Vhf6 hddlmZmZmZeZdZdZdZddl Z ddl m Z ddl m Z mZmZddlmZdd lmZddlZ ddlZd Z dd lmZd Z dd lmZd Zdddgddd iidd iddgddd dgddd idZdZGdde Z dZ!e"dk(re!yy#e$rd ZYXwxYw#e$rd ZY\wxYw#e$rd ZY`wxYw))absolute_importdivisionprint_functionu module: openshift_auth short_description: Authenticate to OpenShift clusters which require an explicit login step version_added: "0.2.0" author: - KubeVirt Team (@kubevirt) - Fabian von Feilitzsch (@fabianvf) description: - This module handles authenticating to OpenShift clusters requiring I(explicit) authentication procedures, meaning ones where a client logs in (obtains an authentication token), performs API operations using said token and then logs out (revokes the token). - On the other hand a popular configuration for username+password authentication is one utilizing HTTP Basic Auth, which does not involve any additional login/logout steps (instead login credentials can be attached to each and every API call performed) and as such is handled directly by the C(k8s) module (and other resource–specific modules) by utilizing the C(host), C(username) and C(password) parameters. Please consult your preferred module's documentation for more details. options: state: description: - If set to I(present) connect to the API server using the URL specified in C(host) and attempt to log in. - If set to I(absent) attempt to log out by revoking the authentication token specified in C(api_key). default: present choices: - present - absent type: str host: description: - Provide a URL for accessing the API server. required: true type: str username: description: - Provide a username for authenticating with the API server. type: str password: description: - Provide a password for authenticating with the API server. type: str ca_cert: description: - "Path to a CA certificate file used to verify connection to the API server. The full certificate chain must be provided to avoid certificate validation errors." aliases: [ ssl_ca_cert ] type: path validate_certs: description: - "Whether or not to verify the API server's SSL certificates." type: bool default: true aliases: [ verify_ssl ] api_key: description: - When C(state) is set to I(absent), this specifies the token to revoke. type: str requirements: - python >= 3.6 - urllib3 - requests - requests-oauthlib aG - name: Example Playbook hosts: localhost module_defaults: group/community.okd.okd: host: https://k8s.example.com/ ca_cert: ca.pem tasks: - name: Authenticate to OpenShift cluster and gell a list of all pods from any namespace block: # It's good practice to store login credentials in a secure vault and not # directly in playbooks. - name: Include 'openshift_passwords.yml' ansible.builtin.include_vars: openshift_passwords.yml - name: Log in (obtain access token) community.okd.openshift_auth: username: admin password: "{{ openshift_admin_password }}" register: openshift_auth_results # Previous task provides the token/api_key, while all other parameters # are taken from module_defaults - name: Get a list of all pods from any namespace kubernetes.core.k8s_info: api_key: "{{ openshift_auth_results.openshift_auth.api_key }}" kind: Pod register: pod_list always: - name: If login succeeded, try to log out (revoke access token) when: openshift_auth_results.openshift_auth.api_key is defined community.okd.openshift_auth: state: absent api_key: "{{ openshift_auth_results.openshift_auth.api_key }}" a openshift_auth: description: OpenShift authentication facts. returned: success type: complex contains: api_key: description: Authentication token. returned: success type: str host: description: URL for accessing the API server. returned: success type: str ca_cert: description: Path to a CA certificate file used to verify connection to the API server. returned: success type: str validate_certs: description: "Whether or not to verify the API server's SSL certificates." returned: success type: bool username: description: Username for authenticating with the API server. returned: success type: str k8s_auth: description: Same as returned openshift_auth. Kept only for backwards compatibility returned: success type: complex contains: api_key: description: Authentication token. returned: success type: str host: description: URL for accessing the API server. returned: success type: str ca_cert: description: Path to a CA certificate file used to verify connection to the API server. returned: success type: str validate_certs: description: "Whether or not to verify the API server's SSL certificates." returned: success type: bool username: description: Username for authenticating with the API server. returned: success type: str N) AnsibleModule)urlparseparse_qs urlencode)urljoin)urlsafe_b64encodeTF) OAuth2Session) make_headerspresentabsent)defaultchoicesrequiredno_logpath ssl_ca_cert)typealiasesbool verify_ssl)rrr)statehostusernamepasswordca_certvalidate_certsapi_keycd}|j|r|t|d}n|}ttj|j j jd}||jdzS)z openshift convert the access token to an OAuthAccessToken resource name using the algorithm https://github.com/openshift/console/blob/9f352ba49f82ad693a72d0d35709961428b43b93/pkg/server/server.go#L609-L613 zsha256~N=zutf-8) startswithlenr hashlibsha256encodedigestrstripdecode) token_name sha256Prefixcontent b64encodeds p/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/okd/plugins/modules/openshift_auth.py*get_oauthaccesstoken_objectname_from_tokenr0sw L\*S.01"7>>'..2B#C#J#J#LMTT J *++G4 44c8eZdZdZdZdZdZdZd dZdZ y) OpenShiftAuthModulectj|tddddgfdddgfgts|j dt s|j d t s|j d yy) Nrrrrrr ) argument_spec required_ifzOThis module requires the python 'requests' package. Try `pip install requests`.zaThis module requires the python 'requests-oauthlib' package. Try `pip install requests-oauthlib`.zMThis module requires the python 'urllib3' package. Try `pip install urllib3`.)r__init__K8S_AUTH_ARG_SPEC HAS_REQUESTSfailHAS_REQUESTS_OAUTH HAS_URLLIB3)selfs r/r7zOpenShiftAuthModule.__init__sw +)j*%=>(YK0  IIa " IIs  II_ r1c|jjd}|jjd}|jjd}|jjd|_|jjd|_|jjd|_|jjd|_|r |r||_n||_|jd}t}|d k(r5|j}t|j ||||j }n|j}|j||| y) Nrrrrrr rFr)rrrr r)changedopenshift_authk8s_auth) paramsget auth_username auth_password auth_api_keycon_host con_verify_caopenshift_discoverdictopenshift_loginopenshift_logout exit_json)r=rrrr?result new_api_keys r/execute_modulez"OpenShiftAuthModule.execute_modules ([[__%56 kkooi0 ![[__Z8![[__Z8 KKOOI6 /  +!,D !+D  ! I ..0K]])##++ F++-G wvOr1ct|jd}tj||j}|j dk7r*|j dd||j|j  |j}|d|_ |d|_ y#t$r(|jd tj YywxYw) Nz&.well-known/oauth-authorization-server)verifyz#Couldn't find OpenShift's OAuth APIGETmethodurlreason status_codeauthorization_endpointtoken_endpointz9Something went wrong discovering OpenShift OAuth details.msg exception)r rGrequestsrCrHrY fail_requestrXjsonopenshift_auth_endpointopenshift_token_endpoint Exception fail_json traceback format_exc)r=rWret oauth_infos r/rIz&OpenShiftAuthModule.openshift_discover+sdmm%MNll3t'9'9: ??c !   5zzOO   J+56N+OD (,67G,HD )  NNO#..0   s2$B.CCcHtd}|j|jdd\}}tdj |j |j }|j|||jdd |jd }|jd k7r*|jd d||j|ji}tt|jdjj!D] \}}|d||<d|d<|j#|j$ddddt'||j}|jdk7r4|jdd|j$|j|j|j)dS)Nzopenshift-challenging-client) client_id1S256)rcode_challenge_methodz{0}:{1}) basic_auth authorization)z X-Csrf-TokenrpF)headersrRallow_redirectsi.zAuthorization failed.rTrULocationrauthorization_code grant_typeapplication/jsonz!application/x-www-form-urlencodedz.Basic b3BlbnNoaWZ0LWNoYWxsZW5naW5nLWNsaWVudDo=Acceptz Content-Type Authorization)rqdatarRrSz(Failed to obtain an authorization token.POST access_token)r authorization_urlrbr formatrDrErCrHrYr`rXrrrqqueryitemspostrcr ra) r=os_oauthr}r auth_headersrhqwargskvs r/rKz#OpenShiftAuthModule.openshift_loginCs +IJ#+#=#=  ( (6$>$  5$ ''(:(:DDDEKKM DAq!F1I 3|mm  ) ), C!Q  6"%%   ??c !   :11zzOO  xxz.))r1ct|j}dddj|jd}dj|j|}dddd}t j |||j | }|jd k7rJ|jd j||jjd |j y)Nrvz Bearer {0}rwz8{0}/apis/oauth.openshift.io/v1/useroauthaccesstokens/{1}zoauth.openshift.io/v1 DeleteOptionsr) apiVersionkindgracePeriodSeconds)rarRrqrSz9Couldn't delete user oauth access token '{0}' due to: {1}message)r]rYT) r0rFr~rGr_deleterHrYrerarC)r=namerqrWrarhs r/rLz$OpenShiftAuthModule.openshift_logout~s9$:K:KL(.)001B1BC  IOO MM4 2#"#  oo d4#5#5w  ??c ! NNOVV#((*..3 OO  r1Nc(|j|y)N)r])re)r=r]s r/r:zOpenShiftAuthModule.fails 3r1c pi}|jD] \}}||d|z<|jdd|i|y)Nreq_r])rre)r=r]kwargsreq_inforrs r/r`z OpenShiftAuthModule.fail_requestsDLLN %DAq#$HVaZ  %+3+(+r1)N) __name__ __module__ __qualname__r7rPrIrKrLr:r`rr1r/r3r3s(2"PH09*v< ,r1r3ct} |jy#t$r8}|jt |t j Yd}~yd}~wwxYw)Nr\)r3rPrdrestrrfrg)modulees r/mainrsQ "FG GSVy/C/C/EFFGs A.AA__main__)# __future__rrrr __metaclass__ DOCUMENTATIONEXAMPLESRETURNrfansible.module_utils.basicr+ansible.module_utils.six.moves.urllib_parserrr urllib.parser base64r r%r_r9 ImportErrorrequests_oauthlibr r; urllib3.utilr r<r8r0r3rrrr1r/rs(A@ C J# P3 l4UU $L/)Kx( 4 M?;%$L>R$ 5"v,-v,rG zFeLKs4B BB' BBB$#B$'B10B1