+  @property
+  def config(self):
+    return self.config_merged
+
+  def load_config(self, path):
+    with open(path) as f:
+      config = yaml.safe_load(f)
+
+    if self.config_merged is None:
+      config_merged = copy.deepcopy(config)
+      for item in ('clusters', 'contexts', 'users'):
+        config_merged[item] = []
+      self.config_merged = ConfigNode(path, config_merged, path)
+
+    for item in ('clusters', 'contexts', 'users'):
+      self._merge(item, config[item], path)
+    self.config_files[path] = config
+
+  def _merge(self, item, add_cfg, path):
+    for new_item in add_cfg:
+      for exists in self.config_merged.value[item]:
+        if exists['name'] == new_item['name']:
+          break
+      else:
+        self.config_merged.value[item].append(
+            ConfigNode('{}/{}'.format(path, new_item), new_item, path))
+
+  def save_changes(self):
+    for path in self.paths:
+      if self.config_saved[path] != self.config_files[path]:
+        self.save_config(path)
+    self.config_saved = copy.deepcopy(self.config_files)
+
+  def save_config(self, path):
+    with open(path, 'w') as f:
+      yaml.safe_dump(self.config_files[path], f, default_flow_style=False)
+
+
+def _get_kube_config_loader_for_yaml_file(filename,
+                                          persist_config=False,
+                                          **kwargs):
+
+  kcfg = KubeConfigMerger(filename)
+  if persist_config and 'config_persister' not in kwargs:
+    kwargs['config_persister'] = kcfg.save_changes()
+
+  return KubeConfigLoader(
+      config_dict=kcfg.config, config_base_path=None, **kwargs)
+
+
+def list_kube_config_contexts(config_file=None):
+
+  if config_file is None:
+    config_file = KUBE_CONFIG_DEFAULT_LOCATION
+
+  loader = _get_kube_config_loader_for_yaml_file(config_file)
+  return loader.list_contexts(), loader.current_context
+
+
+def load_kube_config(config_file=None,
+                     context=None,
+                     client_configuration=None,
+                     persist_config=True):
+  """Loads authentication and cluster information from kube-config file
+
+    and stores them in kubernetes.client.configuration.
+
+    :param config_file: Name of the kube-config file.
+    :param context: set the active context. If is set to None, current_context
+        from config file will be used.
+    :param client_configuration: The kubernetes.client.Configuration to
+        set configs to.
+    :param persist_config: If True, config file will be updated when changed
+        (e.g GCP token refresh).
+    """
+
+  if config_file is None:
+    config_file = KUBE_CONFIG_DEFAULT_LOCATION
+
+  loader = _get_kube_config_loader_for_yaml_file(
+      config_file, active_context=context, persist_config=persist_config)
+
+  if client_configuration is None:
+    config = type.__call__(Configuration)
+    loader.load_and_set(config)
+    Configuration.set_default(config)
+  else:
+    loader.load_and_set(client_configuration)
+
+
+def new_client_from_config(config_file=None, context=None, persist_config=True):
+  """
+    Loads configuration the same as load_kube_config but returns an ApiClient
+    to be used with any API object. This will allow the caller to concurrently
+    talk with multiple clusters.
+    """
+  client_config = type.__call__(Configuration)
+  load_kube_config(
+      config_file=config_file,
+      context=context,
+      client_configuration=client_config,
+      persist_config=persist_config)
+  return ApiClient(configuration=client_config)