3
ܓi @ @ s@ d dl Z d dlmZ d dlmZ d dlmZ G dd deZdS ) N)quote)Cluster)
is_executablec s e Zd ZdZdZd4ZdZdZdZdZ dZ
d5d6d7d8d9d:gZ e dd Z
dd Zdd Z fd d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Z Z S );ocpa
This profile is for use with OpenShift Container Platform (v4) clusters
instead of the kubernetes profile.
This profile will favor using the `oc` transport type, which means it will
leverage a locally installed `oc` binary. This is also how node enumeration
is done. To instead use SSH to connect to the nodes, use the
'--transport=control_persist' option.
Thus, a functional `oc` binary for the user executing sos collect is
required. Functional meaning that the user can run `oc` commands with
clusterAdmin privileges.
If this requires the use of a secondary configuration file, specify that
path with the 'kubeconfig' cluster option. This config file will also be
used on a single master node to perform API collections if the `with-api`
option is enabled (default disabled). If no `kubeconfig` option is given,
but `with-api` is enabled, the cluster profile will attempt to use a
well-known default kubeconfig file if it is available on the host.
Alternatively, provide a clusterAdmin access token either via the 'token'
cluster option or, preferably, the SOSOCPTOKEN environment variable.
By default, this profile will enumerate only master nodes within the
cluster, and this may be changed by overriding the 'role' cluster option.
To collect from all nodes in the cluster regardless of role, use the form
-c ocp.role=''.
Filtering nodes by a label applied to that node is also possible via the
label cluster option, though be aware that this is _combined_ with the role
option mentioned above.
To avoid redundant collections of OCP API information (e.g. 'oc get'
commands), this profile will attempt to enable the API collections on only
a single master node. If the none of the master nodes have a functional
'oc' binary available, *and* the --no-local option is used, that means that
no API data will be collected.
z OpenShift Container Platform v4openshift-hyperkubeopenshift-clientsFNzsos-collect-tmp label3Colon delimited list of labels to select nodes withrolemaster*Colon delimited list of roles to filter on
kubeconfigPath to the kubeconfig filetoken1Service account token to use for oc authorizationwith-api'Collect OCP API data from a master nodeapi-url.Alternate API URL of an external control-planec C s | j sd| _ | jjj rt| jjd}|d dkrVtjj| jjj|d j j
d| _ n | j d | j d|d | j
d r| j d
| j
d 7 _ | j d | j | j S ) Noczwhich ocstatusr output/zHUnable to to determine PATH for 'oc' command, node enumeration may fail.zLocating 'oc' failed: r z --kubeconfig zoc base command set to )_oc_cmdprimaryhostZ in_container run_commandospathjoinsysrootstriplstriplog_warn log_debug
get_option)selfZ_oc_path r( /usr/lib/python3.6/ocp.pyoc_cmdL s"
z
ocp.oc_cmdc C s | j d| S )zcFormat the oc command to optionall include the kubeconfig file if
one is specified
)r* )r' cmdr( r( r)
fmt_oc_cmdf s zocp.fmt_oc_cmdc C s0 | j | jd| j d| jd }|d dkS )zXAttempt to login to the API using the oc command using a provided
token
z.login --insecure-skip-tls-verify=True --token=r+ zapi-urlr r )exec_primary_cmdr- r r& )r' Z_resr( r( r) _attempt_oc_loginl s zocp._attempt_oc_loginc sP t j rdS | jdp"tjdd | _| jr4| j | jd}| j|d dkS )NTr SOSOCPTOKENZwhoamir r ) super
check_enabledr& r getenvr r/ r- r. )r' Z_who) __class__r( r) r2 w s
zocp.check_enabledc C s | j dksdS | j| jd}|d dk| _| jsF| jd td| jd| j d | j| jd
| j }|d dkr| j d S | jd |d
tddS )zpCreate the project that we will be executing in for any nodes'
collection via a container image
r Nzauth can-i '*' '*'r r zWCheck for cluster-admin privileges returned false, cannot create project in OCP clusterzLInsufficient permissions to create temporary collection project.
Aborting...z Creating new temporary project ''z new-project TzFailed to create project: r z?Failed to create temporary project for collection.
Aborting...) set_transport_typer. r- oc_cluster_adminr% Exceptionlog_infoproject_label_sos_project)r' outretr( r( r) setup s
z ocp.setupc C sX ddg}xJ|D ]B}| j | jd| j d| d}|d dkstd|d qW d
S ) zAdd pertinent labels to the temporary project we've created so that
our privileged containers can properly run.
z4security.openshift.io/scc.podSecurityLabelSync=falsez-pod-security.kubernetes.io/enforce=privilegedzlabel namespace r+ z --overwriter r z!Error applying namespace labels: r N)r. r- r: r8 )r' labelsr r= r( r( r) r; s
zocp._label_sos_projectc C s | j ryz| j| jd| j dd}|d dksD| jd|d | j| jd| j d }|d dks~| jd
|d W n4 tk
r } z| jd | d W Y d
d
}~X nX | j| jd d
| _ dS )z8Remove the project we created to execute within
zdelete project )Ztimeoutr r z"Error deleting temporary project: r zwait namespace/z --for=delete --timeout=30sz3Error waiting for temporary project to be deleted: zAFailed attempting to remove temporary project 'sos-collect-tmp': z.
Please manually remove the temporary project.Nzproject defaultT)r: r. r- Z log_errorr8 )r' r= errr( r( r) cleanup s( z ocp.cleanupc
C s i }d|d kr|j dj }i }x8dD ]0}y|j|j ||< W q( tk
rV Y q(X q(W xJ|D ]B}|j }i ||d < x(|j D ] \}} || ||d |< qW qbW |S )a From the output of get_nodes(), construct an easier-to-reference
dict of nodes that will be used in determining labels, primary status,
etc...
:param nodelist: The split output of `oc get nodes`
:type nodelist: ``list``
:returns: A dict of nodes with `get nodes` columns as keys
:rtype: ``dict``
NAMEr r rolesversionos-image)r rD rE rF )popsplitindexupperr8 items)
r' ZnodelistnodesZstatlineidxstatenodeZ_nodecolumnvaluer( r( r) _build_dict s
zocp._build_dictc C sT | j jdkr| j jS td| jjjdr*dS | jd | jjd | j j sPt
d dS )Nautor )r! z]Local installation of 'oc' not found or is not correctly configured. Will use ControlPersist.z=Preferred transport 'oc' not available, will fallback to SSH.z?Press ENTER to continue connecting with SSH, or Ctrl+C toabort.Zcontrol_persist) ZoptsZ transportr r r r! r9 ui_logZwarningZbatchinput)r' r( r( r) r6 s
zocp.set_transport_typec
C s g }i | _ d}| jdr@dj| jdjd}|dt| 7 }| j| j|}|d dkr| jdd krt| jd
t| jdjd}| j |d j
| _ xl| j j D ]>\}}|rx0|D ] }||d kr|j | P qW q|j | qW n d
} d|d krd} t
| |S )Nzget nodes -o wider ,:z -l r r r r zNOTE: By default, only master nodes are listed.
To collect from all/more nodes, override the role option with '-c ocp.role=role1:role2'r rD z'oc' command failedzMissing or incompleteza'oc' failed due to missing kubeconfig on primary node. Specify one via '-c ocp.kubeconfig=') node_dictr& r rH r r. r- r$ listrR
splitlinesrK appendr8 )
r' rL r, r? resrD Z node_namerO r msgr( r( r) get_nodes s0
z
ocp.get_nodesc C s: |j | jkrdS x$dD ] }|| j|j d kr|S qW dS )Nr r workerrD )r r_ )addressrX )r' rO r r( r( r) set_node_label s
zocp.set_node_labelc C s$ |j | jkrdS d| j|j d kS )NFr rD )r` rX )r' rO r( r( r) check_node_is_primary% s zocp.check_node_is_primaryc C sH |j dr d}|rdnd}nd}|r(dnd}|jjd| d| dS ) a In earlier versions of sos, the openshift plugin option that is
used to toggle the API collections was called `no-oc` rather than
`with-api`. This older plugin option had the inverse logic of the
current `with-api` option.
Use this to toggle the correct plugin option given the node's sos
version. Note that the use of version 4.2 here is tied to the RHEL
release (the only usecase for this cluster profile) rather than
the upstream version given the backports for that downstream.
:param node: The node being inspected for API collections
:type node: ``SoSNode``
:param use_api: Should this node enable API collections?
:type use_api: ``bool``
z4.2-16zwith-apiZonZoffzno-ocz
openshift.=N)Zcheck_sos_versionplugoptsr[ )r' rO Zuse_apiZ_optZ_valr( r( r) _toggle_api_opt* s
zocp._toggle_api_optc C s\ |j jd | jds&| j|d d S | jr<| j|d n d}| jd}|rb|jd rbd| }|ph|}d}|jjrd }|jd
d d r|d
7 }|j | d|jjd d}|d dkr| j|d d | _n`| j
r| j
|j d< | j|d d | _n:|j|r*||kr|j jd| | j|d d | _| jrXd|j
d}| jj| | jj| d S )NZ openshiftzwith-apiFzl/host/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfigr z/hostz/host/r z /host/bin/ocz/root/.kube/configT) need_rootz% --kubeconfig /host/root/.kube/configz whoami)Z
use_containerrf r r r0 zopenshift.kubeconfig=z%API collections will be performed on z<
Note: API collections may extend runtime by 10s of minutes
)Zenable_pluginsr[ r& re api_collect_enabled
startswithr Z
containerizedZ file_existsr r Z sos_env_varsrd r` ZsosloginforT )r' rO Z master_kubeZ
_optconfigZ _kubeconfigr Zcan_ocr] r( r( r) set_primary_optionsC sH
zocp.set_primary_optionsc C s | j |d d S )NF)re )r' rO r( r( r) set_node_options s zocp.set_node_options)r r )r r r
)r r r
)r r r )r r r )r Fr )r r r ) __name__
__module__ __qualname____doc__Z cluster_nameZpackagesrg r r: r7 r Z option_listpropertyr* r- r/ r2 r> r; rB rR r6 r^ ra rb re rj rk
__classcell__r( r( )r4 r) r s: & # =r )r Zshlexr Zsos.collector.clustersr Z
sos.utilitiesr r r( r( r( r) s