j4NddlZddlZddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z ddl m Z ddlmZddlmZdZdZd Zd Zd Zd Zd ZejeZGddZdS)N)datetimetimezone)Optional)urlparse) ZTSClient)set_cert_expiry_metriczF^(?:flava-)?(?P[\w-]+)\.(?P[\w-]+)\.(?P[\w-]+)$z$http://lypwg01-001.yahoo-net.jp:8080zapj.zts.athenz.yahoo.co.jpi[z.https://apj.zts.athenz.yahoo.co.jp:4443/zts/v1i,cXeZdZ ddZdZdZdZdZdZd Z d Z d Z d Z d Z dS) AthenzClientNTc||_||_tjt|}|st d|d|d|_|d|_|d|_ ||st dtj d|j|j }tj ||d }|#tj ||d }tj |std |tj|tjst#d |||_||_|rtjd t*nd|_|t1tjdt3t4|_d|_t;j|_| }tCj!|_tD#d||$dS)a Initialize Athenz client with flexible path and proxy configuration. Args: account_name: Account name for authentication. provider_domain: Provider domain (e.g., flava-faas.stage.flava-qa or servicemap.stage.flava-api-test). key_path: Optional custom path to private key file. cert_path: Optional custom path to certificate file. use_proxy: Whether to use proxy for connections (default: True). z Invalid provider_domain format: z@. Expected: [flava-]{product-abbr}.{environment}.{flava-project}productenvprojectNz6account_name is required when key_path is not provided/z.key.pem .cert.pemzPrivate key not found: $No read permission for private key: PROXY_URLCERT_CHECK_INTERVAL_SECONDSgz6Initial certificate preparation completed (renewed=%s))%provider_domain account_namere fullmatchSERVICE_PROVIDER_PATTERN ValueErrorgroup product_abbr environment project_nameospathjoinexistsFileNotFoundErroraccessR_OKPermissionErrorkey_path cert_pathgetenvDEFAULT_PROXY_URL proxy_url_init_zts_configintstr#DEFAULT_CERT_CHECK_INTERVAL_SECONDS_cert_check_interval_last_cert_check_ts threadingLock _cert_lock_check_and_renewtimeloggerdebug_init_zts_client) selfrrr'r( use_proxymatchsecret_mount_pathreneweds A/Users/user/workspace/sujinbaek/cqa-test-app/lib/athenz_client.py__init__zAthenzClient.__init__ sb$ /( 5GG X?XXX  "KK 22 ;;u--!KK 22    L!# S$2BDDU V V w||$5,7P7P7PQQH GLL):|s r?r_zAthenzClient._ensure_cert_readysSikk ) )D,E E E F _ ( ()++CT--0III  ( ( ( ( ( ( ( ( LLQ)(    ++--G'*D $ ( VWWW%%'''% ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s(C#%A1C##C'*C'cnd} tdd}td|tj|dtj|d|}|j}td|td ||Ptj |r1tj |tj std |tj |j std |j tj |j tj std |j tj |rtd||_|rUtd|d}|st%dntdn|1tj |rtd|| t'j||tj|dtdn%#t$r}t%d||d }~wwxYw||_|rTtd|d}|st%dnutdnZtd||_|d}|st%d||_td||S#t,$r!}td|d }~wwxYw)z Check certificate expiry and renew if needed. Returns: True if certificate was newly generated or renewed, False otherwise. Fz.Starting certificate check and renewal process /tmp/athenzz$Ensuring athenz directory exists: %sT)exist_okizLatest cert path: %szOrigin cert path: %sNz+No read permission for origin certificate: zPrivate key not found at rz-Latest certificate exists, checking expiry...z0Certificate needs renewal, attempting renewal...z+Certificate validation failed after renewalz!Latest certificate is still validz;Latest certificate not found, copying from origin: %s -> %siz&Certificate copied and permissions setz/Failed to copy certificate due to permissions: z7Copied certificate needs renewal, attempting renewal...z!Copied certificate is still validz athenz_dirlatest_cert_pathorigin_cert_pathr]s r?r5zAthenzClient._check_and_renews;`  KKH I I I&J LL? L L L K T 2 2 2 2 HZ ' ' '#99;; #~  LL/1A B B B LL/1A B B B +?O0P0P+y!127;;)XFVXX 7>>$-00 U'(SDM(S(STTT9T]BG44 %J4=JJw~~.//6  LMMM!1&&(( FKK RSSS$$&&&"G..00*I LL!DEEEE#/BGNNCS4T4T/KKU(( ! %57GHHH!15999 %MNNNN*!!!*QaQQ !! &6DN**,, J U((***"&#2244". M##  %HIIIIKKV&6DN$$&&&"G..00*L.DN KKV W W W  + + - - -N    LLCQ G G G  s>I?P AK P K+K&&K++DP P4P//P4cj|jpd|jpd|jpd|jpdf}|jr$t j|js*t dtg|dRdS ddd|jdd g}tj |d d }d}|j dkr|j}|d r|t#d d} t%j|d }|t*j}t%jt*j}t1||z }|dkrd}n3#t4$r&} td|| Yd} ~ nd} ~ wwxYwtg||Rt d|dS#t4$r4} td| tg|dRYd} ~ dSd} ~ wwxYw)zP Update certificate expiry metric based on current certificate. unknownz6Certificate does not exist, setting expiry metric to 0rNopensslx509-in-nooutz-enddateTcapture_outputtextz notAfter=z%b %d %H:%M:%S %Y GMT)tzinfoz*Failed to parse cert notAfter date: %s, %sz0Updated cert expiry metric: %s seconds remainingz'Failed to update cert expiry metric: %s)rrrrr(rr r"r7r8r subprocessrun returncodestdoutstrip startswithlenrstrptimereplacerutcutcnowr- total_secondsrYwarningrZ) r:labelscmdresultremaining_secondsline not_afterdtrdr]s r?rpz'AthenzClient._update_cert_expiry_metricTs   *   )   *   *  ~ RW^^DN%C%C  LLQ R R R " .F .A . . . . F /feT^XzRC^C4HHHF !  A%%}**,,??;// $S%5%5%7%7 8 > > @ @I %.y:QRRZZx|Z<<&o//77x|7LL,/c0H0H0J0J,K,K),q0001-$H% # >F >,= > > > > LLBDU      / / / LLBA F F F " .F .A . . . . . . . . . . /sD9B G4BFG4 G G<G4G,G44 H2>)H--H2c"|jr$tj|jstddS t tjdtt}|dz}ddd|jdt|d g}tj |dd }|j d k}|rtd ||S#t$r&}td |Yd}~dSd}~wwxYw)z Check if certificate needs renewal based on expiry time. Uses openssl -checkend to decide whether renewal is required. z,Certificate does not exist, renewal requiredTCERT_RENEWAL_THRESHOLD_HOURSirvrwrxz -checkendryrzrz#Certificate expires within %s hoursz&Failed to check certificate expiry: %sN)r(rr r"r7rcr-r)r.$DEFAULT_CERT_RENEWAL_THRESHOLD_HOURSr~rrrYrZ)r:threshold_hoursthreshold_secondsrr needs_renewalr]s r?rkzAthenzClient._needs_renewals/ ~ RW^^DN%C%C  KKF G G G4 ! 2<==O !0$ 6 %&&C ^C4HHHF"-2M T A?SSS     LLA1 E E E44444 s BC D(D  Dctjdstdd|jd|j}|j}|j}t jdtj }t d|||dd|j d|d |d |j d |d |jd dddddd|g}tdd| t#j|ddd}t dtd|jdS#t"j$rS}td|td|jtd||d}~wt.$r3}td|td||d}~wwxYw)z$Renew certificate using zts-svccert.z zts-svccertzFzts-svccert command not found. Make sure athenz_tools_jp is installed.z flava-iam..POD_UIDz:Renewing certificate for domain=%s, service=%s, pod_uid=%sz-ztsz-domainz-servicez -private-keyz -key-versionz -cert-filez-hdrzYahoo-Principal-Authz -dns-domainzzts.athenz.cloudz -providerz sys.auth.ztsz -instancez Executing: %s Tr{r|checkz*Certificate renewal completed successfullyzzts-svccert output: %szzts-svccert failed: %szError output: %szCertificate renewal failed: NzCertificate renewal error: %s)rnwhichr[rrrrr)socket gethostnamer7rcrMr'r(r8r!r~rrCalledProcessErrorrZstderrrY)r:domainservice key_versionpod_uidrrr]s r?rlzAthenzClient._renew_certs|M** X Ed.DD1BDD#' )Iv'9';';<< H                 M    N  "      + 0  _chhsmm444 J^C4tTTTF KKD E E E LL16= A A A A A, J J J LL11 5 5 5 LL+QX 6 6 6AaAABB I J J J LL8! < < <AaAABB I Js&AD00G ?AF  G .GG c|jr$tj|js"td|jdS ddd|jddg}t j|ddd }d |jvrt d dStd dS#t$r&}td |Yd}~dSd}~wwxYw)z=Validate that certificate is properly formatted and readable.z Certificate file not found at %sFrvrwrxryz-textTrz Certificate:z!Certificate validation successfulz.Certificate validation failed - invalid formatz Certificate validation error: %sN) r(rr r"r7rZr~rrr8rY)r:rrr]s r?rmzAthenzClient._validate_certs~ RW^^DN%C%C  LL;T^ L L L5 feT^XwOC^C4tTTTF.. @AAAt LLI J J J5    LL;Q ? ? ?55555 sAB5B55 C%?C  C%c|jd|jd|jd}tjd|}t d||S)zRCalculate latest certificate path: /tmp/athenz/{project}.{env}.{account}.cert.pem.rrrfzGenerated latest cert path: %s)rrrrr r!r7r8)r:filenamerrs r?rjz"AthenzClient._get_latest_cert_pathsb R R4#3 R Rd6G R R R 7<< x@@ 57GHHHrA)NNT)__name__ __module__ __qualname__r@r,r9r`r_r5rprkrlrmrjrAr?r r s  M M M M dDDD.H:(((@hhhT//////b(((T6J6J6Jp*     rAr )rrr~rnloggingrr2r6rrtypingr urllib.parseryj.athenz.clientrcommon.cert_metricsrrr*rHrJrNrr/ getLoggerrr7r rrAr?rs2    ''''''''!!!!!!&&&&&&666666N;/G'-$&)#  8 $ $d d d d d d d d d d rA