OLD | NEW |
(Empty) | |
| 1 # Copyright 2016 Google Inc. |
| 2 # |
| 3 # Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 # you may not use this file except in compliance with the License. |
| 5 # You may obtain a copy of the License at |
| 6 # |
| 7 # http://www.apache.org/licenses/LICENSE-2.0 |
| 8 # |
| 9 # Unless required by applicable law or agreed to in writing, software |
| 10 # distributed under the License is distributed on an "AS IS" BASIS, |
| 11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 # See the License for the specific language governing permissions and |
| 13 # limitations under the License. |
| 14 |
| 15 """Provides helper methods for talking to the Compute Engine metadata server. |
| 16 |
| 17 See https://cloud.google.com/compute/docs/metadata for more details. |
| 18 """ |
| 19 |
| 20 import datetime |
| 21 import json |
| 22 import logging |
| 23 import os |
| 24 |
| 25 from six.moves import http_client |
| 26 from six.moves.urllib import parse as urlparse |
| 27 |
| 28 from google.auth import _helpers |
| 29 from google.auth import environment_vars |
| 30 from google.auth import exceptions |
| 31 |
| 32 _LOGGER = logging.getLogger(__name__) |
| 33 |
| 34 _METADATA_ROOT = 'http://{}/computeMetadata/v1/'.format( |
| 35 os.getenv(environment_vars.GCE_METADATA_ROOT, 'metadata.google.internal')) |
| 36 |
| 37 # This is used to ping the metadata server, it avoids the cost of a DNS |
| 38 # lookup. |
| 39 _METADATA_IP_ROOT = 'http://{}'.format( |
| 40 os.getenv(environment_vars.GCE_METADATA_IP, '169.254.169.254')) |
| 41 _METADATA_FLAVOR_HEADER = 'metadata-flavor' |
| 42 _METADATA_FLAVOR_VALUE = 'Google' |
| 43 _METADATA_HEADERS = {_METADATA_FLAVOR_HEADER: _METADATA_FLAVOR_VALUE} |
| 44 |
| 45 # Timeout in seconds to wait for the GCE metadata server when detecting the |
| 46 # GCE environment. |
| 47 try: |
| 48 _METADATA_DEFAULT_TIMEOUT = int(os.getenv('GCE_METADATA_TIMEOUT', 3)) |
| 49 except ValueError: # pragma: NO COVER |
| 50 _METADATA_DEFAULT_TIMEOUT = 3 |
| 51 |
| 52 |
| 53 def ping(request, timeout=_METADATA_DEFAULT_TIMEOUT): |
| 54 """Checks to see if the metadata server is available. |
| 55 |
| 56 Args: |
| 57 request (google.auth.transport.Request): A callable used to make |
| 58 HTTP requests. |
| 59 timeout (int): How long to wait for the metadata server to respond. |
| 60 |
| 61 Returns: |
| 62 bool: True if the metadata server is reachable, False otherwise. |
| 63 """ |
| 64 # NOTE: The explicit ``timeout`` is a workaround. The underlying |
| 65 # issue is that resolving an unknown host on some networks will take |
| 66 # 20-30 seconds; making this timeout short fixes the issue, but |
| 67 # could lead to false negatives in the event that we are on GCE, but |
| 68 # the metadata resolution was particularly slow. The latter case is |
| 69 # "unlikely". |
| 70 try: |
| 71 response = request( |
| 72 url=_METADATA_IP_ROOT, method='GET', headers=_METADATA_HEADERS, |
| 73 timeout=timeout) |
| 74 |
| 75 metadata_flavor = response.headers.get(_METADATA_FLAVOR_HEADER) |
| 76 return (response.status == http_client.OK and |
| 77 metadata_flavor == _METADATA_FLAVOR_VALUE) |
| 78 |
| 79 except exceptions.TransportError: |
| 80 _LOGGER.info('Compute Engine Metadata server unavailable.') |
| 81 return False |
| 82 |
| 83 |
| 84 def get(request, path, root=_METADATA_ROOT, recursive=False): |
| 85 """Fetch a resource from the metadata server. |
| 86 |
| 87 Args: |
| 88 request (google.auth.transport.Request): A callable used to make |
| 89 HTTP requests. |
| 90 path (str): The resource to retrieve. For example, |
| 91 ``'instance/service-accounts/defualt'``. |
| 92 root (str): The full path to the metadata server root. |
| 93 recursive (bool): Whether to do a recursive query of metadata. See |
| 94 https://cloud.google.com/compute/docs/metadata#aggcontents for more |
| 95 details. |
| 96 |
| 97 Returns: |
| 98 Union[Mapping, str]: If the metadata server returns JSON, a mapping of |
| 99 the decoded JSON is return. Otherwise, the response content is |
| 100 returned as a string. |
| 101 |
| 102 Raises: |
| 103 google.auth.exceptions.TransportError: if an error occurred while |
| 104 retrieving metadata. |
| 105 """ |
| 106 base_url = urlparse.urljoin(root, path) |
| 107 query_params = {} |
| 108 |
| 109 if recursive: |
| 110 query_params['recursive'] = 'true' |
| 111 |
| 112 url = _helpers.update_query(base_url, query_params) |
| 113 |
| 114 response = request(url=url, method='GET', headers=_METADATA_HEADERS) |
| 115 |
| 116 if response.status == http_client.OK: |
| 117 content = _helpers.from_bytes(response.data) |
| 118 if response.headers['content-type'] == 'application/json': |
| 119 try: |
| 120 return json.loads(content) |
| 121 except ValueError: |
| 122 raise exceptions.TransportError( |
| 123 'Received invalid JSON from the Google Compute Engine' |
| 124 'metadata service: {:.20}'.format(content)) |
| 125 else: |
| 126 return content |
| 127 else: |
| 128 raise exceptions.TransportError( |
| 129 'Failed to retrieve {} from the Google Compute Engine' |
| 130 'metadata service. Status: {} Response:\n{}'.format( |
| 131 url, response.status, response.data), response) |
| 132 |
| 133 |
| 134 def get_project_id(request): |
| 135 """Get the Google Cloud Project ID from the metadata server. |
| 136 |
| 137 Args: |
| 138 request (google.auth.transport.Request): A callable used to make |
| 139 HTTP requests. |
| 140 |
| 141 Returns: |
| 142 str: The project ID |
| 143 |
| 144 Raises: |
| 145 google.auth.exceptions.TransportError: if an error occurred while |
| 146 retrieving metadata. |
| 147 """ |
| 148 return get(request, 'project/project-id') |
| 149 |
| 150 |
| 151 def get_service_account_info(request, service_account='default'): |
| 152 """Get information about a service account from the metadata server. |
| 153 |
| 154 Args: |
| 155 request (google.auth.transport.Request): A callable used to make |
| 156 HTTP requests. |
| 157 service_account (str): The string 'default' or a service account email |
| 158 address. The determines which service account for which to acquire |
| 159 information. |
| 160 |
| 161 Returns: |
| 162 Mapping: The service account's information, for example:: |
| 163 |
| 164 { |
| 165 'email': '...', |
| 166 'scopes': ['scope', ...], |
| 167 'aliases': ['default', '...'] |
| 168 } |
| 169 |
| 170 Raises: |
| 171 google.auth.exceptions.TransportError: if an error occurred while |
| 172 retrieving metadata. |
| 173 """ |
| 174 return get( |
| 175 request, |
| 176 'instance/service-accounts/{0}/'.format(service_account), |
| 177 recursive=True) |
| 178 |
| 179 |
| 180 def get_service_account_token(request, service_account='default'): |
| 181 """Get the OAuth 2.0 access token for a service account. |
| 182 |
| 183 Args: |
| 184 request (google.auth.transport.Request): A callable used to make |
| 185 HTTP requests. |
| 186 service_account (str): The string 'default' or a service account email |
| 187 address. The determines which service account for which to acquire |
| 188 an access token. |
| 189 |
| 190 Returns: |
| 191 Union[str, datetime]: The access token and its expiration. |
| 192 |
| 193 Raises: |
| 194 google.auth.exceptions.TransportError: if an error occurred while |
| 195 retrieving metadata. |
| 196 """ |
| 197 token_json = get( |
| 198 request, |
| 199 'instance/service-accounts/{0}/token'.format(service_account)) |
| 200 token_expiry = _helpers.utcnow() + datetime.timedelta( |
| 201 seconds=token_json['expires_in']) |
| 202 return token_json['access_token'], token_expiry |
OLD | NEW |