gcpdiag.queries.gce

 39class InstanceTemplate(models.Resource):
 40  """Represents a GCE Instance Template."""
 41
 42  _resource_data: dict
 43
 44  def __init__(self, project_id, resource_data):
 45    super().__init__(project_id=project_id)
 46    self._resource_data = resource_data
 47
 48  @property
 49  def self_link(self) -> str:
 50    return self._resource_data['selfLink']
 51
 52  @property
 53  def full_path(self) -> str:
 54    result = re.match(r'https://www.googleapis.com/compute/v1/(.*)',
 55                      self.self_link)
 56    if result:
 57      return result.group(1)
 58    else:
 59      return f'>> {self.self_link}'
 60
 61  @property
 62  def short_path(self) -> str:
 63    path = self.project_id + '/' + self.name
 64    return path
 65
 66  @property
 67  def name(self) -> str:
 68    return self._resource_data['name']
 69
 70  @property
 71  def tags(self) -> List[str]:
 72    return self._resource_data['properties'].get('tags', {}).get('items', [])
 73
 74  @property
 75  def service_account(self) -> Optional[str]:
 76    sa_list = self._resource_data['properties'].get('serviceAccounts', [])
 77    if not sa_list:
 78      return None
 79    email = sa_list[0]['email']
 80    if email == 'default':
 81      project_nr = crm.get_project(self._project_id).number
 82      return f'{project_nr}-compute@developer.gserviceaccount.com'
 83    return email
 84
 85  @property
 86  def network(self) -> network_q.Network:
 87    return network_q.get_network_from_url(
 88        self._resource_data['properties']['networkInterfaces'][0]['network'])
 89
 90  @property
 91  def subnetwork(self) -> network_q.Subnetwork:
 92    subnet_url = self._resource_data['properties']['networkInterfaces'][0][
 93        'subnetwork']
 94    return self.network.subnetworks[subnet_url]
 95
 96  def get_metadata(self, key: str) -> str:
 97    for item in self._resource_data['properties']['metadata']['items']:
 98      if item['key'] == key:
 99        return item['value']
100    return ''

103class InstanceGroup(models.Resource):
104  """Represents a GCE instance group."""
105
106  _resource_data: dict
107
108  def __init__(self, project_id, resource_data):
109    super().__init__(project_id=project_id)
110    self._resource_data = resource_data
111
112  @property
113  def full_path(self) -> str:
114    result = re.match(
115        r'https://www.googleapis.com/compute/v1/(.*)',
116        self._resource_data['selfLink'],
117    )
118    if result:
119      return result.group(1)
120    else:
121      return '>> ' + self._resource_data['selfLink']
122
123  @property
124  def short_path(self) -> str:
125    path = self.project_id + '/' + self.name
126    return path
127
128  @property
129  def self_link(self) -> str:
130    return self._resource_data['selfLink']
131
132  @property
133  def name(self) -> str:
134    return self._resource_data['name']
135
136  @property
137  def named_ports(self) -> List[dict]:
138    if 'namedPorts' in self._resource_data:
139      return self._resource_data['namedPorts']
140    return []
141
142  def has_named_ports(self) -> bool:
143    if 'namedPorts' in self._resource_data:
144      return True
145    return False

148class ManagedInstanceGroup(models.Resource):
149  """Represents a GCE managed instance group."""
150
151  _resource_data: dict
152  _region: Optional[str]
153
154  def __init__(self, project_id, resource_data):
155    super().__init__(project_id=project_id)
156    self._resource_data = resource_data
157    self._region = None
158
159  @property
160  def full_path(self) -> str:
161    result = re.match(
162        r'https://www.googleapis.com/compute/v1/(.*)',
163        self._resource_data['selfLink'],
164    )
165    if result:
166      return result.group(1)
167    else:
168      return '>> ' + self._resource_data['selfLink']
169
170  @property
171  def short_path(self) -> str:
172    path = self.project_id + '/' + self.name
173    return path
174
175  def is_gke(self) -> bool:
176    """Is this managed instance group part of a GKE cluster?
177
178    Note that the results are based on heuristics (the mig name),
179    which is not ideal.
180    """
181
182    # gke- is normal GKE, gk3- is GKE autopilot
183    return self.name.startswith('gke-') or self.name.startswith('gk3-')
184
185  @property
186  def self_link(self) -> str:
187    return self._resource_data['selfLink']
188
189  @property
190  def name(self) -> str:
191    return self._resource_data['name']
192
193  @property
194  def region(self) -> str:
195    if self._region is None:
196      if 'region' in self._resource_data:
197        m = re.search(r'/regions/([^/]+)$', self._resource_data['region'])
198        if not m:
199          raise RuntimeError("can't determine region of mig %s (%s)" %
200                             (self.name, self._resource_data['region']))
201        self._region = m.group(1)
202      elif 'zone' in self._resource_data:
203        m = re.search(r'/zones/([^/]+)$', self._resource_data['zone'])
204        if not m:
205          raise RuntimeError("can't determine region of mig %s (%s)" %
206                             (self.name, self._resource_data['region']))
207        zone = m.group(1)
208        self._region = utils.zone_region(zone)
209      else:
210        raise RuntimeError(
211            f"can't determine region of mig {self.name}, both region and zone"
212            " aren't set!")
213    return self._region
214
215  def count_no_action_instances(self) -> int:
216    """number of instances in the mig that are running and have no scheduled actions."""
217    return self._resource_data['currentActions']['none']
218
219  def is_instance_member(self, project_id: str, region: str,
220                         instance_name: str):
221    """Given the project_id, region and instance name, is it a member of this MIG?"""
222    return (self.project_id == project_id and self.region == region and
223            instance_name.startswith(self._resource_data['baseInstanceName']))
224
225  @property
226  def template(self) -> InstanceTemplate:
227    if 'instanceTemplate' not in self._resource_data:
228      raise RuntimeError('instanceTemplate not set for MIG {self.name}')
229
230    m = re.match(
231        r'https://www.googleapis.com/compute/v1/(.*)',
232        self._resource_data['instanceTemplate'],
233    )
234
235    if not m:
236      raise RuntimeError("can't parse instanceTemplate: %s" %
237                         self._resource_data['instanceTemplate'])
238    template_self_link = m.group(1)
239    templates = get_instance_templates(self.project_id)
240    if template_self_link not in templates:
241      raise RuntimeError(
242          f'instanceTemplate {template_self_link} for MIG {self.name} not found'
243      )
244    return templates[template_self_link]

247class SerialPortOutput:
248  """Represents the full Serial Port Output (/dev/ttyS0 or COM1) of an instance.
249
250  contents is the full 1MB of the instance.
251  """
252
253  _project_id: str
254  _instance_id: str
255  _contents: List[str]
256
257  def __init__(self, project_id, instance_id, contents):
258    self._project_id = project_id
259    self._instance_id = instance_id
260    self._contents = contents
261
262  @property
263  def contents(self) -> List[str]:
264    return self._contents
265
266  @property
267  def instance_id(self) -> str:
268    return self._instance_id

271class Instance(models.Resource):
272  """Represents a GCE instance."""
273
274  _resource_data: dict
275  _region: Optional[str]
276
277  def __init__(self, project_id, resource_data):
278    super().__init__(project_id=project_id)
279    self._resource_data = resource_data
280    self._metadata_dict = None
281    self._region = None
282
283  @property
284  def id(self) -> str:
285    return self._resource_data['id']
286
287  @property
288  def name(self) -> str:
289    return self._resource_data['name']
290
291  @property
292  def full_path(self) -> str:
293    result = re.match(
294        r'https://www.googleapis.com/compute/v1/(.*)',
295        self._resource_data['selfLink'],
296    )
297    if result:
298      return result.group(1)
299    else:
300      return '>> ' + self._resource_data['selfLink']
301
302  @property
303  def short_path(self) -> str:
304    # Note: instance names must be unique per project, so no need to add the zone.
305    path = self.project_id + '/' + self.name
306    return path
307
308  @property
309  def creation_timestamp(self) -> datetime:
310    """VM creation time, as a *naive* `datetime` object."""
311    return (datetime.fromisoformat(
312        self._resource_data['creationTimestamp']).astimezone(
313            timezone.utc).replace(tzinfo=None))
314
315  @property
316  def region(self) -> str:
317    if self._region is None:
318      if 'zone' in self._resource_data:
319        m = re.search(r'/zones/([^/]+)$', self._resource_data['zone'])
320        if not m:
321          raise RuntimeError("can't determine region of instance %s (%s)" %
322                             (self.name, self._resource_data['region']))
323        zone = m.group(1)
324        self._region = utils.zone_region(zone)
325      else:
326        raise RuntimeError(
327            f"can't determine region of instance {self.name}, zone isn't set!")
328    return self._region
329
330  @property
331  def zone(self) -> str:
332    zone_uri = self._resource_data['zone']
333    m = re.search(r'/zones/([^/]+)$', zone_uri)
334    if m:
335      return m.group(1)
336    else:
337      raise RuntimeError(f"can't determine zone of instance {self.name}")
338
339  @property
340  def disks(self) -> List[dict]:
341    if 'disks' in self._resource_data:
342      return self._resource_data['disks']
343    return []
344
345  @property
346  def startrestricted(self) -> bool:
347    return self._resource_data['startRestricted']
348
349  def laststarttimestamp(self) -> str:
350    return self._resource_data['lastStartTimestamp']
351
352  def laststoptimestamp(self) -> str:
353    if 'lastStopTimestamp' in self._resource_data:
354      return self._resource_data['lastStopTimestamp']
355    return ''
356
357  def is_serial_port_logging_enabled(self) -> bool:
358    value = self.get_metadata('serial-port-logging-enable')
359    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
360
361  def is_oslogin_enabled(self) -> bool:
362    value = self.get_metadata('enable-oslogin')
363    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
364
365  def is_metadata_enabled(self, metadata_name) -> bool:
366    """Use to check for common boolen metadata value"""
367    value = self.get_metadata(metadata_name)
368    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
369
370  def has_label(self, label) -> bool:
371    return label in self.labels
372
373  def is_dataproc_instance(self) -> bool:
374    return self.has_label(DATAPROC_LABEL)
375
376  def is_gke_node(self) -> bool:
377    return self.has_label(GKE_LABEL)
378
379  def is_preemptible_vm(self) -> bool:
380    return ('scheduling' in self._resource_data and
381            'preemptible' in self._resource_data['scheduling'] and
382            self._resource_data['scheduling']['preemptible'])
383
384  def is_windows_machine(self) -> bool:
385    if 'disks' in self._resource_data:
386      disks = next(iter(self._resource_data['disks']))
387      if 'guestOsFeatures' in disks:
388        if 'WINDOWS' in [t['type'] for t in iter(disks['guestOsFeatures'])]:
389          return True
390    return False
391
392  def is_public_machine(self) -> bool:
393    if 'networkInterfaces' in self._resource_data:
394      return 'natIP' in str(self._resource_data['networkInterfaces'])
395    return False
396
397  def machine_type(self):
398    if 'machineType' in self._resource_data:
399      #return self._resource_data['machineType']
400      machine_type_uri = self._resource_data['machineType']
401      mt = re.search(r'/machineTypes/([^/]+)$', machine_type_uri)
402      if mt:
403        return mt.group(1)
404      else:
405        raise RuntimeError(
406            f"can't determine machineType of instance {self.name}")
407    return None
408
409  def check_license(self, licenses: List[str]) -> bool:
410    """Checks that a license is contained in a given license list"""
411    if 'disks' in self._resource_data:
412      for disk in self._resource_data['disks']:
413        if 'license' in str(disk):
414          for license_ in licenses:
415            for attached_license in disk['licenses']:
416              if license_ == attached_license.partition('/global/licenses/')[2]:
417                return True
418    return False
419
420  def get_boot_disk_image(self) -> str:
421    """Get VM's boot disk image"""
422    boot_disk_image: str = ''
423    for disk in self.disks:
424      if disk.get('boot', False):
425        disk_source = disk.get('source', '')
426        m = re.search(r'/disks/([^/]+)$', disk_source)
427        if not m:
428          raise RuntimeError(f"can't determine name of boot disk {disk_source}")
429        disk_name = m.group(1)
430        gce_disk: Disk = get_disk(self.project_id,
431                                  zone=self.zone,
432                                  disk_name=disk_name)
433        return gce_disk.source_image
434    return boot_disk_image
435
436  @property
437  def is_sole_tenant_vm(self) -> bool:
438    return bool('nodeAffinities' in self._resource_data['scheduling'])
439
440  @property
441  def network(self) -> network_q.Network:
442    # 'https://www.googleapis.com/compute/v1/projects/gcpdiag-gce1-aaaa/global/networks/default'
443    network_string = self._resource_data['networkInterfaces'][0]['network']
444    m = re.match(r'^.+/projects/([^/]+)/global/networks/([^/]+)$',
445                 network_string)
446    if not m:
447      raise RuntimeError("can't parse network string: %s" % network_string)
448    return network_q.get_network(m.group(1), m.group(2))
449
450  @property
451  def network_ips(self) -> List[network_q.IPv4AddrOrIPv6Addr]:
452    return [
453        ipaddress.ip_address(nic['networkIP'])
454        for nic in self._resource_data['networkInterfaces']
455    ]
456
457  @property
458  def get_network_interfaces(self):
459    return self._resource_data['networkInterfaces']
460
461  @property
462  def subnetworks(self) -> List[network_q.Subnetwork]:
463    subnetworks = []
464    for nic in self._resource_data['networkInterfaces']:
465      subnetworks.append(network_q.get_subnetwork_from_url(nic['subnetwork']))
466    return subnetworks
467
468  @property
469  def routes(self) -> List[network_q.Route]:
470    routes = []
471    for nic in self._resource_data['networkInterfaces']:
472      for route in network_q.get_routes(self.project_id):
473        if nic['network'] == route.network:
474          if route.tags == []:
475            routes.append(route)
476            continue
477          else:
478            temp = [x for x in self.tags if x in route.tags]
479            if len(temp) > 0:
480              routes.append(route)
481    return routes
482
483  def get_network_ip_for_instance_interface(
484      self, network: str) -> Optional[network_q.IPv4NetOrIPv6Net]:
485    """Get the network ip for a nic given a network name"""
486    for nic in self._resource_data['networkInterfaces']:
487      if nic.get('network') == network:
488        return ipaddress.ip_network(nic.get('networkIP'))
489    return None
490
491  def secure_boot_enabled(self) -> bool:
492    if 'shieldedInstanceConfig' in self._resource_data:
493      return self._resource_data['shieldedInstanceConfig']['enableSecureBoot']
494    return False
495
496  @property
497  def access_scopes(self) -> List[str]:
498    if 'serviceAccounts' in self._resource_data:
499      saccts = self._resource_data['serviceAccounts']
500      if isinstance(saccts, list) and len(saccts) >= 1:
501        return saccts[0].get('scopes', [])
502    return []
503
504  @property
505  def service_account(self) -> Optional[str]:
506    if 'serviceAccounts' in self._resource_data:
507      saccts = self._resource_data['serviceAccounts']
508      if isinstance(saccts, list) and len(saccts) >= 1:
509        return saccts[0]['email']
510    return None
511
512  @property
513  def tags(self) -> List[str]:
514    if 'tags' in self._resource_data:
515      if 'items' in self._resource_data['tags']:
516        return self._resource_data['tags']['items']
517    return []
518
519  def get_metadata(self, key: str) -> str:
520    if not self._metadata_dict:
521      self._metadata_dict = {}
522      if ('metadata' in self._resource_data and
523          'items' in self._resource_data['metadata']):
524        for item in self._resource_data['metadata']['items']:
525          if 'key' in item and 'value' in item:
526            self._metadata_dict[item['key']] = item['value']
527    project_metadata = get_project_metadata(self.project_id)
528    return self._metadata_dict.get(key, project_metadata.get(key))
529
530  @property
531  def status(self) -> str:
532    """VM Status"""
533    return self._resource_data.get('status', None)
534
535  @property
536  def is_running(self) -> bool:
537    """VM Status is indicated as running"""
538    return self._resource_data.get('status', False) == 'RUNNING'
539
540  @property  # type: ignore
541  @caching.cached_api_call(in_memory=True)
542  def mig(self) -> ManagedInstanceGroup:
543    """Return ManagedInstanceGroup that owns this instance.
544
545    Throws AttributeError in case it isn't MIG-managed.
546    """
547
548    created_by = self.get_metadata('created-by')
549    if created_by is None:
550      raise AttributeError(f'instance {self.id} is not managed by a mig')
551
552    # Example created-by:
553    # pylint: disable=line-too-long
554    # "projects/12340002/zones/europe-west4-a/instanceGroupManagers/gke-gke1-default-pool-e5e20a34-grp"
555    # (note how it uses a project number and not a project id...)
556    created_by_match = re.match(
557        r'projects/([^/]+)/((?:regions|zones)/[^/]+/instanceGroupManagers/[^/]+)$',
558        created_by,
559    )
560    if not created_by_match:
561      raise AttributeError(f'instance {self.id} is not managed by a mig'
562                           f' (created-by={created_by})')
563    project = crm.get_project(created_by_match.group(1))
564
565    mig_self_link = ('https://www.googleapis.com/compute/v1/'
566                     f'projects/{project.id}/{created_by_match.group(2)}')
567
568    # Try to find a matching mig.
569    for mig in get_managed_instance_groups(
570        models.Context(project_id=self.project_id)).values():
571      if mig.self_link == mig_self_link:
572        return mig
573
574    raise AttributeError(f'instance {self.id} is not managed by a mig')
575
576  @property
577  def labels(self) -> dict:
578    return self._resource_data.get('labels', {})