JFIFxxC      C  " }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr O6ufuCLddlmZddlZddlZddlmZmZmZGddeeZy)) translateN)Plugin RedHatPlugin PluginOptc eZdZdZdZdZdZdZdZdZ dZ e d d e d e d d e d e ddde ddde ddde dde d e dde d e dde d gZ d Zd!Zd"Zd#Zd$Zd%Zd&Zd'Zd(Zd)Zy )* OpenshiftaThis is the plugin for OCP 4.x collections. While this product is still built ontop of kubernetes, there is enough difference in the collection requirements and approach to warrant a separate plugin as opposed to further extending the kubernetes plugin (or the OCP 3.x extensions included in the Red Hat version of the kube plugin). This plugin may collect OCP API information when the `with-api` option is enabled. This option is disabled by default. When enabled, this plugin will collect cluster information and inspect the default namespaces/projects that are created during deployment - i.e. the namespaces of the cluster projects matching openshift.* and kube.*. At the time of this plugin's creation that number of default projects is already north of 50; hence this plugin is expected to take a long time in both the setup() and collect() phases. End-user projects may also be collected from when those projects are included in the `add-namespaces` or `only-namespaces` options. It is expected to need to perform an `oc login` command in order for this plugin to be able to correctly capture information, as system root is not considered cluster root on the cluster nodes in order to access the API. Users will need to either: 1) Accept the use of a well-known stock kubeconfig file provided via a static pod resource for the kube-apiserver 2) Provide the bearer token via the `-k openshift.token` option 3) Provide the bearer token via the `SOSOCPTOKEN` environment variable 4) Otherwise ensure that the root user can successfully run `oc` and get proper output prior to running this plugin It is highly suggested that option #1 be used first, as this uses well known configurations and requires the least information from the user. If using a token, it is recommended to use option #3 as this will prevent the token from being recorded in output saved to the archive. Option #2 may be used if this is considered an acceptable risk. It is not recommended to rely on option #4, though it will provide the functionality needed. z Openshift Container Platform 4.x openshifti)r )zopenshift-hyperkubezg/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfigzoc get tokenNz admin token to allow API queries)defaultval_typedesc kubeconfigz+Path to a locally available kubeconfig filehostzhttps://localhost:6443z0host address to use for oc login, including port)r r with-apiFzcollect output from the OCP APIpodlogsTzcollect logs from each podpodlogs-filterz1only collect logs from pods matching this patternonly-namespacesz2colon-delimited list of namespaces to collect fromadd-namespaceszHcolon-delimited list of namespaces to add to the default collection listc0|jdddk(S)z(Check to see if we can run `oc` commandsz oc whoamistatusr)exec_cmdselfs >/usr/lib/python3/dist-packages/sos/report/plugins/openshift.py_check_oc_functionzOpenshift._check_oc_functionYs}}[)(3q88cB|j|jdS)z?Check if the localhost.kubeconfig exists with system:admin userr) path_exists get_optionrs r_check_localhost_kubeconfigz%Openshift._check_localhost_kubeconfig]s =>>rc|jry|jd|jd|j|j rj|j d|jdi|j d}|ddk(r|jry|jd|dd |d y |jd xstjd d}|rR|j d|jdd|d}|ddk(r|jry|jdy |jdy )zuSee if we're logged in to the API service, and if not attempt to do so using provided plugin options TrN KUBECONFIGz8oc login -u system:admin --insecure-skip-tls-verify=Truerrz&The login command failed with status: z and error: outputFr SOSOCPTOKENz oc login rz --token=z --insecure-skip-tls-verify=TruezIAttempt to login to OCP API failed, will not run or collect `oc` commandszUNot logged in to OCP API, and no login token provided. Will not collect `oc` commands) rr set_optionmaster_localhost_kubeconfigr!set_default_cmd_environmentr _log_warnosgetenv)roc_resr s r_check_oc_logged_inzOpenshift._check_oc_logged_inasm  " " $ ??< ( 0 OO00   + + -  , ,dool;. ]]2Fh1$)@)@)B NN8(#$L1A0BD (JBIImT,J ]]Ytv/F.GH..3W5E$EFFh1$**, NN6 7 9 :rc|jdr)t|jdjdSddg}|jdr6|jdjdD]}|j||S)zCombine a set of regexes for collection with any namespaces passed to sos via the -k openshift.add-namespaces option. Note that this does allow for end users to specify namespace regexes of their own. r:z openshift.*zkube.*r)r listsplitappend)rcollect_regexesnsps r_setup_namespace_regexesz"Openshift._setup_namespace_regexess ??, -(9:@@EF F    ??+ ,'78>>sC ,&&s+ ,rc xd}|j}t|Dchc]}|||s |c}Scc}w)aReduce the namespace listing returned to just the ones we want to collect from. By default, as requested by OCP support personnel, this must include all 'openshift' prefixed namespaces :param nsps list: Namespace names from oc output cB|D]}tj||syy)zMatch a particular namespace for inclusion (or not) in the collection phases :param namespace str: The name of a namespace TF)rematch) namespaceregexesregexs r_match_namespacez:Openshift._reduce_namespace_list.._match_namespaces)! 88E9- r)r5r0)rnspsr=r;ns r_reduce_namespace_listz Openshift._reduce_namespace_lists: //1E1(8G(DQEFFEs77cZ|jd|jd|jddg|jd|j dr|j }nd}|r|j dg}|jgd|j|j|jd }|d d k(rE|d jd dDcgc]}|jd }}|j|}|D]}|j|yycc}w)aThe setup() phase of this plugin will iterate through all default projects (namespaces), and/or those specified via the `add-namespaces` and `only-namespaces` plugin options. Both of these options accept shell-style regexes. Cluster-wide information, that is information that is not tied to a specific namespace, will be saved in the top-level plugin directory. Each namespace will have it's own subdir within the `namespaces` subdir to aide in organization. From there, each namespace subdir will have a subsequent subdir for each type of API resource the plugin collects. In contrast with the `kubernetes` plugin, this plugin will collect logs from all pods within each namespace, as well as the previous pod's logs, by default. The `-k openshift.podlogs-filter` option can be used to greatly reduce the amount of collected information. kubeletz/etc/kubernetes/*.crtz/etc/kubernetes/*.key/etc/kubernetes/*rFzNote that the Openshift Container Platform plugin can be expected in most configurations to take 5+ minutes in both the setup and collection phases)zoc cluster-infoz oc get -A pvz oc get -A csrz oc statusz oc versionz namespacesrrr$N) add_journaladd_service_statusadd_forbidden_path add_copy_specr r-r)add_cmd_outputcollect_cluster_resourcescollect_cmd_outputoc_cmd splitlinesr1r@collect_from_namespace)r can_run_ococ_nsps_nm_resr?r>r:s rsetupzOpenshift.setupsJ( #  *  # #!   ./ ??: &113JJ  NN2  G   !   * * ,-- [.IJGx A%*1(*;*F*F*H*L%&AGGIaL55d;% 7 ++I6 7C 6s!D(c gd}|D]~}d|}d|g}|j|jd|||}|ddk(s:|djd d D],}|jd |d|j d| .y ) zFCollect cluster-level (non-namespaced) resources from the API )clusternetworksclusteroperatorsclusterversionscomponentstatusesconfigscontainerruntimeconfigscontrollerconfigsdnses hostsubnetsinfrastructuresmachineconfigpoolsmachineconfigs netnamespacesnetworksnodesproxiesstorageclasseszcluster_resources/ocp_ subdirtagsrrr$rDNz oc describe rh)rKrLrMrIr1)rglobal_resourcesresource_subdir_tag_res _res_names rrJz#Openshift.collect_cluster_resources s () H*8*5G8*%&D**dkk]!H:+F29+FDH~"!%h!:!:!C#'Gse yk3%(E ++mI;auEH../H!Q&%h/::&,:+;5)A(&=ZDOOI4N6@A ! AHA((H=; >8 BsDcd|d}|jdrt|jd}nd}|D];}|rtj||sd|d|}|j ||dzg|=y) zFor any namespace that has active pods in it, collect the current and previous pod's logs :param pod_list list: A list of pod names rz /pods/podlogsrNzoc logs --namespace=rfz -prj)r rr8r9rI)rr:r_log_dirr<pod_log_cmds rrzOpenshift.collect_podlogs~s ! =9 ??+ ,doo.>?@EE CRXXeS1-i[#?H   5 !   rc|jd|jdgd}ddj|d}|jd|d|j d|dd }|j d |d y) Nzoc rC)z.*.crtzclient-certificate-datazclient-key-datazcertificate-authority-dataz.*.keyr z.*token.*.valuez(\s*(|z):)(.*)z \1 *******rz((?P(.*\\n)?Source:\s(.*),)((.*?))\nz oc describez\g *******\n)do_cmd_private_subdo_file_private_subjoindo_path_regex_subdo_cmd_output_sub)r_fieldsr<s rpostproczOpenshift.postprocs &   !45 '*+73 2E=I y%?< }e5IJr)__name__ __module__ __qualname____doc__ short_desc plugin_nameplugin_timeoutprofilespackagesr'rLrstr option_listrr!r-r5r@rRrJrNrrrrrrs&P4JKNH'H M F '4#9 ;,sD F&":I K*e8 :)T0LM"BJ L#R#K M"B2 4K&9?5n(G0D7L!FO>b 0Krr) fnmatchrr*r8sos.report.pluginsrrrrrrrrs( >>eK eKr