gcpdiag.queries.gce

 40class InstanceTemplate(models.Resource):
 41  """Represents a GCE Instance Template."""
 42
 43  _resource_data: dict
 44
 45  def __init__(self, project_id, resource_data):
 46    super().__init__(project_id=project_id)
 47    self._resource_data = resource_data
 48
 49  @property
 50  def self_link(self) -> str:
 51    return self._resource_data['selfLink']
 52
 53  @property
 54  def full_path(self) -> str:
 55    result = re.match(r'https://www.googleapis.com/compute/v1/(.*)',
 56                      self.self_link)
 57    if result:
 58      return result.group(1)
 59    else:
 60      return f'>> {self.self_link}'
 61
 62  @property
 63  def short_path(self) -> str:
 64    path = self.project_id + '/' + self.name
 65    return path
 66
 67  @property
 68  def name(self) -> str:
 69    return self._resource_data['name']
 70
 71  @property
 72  def tags(self) -> List[str]:
 73    return self._resource_data['properties'].get('tags', {}).get('items', [])
 74
 75  @property
 76  def service_account(self) -> Optional[str]:
 77    sa_list = self._resource_data['properties'].get('serviceAccounts', [])
 78    if not sa_list:
 79      return None
 80    email = sa_list[0]['email']
 81    if email == 'default':
 82      project_nr = crm.get_project(self._project_id).number
 83      return f'{project_nr}-compute@developer.gserviceaccount.com'
 84    return email
 85
 86  @property
 87  def network(self) -> network_q.Network:
 88    return network_q.get_network_from_url(
 89        self._resource_data['properties']['networkInterfaces'][0]['network'])
 90
 91  @property
 92  def subnetwork(self) -> network_q.Subnetwork:
 93    subnet_url = self._resource_data['properties']['networkInterfaces'][0][
 94        'subnetwork']
 95    return self.network.subnetworks[subnet_url]
 96
 97  def get_metadata(self, key: str) -> str:
 98    for item in self._resource_data['properties']['metadata']['items']:
 99      if item['key'] == key:
100        return item['value']
101    return ''

104class InstanceGroup(models.Resource):
105  """Represents a GCE instance group."""
106
107  _resource_data: dict
108
109  def __init__(self, project_id, resource_data):
110    super().__init__(project_id=project_id)
111    self._resource_data = resource_data
112
113  @property
114  def full_path(self) -> str:
115    result = re.match(
116        r'https://www.googleapis.com/compute/v1/(.*)',
117        self._resource_data['selfLink'],
118    )
119    if result:
120      return result.group(1)
121    else:
122      return '>> ' + self._resource_data['selfLink']
123
124  @property
125  def short_path(self) -> str:
126    path = self.project_id + '/' + self.name
127    return path
128
129  @property
130  def self_link(self) -> str:
131    return self._resource_data['selfLink']
132
133  @property
134  def name(self) -> str:
135    return self._resource_data['name']
136
137  @property
138  def named_ports(self) -> List[dict]:
139    if 'namedPorts' in self._resource_data:
140      return self._resource_data['namedPorts']
141    return []
142
143  def has_named_ports(self) -> bool:
144    if 'namedPorts' in self._resource_data:
145      return True
146    return False

149class ManagedInstanceGroup(models.Resource):
150  """Represents a GCE managed instance group."""
151
152  _resource_data: dict
153  _region: Optional[str]
154
155  def __init__(self, project_id, resource_data):
156    super().__init__(project_id=project_id)
157    self._resource_data = resource_data
158    self._region = None
159
160  @property
161  def full_path(self) -> str:
162    result = re.match(
163        r'https://www.googleapis.com/compute/v1/(.*)',
164        self._resource_data['selfLink'],
165    )
166    if result:
167      return result.group(1)
168    else:
169      return '>> ' + self._resource_data['selfLink']
170
171  @property
172  def short_path(self) -> str:
173    path = self.project_id + '/' + self.name
174    return path
175
176  def is_gke(self) -> bool:
177    """Is this managed instance group part of a GKE cluster?
178
179    Note that the results are based on heuristics (the mig name),
180    which is not ideal.
181
182    Returns:
183        bool: True if this managed instance group is part of a GKE cluster.
184    """
185
186    # gke- is normal GKE, gk3- is GKE autopilot
187    return self.name.startswith('gke-') or self.name.startswith('gk3-')
188
189  @property
190  def self_link(self) -> str:
191    return self._resource_data['selfLink']
192
193  @property
194  def name(self) -> str:
195    return self._resource_data['name']
196
197  @property
198  def region(self) -> str:
199    if self._region is None:
200      if 'region' in self._resource_data:
201        m = re.search(r'/regions/([^/]+)$', self._resource_data['region'])
202        if not m:
203          raise RuntimeError("can't determine region of mig %s (%s)" %
204                             (self.name, self._resource_data['region']))
205        self._region = m.group(1)
206      elif 'zone' in self._resource_data:
207        m = re.search(r'/zones/([^/]+)$', self._resource_data['zone'])
208        if not m:
209          raise RuntimeError("can't determine region of mig %s (%s)" %
210                             (self.name, self._resource_data['region']))
211        zone = m.group(1)
212        self._region = utils.zone_region(zone)
213      else:
214        raise RuntimeError(
215            f"can't determine region of mig {self.name}, both region and zone"
216            " aren't set!")
217    return self._region
218
219  def count_no_action_instances(self) -> int:
220    """number of instances in the mig that are running and have no scheduled actions."""
221    return self._resource_data['currentActions']['none']
222
223  def is_instance_member(self, project_id: str, region: str,
224                         instance_name: str):
225    """Given the project_id, region and instance name, is it a member of this MIG?"""
226    return (self.project_id == project_id and self.region == region and
227            instance_name.startswith(self._resource_data['baseInstanceName']))
228
229  @property
230  def template(self) -> InstanceTemplate:
231    if 'instanceTemplate' not in self._resource_data:
232      raise RuntimeError('instanceTemplate not set for MIG {self.name}')
233
234    m = re.match(
235        r'https://www.googleapis.com/compute/v1/(.*)',
236        self._resource_data['instanceTemplate'],
237    )
238
239    if not m:
240      raise RuntimeError("can't parse instanceTemplate: %s" %
241                         self._resource_data['instanceTemplate'])
242    template_self_link = m.group(1)
243    templates = get_instance_templates(self.project_id)
244    if template_self_link not in templates:
245      raise RuntimeError(
246          f'instanceTemplate {template_self_link} for MIG {self.name} not found'
247      )
248    return templates[template_self_link]
249
250  @property
251  def version_target_reached(self) -> bool:
252    return get_path(self._resource_data,
253                    ('status', 'versionTarget', 'isReached'))

256class SerialPortOutput:
257  """Represents the full Serial Port Output (/dev/ttyS0 or COM1) of an instance.
258
259  contents is the full 1MB of the instance.
260  """
261
262  _project_id: str
263  _instance_id: str
264  _contents: List[str]
265
266  def __init__(self, project_id, instance_id, contents):
267    self._project_id = project_id
268    self._instance_id = instance_id
269    self._contents = contents
270
271  @property
272  def contents(self) -> List[str]:
273    return self._contents
274
275  @property
276  def instance_id(self) -> str:
277    return self._instance_id

280class Instance(models.Resource):
281  """Represents a GCE instance."""
282
283  _resource_data: dict
284  _region: Optional[str]
285
286  def __init__(self, project_id, resource_data):
287    super().__init__(project_id=project_id)
288    self._resource_data = resource_data
289    self._metadata_dict = None
290    self._region = None
291
292  @property
293  def id(self) -> str:
294    return self._resource_data['id']
295
296  @property
297  def name(self) -> str:
298    return self._resource_data['name']
299
300  @property
301  def full_path(self) -> str:
302    result = re.match(
303        r'https://www.googleapis.com/compute/v1/(.*)',
304        self._resource_data['selfLink'],
305    )
306    if result:
307      return result.group(1)
308    else:
309      return '>> ' + self._resource_data['selfLink']
310
311  @property
312  def short_path(self) -> str:
313    # Note: instance names must be unique per project,
314    # so no need to add the zone.
315    path = self.project_id + '/' + self.name
316    return path
317
318  @property
319  def creation_timestamp(self) -> datetime:
320    """VM creation time, as a *naive* `datetime` object."""
321    return (datetime.fromisoformat(
322        self._resource_data['creationTimestamp']).astimezone(
323            timezone.utc).replace(tzinfo=None))
324
325  @property
326  def region(self) -> str:
327    if self._region is None:
328      if 'zone' in self._resource_data:
329        m = re.search(r'/zones/([^/]+)$', self._resource_data['zone'])
330        if not m:
331          raise RuntimeError("can't determine region of instance %s (%s)" %
332                             (self.name, self._resource_data['region']))
333        zone = m.group(1)
334        self._region = utils.zone_region(zone)
335      else:
336        raise RuntimeError(
337            f"can't determine region of instance {self.name}, zone isn't set!")
338    return self._region
339
340  @property
341  def zone(self) -> str:
342    zone_uri = self._resource_data['zone']
343    m = re.search(r'/zones/([^/]+)$', zone_uri)
344    if m:
345      return m.group(1)
346    else:
347      raise RuntimeError(f"can't determine zone of instance {self.name}")
348
349  @property
350  def disks(self) -> List[dict]:
351    if 'disks' in self._resource_data:
352      return self._resource_data['disks']
353    return []
354
355  @property
356  def startrestricted(self) -> bool:
357    return self._resource_data['startRestricted']
358
359  def laststarttimestamp(self) -> str:
360    return self._resource_data['lastStartTimestamp']
361
362  def laststoptimestamp(self) -> str:
363    if 'lastStopTimestamp' in self._resource_data:
364      return self._resource_data['lastStopTimestamp']
365    return ''
366
367  def is_serial_port_logging_enabled(self) -> bool:
368    value = self.get_metadata('serial-port-logging-enable')
369    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
370
371  def is_oslogin_enabled(self) -> bool:
372    value = self.get_metadata('enable-oslogin')
373    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
374
375  def is_metadata_enabled(self, metadata_name) -> bool:
376    """Use to check for common boolean metadata value"""
377    value = self.get_metadata(metadata_name)
378    return bool(value and value.upper() in POSITIVE_BOOL_VALUES)
379
380  def has_label(self, label) -> bool:
381    return label in self.labels
382
383  def is_dataproc_instance(self) -> bool:
384    return self.has_label(DATAPROC_LABEL)
385
386  def is_gke_node(self) -> bool:
387    return self.has_label(GKE_LABEL)
388
389  def is_preemptible_vm(self) -> bool:
390    return ('scheduling' in self._resource_data and
391            'preemptible' in self._resource_data['scheduling'] and
392            self._resource_data['scheduling']['preemptible'])
393
394  @property
395  def created_by_mig(self) -> bool:
396    """Return bool indicating if the instance part of a mig.
397
398    MIG which were part of MIG however have been removed or terminated will return True.
399    """
400    created_by = self.get_metadata('created-by')
401    if created_by is None:
402      return False
403
404    created_by_match = re.match(
405        r'projects/([^/]+)/((?:regions|zones)/[^/]+/instanceGroupManagers/[^/]+)$',
406        created_by,
407    )
408    if not created_by_match:
409      return False
410    return True
411
412  def is_windows_machine(self) -> bool:
413    if 'disks' in self._resource_data:
414      disks = next(iter(self._resource_data['disks']))
415      if 'guestOsFeatures' in disks:
416        if 'WINDOWS' in [t['type'] for t in iter(disks['guestOsFeatures'])]:
417          return True
418    return False
419
420  def is_public_machine(self) -> bool:
421    if 'networkInterfaces' in self._resource_data:
422      return 'natIP' in str(self._resource_data['networkInterfaces'])
423    return False
424
425  def machine_type(self):
426    if 'machineType' in self._resource_data:
427      # return self._resource_data['machineType']
428      machine_type_uri = self._resource_data['machineType']
429      mt = re.search(r'/machineTypes/([^/]+)$', machine_type_uri)
430      if mt:
431        return mt.group(1)
432      else:
433        raise RuntimeError(
434            f"can't determine machineType of instance {self.name}")
435    return None
436
437  def check_license(self, licenses: List[str]) -> bool:
438    """Checks that a license is contained in a given license list."""
439    if 'disks' in self._resource_data:
440      for disk in self._resource_data['disks']:
441        if 'license' in str(disk):
442          for license_ in licenses:
443            for attached_license in disk['licenses']:
444              if license_ == attached_license.partition('/global/licenses/')[2]:
445                return True
446    return False
447
448  def get_boot_disk_image(self) -> str:
449    """Get VM's boot disk image."""
450    boot_disk_image: str = ''
451    for disk in self.disks:
452      if disk.get('boot', False):
453        disk_source = disk.get('source', '')
454        m = re.search(r'/disks/([^/]+)$', disk_source)
455        if not m:
456          raise RuntimeError(f"can't determine name of boot disk {disk_source}")
457        disk_name = m.group(1)
458        gce_disk: Disk = get_disk(self.project_id,
459                                  zone=self.zone,
460                                  disk_name=disk_name)
461        return gce_disk.source_image
462    return boot_disk_image
463
464  @property
465  def is_sole_tenant_vm(self) -> bool:
466    return bool('nodeAffinities' in self._resource_data['scheduling'])
467
468  @property
469  def network(self) -> network_q.Network:
470    # 'https://www.googleapis.com/compute/v1/projects/gcpdiag-gce1-aaaa/global/networks/default'
471    network_string = self._resource_data['networkInterfaces'][0]['network']
472    m = re.match(r'^.+/projects/([^/]+)/global/networks/([^/]+)$',
473                 network_string)
474    if not m:
475      raise RuntimeError("can't parse network string: %s" % network_string)
476    return network_q.get_network(m.group(1), m.group(2))
477
478  @property
479  def network_ips(self) -> List[network_q.IPv4AddrOrIPv6Addr]:
480    return [
481        ipaddress.ip_address(nic['networkIP'])
482        for nic in self._resource_data['networkInterfaces']
483    ]
484
485  @property
486  def get_network_interfaces(self):
487    return self._resource_data['networkInterfaces']
488
489  @property
490  def subnetworks(self) -> List[network_q.Subnetwork]:
491    subnetworks = []
492    for nic in self._resource_data['networkInterfaces']:
493      subnetworks.append(network_q.get_subnetwork_from_url(nic['subnetwork']))
494    return subnetworks
495
496  @property
497  def routes(self) -> List[network_q.Route]:
498    routes = []
499    for nic in self._resource_data['networkInterfaces']:
500      for route in network_q.get_routes(self.project_id):
501        if nic['network'] == route.network:
502          if route.tags == []:
503            routes.append(route)
504            continue
505          else:
506            temp = [x for x in self.tags if x in route.tags]
507            if len(temp) > 0:
508              routes.append(route)
509    return routes
510
511  def get_network_ip_for_instance_interface(
512      self, network: str) -> Optional[network_q.IPv4NetOrIPv6Net]:
513    """Get the network ip for a nic given a network name."""
514    for nic in self._resource_data['networkInterfaces']:
515      if nic.get('network') == network:
516        return ipaddress.ip_network(nic.get('networkIP'))
517    return None
518
519  def secure_boot_enabled(self) -> bool:
520    if 'shieldedInstanceConfig' in self._resource_data:
521      return self._resource_data['shieldedInstanceConfig']['enableSecureBoot']
522    return False
523
524  @property
525  def access_scopes(self) -> List[str]:
526    if 'serviceAccounts' in self._resource_data:
527      saccts = self._resource_data['serviceAccounts']
528      if isinstance(saccts, list) and len(saccts) >= 1:
529        return saccts[0].get('scopes', [])
530    return []
531
532  @property
533  def service_account(self) -> Optional[str]:
534    if 'serviceAccounts' in self._resource_data:
535      saccts = self._resource_data['serviceAccounts']
536      if isinstance(saccts, list) and len(saccts) >= 1:
537        return saccts[0]['email']
538    return None
539
540  @property
541  def tags(self) -> List[str]:
542    if 'tags' in self._resource_data:
543      if 'items' in self._resource_data['tags']:
544        return self._resource_data['tags']['items']
545    return []
546
547  def get_metadata(self, key: str) -> str:
548    if not self._metadata_dict:
549      self._metadata_dict = {}
550      if ('metadata' in self._resource_data and
551          'items' in self._resource_data['metadata']):
552        for item in self._resource_data['metadata']['items']:
553          if 'key' in item and 'value' in item:
554            self._metadata_dict[item['key']] = item['value']
555    project_metadata = get_project_metadata(self.project_id)
556    return self._metadata_dict.get(key, project_metadata.get(key))
557
558  @property
559  def status(self) -> str:
560    """VM Status."""
561    return self._resource_data.get('status', None)
562
563  @property
564  def is_running(self) -> bool:
565    """VM Status is indicated as running."""
566    return self._resource_data.get('status', False) == 'RUNNING'
567
568  @property  # type: ignore
569  @caching.cached_api_call(in_memory=True)
570  def mig(self) -> ManagedInstanceGroup:
571    """Return ManagedInstanceGroup that owns this instance.
572
573    Throws AttributeError in case it isn't MIG-managed.
574    """
575
576    created_by = self.get_metadata('created-by')
577    if created_by is None:
578      raise AttributeError(f'instance {self.id} is not managed by a mig')
579
580    # Example created-by:
581    # pylint: disable=line-too-long
582    # "projects/12340002/zones/europe-west4-a/instanceGroupManagers/gke-gke1-default-pool-e5e20a34-grp"
583    # (note how it uses a project number and not a project id...)
584    created_by_match = re.match(
585        r'projects/([^/]+)/((?:regions|zones)/[^/]+/instanceGroupManagers/[^/]+)$',
586        created_by,
587    )
588    if not created_by_match:
589      raise AttributeError(f'instance {self.id} is not managed by a mig'
590                           f' (created-by={created_by})')
591    project = crm.get_project(created_by_match.group(1))
592
593    mig_self_link = ('https://www.googleapis.com/compute/v1/'
594                     f'projects/{project.id}/{created_by_match.group(2)}')
595
596    # Try to find a matching mig.
597    for mig in get_managed_instance_groups(
598        models.Context(project_id=self.project_id)).values():
599      if mig.self_link == mig_self_link:
600        return mig
601
602    raise AttributeError(f'instance {self.id} is not managed by a mig')
603
604  @property
605  def labels(self) -> dict:
606    return self._resource_data.get('labels', {})