o

�N�g[��@s�dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlm	Z	
e�
e�
Zdd�Z
																				
			d(dd�
Z	d)d
d�
ZdZdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zd d!�Zd"d#�Zd)d$d%�
Zd&d'�ZdS)*a<
Manage ELBs

.. versionadded:: 2014.7.0

Create and destroy ELBs. Be aware that this interacts with Amazon's
services, and so may incur charges.

This module uses ``boto``, which can be installed via package, or pip.

This module accepts explicit elb credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More information available `here
<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.

If IAM roles are not used you need to specify them either in a pillar file or
in the minion's config file:

.. code-block:: yaml

    elb.keyid: GKTADJGHEIQSXMKKRBJ08H
    elb.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile, either
passed in as a dict, or as a string to pull from pillars or minion config:

.. code-block:: yaml

    myprofile:
        keyid: GKTADJGHEIQSXMKKRBJ08H
        key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
        region: us-east-1

.. code-block:: yaml

    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - availability_zones:
                - us-east-1a
                - us-east-1c
                - us-east-1d
            - keyid: GKTADJGHEIQSXMKKRBJ08H
            - key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
            - listeners:
                - elb_port: 443
                  instance_port: 80
                  elb_protocol: HTTPS
                  instance_protocol: HTTP
                  certificate: 'arn:aws:iam::1111111:server-certificate/mycert'
                  policies:
                      - my-ssl-policy
                      - cookie-policy
                - elb_port: 8210
                  instance_port: 8210
                  elb_protocol: TCP
            - backends:
                - instance_port: 80
                  policies:
                      - enable-proxy-protocol
            - health_check:
                target: 'HTTP:80/'
            - attributes:
                cross_zone_load_balancing:
                  enabled: true
                access_log:
                  enabled: true
                  s3_bucket_name: 'mybucket'
                  s3_bucket_prefix: 'my-logs'
                  emit_interval: 5
                connecting_settings:
                  idle_timeout: 60
            - cnames:
                - name: mycname.example.com.
                  zone: example.com.
                  ttl: 60
                - name: myothercname.example.com.
                  zone: example.com.
            - security_groups:
                - my-security-group
            - policies:
                - policy_name: my-ssl-policy
                  policy_type: SSLNegotiationPolicyType
                  policy:
                    Protocol-TLSv1.2: true
                    Protocol-SSLv3: false
                    Server-Defined-Cipher-Order: true
                    ECDHE-ECDSA-AES128-GCM-SHA256: true
                - policy_name: cookie-policy
                  policy_type: LBCookieStickinessPolicyType
                  policy: {}  # no policy means this is a session cookie
                - policy_name: enable-proxy-protocol
                  policy_type: ProxyProtocolPolicyType
                  policy:
                    ProxyProtocol: true

    # Using a profile from pillars
    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - profile: myelbprofile

    # Passing in a profile
    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - profile:
                keyid: GKTADJGHEIQSXMKKRBJ08H
                key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

It's possible to specify attributes from pillars by specifying a pillar. You
can override the values defined in the pillard by setting the attributes on the
resource. The module will use the default pillar key 'boto_elb_attributes',
which allows you to set default attributes for all ELB resources.

Setting the attributes pillar:

.. code-block:: yaml

    my_elb_attributes:
      cross_zone_load_balancing:
        enabled: true
      connection_draining:
        enabled: true
        timeout: 20
      access_log:
        enabled: true
        s3_bucket_name: 'mybucket'
        s3_bucket_prefix: 'my-logs'
        emit_interval: 5

Overriding the attribute values on the resource:

.. code-block:: yaml

    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - attributes_from_pillar: my_elb_attributes
            # override cross_zone_load_balancing:enabled
            - attributes:
                cross_zone_load_balancing:
                  enabled: false
            - profile: myelbprofile

It's possible to specify cloudwatch alarms that will be setup along with the
ELB. Note the alarm name will be defined by the name attribute provided, plus
the ELB resource name.

.. code-block:: yaml

    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - profile: myelbprofile
            - alarms:
                UnHealthyHostCount:
                  name: 'ELB UnHealthyHostCount **MANAGED BY SALT**'
                  attributes:
                    metric: UnHealthyHostCount
                    namespace: AWS/ELB
                    statistic: Average
                    comparison: '>='
                    threshold: 1.0
                    period: 600
                    evaluation_periods: 6
                    unit: null
                    description: ELB UnHealthyHostCount
                    alarm_actions: ['arn:aws:sns:us-east-1:12345:myalarm']
                    insufficient_data_actions: []
                    ok_actions: ['arn:aws:sns:us-east-1:12345:myalarm']

You can also use alarms from pillars, and override values from the pillar
alarms by setting overrides on the resource. Note that 'boto_elb_alarms'
will be used as a default value for all resources, if defined and can be
used to ensure alarms are always set for a resource.

Setting the alarms in a pillar:

.. code-block:: yaml

    my_elb_alarm:
      UnHealthyHostCount:
        name: 'ELB UnHealthyHostCount **MANAGED BY SALT**'
        attributes:
          metric: UnHealthyHostCount
          namespace: AWS/ELB
          statistic: Average
          comparison: '>='
          threshold: 1.0
          period: 600
          evaluation_periods: 6
          unit: null
          description: ELB UnHealthyHostCount
          alarm_actions: ['arn:aws:sns:us-east-1:12345:myalarm']
          insufficient_data_actions: []
          ok_actions: ['arn:aws:sns:us-east-1:12345:myalarm']

Overriding the alarm values on the resource:

.. code-block:: yaml

    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - profile: myelbprofile
            - alarms_from_pillar: my_elb_alarm
            # override UnHealthyHostCount:attributes:threshold
            - alarms:
                UnHealthyHostCount:
                  attributes:
                    threshold: 2.0

Tags can also be set:

.. versionadded:: 2016.3.0

.. code-block:: yaml

    Ensure myelb ELB exists:
        boto_elb.present:
            - name: myelb
            - region: us-east-1
            - profile: myelbprofile
            - tags:
                MyTag: 'My Tag Value'
                OtherTag: 'My Other Value'
�N)
�SaltInvocationErrorcCsd
tvrdSdS)z)
    Only load if boto is available.
    �boto_elb.existsZboto_elb)Fz#boto_elb module could not be loaded)
�__salt__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/boto_elb.py�__virtual__�s

r�internet-facing�boto_elb_attributes�boto_elb_alarms�boto_elb_policiesTc$Cs@td
|	i�}|rt
jj�||�n
|}|ddid�}t|tttd�
f�s5d}t	�
|�

|�|dd��

|St|t�r?|�d	�
}t|||
||||||||�}|�|d
d�
|d|dg�
d
��

|drh|dn|d|d<|ddurv|Std|||||�}|s�tdr�|S|r�t||||||�}|�t
jj�|d
|d
�d�
|d|dg�
d
��

|dr�|dn|d|d<|ddur�|St||||||�}|�t
jj�|d
|d
�d�
|d|dg�
d
��

|dr�|dn|d|d<|ddur�|S|
�
r�td|||||�}|�
r�|
D]u}d}d}|�d|dd��

d|v�
r*|�d�
}|dk�
rFdD]} | |v
�
r>t��| �
n|| || <�
q1tdd i|�
�
}|�t
jj�|d
|d
�d�
|d|dg�
d
��

|d�
rs|dn|d|d<|ddu�
r�|
S�
qt|||||||�}|�t
jj�|d
|d
�d�
|d|dg�
d
��

|d�
r�|dn|d|d<|ddu�
r�|St||
||
|||||�	}|�t
jj�|d
|d
�d�
|d|dg�
d
��

|d�
r�|dn|d|d<|ddu�r|St||||||�}|�t
jj�|d
|d
�d�
|d|dg�
d
��

|d�r/|dn|d|d<|ddu�r>|S|�sCg}|�r\d}!|D]}"|td|"|||||!d�7}�qJ|�r�td�r�td||d||||��r�|dd|�d�7<d|d<|Std||d||||�}#|#�s�|dd7<d|d<|S)!aB

    Ensure the ELB exists.

    name
        Name of the ELB.

    availability_zones
        A list of availability zones for this ELB.

    listeners
        A list of listener lists; example::

            [
                ['443', 'HTTPS', 'arn:aws:iam::1111111:server-certificate/mycert'],
                ['8443', '80', 'HTTPS', 'HTTP', 'arn:aws:iam::1111111:server-certificate/mycert']
            ]

    subnets
        A list of subnet IDs in your VPC to attach to your LoadBalancer.

    subnet_names
        A list of subnet names in your VPC to attach to your LoadBalancer.

    security_groups
        The security groups assigned to your LoadBalancer within your VPC. Must
        be passed either as a list or a comma-separated string.

        For example, a list:

        .. code-block:: yaml

            - security_groups:
              - secgroup-one
              - secgroup-two

        Or as a comma-separated string:

        .. code-block:: yaml

            - security_groups: secgroup-one,secgroup-two

    scheme
        The type of a LoadBalancer, ``internet-facing`` or ``internal``. Once
        set, can not be modified.

    health_check
        A dict defining the health check for this ELB.

    attributes
        A dict defining the attributes to set on this ELB.
        Unknown keys will be silently ignored.

        See the :mod:`salt.modules.boto_elb.set_attributes` function for
        recognized attributes.

    attributes_from_pillar
        name of pillar dict that contains attributes.   Attributes defined for this specific
        state will override those from pillar.

    cnames
        A list of cname dicts with attributes needed for the DNS add_record state.
        By default the boto_route53.add_record state will be used, which requires: name, zone, ttl, and identifier.
        See the boto_route53 state for information about these attributes.
        Other DNS modules can be called by specifying the provider keyword.
        the cnames dict will be passed to the state as kwargs.

        See the :mod:`salt.states.boto_route53` state for information about
        these attributes.

    alarms:
        a dictionary of name->boto_cloudwatch_alarm sections to be associated with this ELB.
        All attributes should be specified except for dimension which will be
        automatically set to this ELB.

        See the :mod:`salt.states.boto_cloudwatch_alarm` state for information
        about these attributes.

    alarms_from_pillar:
        name of pillar dict that contains alarm settings.   Alarms defined for this specific
        state will override those from pillar.

    region
        Region to connect to.

    key
        Secret key to be used.

    keyid
        Access key to be used.

    profile
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.

    wait_for_sync
        Wait for an INSYNC change status from Route53.

    tags
        dict of tags

    instance_ids
        list of instance ids.  The state will ensure that these, and ONLY these, instances
        are registered with the ELB.  This is additive with instance_names.

    instance_names
        list of instance names.  The state will ensure that these, and ONLY these, instances
        are registered with the ELB.  This is additive with instance_ids.
    �
config.optionT���name�result�comment�changesNzQThe 'security_group' parameter must be either a list or a comma-separated string.F�rr�
,r�  r)rrrr�test�boto_elb.get_elb_configZboto_route53ZCNAMEZdns_name)Zrecord_type�valueZprovider)�profile�key�keyid�region�
wait_for_synczboto_route53.present)�pendingZ	rebootingZrunningZstopping�stoppedzboto_ec2.find_instances)rrrrrZ	in_stateszboto_elb.set_instancesz ELB z instances would be updated.z"Failed to set requested instances.r)r�salt�utils�
dictupdate�update�
isinstance�str�list�type�log�error�split�_elb_present�join�__opts__�_attributes_present�_health_check_present�pop�locals�get�
__states__�_alarms_present�_policies_present�
_tags_present)$r�	listeners�availability_zones�subnets�subnet_names�security_groups�scheme�health_check�
attributesZattributes_from_pillarZcnames�alarms�alarms_from_pillar�policies�policies_from_pillar�backendsrrrrr�tagsZinstance_idsZinstance_names�tmp�ret�msg�_ret�exists�lb�cnameZdns_provider�
pZrunning_states�
n�successrrr�present
s(
	
�

















�

��







���



��














&



���

�
�
��










�
��



��











�	



�
	�
�

rOcsr
|d
did�}td|||||�}|s'd|��}t
�|�

|�|dd��

|Std|||||�}	d	d
�|	D�
��f
dd
�|
D�
}
|
s[d�t|
�
�d
�
�
}t
�|�

|�d|i
�

|Stdrpd|�d|
�d�|d<d|d<|Std||
||||�}|r�d|�d�}t
�	|�

t
���|
�}
|�|d���
d�t
|
�
�
d�d��

|Sd|�d�}t
�|�

|�|dd��

|S)a

    Add EC2 instance(s) to an Elastic Load Balancer. Removing an instance from
    the ``instances`` list does not remove it from the ELB.

    name
        The name of the Elastic Load Balancer to add EC2 instances to.

    instances
        A list of EC2 instance IDs that this Elastic Load Balancer should
        distribute traffic to. This state will only ever append new instances
        to the ELB. EC2 instances already associated with this ELB will not be
        removed if they are not in the ``instances`` list.

    .. versionadded:: 2015.8.0

    .. code-block:: yaml

        add-instances:
          boto_elb.register_instances:
            - name: myloadbalancer
            - instances:
              - instance-id1
              - instance-id2
    Tr
rrzCould not find lb Frzboto_elb.get_instance_healthc
Ss g|]}
|
dd
kr|
d�qS)�descriptionz.Instance deregistration currently in progress.Zinstance_idr��.0rrrr�
<listcomp>Xs

�z&register_instances.<locals>.<listcomp>c
sg|]}
|
�v
r|
�qSrrrQ�
ZnodesrrrS]szInstance/s {} already exist.z[]rr�ELB z is set to register : �
.Nrzboto_elb.register_instanceszLoad Balancer z has been changed�

��old�new)rrzLoad balancer z failed to add instances)rr(r)r#�formatr%�strip�debugr-�info�set�unionr,r&)rZ	instancesrrrrrFrJrGZhealthrZ�staterrTr�register_instances4sL








�









�





��
�



rbZboto_elb_listener_policiescCs�d
did�}tj
j�|
||f�
std�
�
|sg}|D]_}t|�
dkr&td�
�
d|v
r.td�
�
d	|v
r6td
�
�
d|v
r>td�
�
|d��|d<|dd
krTd|v
rTtd�
�
|�dg�}
|�dd�}|
sh|durht	}|ry|
t
d|i��|dg�7}
q|r�g}|D]>}t
dd||||	|
d�}d|vr�d�|d�
|d<d|d<|
Sd|v
r�d|�d�|d<d|d<|
S|�|d�

q�d}|r�t
d||||	|
�}|�d�
}|s�d |�d!�|d<d|d<|St
d"|||||	|
d#�}|s�d$�|�
|d<d|d<|St
d%||||	|
�}|�
sXt
d&�
rd'|�d(�|d<d|d<|St
d)||
|||||||	|
d*�
}|�
rJd+di
|d,d-<d+|i
|d,d.<d'|�d/�|d<|Sd|d<d0|�d1�|d<|Sd'|�d2�|d<t|||||	|
�}tj
j�|d,|d,�|d,<d3�|d|dg�
|d<|d�
s�|d|d<|ddu�
r�|St|||||	|
�}tj
j�|d,|d,�|d,<d3�|d|dg�
|d<|d�
s�|d|d<|ddu�
r�|S|
�r
t||
|||	|
�}tj
j�|d,|d,�|d,<d3�|d|dg�
|d<|d�s|d|d<|ddu�r|S|S|�r?t|||||	|
�}tj
j�|d,|d,�|d,<d3�|d|dg�
|d<|d�s?|d|d<|S)4NTr
�rrrzWExactly one of availability_zones, subnets, subnet_names must be provided as arguments.�z\Listeners must have at minimum port, instance_port and protocol values in the provided list.�elb_portz+elb_port is a required value for listeners.�
instance_portz0instance_port is a required value for listeners.Zelb_protocolz/elb_protocol is a required value for listeners.ZHTTPSZcertificatezOcertificate is a required value for listeners if HTTPS is set for elb_protocol.rArBz
pillar.getzboto_vpc.get_resource_id�subnet)rrrrrr)zError looking up subnet ids: {}rFr�idzSubnet z does not exist.zboto_vpc.get_subnet_association�vpc_idzSubnets z do not map to a valid vpc id.z"boto_secgroup.convert_to_group_ids)rirrrrz:Security groups {} do not map to valid security group ids.rrrUz is set to be created.zboto_elb.create)
rr8r7r9r;r<rrrr�elbrrYrZz	 created.zFailed to create � ELB.z	 present.r)r r!�dataZexactly_oner�len�upper�
setdefaultr2�"DEFAULT_PILLAR_LISTENER_POLICY_KEYrr[�appendr-�_security_groups_presentr"r#r,�_listeners_present�_zones_present�_subnets_present)rr8r7r9r:r;r<rrrrrF�listenerrAZpolicies_pillar�
i�
rZ_security_groupsrirI�createdrHrrrr+�s




�




�



�




�	





��



�











�











�
��


















�


(�
%�

�

















�




	�


�



r+cCs�d
did�}td|||||�}|s|�d�|d<d|d<|S|
s#g}
i}|
D]}	td	|	�
}
|	||
<q'i}|d
D]}	td	|	�
}
|	||
<q:g}g}
|�
�D]
\}}	||v
r\|
�|	�

qO|�
�D]
\}}	||v
rn|�|	�

qatdr�g}|
sy|r�|�d|�d
��

|
D]}|�d�td	|�
�
�

q�|D]}|�d�td	|�
�
�

q�d|d<n	|�d|�d��

d�|�
|d<|S|r�dd�|D�
}td||||||�}|r�d|�d�|d<nd|�d�|d<d|d<|
�
rtd||
||||�}|�
rd}d�|d|�|�
g�
|d<nd}d�|d|�|�
g�
|d<d|d<|
�
s"|�
rHi|dd
<|d
|dd
d<td|||||�}|d
|dd
d<|Sd|�d�|d<|S) NTr
rcr�* ELB configuration could not be retrieved.rFrzboto_elb.listener_dict_to_tupler7rrUz  set to have listeners modified:zListener {} added.zListener {} deleted.zListeners already set on ELB rVrc
Ssg|]}
|
d�qS)
rer)rR�
lrrrrSWsz&_listeners_present.<locals>.<listcomp>zboto_elb.delete_listenerszDeleted listeners on rkzFailed to delete listeners on zboto_elb.create_listenerszCreated listeners on {0} ELB.�
 z&Failed to create listeners on {0} ELB.rrYrZ)r�itemsrqr-r[r,)rr7rrrrrFrJZexpected_listeners_by_tupler{Zl_keyZactual_listeners_by_tuple�	to_delete�	to_create�
trGrvZports�deletedryrrrrs#s�




















�



�







��



��





�



�







�rsc
Cs

d
did�}td|||||�}|s|�d�|d<d|d<|S|
s#g}
d}t
|
�
t
|d	�
kr1d
}|r{td
rEd|�d�|d<d|d<|Std
||
||||�}	|	r[d|�d�|d<nd|�d�|d<d|d<d	|d	i
|dd<d	|
i
|dd<|Sd|�d�|d<|S)NTr
rcrrzrFrr;rrUz& set to have security groups modified.zboto_elb.apply_security_groupszModified security_groups on rkz$Failed to modify security_groups on rrYrZz#security_groups already set on ELB rV)rr_r-)
rr;rrrrrFrJZ
change_needed�changedrrrrrxs8

















�



�
rrcCs
d
did�}td|||||�}|s d|d<d|�d�|d	<|Sg}d
|
vr;|
d
}	|d
}
|	d|
dkr;|�
d
�

d|
vr_|
d}|d}|d|dksZ|�d
d�|�d
�
kr_|�
d�

d|
vrx|
d}
|d}|
d|dkrx|�
d�

d|
vr�|
d��D]\}}t|d|�
t|�
kr�|�
d�

q�d|
dvr�|
dd}|�d�
s�|�d�
r�td�
�
|r�tdr�d|�d�|d	<d|d<|Std||
||||�}|r�d|i
|dd<d|
i
|dd<d|�d�|d	<|Sd|d<d|�d�|d	<|Sd|�d�|d	<|S) NTr
rczboto_elb.get_attributesFrz&Failed to retrieve attributes for ELB rVrZcross_zone_load_balancing�enabledZconnection_draining�timeouti,
Zconnecting_settingsZidle_timeoutZ
access_logZs3_bucket_prefix�
/z-s3_bucket_prefix can not start or end with /.rrUz set to have attributes set.zboto_elb.set_attributesr>rrYrZzSet attributes on ELB z Failed to set attributes on ELB zAttributes already set on ELB )	rrqr2r}r%�
startswith�endswithrr-)rr>rrrrrF�_attributesZattrs_to_setZczlbZ_czlbZcdZ_cd�csZ_cs�attr�valZsbp�was_setrrrr.�sj

















�











�




�





�


�
�
r.cCs0
d
did�}|
s
i}
td|||||�}|s$d|d<d|�d�|d	<|Sd}|
�
�D]\}	}
t||	�
t|
�
kr:d
}q*|r�td
rOd|�d�|d	<d|d<|Std
||
||||�}|r�d|i
|dd<td|||||�}d|i
|dd<d|�d�|d	<|Sd|d<d|�d�|d	<|Sd|�d�|d	<|S)NTr
rczboto_elb.get_health_checkFrz(Failed to retrieve health_check for ELB rVrrrUz set to have health check set.zboto_elb.set_health_checkr=rrYrZzSet health check on ELB z"Failed to set health check on ELB z Health check already set on ELB )rr}r%r-)rr=rrrrrFZ
_health_checkZneed_to_setr�r�r�rrrr/�sH





�






�






�



�
�
�
r/cCs�
d
did�}td|||||�}|s d|d<d|�d�|d	<|Sg}g}	|d
}
|
D]}||
v
r5|�
|�

q*|
D]}||
v
rC|	�
|�

q8|sH|	r�tdrZd|�d
�|d	<d|d<|S|r~td||||||�}|rrd|�d�|d	<nd|�d�|d	<d|d<|	r�td||	||||�}
|
r�d}d�|d	|�|�
g�
|d	<nd}d�|d	|�|�
g�
|d	<d|d<d
|d
i
|dd<td|||||�}d
|d
i
|dd<|Sd|�d�|d	<|S)NTr
rcrFr�Failed to retrieve ELB rVrr8rrUz  to have availability zones set.z"boto_elb.enable_availability_zoneszEnabled availability zones on rkz'Failed to enable availability zones on z#boto_elb.disable_availability_zonesz'Disabled availability zones on {0} ELB.rz0Failed to disable availability zones on {0} ELB.rrYrZz&Availability zones already set on ELB )rrqr-r,r[)rr8rrrrrFrJ�	to_enable�
to_disableZ_zones�zoner��disabledrGrrrrt�s\












�



�







�




�






�
rtcCs�
d
did�}|
s
g}
td|||||�}|s$d|d<d|�d�|d	<|Sg}g}	|d
}
|
D]}||
v
r9|�
|�

q.|
D]}||
v
rG|	�
|�

q<|sL|	r�tdr^d|�d
�|d	<d|d<|S|r�td||||||�}|rvd|�d�|d	<nd|�d�|d	<d|d<|	r�td||	||||�}
|
r�d�|d	d|�d�g�
|d	<nd�|d	d|�d�g�
|d	<d|d<d
|d
i
|dd<td|||||�}d
|d
i
|dd<|Sd|�d�|d	<|S)NTr
rcrFrr�rVrr9rrUz to have subnets set.zboto_elb.attach_subnetszAttached subnets on rkzFailed to attach subnets on zboto_elb.detach_subnetsr|zDetached subnets on zFailed to detach subnets on rrYrZzSubnets already set on ELB )rrqr-r,)rr9rrrrrFrJr�r�Z_subnetsrgZattachedZdetachedrrrru&sh














�



�







�




�


�

��


�
ruc
Cs

td
|i�}|
rt
jj�||
�}|ddid�}|��D]f\}	}
|d|
d|
d<|d|
dd|
dd<d	|g
i
|
dd
<|
d|
d||||d�}tddi|�
�
}|�d
�
sb|d
|d
<|�di�ikrt|d|d|
d<d|vr�|d|d7<q|S)zAhelper method for present.  ensure that cloudwatch_alarms are setrTr
rr|rr>rPZLoadBalancerNameZ
dimensions)rr>rrrrzboto_cloudwatch_alarm.presentrrrNr)rr r!r"r#r}r3r2)
rr?r@rrrr�currentrF�
_r^�kwargs�resultsrrrr4^s2





�




�	






�
r4c	*s�|
d
urg}
td|g�}	|
|	}
|d
urg}t
�}
|
D]0}d|v
r&td�
�
d|v
r.td�
�
d|v
r6td�
�
|d|
vrEtd	�|d�
�
�
|
�|d�

q|D]}|�d
g�D]}||
v
rhtd�|d||��
�
qWqO|D]}
|
�d
g�D]}||
v
r�td
�|
d||��
�
qtqlddid�}td|||||�}|s�|�d�|d<d|d<|Si}i�|
D]}t|�
}|||<|�|d<q�|��}|d
}t
�}i}|D]}�f
dd�|�d
g�D�
||d<q�i}|dD]!}t
|�d
g��
}|||d<|D]}t�	d|��
r|�|�

q�q�i}|D]}
�f
dd�|
�d
g�D�
||
d<�
qi}|dD]}
t
|
�d
g��
}|||
d<�
q'g}g}|D]
}||v
�
rK|�
|�

�
q?|D]}||v
�
r`||v
�
r`|�
|�

�
qOt
�}|��D]\}}
|
|�|t
��k�
r||�|�

�
qi|��D]\}}
|
|�|t
��k�
r�|�|�

�
q�t
�} |��D]\}}
|
|�|t
��k�
r�| �|�

�
q�|��D]\}}
|
|�|t
��k�
r�| �|�

�
q�td�r5g}!|�
s�|�r|!�
d|�d��

|D]}"|!�
d |"�d!��

�
q�|D]}"|!�
d |"�d"��

�
q�d
|d<n	|!�
d#|�d$��

|D]}#|!�
d%|#�d&��

�q| D]}$|!�
d'|$�d&��

�qd(�
|!�
|d<|S|�r�|D]E}td)||||d||d||||d*�}%|%�rx||d+�|i�d,<d |�d-|��}&d(�
|d|&g�
|d<d|d<�q:d|d<|
S|D]T}td.||t|�|g��
||||d/�}'|'�r�d0|�d1�}(t|�|g��
t|�|g��
d2�|d+|(<d3�||||�}&d(�
|d|&g�
|d<d|d<�q�d|d<|
S| D]T}td4||t|�|g��
||||d/�}'|'�r&d5|�d1�}(t|�|g��
t|�|g��
d2�|d+|(<d6�||||�}&d(�
|d|&g�
|d<d|d<�q�d|d<|
S|�ro|D];}td7||||||d8�})|)�rg||d+�|i�d9<d |�d:|��}&d(�
|d|&g�
|d<d|d<�q3d|d<|
S|S);z;helper method for present. ensure that ELB policies are setNr�policy_namez-policy_name is a required value for policies.�policy_typez-policy_type is a required value for policies.�policyz)policy is a required value for listeners.z9Policy names must be unique: policy {} is declared twice.rAz4Listener {} on ELB {} refers to undefined policy {}.rez3Backend {} on ELB {} refers to undefined policy {}.rfTr
rcrrzrFrc
�h|]}
�|
�qSrr�rRrL�
Zcnames_by_namerr�	<setcomp>��
�z$_policies_present.<locals>.<setcomp>r7z^ELBSecurityPolicy-\d{4}-\d{2}$c
r�rrr�r�rrr��r�rCrrUz set to have policies modified:zPolicy z added.�	 deleted.zPolicies already set on ELB rVz	Listener z policies updated.zBackend rzboto_elb.create_policy)rr�r�r�rrrrrrZz was created on ELB zboto_elb.set_listener_policy)r�portrArrrrZ	listener_Z_policyrXz+Policy {} was created on ELB {} listener {}zboto_elb.set_backend_policyZbackend_z*Policy {} was created on ELB {} backend {}zboto_elb.delete_policy)rr�rrrrrYz was deleted from ELB )rr_rr[�addr2�
_policy_cname�keys�re�matchrqr}r-r,ror&)*rrArBr7rCrrrrZpillar_policiesZpolicy_namesrLr{�
brFrJZpolicies_by_cnamerKZexpected_policy_namesZactual_policy_namesZdefault_aws_policiesZexpected_policies_by_listenerZactual_policies_by_listenerZlistener_policiesZexpected_policies_by_backendZactual_policies_by_backendZbackend_policiesr~rr�Zlisteners_to_updater�Zbackends_to_updaterGr�rvZbackendryrZ
policy_setZ
policy_keyr�rr�rr5}s�















��





����	





����









	




�





��




�







�






�



�



�



�



�



























�













�	

�

�









�	

�

�









�





r5c
Csz|d
}
|d}|d}tt
t|���
dd�d��
}t�tjj�	t|�
�
�
�
�}|�d�
r3|dd�}|�d	|
�d	|��S)
Nr�r�r�c

Sst|d
�
S)Nr
)
r%)
�
xrrr�<lambda>sz_policy_cname.<locals>.<lambda>)
rZType����
-)r%�sortedr&r}�hashlib�md5r r!Zstringutils�to_bytes�	hexdigestr�)Zpolicy_dictr�r�r�Zcanonical_policy_reprZpolicy_hashrrrr�{s





��


r�cCs�|d
did�}td||
|||�}|rYt
dr%d|�d�|d<d	|d
<|Std||
|||�}|rKd|i
|d
d<dd	i
|d
d<d|�d�|d<|Sd|d
<d|�d�|d<|S|�d�|d<|S)zH
    Ensure an ELB does not exist

    name
        name of the ELB
    Tr
rrrrUz is set to be removed.rNrzboto_elb.deleterjrrYrZr�FzFailed to delete rkz ELB does not exist.)rr-)rrrrrrFrIr�rrr�absent�s$









�
�
r�cCsdd
did�}|
�
r�td|||||�}|
}i}	g}
|�
d�
rJ|dD]'}||
��v
r4||
v
r3|
�|�

q"|
||d|krD|
||	|<|�|�

q"|
r�tdrqd�t|
�
dkrZd	n
d
d�|
�
�}d�|d
|g�
|d
<d|d<nMtd||
||||�}
|
s�d|d<d|
�d�}d�|d
|g�
|d
<|Sd|dv
r�t	j
j�|dddii
i
�|d<|
D]}|d||ddd|<q�|s�|	�
r�td�
r|r�d�t|���
dkr�d	n
d
d�|���
�}d�|d
|g�
|d
<d|d<|	�
rd�t|	���
dkr�dn
dd�|	���
�}d�|d
|g�
|d
<n�t	j
j�||	�}td||||||�}
|
�
s;d|d<d}d�|d
|g�
|d
<|Sd|dv
�
rRt	j
j�|dddii
i
�|d<d|dv
�
rit	j
j�|dddii
i
�|d<|D].}|
||ddd|<d|v�
r�|d�
r�||dv�
r�|d||ddd|<�
qk|	�
s�|
�
s�|�
s�d}d�|d
|g�
|d
<|S)z1
    helper function to validate tags on elb
    Tr
rcrrDrz*The following tag{} set to be removed: {}.�
zs arez isz, rrNrzboto_elb.delete_tagsFzError attempting to delete tag rVrYrz(The following tag{} set to be added: {}.r|z+The following tag {} set to be updated: {}.z
values arezvalue iszboto_elb.set_tagszError attempting to set tags.rZzTags are already set.)
rr2r�rqr0r-r[rmr,r r!r"r#)rrDrrrrrFrJZtags_to_addZtags_to_updateZtags_to_removeZ_tagrGrHZall_tag_changes�tagrrrr6�s�










�






�


�






�








�


���
�
�






�

�






�



r6)NNNNrNNr	NNr
NrNNNNNTNNN)NNNN)�__doc__r��loggingr�Zsalt.utils.datar Zsalt.utils.dictupdateZsalt.utils.stringutilsZsalt.exceptionsr�	getLogger�__name__r(rrOrbrpr+rsrrr.r/rtrur4r5r�r�r6rrrr�<module>
sjm



























�5
�I$U 7&18