o
    !d&                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d	Zd
ZdZdZdZdZdZeegZegZdZdZdZdZdZdZ dZ!G dd deZ"G dd de#Z$G dd de#Z%dS )    N)datetime	timedelta)RequestSigner)	ServiceId)get_formatter)BasicCommand)	uni_print)validate_mutually_exclusivestsZGetCallerIdentityz
2011-06-15v4z%client.authentication.k8s.io/v1alpha1z$client.authentication.k8s.io/v1beta1zclient.authentication.k8s.io/v1z{0} KUBERNETES_EXEC_INFO, defaulting to {1}. This is likely a bug in your Kubernetes client. Please update your Kubernetes client.zUnrecognized API version in KUBERNETES_EXEC_INFO, defaulting to {0}. This is likely due to an outdated AWS CLI. Please update your AWS CLI.zeKubeconfig user entry is using deprecated API version {0}. Run 'aws eks update-kubeconfig' to update.<      zk8s-aws-v1.zx-k8s-aws-idc                   @   sN   e Zd ZdZdZddddddddd	d
ddgZdd Zdd Zdd ZdS )GetTokenCommandz	get-tokenz{Get a token for authentication with an Amazon EKS cluster. This can be used as an alternative to the aws-iam-authenticator.zcluster-namezSpecify the name of the Amazon EKS cluster to create a token for. (Note: for local clusters on AWS Outposts, please use --cluster-id parameter)F)nameZ	help_textrequiredzrole-arna  Assume this role for credentials when signing the token. Use this optional parameter when the credentials for signing the token differ from that of the current role session. Using this parameter results in new role session credentials that are used to sign the token.z
cluster-idzoSpecify the id of the Amazon EKS cluster to create a token for. (Note: for local clusters on AWS Outposts only)c                 C   s   t  ttd }|dS )N)minutesz%Y-%m-%dT%H:%M:%SZ)r   utcnowr   TOKEN_EXPIRATION_MINSstrftime)selftoken_expiration r   Gusr/lib/python3.10/site-packages/awscli/customizations/eks/get_token.pyget_expiration_timel   s   
z#GetTokenCommand.get_expiration_timec                 C   s   t | j}|j|j|jd}t|dgdg |jr|j}n|jr$|j}ntdS t	|
|}|  }d|  i ||dd}|j}	|	d u rL| jd}	t|	|}
|j|
_|
| j| td	 d
S )N)region_namerole_arncluster_name
cluster_idzBEither parameter --cluster-name or --cluster-id must be specified.ZExecCredential)ZexpirationTimestamptoken)kind
apiVersionspecstatusoutput
r   )STSClientFactory_sessionget_sts_clientZregionr   r	   r   r   
ValueErrorTokenGenerator	get_tokenr   discover_api_versionr#   Zget_config_variabler   queryNAMEr   )r   Zparsed_argsZparsed_globalsZclient_factory
sts_client
identifierr   r   Zfull_objectr#   	formatterr   r   r   	_run_mainr   s6   


zGetTokenCommand._run_mainc                 C   s   t }ddd}tjdd}|s|S zt|}W n tjy7   tt	|d |t
j tdt
j | Y S w |d}|tv rC|S |tv rXtt	|t
j tdt
j |S tt	|t
j tdt
j |S )	a  
        Parses the KUBERNETES_EXEC_INFO environment variable and returns the
        API version. If the environment variable is malformed or invalid,
        return the v1beta1 response and print a message to stderr.

        If the v1alpha1 API is specified explicitly, a message is printed to
        stderr with instructions to update.

        :return: The client authentication API version
        :rtype: string
        zError parsingEmpty)erroremptyZKUBERNETES_EXEC_INFO r3   r$   r    )BETA_APIosenvirongetjsonloadsJSONDecodeErrorr   ERROR_MSG_TPLformatsysstderrFULLY_SUPPORTED_API_VERSIONSDEPRECATED_API_VERSIONSDEPRECATION_MSG_TPLUNRECOGNIZED_MSG_TPL)r   Zfallback_api_versionZerror_prefixesZexec_info_rawZ	exec_infoZapi_version_rawr   r   r   r+      sB   
z$GetTokenCommand.discover_api_versionN)	__name__
__module____qualname__r-   ZDESCRIPTIONZ	ARG_TABLEr   r1   r+   r   r   r   r   r   F   s(    *r   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )r)   c                 C   
   || _ d S N)_sts_clientr   r.   r   r   r   __init__      
zTokenGenerator.__init__c                 C   s.   |  |}tt|ddd }|S )z2Generate a presigned url token to pass to kubectl.zutf-8=)_get_presigned_urlTOKEN_PREFIXbase64urlsafe_b64encodeencodedecoderstrip)r   
k8s_aws_idurlr   r   r   r   r*      s   
zTokenGenerator.get_tokenc                 C   s   | j jdt|itddS )NZget_caller_identityZGET)ZParamsZ	ExpiresInZ
HttpMethod)rJ   Zgenerate_presigned_urlK8S_AWS_ID_HEADERURL_TIMEOUT)r   rV   r   r   r   rO      s   z!TokenGenerator._get_presigned_urlN)rE   rF   rG   rL   r*   rO   r   r   r   r   r)      s    r)   c                   @   s>   e Zd Zdd ZdddZdd Zdd	 Zd
d Zdd ZdS )r%   c                 C   rH   rI   )r&   )r   Zsessionr   r   r   rL      rM   zSTSClientFactory.__init__Nc                 C   s`   d|i}|d ur |  ||}|d |d< |d |d< |d |d< | jjd	i |}| | |S )
Nr   ZAccessKeyIdZaws_access_key_idZSecretAccessKeyZaws_secret_access_keyZSessionTokenZaws_session_tokenr
   )r
   )_get_role_credentialsr&   create_client_register_k8s_aws_id_handlers)r   r   r   Zclient_kwargsZcredsr
   r   r   r   r'      s   
zSTSClientFactory.get_sts_clientc                 C   s    | j d|}|j|ddd S )Nr
   ZEKSGetTokenAuth)ZRoleArnZRoleSessionNameZCredentials)r&   r[   Zassume_role)r   r   r   r
   r   r   r   rZ      s   z&STSClientFactory._get_role_credentialsc                 C   s(   |j jd| j |j jd| j d S )Nz+provide-client-params.sts.GetCallerIdentityz!before-sign.sts.GetCallerIdentity)metaeventsregister_retrieve_k8s_aws_id_inject_k8s_aws_id_headerrK   r   r   r   r\     s   z.STSClientFactory._register_k8s_aws_id_handlersc                 K   s   t |v r|t |t < d S d S rI   )rX   pop)r   paramscontextkwargsr   r   r   r`     s   z%STSClientFactory._retrieve_k8s_aws_idc                 K   s"   t |jv r|jt  |jt < d S d S rI   )rX   rd   headers)r   Zrequestre   r   r   r   ra     s   
z*STSClientFactory._inject_k8s_aws_id_header)NN)	rE   rF   rG   rL   r'   rZ   r\   r`   ra   r   r   r   r   r%      s    

r%   )&rQ   Zbotocorer:   r7   r?   r   r   Zbotocore.signersr   Zbotocore.modelr   Zawscli.formatterr   Zawscli.customizations.commandsr   Zawscli.customizations.utilsr   r	   ZAUTH_SERVICEZAUTH_COMMANDZAUTH_API_VERSIONZAUTH_SIGNING_VERSIONZ	ALPHA_APIr6   ZV1_APIrA   rB   r=   rD   rC   rY   r   rP   rX   r   objectr)   r%   r   r   r   r   <module>   sL    