܍~cTddlZddlZddlZddlmZddlmZddlmZddlm Z m Z ddlm Z ddlm Z mZddlmZmZdd lmZdd lmZdd lmZejeZee jgZd Zd ZdZ dZ!dZ"e"dzZ#e"e#gZ$GddZ%dZ&Gdde j'Z(Gdde(Z)dZ*dZ+dZ,dZ-dZ.dZ/dZ0d Z1d!Z2d"Z3 d(d$Z4d%Z5d&Z6e)e j7ffe(e j7e j8ffgZ9d'Z:dS))N)List)dmi)log)netsources) url_helper)utilwarnings) EventScope EventType)NoDHCPLeaseError)EphemeralIPNetwork)ec2) datasourceEc2 strict_idwarnzlatest/api/token21600zX-aws-ec2-metadata-tokenz -ttl-secondsc.eZdZdZdZdZdZdZdZdZ dZ d S) CloudNamesaliyunaws brightboxzstacke24cloudoutscaleunknownzno-ec2-metadataN) __name__ __module__ __qualname__ALIYUNAWS BRIGHTBOXZSTACKE24CLOUDOUTSCALEUNKNOWNNO_EC2_METADATAA/usr/lib/python3/dist-packages/cloudinit/sources/DataSourceEc2.pyrr(s: F CI FHHG(OOOr*rc*|jdkod|jvS)Nzmeta-data/tags/)codeurl) exceptions r+skip_404_tag_errorsr18s >S G%6)-%GGr*ceZdZUdZgdZdZgdZeee d<dZ dZ dZ e jZd ZejejejejejhiZfd Zd Zd Zd ZedZedZdZ dZ!dZ"dZ#dZ$edZ%edZ&dZ'edZ(efdZ)dZ*e+fdZ,dZ-dZ.d!dZ/d"d Z0xZ1S)# DataSourceEc2r)zhttp://169.254.169.254zhttp://[fd00:ec2::254]zhttp://instance-data.:8773z 2009-04-04)z 2021-03-23z 2018-09-24z 2016-09-02extended_metadata_versionsx2NFcjtt||||d|_dSN)superr3__init__metadata_address)selfsys_cfgdistropaths __class__s r+r:zDataSourceEc2.__init__gs3 mT""++GVUCCC $r*ctS)z5Return the cloud name as identified during _get_data.)identify_platformr<s r+_get_cloud_namezDataSourceEc2._get_cloud_nameks """r*cBttj|jtt d\}}t d||j|j |dkr|jtj krdS|jtj krdS|j rtjrt ddS t|jdd|j5}|jr d|jnd }tjt jd ||j |_dddn #1swxYwYn<#t.$rYdSwxYwtjt jd |j |_|jsdS|jd d|_|jd d|_|jdididi|_dS)N)rNz0strict_mode: %s, cloud_name=%s cloud_platform=%strueFz1FreeBSD doesn't support running dhclient with -sfT)ipv4ipv6tmp_dir zCrawl of metadata servicelogfuncmsgfunc meta-data user-datadynamicinstance-identitydocument)read_strict_moder get_cfg_by_pathr=STRICT_ID_PATHSTRICT_ID_DEFAULTLOGdebug cloud_nameplatformrr'r(perform_dhcp_setup is_FreeBSDrfallback_interfacer>get_tmp_exec_path state_msglog_timecrawl_metadata_crawled_metadatar getmetadata userdata_rawidentity)r< strict_mode_sleepnetwras r+ _get_datazDataSourceEc2._get_dataosu.   n.?       V >  O M    & T_ 8J%J%J5 _ : : :5  "     MNNNu '+ K99;;   8< N 4DN 4 4 4BI-1] # C CC!0...D*               $   uu &*] /(&&&D " % 5.22;EE  266{DII  " & &y" 5 5 S$b ) ) SR  ts7 /E8AE: EE  E E E E E c|jsdS|jdidi}|diD] \}}d|vrdS dS)z6Report if this instance type is Ec2 Classic (non-vpc).Fnetwork interfacesmacszvpc-idT)rfreitems)r< ifaces_md_macmac_datas r+is_classic_instancez!DataSourceEc2.is_classic_instances} 5M%%i4488rJJ 'mmFB77==??  ND(8##uu$tr*cH|jsdS|jdS)Nzami-launch-index)rfrerCs r+ launch_indexzDataSourceEc2.launch_indexs(} 4}  !3444r*ct|ds#tj|_|js#tj|_|jS)N_platform_type)hasattrr3dsnamelowerryrCs r+r\zDataSourceEc2.platformsYt-.. ?"/"6"<"<">">D " ?"/"6"<"<">">D ""r*cd}|}|jD]}||j|} t j||t }|jdkrt d||cS|jdkr#d}t |||j #tj $r&}t d||Yd}~d}~wwxYw|j S) aEGet the best supported api version from the metadata service. Loop through all extended support metadata versions in order and return the most-fully featured metadata api version discovered. If extended_metadata_versions aren't present, return the datasource's min_metadata_version. z{0}/{1}/meta-data/instance-id)r/headersheaders_redactz#Found preferred metadata version %sr-z0Metadata api version %s not present. Headers: %szurl %s raised exception %sN) _get_headersr4formatr;uhelpreadurlAWS_TOKEN_REDACTr.rYrZr~UrlErrormin_metadata_version)r<url_tmplr~api_verr/resprNes r+get_metadata_api_versionz&DataSourceEc2.get_metadata_api_versions3##%%6 : :G//$"7AAC :}W=M 9##IICWMMM"NNNY#%%LCIIc7DL999> @ @ @ 6Q???????? @((sB11C&C!!C&ch|jtjkrt|ddsZ|}t j||j|jt|j  di|_ |j d|j dS|j dS)Nrh headers_cbr exception_cbrT instanceIdz instance-id)r[rr"getattrrrget_instance_identityr;rr_refresh_stale_aws_token_cbrerhrf)r< api_versions r+get_instance_idzDataSourceEc2.get_instance_ids ?jn , ,4T22 &#;;== # 9)#0#3!%!A !!! #j"%%  =$$dmM: =/ /r*c |jtjkrdSg}i}t}d}|D]2}d||}|||||<3t dd}d}|} tj || j | j t j |j|j|t d \}}n#tj$rYnwxYw|r|r||_||SdS)aGet an API token for EC2 Instance Metadata Service. On EC2. IMDS will always answer an API token, unless the instance owner has disabled the IMDS HTTP endpoint or the network topology conflicts with the configured hop-limit. NPUT{0}/{1}zFetching Ec2 IMDSv2 API TokenF) urlsmax_waittimeout status_cbrrrequest_methodrconnect_synchronously)r[rr"API_TOKEN_ROUTErappendrYrZget_url_paramsr wait_for_urlmax_wait_secondstimeout_secondswarningr_imds_exception_cbrr _api_token) r<mdurlsrurl2baseurl_pathrr/curresponse url_paramss r+_maybe_fetch_api_tokenz$DataSourceEc2._maybe_fetch_api_tokens7 ?jn , , F"  C""311C KK   HSMM 1222((**  !.#4"2+,!4-/&+   MC~    D   !8 !&DOC= ts ACC#"C#c |j}|}|jdkrdS|d|j}d|D}t |t |krEt dtt |t |z t|r|}n!t d|j}| |}|s|j tjkrg}i}d|j}d } |D]2} d | |} || | || <3t%j} t'j||j|jt j t,|j| \} } | r|| }|r(||_t d |jnm|j tjkrt d n=t d|t5t%j| z t7|S)NrF metadata_urlsc:g|]}tj||Sr))r is_resolvable_url).0xs r+ z;DataSourceEc2.wait_for_metadata_service../s(CCC!)?)B)BCACCCr*z,Removed the following from metadata urls: %sz+Empty metadata url list! using default listz{ver}/meta-data/instance-id)verGETr)rrrrrrrzUsing metadata source: '%s'z)IMDS's HTTP endpoint is probably disabledz(Giving up on md from %s after %s seconds)ds_cfgrrrersetrYrZlistlenrrr[rr"rrrtimerrrrrr;criticalintbool)r<mcfgrrfilteredr;rrrrr/r start_time_s r+wait_for_metadata_servicez'DataSourceEc2.wait_for_metadata_service&sc{((**  &! + +5/4+=>>CCvCCC x==CKK ' ' II>c&kkCMM133    x== (FF KKE F F F'F 66v>>   1DOz~$E$EDH4;;-<H#N $ $&&sH55 C   # J'#4"2+/,-FC 1#+C=  $4D ! II3T5J K K K K _  . . KKC D D D D LL:DIKK*,--    $%%%r*cnd|jvrdSd}|jd}t|tstd|dS|D]\}}||kr|}n|dkr|dkr|}|td|dS|}|dsd|z}tj |r|S| tj |}|rtd|||S|dkrdS|S) Nzblock-device-mappingz+block-device-mapping not a dictionary: '%s' ephemeral ephemeral0z Unable to convert %s to a device/z/dev/%szRemapped device name %s => %s) rf isinstancedictrYrZrq startswithospathexists _remap_devicebasename)r<namefoundbdmentnamedeviceofoundremappeds r+device_name_to_devicez#DataSourceEc2.device_name_to_devicels] " 6 64m23#t$$  IICS I I I4!$   Wf$+%%$,*>*> = II8$ ? ? ?4$$ &%E 7>>%  L%%bg&6&6u&=&=>>   II5uh G G GO <  4 r*c |jtjkr,|jd|jddS|jddS#t $rYdSwxYw)NavailabilityZone placementzavailability-zone)r[rr"rhrerfKeyErrorrCs r+availability_zonezDataSourceEc2.availability_zonesz *.00}((&M+./BC }[12EFF   44 sAAA A$#A$c|jtjkr4|jd}|jr|s|jdd}|S|j}| |ddSdS)Nregion)r[rr"rhrer)r<razs r+rzDataSourceEc2.regionsm ?jn , ,]&&x00F% 5f 5/4M'B~#2#wtr*c|sdS|jtjkr0tt j|t t|dSdSr8)r[rr'warn_if_necessaryr rVrWrX)r<cfgis_new_instances r+activatezDataSourceEc2.activatesY  F ?j0 0 0 $S.:KLL      1 0r*c |jtjkr|jS|jtddSd}t d|jvo|jtj k}|r@t dtj tj d|j |j}|jd}t!|t"rt%||tj|jdd }|rt-j|j|_|jt2jt8j|jt2jt8jntd |||_|jS) z@Return a network config dict for rendering ENI or netplan files.Nz8Unexpected call to network_config when metadata is None.rnzPMetadata 'network' not present: Refreshing stale metadata from prior to upgrade.zRe-crawl of metadata servicerLapply_full_imds_network_configT) fallback_nicfull_network_configz%Metadata 'network' key not valid: %s.)_network_configrUNSETrfrYrrr[rr"rZr rbget_datar_rerr#convert_ec2_metadata_network_configget_cfg_option_boolrrucopydeepcopydefault_update_eventsr NETWORKaddr BOOT BOOT_LEGACY)r<resultno_network_metadata_on_awsifacenet_mds r+network_configzDataSourceEc2.network_configs  7= 0 0' ' = KKJ   4%) T] * 2:>1& & " &  IID    M 2]     '""9-- fd # # I9"$($<K!A4%%F'')) -1]...**:+=>BBN*:+=>BB) KK? H H H%##r*c|j=D>ct|jtjkrdStdt |i}d|jt} tj ||td}n9#tj $r'}t d||Yd}~dSd}~wwxYw|jS)zRequest new metadata API token. @param seconds: The lifetime of the token in seconds @return: The API token or None if unavailable. Nz!Refreshing Ec2 metadata API tokenz{}/{}r)r~rrz/Unable to get API token: %s raised exception %s)r[rr"rYrZAWS_TOKEN_REQ_HEADERrr;rrrrrrcontents)r<secondsrequest_header token_urlrrs r+_refresh_api_tokenz DataSourceEc2._refresh_api_tokenDs ?jn , ,4 5666.8NN4#8/JJ  }&/$ HH ~    KKA9a   44444     sA::B0 B++B0cvtjtj||}|sdS|||S)zSCallback will not retry on SKIP_USERDATA_CODES or if no token is available.F)rskip_retry_on_codesSKIP_USERDATA_CODESr)r<rNr0retrys r+rz1DataSourceEc2._skip_or_refresh_stale_aws_token_cb]sE'  #S)   5//Y???r*ct|tjr,|jdkr!tdd|_dS)z=Exception handler for Ec2 to refresh token if token is stale.iz+Clearing cached Ec2 API token due to expiryNT)rrrr.rYrZrr<rNr0s r+rz)DataSourceEc2._refresh_stale_aws_token_cbgsA i 0 0 #Y^s5J5J IIC D D D"DOtr*ct|tjrT|jrO|jdkrF|jdkrtdntd|dSdSdS)a2Fail quickly on proper AWS if IMDSv2 rejects API token request Guidance from Amazon is that if IMDSv2 had disabled token requests by returning a 403, or cloud-init malformed requests resulting in other 40X errors, we want the datasource detection to fail quickly without retries as those symptoms will likely not be resolved by retries. Exceptions such as requests.ConnectionError due to IMDS being temporarily unroutable or unavailable will still retry due to the callsite wait_for_url. iizLEc2 IMDS endpoint returned a 403 error. HTTP endpoint is disabled. Aborting.z2Fatal error while requesting Ec2 IMDSv2 API tokensN)rrrr.rYrrs r+rz DataSourceEc2._imds_exception_cbos i 0 0 ~ ).C"7"7>S((KK? KKL   "7"7r*rKc|jtjkriStti}t |vr|S|js"||_|jsiSt|jiS)zReturn a dict of headers for accessing a url. If _api_token is unset on AWS, attempt to refresh the token via a PUT and then return the updated token header. ) r[rr"rAWS_TOKEN_TTL_SECONDSrrrAWS_TOKEN_PUT_HEADER)r<r/request_token_headers r+rzDataSourceEc2._get_headerssp ?jn , ,I 46KL c ! !' ' #5577DO?  $do66r*r8)rK)2rrr r{rrr4rstr__annotations__ url_max_wait url_timeoutrrrrr]r rr BOOT_NEW_INSTANCErrHOTPLUGsupported_update_eventsr:rDrlrupropertyrwr\rrrrrrrrrr_rcrrrrrr __classcell__r@s@r+r3r3<sx FM( ---S LKJmO   ' N  !    %%%%%###666p   55X5 ##X#))):000(000dD&D&D&L111f  X   X :$:$X:$x ( ( ( (X (5 5 5 n*?!!!!2@@@    677777777r*r3c&eZdZdZdZfdZxZS)DataSourceEc2LocalayDatasource run at init-local which sets up network to query metadata. In init-local, no network is available. This subclass sets up minimal networking with dhclient on a viable nic so that it can talk to the metadata service. If the metadata service provides network configuration then render the network configuration for that instance based on metadata. Tctjtjf}|j|vr#td||jdSt t|S)Nz+Local Ec2 mode only supported on %s, not %sF) rr"r&r[rYrZr9r*r)r<supported_platformsr@s r+rzDataSourceEc2Local.get_datasf)~z/BC ?"5 5 5 II=#    5'..77999r*)rrr __doc__r]rr'r(s@r+r*r*sJ : : : : : : : : :r*r*c t|S#t$r&}t||cYd}~Sd}~wwxYwr8)parse_strict_mode ValueErrorrYr)cfgvaldefaultrs r+rUrUsR (((  As A<AAc |durdS|durdS|sdS|d\}}}|dvrtd|d |d |r: t|}n+#t$r}td |d |d |d}~wwxYwd}||fS) NT)rFNF)falseN)rr,)rFr4rzInvalid mode 'z' in strict_id setting 'z+': Expected one of 'true', 'false', 'warn'.zInvalid sleep 'z': not an integer) partitionr0r)r1modersleeprs r+r/r/s~~| } y%%c**ND!U ,,,j:>$$ H     JJEE   *55&&&"    ;sA A=!A88A=c t|\}}n2#t$r%}t|Yd}~dSd}~wwxYw|dkrdSt jd|d|dS)Nr4 non_ec2_mdT)r7r8)r/r0rYrr show_warning)r1rr7r8rs r+rrs'// ee  A w ,$eDDDDDDs A?Ac|ddr*|ddks|d|dkr tjSdS)Nuuidr uuid_source hypervisorserial)rrr"datas r+ identify_awsrCsK F|u%% ]|++tF|tH~/M/M~ 4r*cT|ddr tjSdS)Nr@z.brightbox.com)endswithrr#rAs r+identify_brightboxrFs0 H~/00$##$$r*cT|ddr tjSdS)N asset_tagz .zstack.io)rErr$rAs r+identify_zstackrIs0 K!!,//!  !!r*c6|ddkr tjSdS)Nvendorr)rr%rAs r+identify_e24cloudrLs" H~##""$#r*c|ddkr*|ddkrtjSdSdS)N product_namez3DS Outscale VMrKz 3DS Outscale)r|rr&rAs r+identify_outscalerOsQ ^ 1 7 7 9 999 Nn2244 4 4"" :9 4 4r*ct}ttttt df}|D]H} ||}|r|cS#t $r'}td|||Yd}~Ad}~wwxYwdS)NctjSr8)rr')rs r+z#identify_platform..s *$r*z'calling %s with %s raised exception: %s) _collect_platform_datarCrFrIrLrOrrYr)rBcheckscheckerrrs r+rBrBs ! # #D$$ F WT]]F       KK97D!          sA A9A44A9cdi} tjd}d|d<n)#t$rt jd}d|d<YnwxYw|d}||d<t jd }|d}||d <t jd }|d}||d <t jd }|r|nd|d<t jd}|r|nd|d<|S)aReturns a dictionary of platform info from dmi or /sys/hypervisor. Keys in the dictionary are as follows: uuid: system-uuid from dmi or /sys/hypervisor uuid_source: 'hypervisor' (/sys/hypervisor/uuid) or 'dmi' serial: dmi 'system-serial-number' (/sys/.../product_serial) asset_tag: 'dmidecode -s chassis-asset-tag' vendor: dmi 'system-manufacturer' (/sys/.../sys_vendor) product_name: dmi 'system-product-name' (/sys/.../system-manufacturer) On Ec2 instances experimentation is that product_serial is upper case, and product_uuid is lower case. This returns lower case values for both. z/sys/hypervisor/uuidr?r>z system-uuidrNrKr=zsystem-serial-numberr@zchassis-asset-tagrHzsystem-manufacturerrKzsystem-product-namerN)r load_filestriprr read_dmi_datar|)rBr=r@rHrKrNs r+rSrS$sO D$~455;;==*] $$$ //#]$ |::<rs $$$$$$""""""""))))))$$$$$$$$11111111//////666666))))))g!!#)U_$5663$1+n<(*>? ( ( ( ( ( ( ( ( HHHa 7a 7a 7a 7a 7G&a 7a 7a 7H::::::::.B E E E$$$ !!! ### ###,,,,`KOFFFFR2<'023W+W-@AB ;;;;;r*