3
ܓiC @ sF d dl mZ d dlZd dlZd dlmZmZmZ G dd deeZdS ) ) translateN)Plugin RedHatPlugin PluginOptc
@ s e Zd ZdZdZdZdZd4Zd5ZdZ dZ
e d d
e d d e d
d
e dd e dddde dddde dddde dde dd e d de d d e d de d d gZ
d d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd
S )6 Openshifta This is the plugin for OCP 4.x collections. While this product is still
built ontop of kubernetes, there is enough difference in the collection
requirements and approach to warrant a separate plugin as opposed to
further extending the kubernetes plugin (or the OCP 3.x extensions included
in the Red Hat version of the kube plugin).
This plugin may collect OCP API information when the `with-api` option is
enabled. This option is disabled by default.
When enabled, this plugin will collect cluster information and inspect the
default namespaces/projects that are created during deployment - i.e. the
namespaces of the cluster projects matching openshift.* and kube.*. At the
time of this plugin's creation that number of default projects is already
north of 50; hence this plugin is expected to take a long time in both the
setup() and collect() phases. End-user projects may also be collected from
when those projects are included in the `add-namespaces` or
`only-namespaces` options.
It is expected to need to perform an `oc login` command in order for this
plugin to be able to correctly capture information, as system root is not
considered cluster root on the cluster nodes in order to access the API.
Users will need to either:
1) Accept the use of a well-known stock kubeconfig file provided via a
static pod resource for the kube-apiserver
2) Provide the bearer token via the `-k openshift.token` option
3) Provide the bearer token via the `SOSOCPTOKEN` environment variable
4) Otherwise ensure that the root user can successfully run `oc` and
get proper output prior to running this plugin
It is highly suggested that option #1 be used first, as this uses well
known configurations and requires the least information from the user. If
using a token, it is recommended to use option #3 as this will prevent
the token from being recorded in output saved to the archive. Option #2 may
be used if this is considered an acceptable risk. It is not recommended to
rely on option #4, though it will provide the functionality needed.
z Openshift Container Platform 4.x openshifti openshift-hyperkubeopenshift-kubeletzg/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfigzoc get tokenNz admin token to allow API queries)defaultZval_typedesc
kubeconfigz+Path to a locally available kubeconfig filehostzhttps://localhost:6443z0host address to use for oc login, including port)r r zwith-apiFz collect output from the OCP APIpodlogsTzcollect logs from each podzpodlogs-filter z1only collect logs from pods matching this patternzonly-namespacesz2colon-delimited list of namespaces to collect fromzadd-namespaceszHcolon-delimited list of namespaces to add to the default collection listc C s | j dd dkS )z(Check to see if we can run `oc` commandsz oc whoamistatusr )exec_cmd)self r /usr/lib/python3.6/openshift.py_check_oc_functionY s z Openshift._check_oc_functionc C s | j | jdS )z?Check if the localhost.kubeconfig exists with system:admin userr
)Z path_exists
get_option)r r r r _check_localhost_kubeconfig] s z%Openshift._check_localhost_kubeconfigc C s | j r dS | jddkr(| jd| j | j r| jd| jdi | jd}|d dkrf| j rfdS | jd|d d |d
d S | jd ptj d
d}|r| jd| jd d| d}|d dkr| j rdS | jd d S | jd d S )zuSee if we're logged in to the API service, and if not attempt to do
so using provided plugin options
Tr
NZ
KUBECONFIGz8oc login -u system:admin --insecure-skip-tls-verify=Truer r z&The login command failed with status: z and error: outputFr
Z SOSOCPTOKENz oc login r z --token=z --insecure-skip-tls-verify=TruezIAttempt to login to OCP API failed, will not run or collect `oc` commandszUNot logged in to OCP API, and no login token provided. Will not collect `oc` commands)
r r Z
set_optionmaster_localhost_kubeconfigr Zset_default_cmd_environmentr _log_warnosgetenv)r Zoc_resr
r r r _check_oc_logged_ina s4
z Openshift._check_oc_logged_inc C sX | j dr t| j djdS ddg}| j drTx"| j djdD ]}|j| qBW |S )zCombine a set of regexes for collection with any namespaces passed
to sos via the -k openshift.add-namespaces option. Note that this does
allow for end users to specify namespace regexes of their own.
zonly-namespaces:z openshift.*zkube.*zadd-namespaces)r listsplitappend)r Zcollect_regexesZnspr r r _setup_namespace_regexes s
z"Openshift._setup_namespace_regexesc s( dd | j t fdd|D S )a Reduce the namespace listing returned to just the ones we want to
collect from. By default, as requested by OCP support personnel, this
must include all 'openshift' prefixed namespaces
:param nsps list: Namespace names from oc output
c S s" x |D ]}t j|| rdS qW dS )zMatch a particular namespace for inclusion (or not) in the
collection phases
:param namespace str: The name of a namespace
TF)rematch) namespaceregexesregexr r r _match_namespace s
z:Openshift._reduce_namespace_list.._match_namespacec s h | ]} |r|qS r r ).0n)r) r' r r s z3Openshift._reduce_namespace_list..)r# r )r nspsr )r) r' r _reduce_namespace_list s z Openshift._reduce_namespace_listc C s | j d | jd | jddg | jd | jdr@| j }nd}|r| jd g }| jdd d
d d g | j | j | j
d
}|d dkrdd |d j dd D }| j |}x|D ]}| j
| qW dS )a The setup() phase of this plugin will iterate through all default
projects (namespaces), and/or those specified via the `add-namespaces`
and `only-namespaces` plugin options. Both of these options accept
shell-style regexes.
Cluster-wide information, that is information that is not tied to a
specific namespace, will be saved in the top-level plugin directory.
Each namespace will have it's own subdir within the `namespaces` subdir
to aide in organization. From there, each namespace subdir will have a
subsequent subdir for each type of API resource the plugin collects.
In contrast with the `kubernetes` plugin, this plugin will collect
logs from all pods within each namespace, as well as the previous pod's
logs, by default. The `-k openshift.podlogs-filter` option can be used
to greatly reduce the amount of collected information.
Zkubeletz/etc/kubernetes/*.crtz/etc/kubernetes/*.keyz/etc/kubernetes/*zwith-apiFzNote that the Openshift Container Platform plugin can be expected in most configurations to take 5+ minutes in both the setup and collection phaseszoc cluster-infoz oc get -A pvz
oc get -A csrz oc statusz
oc versionz namespacesr r c S s g | ]}|j d qS )r )r! )r* r+ r r r
s z#Openshift.setup..r N)Z add_journalZadd_service_statusZadd_forbidden_pathZ
add_copy_specr r r add_cmd_outputcollect_cluster_resourcescollect_cmd_outputoc_cmd
splitlinesr. collect_from_namespace)r Z
can_run_ocZoc_nspsZ_nm_resr- r& r r r setup s4
zOpenshift.setupc C s ddddddddd d
d d d
ddddg}x|D ]}d| }d| g}| j | j d| ||d}|d dkr,x>|d j dd D ]&}| jd| d|j d |d qW q,W dS ) zFCollect cluster-level (non-namespaced) resources from the API
ZclusternetworksZclusteroperatorsZclusterversionsZcomponentstatusesZconfigsZcontainerruntimeconfigsZcontrollerconfigsZdnsesZ hostsubnetsZinfrastructuresZmachineconfigpoolsZmachineconfigsZ
netnamespacesZnetworksZnodesZproxiesZstorageclasseszcluster_resources/ocp_ )subdirtagsr r r r0 Nz oc describe )r: )r3 r4 r5 r1 r! )r Zglobal_resourcesZresource_subdirZ_tagZ_resZ _res_namer r r r2
s6
z#Openshift.collect_cluster_resourcesc
C sL ddddddddd d
d d d
ddddddddddddddd d d g }d | }| j d | |d! x|D ]}| d"| }d#| d#| d$| |g}| j d%| d&| }| j|||d'}|d( d)krd|d* j d+d, } x:| D ]2}
|
j d) } | j | d&| d-|| d.d/ qW |dkrd| rd| jd0rdd1d2 | D } | j|| qdW d,S )3zRun through the collection routines for an individual namespace.
This collection should include all requested resources that exist
within that namesapce
:param namespace str: The name of the namespace
Z buildconfigsZbuildsZcatalogsourceconfigsZcatalogsourcesZclusterserviceversionsZ
configmapsZ
daemonsetsZdeploymentconfigsZ deploymentsZeventsZhorizontalpodautoscalersZ imagestreamsZingresscontrollersZ ingressesZ installplansZ limitrangesZmachinesZ machinesetsZ
mcoconfigsznet-attach-defZoperatorgroupsZoperatorsourcesZpodsZpvcZresourcequotasZroutessecretsZservicesZ statefulsetsZ
subscriptionsz namespaces/zoc describe namespace )r: /r8 _z
--namespace=r9 )r: r; r r r r0 Nz -o yamlz.yaml)r: Zsuggest_filenamer c S s g | ]}|j d qS )r )r! )r* pr r r r/ { s z4Openshift.collect_from_namespace..)r1 r4 r3 r5 r! r collect_podlogs)
r r& Z resourcesr: resr< Z_tagsZ_get_cmdZ_res_outZ
_instancesZ _instanceZ_instance_namepod_listr r r r6 - sl
z Openshift.collect_from_namespacec C sv d| d}| j dr&t| j d}nd}xF|D ]>}|rHtj|| rHq0d| d| }| j||d g|d q0W dS ) zFor any namespace that has active pods in it, collect the current
and previous pod's logs
:param pod_list list: A list of pod names
z namespaces/z
/pods/podlogszpodlogs-filterNzoc logs --namespace=r9 z -p)r: )r r r$ r% r1 )r r& rC Z_log_dirr( ZpodZ_log_cmdr r r rA ~ s
zOpenshift.collect_podlogsc C sj | j d | jd ddddddd g}d
d j| d }| jd|d
| jd|d
d}| jd|d d S )Nzoc z/etc/kubernetes/*z.*.crtzclient-certificate-datazclient-key-datazcertificate-authority-dataz.*.keyr
z.*token.*.valuez(\s*(|z):)(.*)z
\1 *******r= z((?P(.*\\n)?Source:\s(.*),)((.*?))\nz oc describez\g *******\n)Zdo_cmd_private_subZdo_file_private_subjoinZdo_path_regex_subZdo_cmd_output_sub)r _fieldsr( r r r postproc s
zOpenshift.postproc)r )r r )__name__
__module__ __qualname____doc__Z
short_descZ plugin_nameZplugin_timeoutZprofilesZpackagesr r4 r strZ option_listr r r r# r. r7 r2 r6 rA rG r r r r r sB '
7F#Qr ) Zfnmatchr r r$ Zsos.report.pluginsr r r r r r r r s