gcpdiag.queries.gce

 39class InstanceTemplate(models.Resource):
 40  """Represents a GCE Instance Template."""
 41
 42  _resource_data: dict
 43
 44  def __init__(self, project_id, resource_data):
 45    super().__init__(project_id=project_id)
 46    self._resource_data = resource_data
 47
 48  @property
 49  def self_link(self) -> str:
 50    return self._resource_data['selfLink']
 51
 52  @property
 53  def full_path(self) -> str:
 54    result = re.match(r'https://www.googleapis.com/compute/v1/(.*)',
 55                      self.self_link)
 56    if result:
 57      return result.group(1)
 58    else:
 59      return f'>> {self.self_link}'
 60
 61  @property
 62  def short_path(self) -> str:
 63    path = self.project_id + '/' + self.name
 64    return path
 65
 66  @property
 67  def name(self) -> str:
 68    return self._resource_data['name']
 69
 70  @property
 71  def tags(self) -> List[str]:
 72    return self._resource_data['properties'].get('tags', {}).get('items', [])
 73
 74  @property
 75  def service_account(self) -> Optional[str]:
 76    sa_list = self._resource_data['properties'].get('serviceAccounts', [])
 77    if not sa_list:
 78      return None
 79    email = sa_list[0]['email']
 80    if email == 'default':
 81      project_nr = crm.get_project(self._project_id).number
 82      return f'{project_nr}-compute@developer.gserviceaccount.com'
 83    return email
 84
 85  @property
 86  def network(self) -> network_q.Network:
 87    return network_q.get_network_from_url(
 88        self._resource_data['properties']['networkInterfaces'][0]['network'])
 89
 90  @property
 91  def subnetwork(self) -> network_q.Subnetwork:
 92    subnet_url = self._resource_data['properties']['networkInterfaces'][0][
 93        'subnetwork']
 94    return self.network.subnetworks[subnet_url]
 95
 96  def get_metadata(self, key: str) -> str:
 97    for item in self._resource_data['properties']['metadata']['items']:
 98      if item['key'] == key:
 99        return item['value']
100    return ''

103class InstanceGroup(models.Resource):
104  """Represents a GCE instance group."""
105
106  _resource_data: dict
107
108  def __init__(self, project_id, resource_data):
109    super().__init__(project_id=project_id)
110    self._resource_data = resource_data
111
112  @property
113  def full_path(self) -> str:
114    result = re.match(
115        r'https://www.googleapis.com/compute/v1/(.*)',
116        self._resource_data['selfLink'],
117    )
118    if result:
119      return result.group(1)
120    else:
121      return '>> ' + self._resource_data['selfLink']
122
123  @property
124  def short_path(self) -> str:
125    path = self.project_id + '/' + self.name
126    return path
127
128  @property
129  def self_link(self) -> str:
130    return self._resource_data['selfLink']
131
132  @property
133  def name(self) -> str:
134    return self._resource_data['name']
135
136  @property
137  def named_ports(self) -> List[dict]:
138    if 'namedPorts' in self._resource_data:
139      return self._resource_data['namedPorts']
140    return []
141
142  def has_named_ports(self) -> bool:
143    if 'namedPorts' in self._resource_data:
144      return True
145    return False

148class ManagedInstanceGroup(models.Resource):
149  """Represents a GCE managed instance group."""
150
151  _resource_data: dict
152  _region: Optional[str]
153
154  def __init__(self, project_id, resource_data):
155    super().__init__(project_id=project_id)
156    self._resource_data = resource_data
157    self._region = None
158
159  @property
160  def full_path(self) -> str:
161    result = re.match(
162        r'https://www.googleapis.com/compute/v1/(.*)',
163        self._resource_data['selfLink'],
164    )
165    if result:
166      return result.group(1)
167    else:
168      return '>> ' + self._resource_data['selfLink']
169
170  @property
171  def short_path(self) -> str:
172    path = self.project_id + '/' + self.name
173    return path
174
175  def is_gke(self) -> bool:
176    """Is this managed instance group part of a GKE cluster?
177
178    Note that the results are based on heuristics (the mig name),
179    which is not ideal.
180    """
181
182    # gke- is normal GKE, gk3- is GKE autopilot
183    return self.name.startswith('gke-') or self.name.startswith('gk3-')
184
185  @property
186  def self_link(self) -> str:
187    return self._resource_data['selfLink']
188
189  @property
190  def name(self) -> str:
191    return self._resource_data['name']
192
193  @property
194  def region(self) -> str:
195    if self._region is None:
196      if 'region' in self._resource_data:
197        m = re.search(r'/regions/([^/]+)$', self._resource_data['region'])
198        if not m:
199          raise RuntimeError("can't determine region of mig %s (%s)" %
200                             (self.name, self._resource_data['region']))
201        self._region = m.group(1)
202      elif 'zone' in self._resource_data:
203        m = re.search(r'/zones/([^/]+)$', self._resource_data['zone'])
204        if not m:
205          raise RuntimeError("can't determine region of mig %s (%s)" %
206                             (self.name, self._resource_data['region']))
207        zone = m.group(1)
208        self._region = utils.zone_region(zone)
209      else:
210        raise RuntimeError(
211            f"can't determine region of mig {self.name}, both region and zone"
212            " aren't set!")
213    return self._region
214
215  def count_no_action_instances(self) -> int:
216    """number of instances in the mig that are running and have no scheduled actions."""
217    return self._resource_data['currentActions']['none']
218
219  def is_instance_member(self, project_id: str, region: str,
220                         instance_name: str):
221    """Given the project_id, region and instance name, is it a member of this MIG?"""
222    return (self.project_id == project_id and self.region == region and
223            instance_name.startswith(self._resource_data['baseInstanceName']))
224
225  @property
226  def template(self) -> InstanceTemplate:
227    if 'instanceTemplate' not in self._resource_data:
228      raise RuntimeError('instanceTemplate not set for MIG {self.name}')
229    m = re.match(
230        r'https://www.googleapis.com/compute/v1/projects/([^/]+)/global/instanceTemplates/([^/]+)',
231        self._resource_data['instanceTemplate'],
232    )
233    if not m:
234      raise RuntimeError("can't parse instanceTemplate: %s" %
235                         self._resource_data['instanceTemplate'])
236    (project_id, template_name) = (m.group(1), m.group(2))
237    templates = get_instance_templates(project_id)
238    if template_name not in templates:
239      raise RuntimeError(
240          f'instanceTemplate {template_name} for MIG {self.name} not found')
241    return templates[template_name]

244class SerialPortOutput:
245  """Represents the full Serial Port Output (/dev/ttyS0 or COM1) of an instance.
246
247  contents is the full 1MB of the instance.
248  """
249
250  _project_id: str
251  _instance_id: str
252  _contents: List[str]
253
254  def __init__(self, project_id, instance_id, contents):
255    self._project_id = project_id
256    self._instance_id = instance_id
257    self._contents = contents
258
259  @property
260  def contents(self) -> List[str]:
261    return self._contents
262
263  @property
264  def instance_id(self) -> str:
265    return self._instance_id

268class Instance(models.Resource):
269  """Represents a GCE instance."""
270
271  _resource_data: dict
272  _region: Optional[str]
273
274  def __init__(self, project_id, resource_data):
275    super().__init__(project_id=project_id)
276    self._resource_data = resource_data
277    self._metadata_dict = None
278    self._region = None
279
280  @property
281  def id(self) -> str:
282    return self._resource_data['id']
283
284  @property
285  def name(self) -> str:
286    return self._resource_data['name']
287
288  @property
289  def full_path(self) -> str:
290    result = re.match(
291        r'https://www.googleapis.com/compute/v1/(.*)',
292        self._resource_data['selfLink'],
293    )
294    if result:
295      return result.group(1)
296    else:
297      return '>> ' + self._resource_data['selfLink']
298
299  @property
300  def short_path(self) -> str:
301    # Note: instance names must be unique per project, so no need to add the zone.
302    path = self.project_id + '/' + self.name
303    return path
304
305  @property
306  def creation_timestamp(self) -> datetime:
307    """VM creation time, as a *naive* `datetime` object."""
308    return (datetime.fromisoformat(
309        self._resource_data['creationTimestamp']).astimezone(
310            timezone.utc).replace(tzinfo=None))
311
312  @property
313  def region(self) -> str:
314    if self._region is None:
315      if 'zone' in self._resource_data:
316        m = re.search(r'/zones/([^/]+)$', self._resource_data['zone'])
317        if not m:
318          raise RuntimeError("can't determine region of instance %s (%s)" %
319                             (self.name, self._resource_data['region']))
320        zone = m.group(1)
321        self._region = utils.zone_region(zone)
322      else:
323        raise RuntimeError(
324            f"can't determine region of instance {self.name}, zone isn't set!")
325    return self._region
326
327  @property
328  def zone(self) -> str:
329    zone_uri = self._resource_data['zone']
330    m = re.search(r'/zones/([^/]+)$', zone_uri)
331    if m:
332      return m.group(1)
333    else:
334      raise RuntimeError(f"can't determine zone of instance {self.name}")
335
336  @property
337  def disks(self) -> List[str]:
338    if 'disks' in self._resource_data:
339      return self._resource_data['disks']
340    return []
341
342  @property
343  def startrestricted(self) -> bool:
344    return self._resource_data['startRestricted']
345
346  def is_serial_port_logging_enabled(self) -> bool:
347    value = self.get_metadata('serial-port-logging-enable')
348    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
349
350  def is_oslogin_enabled(self) -> bool:
351    value = self.get_metadata('enable-oslogin')
352    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
353
354  def is_metadata_enabled(self, metadata_name) -> bool:
355    """Use to check for common boolen metadata value"""
356    value = self.get_metadata(metadata_name)
357    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
358
359  def has_label(self, label) -> bool:
360    return label in self.labels
361
362  def is_dataproc_instance(self) -> bool:
363    return self.has_label(DATAPROC_LABEL)
364
365  def is_gke_node(self) -> bool:
366    return self.has_label(GKE_LABEL)
367
368  def is_preemptible_vm(self) -> bool:
369    return ('scheduling' in self._resource_data and
370            'preemptible' in self._resource_data['scheduling'] and
371            self._resource_data['scheduling']['preemptible'])
372
373  def is_windows_machine(self) -> bool:
374    if 'disks' in self._resource_data:
375      disks = next(iter(self._resource_data['disks']))
376      if 'guestOsFeatures' in disks:
377        if 'WINDOWS' in [t['type'] for t in iter(disks['guestOsFeatures'])]:
378          return True
379    return False
380
381  def is_public_machine(self) -> bool:
382    if 'networkInterfaces' in self._resource_data:
383      return 'natIP' in str(self._resource_data['networkInterfaces'])
384    return False
385
386  def machine_type(self):
387    if 'machineType' in self._resource_data:
388      return self._resource_data['machineType']
389    return None
390
391  def check_license(self, licenses: List[str]) -> bool:
392    """Checks that a licence is contained in a given license list"""
393    if 'disks' in self._resource_data:
394      for disk in self._resource_data['disks']:
395        if 'license' in str(disk):
396          for license_ in licenses:
397            for attached_license in disk['licenses']:
398              if license_ == attached_license.partition('/global/licenses/')[2]:
399                return True
400    return False
401
402  @property
403  def network(self) -> network_q.Network:
404    # 'https://www.googleapis.com/compute/v1/projects/gcpdiag-gce1-aaaa/global/networks/default'
405    network_string = self._resource_data['networkInterfaces'][0]['network']
406    m = re.match(r'^.+/projects/([^/]+)/global/networks/([^/]+)$',
407                 network_string)
408    if not m:
409      raise RuntimeError("can't parse network string: %s" % network_string)
410    return network_q.get_network(m.group(1), m.group(2))
411
412  @property
413  def network_ips(self) -> List[network_q.IPv4AddrOrIPv6Addr]:
414    return [
415        ipaddress.ip_address(nic['networkIP'])
416        for nic in self._resource_data['networkInterfaces']
417    ]
418
419  @property
420  def get_network_interfaces(self):
421    return self._resource_data['networkInterfaces']
422
423  @property
424  def subnetworks(self) -> List[network_q.Subnetwork]:
425    subnetworks = []
426    for nic in self._resource_data['networkInterfaces']:
427      subnetworks.append(network_q.get_subnetwork_from_url(nic['subnetwork']))
428    return subnetworks
429
430  @property
431  def routes(self) -> List[network_q.Route]:
432    routes = []
433    for nic in self._resource_data['networkInterfaces']:
434      for route in network_q.get_routes(self.project_id):
435        if nic['network'] == route.network:
436          if route.tags == []:
437            routes.append(route)
438            continue
439          else:
440            temp = [x for x in self.tags if x in route.tags]
441            if len(temp) > 0:
442              routes.append(route)
443    return routes
444
445  def get_network_ip_for_instance_interface(
446      self, network: str) -> Optional[network_q.IPv4NetOrIPv6Net]:
447    """Get the network ip for a nic given a network name"""
448    for nic in self._resource_data['networkInterfaces']:
449      if nic.get('network') == network:
450        return ipaddress.ip_network(nic.get('networkIP'))
451    return None
452
453  def secure_boot_enabled(self) -> bool:
454    if 'shieldedInstanceConfig' in self._resource_data:
455      return self._resource_data['shieldedInstanceConfig']['enableSecureBoot']
456    return False
457
458  @property
459  def access_scopes(self) -> List[str]:
460    if 'serviceAccounts' in self._resource_data:
461      saccts = self._resource_data['serviceAccounts']
462      if isinstance(saccts, list) and len(saccts) >= 1:
463        return saccts[0].get('scopes', [])
464    return []
465
466  @property
467  def service_account(self) -> Optional[str]:
468    if 'serviceAccounts' in self._resource_data:
469      saccts = self._resource_data['serviceAccounts']
470      if isinstance(saccts, list) and len(saccts) >= 1:
471        return saccts[0]['email']
472    return None
473
474  @property
475  def tags(self) -> List[str]:
476    if 'tags' in self._resource_data:
477      if 'items' in self._resource_data['tags']:
478        return self._resource_data['tags']['items']
479    return []
480
481  def get_metadata(self, key: str) -> str:
482    if not self._metadata_dict:
483      self._metadata_dict = {}
484      if ('metadata' in self._resource_data and
485          'items' in self._resource_data['metadata']):
486        for item in self._resource_data['metadata']['items']:
487          if 'key' in item and 'value' in item:
488            self._metadata_dict[item['key']] = item['value']
489    project_metadata = get_project_metadata(self.project_id)
490    return self._metadata_dict.get(key, project_metadata.get(key))
491
492  @property
493  def status(self) -> str:
494    """VM Status"""
495    return self._resource_data.get('status', None)
496
497  @property
498  def is_running(self) -> bool:
499    """VM Status is indicated as running"""
500    return self._resource_data.get('status', False) == 'RUNNING'
501
502  @property  # type: ignore
503  @caching.cached_api_call(in_memory=True)
504  def mig(self) -> ManagedInstanceGroup:
505    """Return ManagedInstanceGroup that owns this instance.
506
507    Throws AttributeError in case it isn't MIG-managed.
508    """
509
510    created_by = self.get_metadata('created-by')
511    if created_by is None:
512      raise AttributeError(f'instance {self.id} is not managed by a mig')
513
514    # Example created-by:
515    # pylint: disable=line-too-long
516    # "projects/12340002/zones/europe-west4-a/instanceGroupManagers/gke-gke1-default-pool-e5e20a34-grp"
517    # (note how it uses a project number and not a project id...)
518    created_by_match = re.match(
519        r'projects/([^/]+)/((?:regions|zones)/[^/]+/instanceGroupManagers/[^/]+)$',
520        created_by,
521    )
522    if not created_by_match:
523      raise AttributeError(f'instance {self.id} is not managed by a mig'
524                           f' (created-by={created_by})')
525    project = crm.get_project(created_by_match.group(1))
526
527    mig_self_link = ('https://www.googleapis.com/compute/v1/'
528                     f'projects/{project.id}/{created_by_match.group(2)}')
529
530    # Try to find a matching mig.
531    for mig in get_managed_instance_groups(
532        models.Context(project_id=self.project_id)).values():
533      if mig.self_link == mig_self_link:
534        return mig
535
536    raise AttributeError(f'instance {self.id} is not managed by a mig')
537
538  @property
539  def labels(self) -> dict:
540    return self._resource_data.get('labels', {})