/
lib
/
python3.9
/
site-packages
/
oci
/
auth
/
__pycache__
/
Upload File
HOME
a ���f� � @ s d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlm m Z ddl m Z dZ dZdZd Zd Zd d iZd Ze�e�ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� de�Z G dd� de�Z G dd� de�Z G d d � d e�Z d d � Z d d!� Z!dS )"� )�absolute_importN)�requests� )�%InstancePrincipalsSecurityTokenSigner� OCI_RESOURCE_PRINCIPAL_RPT_PATH� OCI_RESOURCE_PRINCIPAL_RPT_ID�1OCI_RESOURCE_PRINCIPAL_RPT_PATH_FOR_LEAF_RESOURCE�/OCI_RESOURCE_PRINCIPAL_RPT_ID_FOR_LEAF_RESOURCEz%/20180711/resourcePrincipalToken/{id}Z Authorizationz Bearer Oraclez3/var/run/secrets/kubernetes.io/serviceaccount/tokenc @ s e Zd ZdZdd� ZdS )�RptPathProviderInterfacez9An informal interface which returns the complete RPT pathc C s d S �N� ��selfr r �?/usr/lib/python3.9/site-packages/oci/auth/rpt_path_providers.py�get_path s z!RptPathProviderInterface.get_pathN)�__name__� __module__� __qualname__�__doc__r r r r r r s r c @ s e Zd Zdd� Zdd� ZdS )�StringRptPathProviderc C s || _ t�d�|�� d S )Nz+Found String RPT Path Provider with path {})�path�logger�debug�format)r r r r r �__init__" s z StringRptPathProvider.__init__c C s | j S r )r r r r r r & s z StringRptPathProvider.get_pathN)r r r r r r r r r r ! s r c @ s4 e Zd ZdZejZdd� Zdd� Zej dd� �Z dS ) �AbstractRptPathProviderz�This abstract path provider has a string template with placeholders like {id}, and provides a way to get a mapping of substitutions to fill inc C s || _ d S r )� path_template�r r r r r r / s z AbstractRptPathProvider.__init__c C s. | � � }| jjf i |��}t�d�|�� |S )Nz Using path {})�get_replacementsr r r r )r � replacementsr r r r r 2 s z AbstractRptPathProvider.get_pathc C s d S r r r r r r r 8 s z(AbstractRptPathProvider.get_replacementsN) r r r r �abc�ABCMetaZ __metaclass__r r �abstractmethodr r r r r r * s r c s4 e Zd Z� fdd�Zdd� Zdd� Zdd� Z� ZS ) �ImdsRptPathProviderc s" t t| ��| �� � | �� | _d S r )�superr# r �get_path_template�build_replacementsr r �� __class__r r r > s z ImdsRptPathProvider.__init__c C s | j S r �r r r r r r B s z$ImdsRptPathProvider.get_replacementsc C s t S r )�IMDS_PATH_TEMPLATEr r r r r% E s z%ImdsRptPathProvider.get_path_templatec C s dt � iS �N�id)�get_instance_id_from_imdsr r r r r& H s z&ImdsRptPathProvider.build_replacements�r r r r r r% r& � __classcell__r r r' r r# = s r# c s4 e Zd Z� fdd�Zdd� Zdd� Zdd� Z� ZS ) �EnvRptPathProviderc s< |� dd�rd| _nd| _tt| ��| �� � | �� | _d S )N�child_resourceFT)�getr1 r$ r0 r r% r& r �r �kwargsr' r r r N s zEnvRptPathProvider.__init__c C s | j S r r) r r r r r V s z#EnvRptPathProvider.get_replacementsc C s | j rtj�t�S tj�t�S r )r1 �os�environr2 r r r r r r r% Y s z$EnvRptPathProvider.get_path_templatec C s0 | j rtj�t�}n tj�t�}|r,d|iS d S r+ )r1 r5 r6 r2 r r )r Zrpt_idr r r r& ^ s z%EnvRptPathProvider.build_replacementsr. r r r' r r0 M s r0 c s8 e Zd ZdZ� fdd�Zdd� Zdd� Zdd � Z� ZS ) �DefaultRptPathProvidera- This path provider makes sure the behavior happens with the correct fallback. For the path, Use the contents of the OCI_RESOURCE_PRINCIPAL_RPT_PATH environment variable, if set. Otherwise, use the current path: "/20180711/resourcePrincipalToken/{id}" For the resource id, Use the contents of the OCI_RESOURCE_PRINCIPAL_RPT_ID environment variable, if set. Otherwise, use IMDS to get the instance id This path provider is used when the caller doesn't provide a specific path provider to the resource principals signer c sD t �d� tf i |��| _t� | _tt| ��| � � � | � � | _ d S )Nz?A path provider was not specified, using DefaultRptPathProvider) r r r0 �env_rpt_path_providerr# �imds_rpt_path_providerr$ r7 r r% r& r r3 r' r r r w s z DefaultRptPathProvider.__init__c C s< | j �� }|s(t�d�t�� | j�� }t�d�|�� |S )NzEUnable to get path template from {} env variable, using IMDS templatezThe path template is {})r8 r% r r r r r9 r r r r r% ~ s z(DefaultRptPathProvider.get_path_templatec C s< | j �� }|s(t�d�t�� | j�� }t�d�|�� |S )NzOUnable to get replacements from {} env variable, getting replacements from IMDSzThe replacement dict is {})r8 r& r r r r r9 )r r r r r r& � s z)DefaultRptPathProvider.build_replacementsc C s | j S r r) r r r r r � s z'DefaultRptPathProvider.get_replacements) r r r r r r% r& r r/ r r r' r r7 h s r7 c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�"DefaultServiceAccountTokenProviderc C s t | _d S r )�)OCI_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH� token_pathr r r r r � s z+DefaultServiceAccountTokenProvider.__init__c C s || _ d S r )r< )r Znew_token_pathr r r �override_sa_token_path� s z9DefaultServiceAccountTokenProvider.override_sa_token_pathc C sl t j�| j�}t|ddd�� }|�� �� }W d � n1 s>0 Y t|�}|du rhtd� | j���|S )N�rzutf-8)�mode�encodingFz'Service account token at {} has expired) r5 r � expanduserr< �open�read�strip�is_valid_sa_token� RuntimeErrorr )r r< �fZsa_token�is_sa_token_validr r r � get_sa_token� s *z/DefaultServiceAccountTokenProvider.get_sa_tokenN)r r r r r= rI r r r r r: � s r: c @ s e Zd Zdd� Zdd� ZdS )�#SuppliedServiceAccountTokenProviderc C s || _ d S r )� token_string)r rK r r r r � s z,SuppliedServiceAccountTokenProvider.__init__c C s t | j�}|du rtd��| jS )NFz/The supplied service account token has expired.)rE rK rF )r rH r r r rI � s z0SuppliedServiceAccountTokenProvider.get_sa_tokenN)r r r r rI r r r r rJ � s rJ c C s. d� tj�} d}tj| |td�}|j�� �� S )Nz{}/instance/id)� �< )�timeoutZheaders) r r ZMETADATA_URL_BASEr r2 �METADATA_AUTH_HEADERS�textrD �lower)ZendpointrN Zresponser r r r- � s r- c C s< t j| dd�}tt�� �}|�d�d u r0td��||d k S )NF)�jwtZverifyZexpz3Service account token does not have an 'exp' field.)rR �decode�int�timer2 rF )�tokenZ decoded_jwtZtime_nowr r r rE � s rE )"Z __future__r r r5 ZloggingrU Z oci._vendorr Zoci._vendor.jwtZ_vendorrR Z1signers.instance_principals_security_token_signerr r r r r r* rO r; Z getLoggerr r �objectr r r r# r0 r7 r: rJ r- rE r r r r �<module> s2 *