HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/lxc.cpython-310.pyc
o

�N�gM�@s�dZddlZddlZddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddl
Z
ddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlmZmZddl m!Z!e�"e#�Z$ddd�Z%dZ&d	Z'd
Z(dZ)dZ*d
Z+e,�Z-dd�Z.dd�Z/dd�Z0dd�Z1dd�Z2dd�Z3dd�Z4dd�Z5d�dd�Z6d d!�Z7d�d"d#�Z8d�d$d%�Z9d&d'�Z:d�d(d)�Z;d*d+�Z<d�d-d.�Z=d/d0�Z>Gd1d2�d2�Z?d3d4�Z@									5										,	,				d�d6d7�ZAd�d8d9�ZBd�d:d;�ZCd<d=�ZDd>d?�ZE	d�d@dA�ZFd�dBdC�ZGd�dDdE�ZHd�dFdG�ZIe-e-e-e-e-dfdHdI�ZJd�dJdK�ZKd�dLdM�ZLd�dNdO�ZMdPdQ�ZNd�dRdS�ZOdTdU�ZPd�dVdW�ZQd�dXdY�ZRejSjT�UeRdZ�ZVd�d[d\�ZWd�d]d^�ZXd�d_d`�ZYd�dadb�ZZd�dcdd�Z[d�dedf�Z\ejSjT�Ue\dg�Z]d�dhdi�Z^d�djdk�Z_d�dldm�Z`d�dndo�Zad�dpdq�Zbd�drds�Zcd�dudv�Zdd�dwdx�Ze		5	5				,	,				d�dydz�Zfd�d{d|�Zg		,	5		5	}	,		,		~d�dd��Zh	,	5		5	}	,		,	,	~d�d�d��Zi	,	5		5	}	,		,	,	~d�d�d��Zj	,	5		5	}	,		,	,	~d�d�d��Zk	,	5		5	}	,		,	,	~d�d�d��Zl	,	5		5	}	,		,	,	~d�d�d��Zmd�d��Znd�d�d��ZoejSjT�Ueod��Zpd�d�d��Zqd�d��Zr	d�d�d��Zsd�d�d��Zt													d�d�d��Zud�d�d��Zvd�d�d��Zwd�d�d��ZxdS)�zv
Control Linux Containers via Salt

:depends: lxc package for distribution

lxc >= 1.0 (even beta alpha) is required

�N)�CommandExecutionError�SaltInvocationError)�Version�list�ls)�list_�ls_�lxc�eth0�br0�/lxc.initial_seed�
lxc-attachz/var/lib/lxccCstjj�d�r	tSdS)N�	lxc-start)FzSThe lxc execution module cannot be loaded: the lxc-start binary is not in the path.)�salt�utils�path�which�__virtualname__�rr�D/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/lxc.py�__virtual__7srcCs|st�dt�}|S)z�
    Get the configured lxc root for containers

    .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.get_root_path

    z
lxc.root_path)�__opts__�get�DEFAULT_PATH�rrrr�
get_root_pathTs
rcCsZd}t�|d�s'tdd�}|ds't|d�}|td�kr"td��|�t|<t�|d�S)	z�
    Return the actual lxc client version

    .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.version

    zlxc.versionN�cmd.run_allzlxc-info --version�retcode�stdoutz1.0zLXC should be at least 1.0)�__context__r�__salt__rr)�kZcversion�verrrr�versionfs

r#cCs0dd�tD�D]}t�d|�t�|d�qdS)z4
    Clear any lxc variables set in __context__
    cSsg|]	}|�d�r|�qS)�lxc.��
startswith��.0�xrrr�
<listcomp>�sz"_clear_context.<locals>.<listcomp>zClearing __context__['%s']N)r�logZtrace�pop)�varrrr�_clear_context~s�r.cCs8d}|dkrd}|dkrd}nd|vrd}|�d|��S)	z
Ip sortingZ001�	127.0.0.1Z200�::1Z201z::Z100Z___r)�ip�idxrrr�_ip_sort�sr3c	Cs�t�dd�}|s|t�}t�}|�t�z%tdd�}|d��dd�D]}|�d�s6|�|��d�	��q$Wnt
tfyCYnwt�d	i��
�D]\}}||vrZ|�|�qLtj�d
|�d��ri|�|�qLt|�}dd
�}|j|d�|td<|S)z�
    Search which bridges are potentially available as LXC bridges

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.search_lxc_bridges

    zlxc.bridgesNrz
brctl showr�� rZ
ip_interfacesz/sys/devices/virtual/net/z/bridgecSs,d}d|vr	d}nd|krd}|�d|��S)N�zr	�ar�c�_r)r7Zprefrrr�sort_bridges�sz(search_lxc_bridges.<locals>.sort_bridges��key)rr�set�add�
DEFAULT_BRr �
splitlinesr&�split�striprr�
__grains__�items�osr�existsr�sort)ZbridgesZrunning_bridges�output�lineZifcr1r:rrr�search_lxc_bridges�s4

���
�rJcCs
t�dS)z�
    Search the first bridge which is potentially available as LXC bridge

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.search_lxc_bridge

    r)rJrrrr�search_lxc_bridge�s
rKcKsr|s|�di�}|si}|�d|�dt�dtd���|�d|�dt�dt�dt�d�����|ds7i}|S)N�minionZmaster�idZmaster_portZret_portZ4506)r�
setdefaultr)�config�kwargsrrr�_get_salt_config�s"���rQc4	s��duri�t����tjj��|��t���d��di���}t|tt	ff�s*i}t
|��dD��fdd�	}|dur>�d}d}t�dd�d	vrJd
}|d�}|sU|d|�|d
d�}|r`|�d<|dd�}|rk|�d<|rq|�d
<|dd�}	t|dd��}
|dg�}|dd�}|dd�}
|dd�}|dd�}|dd�}|dd�}|dd�}|dd�}|dd�}|d d�}|d!d�}|d"d�}|dur�g}|d#d�}|r�||vr�|�
|�|d$d�}|�d%d�}|d&d'�}|d(d�}|d)d�}|d*d�}|d+d�}|d,d�} t|d-i�fi���}!|d.t�}"t|t��stjj��}|�|"tjj���}#t|tjjj��s9tjj��}$|$�|�|$}d}%|d)d�}|d/d�}&|d0d�}'|&�rf|&}(|�rY|(d1|��7}(|(|#d2<|'du�rf|'|#d0<t|d3g��D]�\})}*d4|)d5��}+|�|+i�},|%du�r�|*�d*|,�d*d��}%|%�r�|#�d*d�d}|%|,d*<|*�d6|,�d6d��}-|-�r�|-|,d6<|*�d2|*�d/d��}.|.�r�|.|,d2<|*�d&d�}/|/�r�|,d2d1|/��7<d7D]}0|0|*v�r�|*|0|,d0<n�q�d0|,v�r�tjj��|,d0<�qmd}%d8d9�|D�D]},||,}1|%�r|1�d*d�d*|1v�r|1d*}%d}�q�|�r ||#d6<|�r'||#d*<i}2||2d<|!|2d-<|d:d;�|2d:<||2d<||2d<||2d%<d<D]}3||3d�|2d=<|2d=du�rXn�qF�|2d<|	|2d<||2d<||2d<||2d(<||2d<||2d<||2d<||2d<| |2d,<||2d+<||2d><||2d?<|d@dA�|2d@<|dBd�|2dB<|
|2d<||2d"<|
|2d<||2d<||2d$<dCD]$}0||0d��r�z	�|0|2|0<W�q�t�y��|0|2|0<Y�q�w�q�|2S)Ea�
    Interface between salt.cloud.lxc driver and lxc.init
    ``vm_`` is a mapping of vm opts in the salt.cloud format
    as documented for the lxc driver.

    This can be used either:

    - from the salt cloud driver
    - because you find the argument to give easier here
      than using directly lxc.init

    .. warning::
        BE REALLY CAREFUL CHANGING DEFAULTS !!!
        IT'S A RETRO COMPATIBLE INTERFACE WITH
        THE SALT CLOUD DRIVER (ask kiorky).

    name
        name of the lxc container to create
    pub_key
        public key to preseed the minion with.
        Can be the keycontent or a filepath
    priv_key
        private key to preseed the minion with.
        Can be the keycontent or a filepath
    path
        path to the container parent directory (default: /var/lib/lxc)

        .. versionadded:: 2015.8.0

    profile
        :ref:`profile <tutorial-lxc-profiles-container>` selection
    network_profile
        :ref:`network profile <tutorial-lxc-profiles-network>` selection
    nic_opts
        per interface settings compatibles with
        network profile (ipv4/ipv6/link/gateway/mac/netmask)

        eg::

              - {'eth0': {'mac': '00:16:3e:01:29:40',
                          'gateway': None, (default)
                          'link': 'br0', (default)
                          'gateway': None, (default)
                          'netmask': '', (default)
                          'ip': '22.1.4.25'}}
    unconditional_install
        given to lxc.bootstrap (see relative doc)
    force_install
        given to lxc.bootstrap (see relative doc)
    config
        any extra argument for the salt minion config
    dnsservers
        list of DNS servers to set inside the container
    dns_via_dhcp
        do not set the dns servers, let them be set by the dhcp.
    autostart
        autostart the container at boot time
    password
        administrative password for the container
    bootstrap_delay
        delay before launching bootstrap script at Container init


    .. warning::

        Legacy but still supported options:

        from_container
            which container we use as a template
            when running lxc.clone
        image
            which template do we use when we
            are using lxc.create. This is the default
            mode unless you specify something in from_container
        backing
            which backing store to use.
            Values can be: overlayfs, dir(default), lvm, zfs, brtfs
        fstype
            When using a blockdevice level backing store,
            which filesystem to use on
        size
            When using a blockdevice level backing store,
            which size for the filesystem to use on
        snapshot
            Use snapshot when cloning the container source
        vgname
            if using LVM: vgname
        lvname
            if using LVM: lvname
        thinpool:
            if using LVM: thinpool
        ip
            ip for the primary nic
        mac
            mac address for the primary nic
        netmask
            netmask for the primary nic (24)
            = ``vm_.get('netmask', '24')``
        bridge
            bridge for the primary nic (lxcbr0)
        gateway
            network gateway for the container
        additional_ips
            additional ips which will be wired on the main bridge (br0)
            which is connected to internet.
            Be aware that you may use manual virtual mac addresses
            providen by you provider (online, ovh, etc).
            This is a list of mappings {ip: '', mac: '', netmask:''}
            Set gateway to None and an interface with a gateway
            to escape from another interface that eth0.
            eg::

                  - {'mac': '00:16:3e:01:29:40',
                     'gateway': None, (default)
                     'link': 'br0', (default)
                     'netmask': '', (default)
                     'ip': '22.1.4.25'}

        users
            administrative users for the container
            default: [root] and [root, ubuntu] on ubuntu
        default_nic
            name of the first interface, you should
            really not override this

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.cloud_init_interface foo

    NZlxc_profile�profilecs��|��||��S�N)r)r!�default�rR�vm_rr�
_cloud_getusz(cloud_init_interface.<locals>._cloud_get�name�rE)ZUbuntu�ubuntu�image�template�backing�dir�vgname�snapshotF�	autostartT�
dnsservers�dns_via_dhcp�passwordZs3cr3t�password_encrypted�fstype�lvname�thinpool�pub_key�priv_key�sizeZ20G�script�script_args�users�ssh_username�network_profile�nic_opts�netmaskZ24r�bridge�gateway�unconditional_install�
force_installrO�default_nicr1�mac�/�ipv4Zadditional_ipsZethr4�link)rx�hwaddrcS�g|]}|�qSrr�r(r7rrrr*��z(cloud_init_interface.<locals>.<listcomp>�memoryr)�
clone_from�cloneZfrom_containerr��
bootstrap_url�bootstrap_args�bootstrap_shell�sh�bootstrap_delay)�cpu�cpuset�cpusharerS)�copy�deepcopyrr�
dictupdate�updater�
isinstance�dict�str�get_container_profilerC�bool�appendrQ�DEFAULT_NIC�odict�OrderedDictrN�	enumerater,�network�gen_mac�KeyError)4rXrVrPZprofile_datarWZdefault_templater[r]r_r`rarbrcrdrerfrgrhrirjrkrlrmrnrorprqrrrrsrtrurvrOrwr
Z	bnic_optsZgwr1rxZfullipZixZioptsZifh�ethxZelinkZaipZnm�i�ndataZlxc_init_interfacer�rrUr�cloud_init_interface�s4


































�
�
����r�cKs�t|t�r|�dd�}t||fi|��S|duri}ntdd|�d|��ddd�}|dur0i}t|t�s=td|�d���tjjj	dit
�|���}tjj�
t
�|�|�}|S)	NrX�
config.getr$�:Zrecurse)rT�mergez must be a dictionaryr)r�r�r,�_get_profiler rrr�argsZclean_kwargsr�r�r�r�)r<rXrPZprofilename�
profile_matchZ	overridesrrrr�s"
�

�r�cK�td|fi|��}|S)a�
    .. versionadded:: 2015.5.0

    Gather a pre-configured set of container configuration parameters. If no
    arguments are passed, an empty profile is returned.

    Profiles can be defined in the minion or master config files, or in pillar
    or grains, and are loaded using :mod:`config.get
    <salt.modules.config.get>`. The key under which LXC profiles must be
    configured is ``lxc.container_profile.profile_name``. An example container
    profile would be as follows:

    .. code-block:: yaml

        lxc.container_profile:
          ubuntu:
            template: ubuntu
            backing: lvm
            vgname: lxc
            size: 1G

    Parameters set in a profile can be overridden by passing additional
    container creation arguments (such as the ones passed to :mod:`lxc.create
    <salt.modules.lxc.create>`) to this function.

    A profile can be defined either as the name of the profile, or a dictionary
    of variable names and values. See the :ref:`LXC Tutorial
    <tutorial-lxc-profiles>` for more information on how to use LXC profiles.

    CLI Example:

    .. code-block:: bash

        salt-call lxc.get_container_profile centos
        salt-call lxc.get_container_profile ubuntu template=ubuntu backing=overlayfs
    Zcontainer_profile�r��rXrPrRrrrr�4s%r�cKr�)ay
    .. versionadded:: 2015.5.0

    Gather a pre-configured set of network configuration parameters. If no
    arguments are passed, the following default profile is returned:

    .. code-block:: python

        {'eth0': {'link': 'br0', 'type': 'veth', 'flags': 'up'}}

    Profiles can be defined in the minion or master config files, or in pillar
    or grains, and are loaded using :mod:`config.get
    <salt.modules.config.get>`. The key under which LXC profiles must be
    configured is ``lxc.network_profile``. An example network profile would be
    as follows:

    .. code-block:: yaml

        lxc.network_profile.centos:
          eth0:
            link: br0
            type: veth
            flags: up

    To disable networking entirely:

    .. code-block:: yaml

        lxc.network_profile.centos:
          eth0:
            disable: true

    Parameters set in a profile can be overridden by passing additional
    arguments to this function.

    A profile can be passed either as the name of the profile, or a
    dictionary of variable names and values. See the :ref:`LXC Tutorial
    <tutorial-lxc-profiles>` for more information on how to use network
    profiles.

    .. warning::

        The ``ipv4``, ``ipv6``, ``gateway``, and ``link`` (bridge) settings in
        network profiles will only work if the container doesn't redefine the
        network configuration (for example in
        ``/etc/sysconfig/network-scripts/ifcfg-<interface_name>`` on
        RHEL/CentOS, or ``/etc/network/interfaces`` on Debian/Ubuntu/etc.)

    CLI Example:

    .. code-block:: bash

        salt-call lxc.get_network_profile default
    rpr�r�rrr�get_network_profile]s8r�cCsvt|�}td�}||krd|��St�}t|�|kr4t�d|d�}||vr.|�t|��t|�|ksd�t	|��S)z>
    Return a random subset of cpus for the cpuset config
    zstatus.nprocz0-rr4�,)
�intr r=�len�random�randintr>r��join�sorted)r�ZavailZto_set�choicerrr�
_rand_cpu_str�s

�r�c%s|�dd�}g}|�di�}|duri}|sg}t|�}|s i}|r/t|tftf�r/t|��ni�t�vr9i�t<t�|�}|�	dd�}|�dd�}|rp|�
�D]\}}	��|i�}
z
tj
j�|
|	�}
WqPtyotd��wdd��D�}|�fd	d�|D�7}|��d
}|D�]O}��|i�}	|r�|�|i�ni}
|�|i�}|
�d|	�dd
��}|r�q�|
�d|
�d
|	�d|	�d
d����}|
�d|	�dd��}|
�d|	�dd��}|
�d|	�dd��}|
�d|	�dd��}|
�d|	�dd��}tj
j�d|||�d�dd�fdd
|||d�fd|||�d�dd�fd|||�d�t�d�fd|||�d�tj
j��d�fd|||�dd�dd�fd|||�dd�dd�fg�}t|���D]$}||}|d�r{|d�rp|d|d <�qX|d!�r{|d!|d <�qX|�
�D]\}}|d �r�|�||d i��q�|	�
�D]&\}}|dk�r�|�r�|}|
�||�}|d"v�r��q�|�d#|��|i��q�|�s�|	�dd�}|du�r�|�s�|�d$|i�d%}q�|du�r�|�s�|�d$|i�d%}t|�}d&d�|D�D]K}||}|�dd�}|�dd�} d'\}!}"||v�r"||}#|#�dd�}!|#�dd�}"|"�r*| �s*|"} | �s/d} | ||d<|!�rA|�sA|!||d<�q�g}|��D]}|D]}$|�tj
j�|$||$fg���qM�qItt��td(�k�r�d%d)d�|D�v�r�d%d*d�|D�v�r�|�d$d+i�|S),a<
    Network configuration defaults

        network_profile
            as for containers, we can either call this function
            either with a network_profile dict or network profile name
            in the kwargs
        nic_opts
            overrides or extra nics in the form {nic_name: {set: tings}

    rpNrqrtrszInvalid nic_opts configurationcSr}rrr~rrrr*�rz!_network_conf.<locals>.<listcomp>c�g|]}|�vr|�qSrrr~�Znicprrr*��F�disablerxr|rY�type�flagsr{rz�ipv6�lxc.network.type�veth)�test�value�oldrT�lxc.network.namezlxc.network.flagsZupzlxc.network.linkzlxc.network.hwaddr�lxc.network.ipv4zlxc.network.ipv6r�r�r�rT)r�r�rXrtrxr{rzr��lxc.network.�lxc.network.ipv4.gatewayTcSr}rrr~rrrr*Ur)rYrYz1.0.7cS�g|]}d|v�qS)r�rr~rrrr*r�cSr�)r�rr~rrrr*sr��auto)r�
_get_vethsr�r�r�r�r�r�r�r,rDrNrrr�r��AttributeErrorrrGr�r�rKr�r�r�keysr��valuesrr#)%�conf_tuplesrPZnic�retrqr�rtrs�devr�r��ifsZgateway_set�optsZold_ifr�rxZtype_r�r{rzr��infos�infoZbundle�datar<�val�newZifacer�ZnmacZntypeZomacZotype�odata�rowrr�r�
_network_conf�s*

�
���
���
��

��

��

����A


�
�

�
�"�r�c	Ks�t�|�}i}dD]}|�|d�}|dur||d|��<q	|�d�}|dur(d}|dkr7|r3d|d<nd|d<|�d	�}|durH|d
d
|d<|�d�}|rS||d
<|�d�}|�d�}|rc||d<|rm|smt|�|d
<|S)N)�utsname�rootfsr$raT�keep�1zlxc.start.auto�0r�i� lxc.cgroup.memory.limit_in_bytesr�zlxc.cgroup.cpuset.cpusr�r�zlxc.cgroup.cpu.shares)r�r�rr�)	rPr�r!r�rar�r�r�r�rrr�_get_lxc_default_datays6
�





r�FcKspt|�}|sg}t�|�}g}|s(tdi|��}|��D]\}}|�||i�qtdd|i|��}|�|�|S)a
    Return a list of dicts from the salt level configurations

    conf_tuples
        _LXCConfig compatible list of entries which can contain

            - string line
            - tuple (lxc config param,value)
            - dict of one entry: {lxc config param: value)

    only_net
        by default we add to the tuples a reflection of both
        the real config if avalaible and a certain amount of
        default values like the cpu parameters, the memory
        and etc.
        On the other hand, we also no matter the case reflect
        the network configuration computed from the actual config if
        available and given values.
        if no_default_loads is set, we will only
        reflect the network configuration back to the conf tuples
        list

    r�Nr)r�r�r�r�rDr�r��extend)r��only_netrPr��default_datar!r��	net_datasrrr�_config_list�s

r�cCst|t�rt|���}tjj��}tjj��}d}|D]\}|r-t|t�r-t|���d}n"t|t�rO|�	�}|�
d�s=|s>qd|vrOtdd�|�dd�D��}|ddkr[tjj��}|dd	krkd
}|||d�	�<|d�	�||d�	�<q|r�|r�||t
<|S)zj
    Parse the nic setup inside lxc conf tuples back to a dictionary indexed by
    network interface
    Tr�#�=css�|]}|��VqdSrS�rBr~rrr�	<genexpr>���z_get_veths.<locals>.<genexpr>r4r�r�F)r�r�rrDrrr�r�r�rBr&�tuplerAr�)Znet_data�nicsZcurrent_nicZno_names�itemZsitemrrrr��s.

r�c@sLeZdZdZe�d�Ze�d�Zdd�Zdd�Z	dd	�Z
d
d�Zdd
�ZdS)�
_LXCConfigz 
    LXC configuration data
    z^(\S+)(\s*)(=)(\s*)(.*)z^((#.*)|(\s*))$cs�t�|�}|�dd��_t|�dd��}g�_�jr�tj�	|�jd��_tj�
�j�rtjj
��j��D}tjj�|���D]2}�j�|���}|rY�j�|dd|ddf��j�|���}|ro�j�d|ddf�q=Wd�n1szwYnd�_�fdd�}tdi|��}|��D]	\}}	|||	�q���d	�}
tdd
|
i|��}|r�|D]}�j�t|����q�dD]}
|�|
�sˈ�|
�q�dS)
NrXrrOr���rYcs&|r��|��j�||f�dSdSrS)�_filter_datar�r�)r<r���selfrr�_replaces
�z%_LXCConfig.__init__.<locals>._replace�lxc.networkr�)r�r)r�r�r,rXrrr�rErr��isfilerr�files�fopen�decode�	readlines�pattern�findallrBr��non_interpretable_patternr�rDr�r�r�r)r�rPrZfhrrI�matchr�r�r<r��old_netr�r�r2rr�r�__init__�sD
 ����	


��z_LXCConfig.__init__cCsdd�|jD�}d�|�dS)Ncss(�|]}d�||dr
dnd�VqdS)z{0[0]}{1}{0[1]}r� = rYN)�format)r(r�rrrr�s
��
�z'_LXCConfig.as_string.<locals>.<genexpr>�
)r�r�)r��chunksrrr�	as_strings�z_LXCConfig.as_stringcCsf|jr1|��}tjj�|jd��}|�tjj�|��|�	�Wd�dS1s*wYdSdS)N�w)
rrrrr�r��write�stringutils�to_str�flush)r��content�ficrrrrs
"��z_LXCConfig.writecCs"t��}|�|���|��|SrS)�tempfileZNamedTemporaryFilerrr)r�Zntfrrrr	&sz_LXCConfig.tempfilecCsBg}g}|jD]}|d�|�s|�|�q|�|�q||_|S)zQ
        Removes parameters which match the pattern from the config data
        r)r�r&r�)r�r��removedZfiltered�paramrrrr�.s
z_LXCConfig._filter_dataN)
�__name__�
__module__�__qualname__�__doc__�re�compiler�r�r�rrr	r�rrrrr��s

&	r�c
s�tt�|�d����t�|��d��fdd�	}|d�}|d�}|d�}|�dd�}d	D]}|�|d�q+|r�tj�|�j}t	d
|�}t
j�|�}	t
jj�|t	dd��}
d
|�d|	�d|
��}t||d�s�t|f||||d�|��|r�t
j�d||�}tt||d�dfddid|i��|S|r�d
|��}t||d�s�t|f||||d�|��|r�t
j�d||�}tt||d�dfddid|i��|SdS)z�
    If the needed base does not exist, then create it, if it does exist
    create nothing and return the name of the base lxc container so
    it can be cloned.
    rRNc�(��|t�}��||�}|tur|S|SrS�r,�_marker�r<rTZkw_overrides_matchr���kw_overridesrRrr�selectF�
z_get_base.<locals>.selectr\r[r_r)rr[r_r\�
cp.cache_filer�Z	hash_typeZ__base_r9r)r\r[rr_z/devrO�
out_format�	commented�
lxc.rootfsrYrS)r�r�r�rr,�urllib�parse�urlparse�schemer rEr�basenamerrZ	hashutilsZget_hashrF�creater��	edit_confr�)
rPrr\r[r_rr�proto�img_tarZimg_nameZhash_rXr�rrr�	_get_base=sp
�������
������r'Tc<s>
�id�}tt�����|s��d�}|st}dgi}|�d�}|dur&g}dg}|D]}||vr6|�|�q+t�|��d^��fdd�	}|d��t��} t��d	�}!|d
�}"|"rZ|"ntdd�}#|d
d�}$|d|	�}	|dd�}%|dd�}&|d�}'t	|fi|��}(|dd�})|d�}*|#r�|*s�z|#|d
<t
d_d�i|��}*Wn!ttfy�}+z|+j
|d<|r�||d<|WYd}+~+Sd}+~+ww|�d�dur�d|d<t��d	�},d}-d}.|,rאn/|*�rTd}.zt�|*fd�i|��|�ddi�Wn;ttf�y+}+z,d|+j
v�r	|�ddi�nd|d<|+j
|d<|�r||d<|WYd}+~+SWYd}+~+nd}+~+wwt�|||�||	|||d�
}/t|/jd d!�}0|/��t|/jd d!�}1|0|1k�rSd}-n�d}.t|||�|||	||d"�	}/|/���\}2zt�f|2j�d#�|��|�dd$i�Wn>ttf�y�}+z/d|+j
v�r�|�ddi�n|+j
|d<|�r�||d<|WYd}+~+Wd�SWYd}+~+nd}+~+wwWd�n	1�s�wYtj�| �d%�}3g}0tj�|3��r�t|3d d!�}0t|0|||||||d&�}4|4�r�t|3d |4d'�t|3d d!�}1|0|1k�rd}-t�|||�||	|||d�
}/g}0tj�|/j��r%t|/jd d!�}0|/��t|/jd d!�}1|0|1k�r>|�d%d(i�d}-|-�rozt��d	�Wn%ttf�yn}+zd)|+��|d<|�rb||d<|WYd}+~+Sd}+~+ww|,�r~|,�r�t��d	�d*k�r�zt��d	�Wn%ttf�y�}+zd)|+��|d<|�r�||d<|WYd}+~+Sd}+~+ww|.�r�t�d+t�d,��ddd-�|�dd��rv|
�rvd.}5|5d/d0��d1�g}6t��fd2d3�|6D���svd4D]}7|7|v�r�t �d5|7��d�ddd6�d7k�r�|�|7��q�|D]@}z
t!�|g�|
|d8�}8W�qttf�y@}+z"|�d9�|+j
}9|dk�r0|9|d<d|d<nt"�#|9�WYd}+~+�qd}+~+ww|�dd��rv|�d:d;i�t �d<�$|5��ddd=�d7k�rvd>|d<|d?d:d@|ddA7<d|d<|�dd��r�|
�r�dB}5|5dCdD��dE�g}6t��fdFd3�|6D���s�z
t%��|
|dG�Wn ttf�y�}+zdH|+j
|d<d|d<WYd}+~+n3d}+~+ww|�dIdJi�t �d<�$|5�d�ddK�d7k�r�dL|d<|d?dId@|ddA7<d|d<|.�rt�d+t�d,��ddM�dN}5|5dOg}6t��fdPd3�|6D���s|�dd��sn�|%�s!|'�r�|%�rlzt&�|(�|)|||&||||||dQ�
}:Wn ttf�yW}+zdR|+j
|d<d|d<WYd}+~+nhd}+~+ww|:�sddS|d<d|d<nW|�dTdUi�nO|'�r�zt|'t'��d	�dV�|(�}:Wn"ttf�y�}+zdW�$|'|+j
�|d<d|d<WYd}+~+nd}+~+ww|:�s�dX�$|'�|d<d|d<n
|�dTdY�$|'�i�|�dd��r�|$�s�zt��d	�Wn ttf�y�}+zd)|+��|d<d|d<WYd}+~+nd}+~+wwt��d	�};|!|;k�r|�dZ|!|;d[�i�|�dd��rd\��d]�|d<d|d<|�r||d<|S)`aO
    Initialize a new container.

    This is a partial idempotent function as if it is already provisioned, we
    will reset a bit the lxc configuration file but much of the hard work will
    be escaped as markers will prevent re-execution of harmful tasks.

    name
        Name of the container

    image
        A tar archive to use as the rootfs for the container. Conflicts with
        the ``template`` argument.

    cpus
        Select a random number of cpu cores and assign it to the cpuset, if the
        cpuset option is set then this option will be ignored

    cpuset
        Explicitly define the cpus this container will be bound to

    cpushare
        cgroups cpu shares

    autostart
        autostart container on reboot

    memory
        cgroups memory limit, in MB

        .. versionchanged:: 2015.5.0
            If no value is passed, no limit is set. In earlier Salt versions,
            not passing this value causes a 1024MB memory limit to be set, and
            it was necessary to pass ``memory=0`` to set no limit.

    gateway
        the ipv4 gateway to use
        the default does nothing more than lxcutils does

    bridge
        the bridge to use
        the default does nothing more than lxcutils does

    network_profile
        Network profile to use for the container

        .. versionadded:: 2015.5.0

    nic_opts
        Extra options for network interfaces, will override

        ``{"eth0": {"hwaddr": "aa:bb:cc:dd:ee:ff", "ipv4": "10.1.1.1", "ipv6": "2001:db8::ff00:42:8329"}}``

        or

        ``{"eth0": {"hwaddr": "aa:bb:cc:dd:ee:ff", "ipv4": "10.1.1.1/24", "ipv6": "2001:db8::ff00:42:8329"}}``

    users
        Users for which the password defined in the ``password`` param should
        be set. Can be passed as a comma separated list or a python list.
        Defaults to just the ``root`` user.

    password
        Set the initial password for the users defined in the ``users``
        parameter

    password_encrypted : False
        Set to ``True`` to denote a password hash instead of a plaintext
        password

        .. versionadded:: 2015.5.0

    profile
        A LXC profile (defined in config or pillar).
        This can be either a real profile mapping or a string
        to retrieve it in configuration

    start
        Start the newly-created container

    dnsservers
        list of dns servers to set in the container, default [] (no setting)

    seed
        Seed the container with the minion config. Default: ``True``

    install
        If salt-minion is not already installed, install it. Default: ``True``

    config
        Optional config parameters. By default, the id is set to
        the name of the container.

    master
        salt master (default to minion's master)

    master_port
        salt master port (default to minion's master port)

    pub_key
        Explicit public key to preseed the minion with (optional).
        This can be either a filepath or a string representing the key

    priv_key
        Explicit private key to preseed the minion with (optional).
        This can be either a filepath or a string representing the key

    approve_key
        If explicit preseeding is not used;
        Attempt to request key approval from the master. Default: ``True``

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    clone_from
        Original from which to use a clone operation to create the container.
        Default: ``None``

    bootstrap_delay
        Delay in seconds between end of container creation and bootstrapping.
        Useful when waiting for container to obtain a DHCP lease.

        .. versionadded:: 2015.5.0

    bootstrap_url
        See lxc.bootstrap

    bootstrap_shell
        See lxc.bootstrap

    bootstrap_args
        See lxc.bootstrap

    force_install
        Force installation even if salt-minion is detected,
        this is the way to run vendor bootstrap scripts even
        if a salt minion is already present in the container

    unconditional_install
        Run the script even if the container seems seeded

    CLI Example:

    .. code-block:: bash

        salt 'minion' lxc.init name [cpuset=cgroups_cpuset] \
                [cpushare=cgroups_cpushare] [memory=cgroups_memory] \
                [nic=nic_profile] [profile=lxc_profile] \
                [nic_opts=nic_opts] [start=(True|False)] \
                [seed=(True|False)] [install=(True|False)] \
                [config=minion_config] [approve_key=(True|False) \
                [clone_from=original] [autostart=True] \
                [priv_key=/path_or_content] [pub_key=/path_or_content] \
                [bridge=lxcbr0] [gateway=10.0.3.1] \
                [dnsservers[dns1,dns2]] \
                [users=[foo]] [password='secret'] \
                [password_encrypted=(True|False)]

    )rX�changesrp�initN�rootcrrSrrrrrrQrzinit.<locals>.selectrrr_r��
lxc.vgname�startTra�seed�install�seed_cmd�approve_keyr�rR�commentr(r`Fr#zContainer clonedzalready existszContainer already exists�result)
rXrprqrsrrtrar�r�r�r�r)	rprqr�rrsrtrar�r�)rOrRzContainer createdrO)r�r�rprqrsr�r�r��r�
lxc_configzContainer configuration updated�Unable to stop container: �runningzrm -f '�')r�chroot_fallback�python_shellz/.lxc.initial_passz/lxc.initial_passz/.lxc.z
.initial_passc3�.�|]}t�d|�d�d�dd�dkVqdS�z	test -e "�"T�r9r�ignore_retcoderN�rr'�rXrrrr����	�
��
�zinit.<locals>.<genexpr>)rZzid )r:rr9r?r)rnrrd�	encryptedz: Failed to set passwordrdzPassword(s) updatedz"sh -c 'touch "{0}"; test -e "{0}"'�rr9r?zFailed to set password markerr�z. �.z/.lxc.initial_dnsz/lxc.initial_dnsz/lxc.z.initial_dnsc3r;r<r@r'rArrr�;rB)rrb�
searchdomainszFailed to set DNS: �dnszDNS updatedr>zFailed to set DNS marker�rr:z/.lxc.initial_seedrc3s,�|]}t�d|���ddd�dkVqdS)ztest -e TrDrNr@r'rArrr�bs�	���
�)rOrr0rirjr.rvrur�r�r�r�zBootstrap failed: z5Bootstrap failed, see minion log for more information�	bootstrapz#Container successfully bootstrappedr�z&Bootstrap via seed_cmd '{}' failed: {}zHBootstrap via seed_cmd '{}' failed, see minion log for more information z7Container successfully bootstrapped using seed_cmd '{}'�state�r�r��Container 'z' successfully initializedrSr)(r�r�r�rr�r�rrJr rQr'rr�strerrorrFr�r��	read_confrrr	r#rXrEr�r�r$�stopr,�run�SEED_MARKER�anyr�set_passwordr+�debugr��set_dnsrIr�)<rXrOr�r�r�rRrprqr�rardrernrbrFrsrtrirjrvrur�r�r�r�rPr�Zchanges_dictr(Zdusers�userr�bpathZ	state_pre�tvgr_�start_r-r.r/Zsalt_configr0r��exc�
does_existZ	to_rebootZremove_seed_markerZcfg�
old_chunksr�cfile�cpath�new_cfg�gid�gidsZdefault_user�cret�msgr2Z
state_postr)rrXrrRrr)|s�
?


�






��
���	�
��

������

�
����
�		
�
��

��


��	��	 	
�
�����	 	
�

�
����
�����
��	��
r)cKs.t||fi|��}|�d|�}t|fi|��S)a8
    Thin wrapper to lxc.init to be used from the saltcloud lxc driver

    name
        Name of the container
        may be None and then guessed from saltcloud mapping
    `vm_`
        saltcloud mapping defaults for the vm

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.cloud_init foo
    rX)r�r,r))rXrVrPZinit_interfacerrr�
cloud_init�srdc	Cs�tdddd�}d|vrtd��i}d}|��D]0}z|��\}}}}}	Wn	ty.Yqw|s8|dkr7d}q|�|g�}
|
�||||	d��q|d	urXt||�|g�fg�S|S)
a'
    .. versionadded:: 2015.5.0

    List the available images for LXC's ``download`` template.

    dist : None
        Filter results to a single Linux distribution

    CLI Examples:

    .. code-block:: bash

        salt myminion lxc.images
        salt myminion lxc.images dist=centos
    �cmd.run_stdoutz.lxc-create -n __imgcheck -t download -- --listT)r?ZDISTz>Unable to run the 'download' template script. Is it installed?F)�release�arch�variant�
build_timeN)	r rr@rA�
ValueErrorrNr�r�r)�dist�outr�Z
passed_headerrIZdistrorfrgrhriZ	dist_listrrr�images�s<�����	rmcCs4zt�d�}WntygYSwdd�|D�S)z�
    .. versionadded:: 2015.5.0

    List the available LXC template scripts installed on the minion

    CLI Examples:

    .. code-block:: bash

        salt myminion lxc.templates
    z/usr/share/lxc/templatescSs"g|]
}|�d�r|dd��qS)zlxc-�Nr%r'rrrr*�"ztemplates.<locals>.<listcomp>)rE�listdir�OSError)Ztemplate_scriptsrrr�	templatess�rrcCs�t�|ddkr1t||d�r1|r#t||||d�}|r#t�d|||�t||d�}dd|d�d�St||d�rTd	}|rE|d
t�|���7}|d|��7}td|d
d�t	d�
||d���)Nrrr)rrqzVNetwork changes from applying network profile '%s' to newly-created container '%s':
%sTrK�r2rJ�lxc-destroy� -P � -n �cmd.retcodeF�r:z0Container could not be created with cmd '{}': {}�stderr)r.rF�apply_network_profiler+r�rJ�shlex�quoter rr�)�cmdr�rXrprrqZnetwork_changes�c_staterrr�_after_ignition_network_profiles4����rcs�d}d|��}tt�����t�|��d8��fdd�	}|d�}	t||	d�r-td|�d	���|d
�}
|
r5|
ntdd�}|d
�}|d�}
|rK|
rKtd��t||
�f�sVtd��|d�p[i�|d�}|rf|sfd}|d�}|d�}|d�}|dd�}|d�}|dvr�d}d}|dvr�d}}}|
r�td|
�}tj	�
tj	�tj
�ddd�}|�d <|	r�|d!t�|	���7}tj	�|	�s�t�|	�|r�|d"|��7}|r�|d#|��7}|�r&|��}|d$|��7}|d%vr�|r�|d&|��7}|d'v�r
|r�|d(|��7}|�r|d)|��7}|�r
|d*|��7}|d+v�r&|�r|d,|��7}|�r&|d-|��7}��r\|d.k�rD�fd/d0�|D�}|�rDtd1�d2�
|����|d37}���D]\}}|d3|�d4|��7}�qLtd5|d6d7�}t|||||	|�S)9a�
    Create a new container.

    name
        Name of the container

    config
        The config file to use for the container. Defaults to system-wide
        config (usually in /etc/lxc/lxc.conf).

    profile
        Profile to use in container creation (see
        :mod:`lxc.get_container_profile
        <salt.modules.lxc.get_container_profile>`). Values in a profile will be
        overridden by the **Container Creation Arguments** listed below.

    network_profile
        Network profile to use for container

        .. versionadded:: 2015.5.0

    **Container Creation Arguments**

    template
        The template to use. For example, ``ubuntu`` or ``fedora``.
        For a full list of available templates, check out
        the :mod:`lxc.templates <salt.modules.lxc.templates>` function.

        Conflicts with the ``image`` argument.

        .. note::

            The ``download`` template requires the following three parameters
            to be defined in ``options``:

            * **dist** - The name of the distribution
            * **release** - Release name/version
            * **arch** - Architecture of the container

            The available images can be listed using the :mod:`lxc.images
            <salt.modules.lxc.images>` function.

    options
        Template-specific options to pass to the lxc-create command. These
        correspond to the long options (ones beginning with two dashes) that
        the template script accepts. For example:

        .. code-block:: bash

            options='{"dist": "centos", "release": "6", "arch": "amd64"}'

        For available template options, refer to the lxc template scripts
        which are usually located under ``/usr/share/lxc/templates``,
        or run ``lxc-create -t <template> -h``.

    image
        A tar archive to use as the rootfs for the container. Conflicts with
        the ``template`` argument.

    backing
        The type of storage to use. Set to ``lvm`` to use an LVM group.
        Defaults to filesystem within /var/lib/lxc.

    fstype
        Filesystem type to use on LVM logical volume

    size : 1G
        Size of the volume to create. Only applicable if ``backing=lvm``.

    vgname : lxc
        Name of the LVM volume group in which to create the volume for this
        container. Only applicable if ``backing=lvm``.

    lvname
        Name of the LVM logical volume in which to create the volume for this
        container. Only applicable if ``backing=lvm``.

    thinpool
        Name of a pool volume that will be used for thin-provisioning this
        container. Only applicable if ``backing=lvm``.

    nic_opts
        give extra opts overriding network profile values

    path
        parent path for the container creation (default: /var/lib/lxc)

    zfsroot
        Name of the ZFS root in which to create the volume for this container.
        Only applicable if ``backing=zfs``. (default: tank/lxc)

        .. versionadded:: 2015.8.0
    )rkrfrgzlxc-create -n Nc�(��|d�}��||�}|dur|S|SrS�r,rrrrr�s
zcreate.<locals>.selectrrrL�' already existsr_r�r+r\r[z/Only one of 'template' and 'image' is permittedz>At least one of 'template', 'image', and 'profile' is required�optionsr]�lvmrgrhrfrk�1G�zfsroot)r^�	overlayfs�btrfs�zfs)Zaufsr^r�r�rrrr	Zsalt_tarballZimgtarru� -f z -t � -B )r�z --zfsroot )r�z
 --lvname z
 --vgname z --thinpool �r^r�z
 --fstype z
 --fssize �downloadcr�rrr')r�rrr*�r�zcreate.<locals>.<listcomp>z$Missing params in 'options' dict: {}�, z --r5rFrxrS)r�r�r�rFrr rrRrErr��dirnamer�__file__r{r|�makedirs�lowerr�rDr)rXrOrRrprqrPZdownload_template_depsr}rrrXr_r\r[r]rgrhrfrkr�r&Zmissing_depsr<r�r�r)rr�rRrr#7s�a

	�
�



���r#c
s�tt�����t�|��d ��fdd�	}|d�}t||d�r&td|�d���t||d�t||d�dkr<td|�d	���|d
�}|d�}	|dvrJd
}	|	sOd}	nd}	|dd�}
|dvr\d}
tt��td�krud}|d|	�d|�d|��7}nd}|d|	�d|�d|��7}|r�|dt	�
|���7}tj�|�s�t�
|�|r�|��}|d|��7}|dvr�|
r�|d|
��7}td|d
d�}t||||||�S)!a�
    Create a new container as a clone of another container

    name
        Name of the container

    orig
        Name of the original container to be cloned

    profile
        Profile to use in container cloning (see
        :mod:`lxc.get_container_profile
        <salt.modules.lxc.get_container_profile>`). Values in a profile will be
        overridden by the **Container Cloning Arguments** listed below.

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    **Container Cloning Arguments**

    snapshot
        Use Copy On Write snapshots (LVM)

    size : 1G
        Size of the volume to create. Only applicable if ``backing=lvm``.

    backing
        The type of storage to use. Set to ``lvm`` to use an LVM group.
        Defaults to filesystem within /var/lib/lxc.

    network_profile
        Network profile to use for container

        .. versionadded:: 2015.8.0

    nic_opts
        give extra opts overriding network profile values

        .. versionadded:: 2015.8.0

    CLI Examples:

    .. code-block:: bash

        salt '*' lxc.clone myclone orig=orig_container
        salt '*' lxc.clone myclone orig=orig_container snapshot=True
    Ncr�rSr�rrrrr5rzclone.<locals>.selectrrrLr��stoppedz' must be stopped to be clonedr]r`)r^FrYz-srkr�)r^r�r�z2.0zlxc-copyr5rvz -N z	lxc-clonez -o rur�r�z -L rrxrS)r�r�r�rFr�_ensure_existsrJrr#r{r|rErr�r�r r)
rX�origrRrprqrPrrr]r`rkr}r�rrrr��sL3


�r�cCs�d|��}|r|d7}|r|tvrt|Sg}d}|r%|dt�|���7}|r+|d7}td|dd�}|��D]	}|�|���q7|t|<|S)	a�
    Return a list of the containers available on the minion

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    active
        If ``True``, return only active (i.e. running) containers

        .. versionadded:: 2015.5.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.ls
        salt '*' lxc.ls active=True
    zlxc.lsz.activezlxc-lsruz	 --activereFrx)rr{r|r r@r�rA)Zactive�cacherZ
contextvarr�r}rHrIrrrrls 
rcCs\t|d�}|ri}i}i}ng}g}g}|||d�}|D]�}d}	|r,|	dt�|���7}	|	d|��7}	td|	ddd	�}
d
}|
��D]}|�d�}
|
dd
vrW|
d��}nqB|rd|d
ure|��|kreq|rtt||d�}d}||i}nd}|}|dkr�t	||�|�q|dkr�t	||�|�q|dkr�t	||�|�qq|d
ur�|�
||r�i�Sg�S|S)a�
    List containers classified by state

    extra
        Also get per-container specific info. This will change the return data.
        Instead of returning a list of containers, a dictionary of containers
        and each container's output from :mod:`lxc.info
        <salt.modules.lxc.info>`.

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    limit
        Return output matching a specific state (**frozen**, **running**, or
        **stopped**).

        .. versionadded:: 2015.5.0

    CLI Examples:

    .. code-block:: bash

        salt '*' lxc.list
        salt '*' lxc.list extra=True
        salt '*' lxc.list limit=running
    r)r7r��frozen�lxc-inforurv�cmd.runFrT)r:�output_loglevelNr�r)�StaterJr4r�r�ZSTOPPEDZFROZENZRUNNING)rr{r|r r@rArBr�r��getattrr)�extra�limitrZctnrsr�r�r7r��	containerr}�c_infor~rI�statr��methodr�rrrr�sV

�
�rc	Cs�t||d�}	|	|krd||d�d|�d|��d�S|dkr:d}
|r+|
d	t�|���7}
|
d
|��7}
td|
dd
�|rJd	|vrJ|d	t�|���7}|d|��7}dd||||d�}dd�|D�D]}||}
|
turq|�|d�qatd|fi|��}|ddkr�td�|||d���|dur�d}|r�|d	t�|���7}|d|�d|����7}td|ddd�t	�t||d�}||k|	|d�d�}|S)NrTrKrLz
' already )r2rJr1rt�lxc-stopruz -k -n r�Frxrv)r:�redirect_stderr�with_communicate�use_vt�stdinrcSr}rrr~rrrr*	rz!_change_state.<locals>.<listcomp>rrrz>Error changing state for container '{}' using command '{}': {}rzlxc-waitz -s �)r:�timeoutrs)
rJr{r|r rr,rr��upperr.)r}rX�expectedr�rryr�r�r�preZscmdZpkwargsr�r�Z_cmdoutZrcmdZpostr�rrr�
_change_state�sX���
��r�cCs t||d�std|�d���dS)z<
    Raise an exception if the container does not exist
    rrLz' does not existN)rFrrArrrr�+	s�r�cCs�t||d�t||d�}|dkrt||d�S|dkr*|r$td|�d���t||d�S|dkr>|r8td|�d���t||d�SdS)a
    If the container is not currently running, start it. This function returns
    the state that the container was in before changing

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0
    rr7r�rLz' is not runningr�N)r�rJr,r�unfreeze)rX�no_startrr�rrr�_ensure_running3	s�r�cCs\t||d�t||d�}|dkrt|||d�t|||d�}||dd<|dkr,d|d<|S)	a�
    .. versionadded:: 2015.5.0

    Restart the named container. If the container was not running, the
    container will merely be started.

    name
        The name of the container

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    lxc_config
        path to a lxc config file
        config file will be guessed from container name otherwise

        .. versionadded:: 2015.8.0

    force : False
        If ``True``, the container will be force-stopped instead of gracefully
        shut down

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.restart name
    rr�)�killr)rr5rJr�TZ	restarted)r�rJrOr,)rXrr5�force�
orig_stater�rrr�restartN	s r�cKs�|�dd�}t|�}|�dd�}d}|stj�||d�}tj�|�r,|dt�|���7}|d7}t||d�t	||d�d	krFt
d
|�d���|�dd�}|�d
d�}t||dddd|||d�	S)a�
    Start the named container

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    lxc_config
        path to a lxc config file
        config file will be guessed from container name otherwise

        .. versionadded:: 2015.8.0

    use_vt
        run the command through VT

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.start name
    rNr5rrOr�z -drr�rLz' is frozen, use lxc.unfreezer�r�Fr7)rryr�r�rr�)rrrErr�rFr{r|r�rJrr�)rXrPrr^r5r}r�r�rrrr,y	s2�r,cCsbt||d�t||d�}|dkr|st||d�d}|r |d7}t||d||d�}||dd<|S)	aa
    Stop the named container

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    kill: False
        Do not wait for the container to stop, kill all tasks in the container.
        Older LXC versions will stop containers like this irrespective of this
        argument.

        .. versionchanged:: 2015.5.0
            Default value changed to ``False``

    use_vt
        run the command through VT

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.stop name
    rr�r�z -kr��r�rrJr�)r�rJr�r�)rXr�rr�r�r}r�rrrrO�	srOcKs�|�dd�}|�dd�}t||d�t||d�}|�dd�}|dkr2|s,td|�d	���t||d�d
}|r@|dt�|���7}t||d||d
�}|dkrY|rY||dd<d|d<t||d�|dd<|S)a�
    Freeze the named container

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    start : False
        If ``True`` and the container is stopped, the container will be started
        before attempting to freeze.

        .. versionadded:: 2015.5.0

    use_vt
        run the command through VT

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.freeze name
    r�Nrrr,Fr�rL�' is stoppedz
lxc-freezerur�r�rJr�T�startedr�)rr�rJrr,r{r|r�)rXrPr�rr�rYr}r�rrr�freeze�	s$r�cCsZt||d�t||d�dkrtd|�d���d}|r$|dt�|���7}t||d||d�S)	aN
    Unfreeze the named container.

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    use_vt
        run the command through VT

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.unfreeze name
    rr�rLr�zlxc-unfreezerur7)rr�)r�rJrr{r|r�)rXrr�r}rrrr�
sr�cCs@t||d�|st||d�dkrtd|�d���td|d|d�S)a

    Destroy the named container.

    .. warning::

        Destroys all data associated with the container.

    path
        path to the container parent directory (default: /var/lib/lxc)

        .. versionadded:: 2015.8.0

    stop : False
        If ``True``, the container will be destroyed even if it is
        running/frozen.

        .. versionchanged:: 2015.5.0
            Default value changed to ``False``. This more closely matches the
            behavior of ``lxc-destroy(1)``, and also makes it less likely that
            an accidental command will destroy a running container that was
            being used for important things.

    CLI Examples:

    .. code-block:: bash

        salt '*' lxc.destroy foo
        salt '*' lxc.destroy foo stop=True
    rr�rLz' is not stoppedrtN)r�rJrr�)rXrOrrrr�destroy*
sr��removecCs&|t|d�v}|s|td|d�v}|S)z�
    Returns whether the named container exists.

    path
        path to the container parent directory (default: /var/lib/lxc)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.exists name
    rF)r�r)r)rXr�_existsrrrrFR
srFc	Cs�d|�|��}zt|WSty~t||d�sdt|<n[d}|r,|dt�|���7}|d|��7}td|dd	�}|d
dkrLt�td|�d
���|d��}d}|D]}|�	d�}|d�
�dkro|d���
�}nqV|t|<Yt|SYt|Sw)z�
    Returns the state of a container.

    path
        path to the container parent directory (default: /var/lib/lxc)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.state name
    z
lxc.state.rNr�rurvrFrxrrz"Unable to get state of container 'r8rr�rJr4)rr�rFr{r|r r.rr@rAr�rB)	rXr�cachekeyr}r�Zc_infosr~r�r�rrrrJj
s:


�
�
��rJcCstt||d�d}|r|dt�|���7}|d|�d|��7}td|dd�}|d	d
kr4td|�d���|d
��S)a:
    Returns the value of a cgroup parameter for a container

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.get_parameter container_name memory.limit_in_bytes
    r�
lxc-cgrouprurvr5rFrxrrzUnable to retrieve value for 'r8r)r�r{r|r rrB)rX�	parameterrr}r�rrr�
get_parameter�
sr�cCsjt||d�sdSd}|r|dt�|���7}|d|�d|�d|��7}td|dd	�}|d
dkr3dSdS)
a'
    Set the value of a cgroup parameter for a container.

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.set_parameter name parameter value
    rNr�rurvr5rFrxrrT)rFr{r|r )rXr�r�rr}r�rrr�
set_parameter�
sr�c
Cs�d|�|��}zt|WSt�yVt||d�t|�}z
tj�||d�}Wnty;tj�|t|�d�}Ynwtj�	|�sJt
d|�d���i}g}tjj
�|��4}|D])}tjj�|�}dd�|�dd	�d
���dd	�D�}	t|	�dkr�|�t|	��qXWd
�n1s�wYg}
i}|D]#\}}
|dkr�d|
i}|
�|�q�|s�q�|�d�r�|
||�ddd	�<q�|
r�|
|d<tdd�|D�d
�|d<t||d�|d<g|d<g|d<g|d<g|d<g|d<g|d<g|d<g|d<g|d<d
|d <||d<|dd!k�r:z	tt|d"��}Wnt
ttf�y d
}Ynwz	tt|d#��}Wnt
ttf�y9d
}Ynw||}||d$<||d%<t|d&|d'd(�}|��d)��d	|d <t |d*|d'd(�}|d+d
k�r�|d,}t |d-|d'd(�}|d.|d,7}tjj!�"|�}n!t |d/|d'd(�}|d+d
k�r�tjj!�#|d,�}nt$�%d0|�i}tjj!j&d1|d2�|d<tjj!j'd1|d2�|d<|d|d|d<|dD]>}|d3k�r�|d�|�|d�|��q�tjj(�)|��r�|d�|�|d�|��q�|d�|�|d�|��q�|dD],}|d4k�s|�d5��r*|d�|�|d�|��q
|d�|�|d�|��q
d6d�|D�D]}||j*t+d7��qA|t|<Yt|Sw)8z�
    Returns information about a container

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.info name
    z	lxc.info.rrOzLXC config file � does not existcSsg|]}|���qSrr�r'rrrr*�
r�zinfo.<locals>.<listcomp>r�r4rr��Nr�r�r�rYr�css$�|]
}|ddkr|dVqdS)rrr4Nrr'rrrr�s�"zinfo.<locals>.<genexpr>r�rJ�ipsZ
public_ipsZprivate_ipsZpublic_ipv4_ipsZpublic_ipv6_ipsZprivate_ipv4_ipsZprivate_ipv6_ipsZipv4_ipsZipv6_ipsrkr7zmemory.limit_in_byteszmemory.usage_in_bytesZmemory_limitZmemory_freezdf /FrHr�zip link showrrzip addr showr�Zifconfigz.Unable to run ip or ifconfig in container '%s'T)Zinclude_loopbackZinterface_datar/r0Zfe80cSs"g|]
}|dks
|�d�r|�qS)r�)�endswithr'rrrr*Mror;),rr�r�rrErr�r�r�r�rrrr�r�r�
to_unicoderArBr�r�r�r&�replace�nextrJr�r��	TypeErrorrj�
run_stdoutr@�run_allr�Z_interfaces_ipZ_interfaces_ifconfigr+�warningZip_addrsZ	ip_addrs6ZcloudZis_public_iprGr3)rXrr�r^�	conf_filer�rO�fp_rI�compsZifaces�currentr<r�r��usage�freerkZip_cmdZip_data�addressrrrr��
s�
�&���
���
�
�

�r�c	
Cs�dd�}t|t�sz|�d�}Wnty|�Ynw|s"|�g}|D]"}t|d�|r0dnd�d�||f�d|d	d
d�}|dkrH|�|�q&|rUtd
�d�|����d	S)a

    .. versionchanged:: 2015.5.0
        Function renamed from ``set_pass`` to ``set_password``. Additionally,
        this function now supports (and defaults to using) a password hash
        instead of a plaintext password.

    Set the password of one or more system users inside containers


    users
        Comma-separated list (or python list) of users to change password

    password
        Password to set for the specified user(s)

    encrypted : True
        If true, ``password`` must be a password hash. Set to ``False`` to set
        a plaintext password (not recommended).

        .. versionadded:: 2015.5.0

    path
        path to the container parent directory
        default: /var/lib/lxc (system)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.set_pass container-name root '$6$uJ2uAyLU$KoI67t8As/0fXtJOPcHKGXmUpcoYUcVR2K6x93walnShTCQvjRwq25yIkiCBOqgbfdKQSFnAo28/ek6716vEV1'
        salt '*' lxc.set_pass container-name root foo encrypted=False

    cSstd��)Nz#Invalid input for 'users' parameter)rrrrr�_bad_user_inputxsz%set_password.<locals>._bad_user_inputr�z
chpasswd{}z -erYr�FT�quiet)r�r:rr9r�rz4Password change failed for the following user(s): {}r�)	r�rrAr�rr�r�r�r)	rXrnrdrCrr�Zfailed_usersrVr2rrrrSSs<%

��	
���rS�set_passc	s�t||d�t|�}tj�||d�}tj�|�s td|�d���gggd���ddd�}tjj	�
|d	���}}g}|D]}	|	s?q:|	D]}
|�|
��|	|
��f�qAq:d
|d<g}tjj
�|���}|��D]1}
|
�d�sp|
��sx|�|
dg�qe|
�d
�}
|
�d�}|��d
�|
���f}||vr�|�|�qe|D]]\}}d}t|dd��D]6\}}
|
d|kr�d}||f||<d
�|
dd����|��kr݈d�|
d|
dd�i||if�nq�|s�||f|vr�|�||f��d�||i�q�g}|�r#|D]#}
|D]}|
d�|��s|
|v�r|�|
��q�d�|��qq�n|}d}
|D]\}}|�s9|
|�d�7}
�q)|
|���d|���d�7}
�q)|
|k}tj���d�}|�r�tjj	�
|�d|��d��}|�tjj
�|
��Wd�n	1�s{wYtjj	�
|d��}|�tjj
�|
��Wd�n	1�s�wYd|d<d|d<Wd�n	1�s�wYt�fdd��D���s�i|d<|S)az
    Edit LXC configuration options

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.update_lxc_conf ubuntu \
                lxc_conf="[{'network.ipv4.ip':'10.0.3.5'}]" \
                lxc_conf_unset="['lxc.utsname']"

    rrOzConfiguration file r�)�edited�addedr
TrY)r(r2r1�rzlxc.conf is up to dater1r�r�rFNr4r�r�r
r�r�z%Y-%m-%d_%H-%M-%SrErZUpdatedr2c3s�|]}�|VqdSrSrr'�r(rrr��r�z"update_lxc_conf.<locals>.<genexpr>r()r�rrErr�rFrrrr�r�r�rBrr��readr@r&rAr,r��datetime�now�strftimerrrR)rXZlxc_confZlxc_conf_unsetrr^Z
lxc_conf_pr�rZfiltered_lxc_confr��conf�linesZorig_configrI�indexr�r<r�Zmatchedr2Z
dest_lxc_conf�optZconf_changedZchronoZwficrr�r�update_lxc_conf�s��


�&���� ����=r�c
Cs~|dur	ddg}nt|t�s!z|�d�}Wnty td��w|dur(g}nt|t�s@z|�d�}Wnty?td��wdd�|D�}|�d	d�|D��d
�|�d
}td�}d|�d
�}d
�ddddddd|ddddd|ddg�}t|d|��||dd�}|ddkr�t|d�	|�|dd �}t|d!�	|�|dd �|ddkr�d"|�d#�}	|d$r�|	d%�	|d$�7}	t
|	��dS)&a�
    .. versionchanged:: 2015.5.0
        The ``dnsservers`` and ``searchdomains`` parameters can now be passed
        as a comma-separated list.

    Update /etc/resolv.confo

    path

        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.set_dns ubuntu "['8.8.8.8', '4.4.4.4']"

    Nz8.8.8.8z4.4.4.4r�z(Invalid input for 'dnsservers' parameterz+Invalid input for 'searchdomains' parametercS�g|]}d|���qS)znameserver rr'rrrr* �zset_dns.<locals>.<listcomp>cSr�)zsearch rr'rrrr*!r�r��test.random_hash�/sbin/z_dns.shz#!/usr/bin/env bashzif [ -h /etc/resolv.conf ];thenzO if [ "x$(readlink /etc/resolv.conf)" = "x../run/resolvconf/resolv.conf" ];thenz#  if [ ! -d /run/resolvconf/ ];thenz   mkdir -p /run/resolvconfz  fiz0  cat > /etc/resolvconf/resolv.conf.d/head <<EOFZEOFrYz fi�fizcat > /etc/resolv.conf <<EOF�tee T�rr�r:rr�sh -c "chmod +x {0};{0}"rH�+sh -c 'if [ -f "{0}" ];then rm -f "{0}";fi'z2Unable to write to /etc/resolv.conf in container 'r8ry�: {})r�rrAr�rr�r�r r�r�r)
rXrbrFrrG�rstrrlZ
DNS_SCRIPTr2�errorrrrrU�s|

�
�
�����rUc
Cs�d|�|��}t�|d�}|dus|s|td�}d|�d�}t�d�}t|d|��||dd	�}|d
dkrAt|d�|�|dd
�}ntd|�d���t|d�|�|ddd�|d
dkrmd�|�}	|drm|	d�|d�7}	|d
dvr||d
t|<}|S)z�
    Determine if systemD is running

    path
        path to the container parent

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.running_systemd ubuntu

    zlxc.systemd.test.Nr�r�z_testsystemd.sha)            #!/usr/bin/env bash
            set -x
            if ! command -v systemctl 1>/dev/null 2>/dev/null;then exit 2;fi
            for i in \
                /run/systemd/journal/dev-log\
                /run/systemd/journal/flushed\
                /run/systemd/journal/kernel-seqnum\
                /run/systemd/journal/socket\
                /run/systemd/journal/stdout\
                /var/run/systemd/journal/dev-log\
                /var/run/systemd/journal/flushed\
                /var/run/systemd/journal/kernel-seqnum\
                /var/run/systemd/journal/socket\
                /var/run/systemd/journal/stdout\
            ;do\
                if test -e ${i};then exit 0;fi
            done
            if test -d /var/systemd/system;then exit 0;fi
            exit 2
            r�Tr�rrr�rHzlxc z failed to copy initd testerr��rr?r:zSUnable to determine if the container '{}' was running systemd, assmuming it is not.ryr�)rr�)rrr �textwrap�dedentr�r�r)
rXr�rr!r�r�rl�_scriptr2r�rrr�running_systemd`sF
�����r�cCs4z
t|d|dd�d}W|Styd}Y|Sw)a'
    Get the operational state of a systemd based container

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.systemd_running_state ubuntu

    zsystemctl is-system-runningT�rr?rrY�r�r�rXrr�rrr�systemd_running_state�s����r�cCs(t||d�}|dvrdS|dkrdSdS)a
    Test if a systemd container is fully started

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.test_sd_started_state ubuntu

    r)ZinitializingZstartingFrYNT)r�)rXrZqstaterrr�test_sd_started_state�sr�cCs:zt|d|dd�ddk}W|Stfyd}Y|Sw)ah
    Test if a non systemd container is fully started
    For now, it consists only to test if the container is attachable

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.test_bare_started_state ubuntu

    rTr�rrNr�r�rrr�test_bare_started_state�s��r��,c	Cs�t||d�std|�d���t||d�dkstd|�d���d}t||d�r,t}tj}nt}tj}t	�	�}||}t	�	�}|||d�}t	�	�|kr^|s^t	�
d�|||d�}t	�	�|kr^|rK|durk|d	|�d
}|S|}|S)a�
    Check that the system has fully inited

    This is actually very important for systemD based containers

    see https://github.com/saltstack/salt/issues/23847

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.wait_started ubuntu

    r�
Container z does does existsr7z is not runningFg333333�?NzTAssuming %s is started, although we failed to detect that is fully started correctlyT)rFrrJr�r�r+r�r�rT�time�sleep)	rXrr�r�Ztest_started�loggerr�Zexpirer�rrr�wait_started�s6
���r�cCsLd}t|d|dd�}|r"t|d|d�}d|vrd}|St|d	�|Sd}|S)
Nrzwhich salt-minionTr�zps auxrzsalt-minionr4z*salt-call --local service.stop salt-minion)rr�)rXrr�Z
has_minionZ	processesrrr�_needs_install2
s
��rc
Cs2t||	d�|
dur'zt�d||
�t�|
�Wnty&t�d�Ynwt||	d�}
|
s1dS|r<d|vr;|d7}nd}|sBd}t||	d�}|sL|S|sUt||	d�}nd	}t|d
t	�d�|	d	d	d�d
k}t
��}|rr|srd	}|Sd}td||||||d�}|s�|s�|�r.|�r+td�}d|��}d|��}t
|||	dd�dd
kr�t�d||�dStd|d�}d|�d�}t||||	d�t
|d|�d�|	d	d�}t||dtj�|d�|	d�t||dtj�|d �|	d�t||d!tj�|d"�|	d�|�|�}d#�||�dd$�|�}t�d%||�t||d&|	d	d'�d
k}t
|d(�|�|	d	d	d)�nAd}n>tj�|d�}|d*}t||dd+|	d�t||dtj�|d �|	d�t||d!tj�|d"�|	d�t|d,|	dd�d	}t�|�|d-k�r}t||	d�n|d.k�r�t||	d�|�r�t|d/t	�d�|	dd�|S)0a
    Install and configure salt in a container.

    config
        Minion configuration options. By default, the ``master`` option is set
        to the target host's master.

    approve_key
        Request a pre-approval of the generated minion key. Requires
        that the salt-master be configured to either auto-accept all keys or
        expect a signing request from the target host. Default: ``True``

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    pub_key
        Explicit public key to pressed the minion with (optional).
        This can be either a filepath or a string representing the key

    priv_key
        Explicit private key to pressed the minion with (optional).
        This can be either a filepath or a string representing the key

    bootstrap_delay
        Delay in seconds between end of container creation and bootstrapping.
        Useful when waiting for container to obtain a DHCP lease.

        .. versionadded:: 2015.5.0

    bootstrap_url
        url, content or filepath to the salt bootstrap script

    bootstrap_args
        salt bootstrap script arguments

    bootstrap_shell
        shell to execute the script into

    install
        Whether to attempt a full installation of salt-minion if needed.

    force_install
        Force installation even if salt-minion is detected,
        this is the way to run vendor bootstrap scripts even
        if a salt minion is already present in the container

    unconditional_install
        Run the script even if the container seems seeded

    CLI Examples:

    .. code-block:: bash

        salt 'minion' lxc.bootstrap container_name [config=config_data] \
                [approve_key=(True|False)] [install=(True|False)]

    rNzLXC %s: bootstrap_delay: %s�z{0}z -c {0}z-c {0}r�Tz	test -e 'r8rDrFz
seed.mkconfig)�tmpZid_r0rirjr�z/var/tmp/.c_zinstall -m 0700 -d rHrztmpdir %s creation failed %szconfig.gather_bootstrap_script)rIr�z
_bootstrap.shzsh -c "chmod +x r=rOrLZprivkeyz
minion.pemZpubkeyz
minion.pubz{0} {2} {1}z''z Running %s in LXC container '%s'r�)r�rr�r�r��pki_dirz/etc/salt/minionz,salt-call --local service.enable salt-minionr�r�ztouch ')r�r+r�r�r�r�r�rrrQr	Zmkdtempr r�r��copy_torErr�r�r�rrO�
minion_configrP�shutil�rmtreerOr�)rXrOr0r.rirjr�rvrurr�r�r�r�r�Z
needs_installZseededrr�Z	cfg_filesr�Z	configdirr}Zbs_rlr2rrrrrrID
sK��
���
g��


�
����
�������


rIc	Cs�d|�|��}zt|WStyJt||d�t�d|�d}|r-|dt�|���7}|d|�d�7}td|d	d
dd�d
k}|t|<Yt|Sw)a9
    Return True if the named container can be attached to via the lxc-attach
    command

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt 'minion' lxc.attachable ubuntu
    zlxc.attachablerz*Checking if LXC container %s is attachabler
ruz --clear-env -n z -- /usr/bin/envrwFr�T)r:r�r?r)rr�r�r+rTr{r|r )rXrr�r}r2rrr�
attachable's&
���
�rrT�http_proxy,https_proxy,no_proxyc
CsBt||	d�}
zft||	d�r!td|||	tt||||||
||d�
}n$|s*t|�d���t||	d��d�}tdtd<td||||||
d	�}Wt||	d�}|rl|
d
kr]|d
kr]t	||	d�n:|
dkrl|dkrlt
|d|	d
�n*t||	d�}|r�|
d
kr�|d
kr�t	||	d�w|
dkr�|dkr�t
|d|	d
�wwww|dvr�|S||S)z�
    Common logic for lxc.run functions

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    rzcontainer_resource.run)r�container_type�exec_driverrHr�r�r:r�r?r��keep_envz is not attachable.r�r�zcmd.run_chroot.funczcmd.run_chroot)r�r:r�r?r�r�T)r,r)N�all)rJrr r�EXEC_DRIVERrr�rrrOr�)rXr}rHr��preserve_stater�r:r�r�rr?r9rr�r�r�Z	new_staterrr�_runNsb���
���rcC�"t|||d|||||||	|
|d�
S)a�
    .. versionadded:: 2015.8.0

    Run :mod:`cmd.run <salt.modules.cmdmod.run>` within a container

    .. warning::

        Many shell builtins do not work, failing with stderr similar to the
        following:

        .. code-block:: bash

            lxc_container: No such file or directory - failed to exec 'command'

        The same error will be displayed in stderr if the command being run
        does not exist. If no output is returned using this function, try using
        :mod:`lxc.run_stderr <salt.modules.lxc.run_stderr>` or
        :mod:`lxc.run_all <salt.modules.lxc.run_all>`.

    name
        Name of the container in which to run the command

    cmd
        Command to run

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    no_start : False
        If the container is not running, don't start it

    preserve_state : True
        After running the command, return the container to its previous state

    stdin : None
        Standard input to be used for the command

    output_loglevel : debug
        Level at which to log the output from the command. Set to ``quiet`` to
        suppress logging.

    use_vt : False
        Use SaltStack's utils.vt to stream output to console. Assumes
        ``output=all``.

    chroot_fallback
        if the container is not running, try to run the command using chroot
        default: false

    keep_env : http_proxy,https_proxy,no_proxy
        A list of env vars to preserve. May be passed as commma-delimited list.

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.run mycontainer 'ifconfig -a'
    N�rrHr�rr�r:r�r�r?r9r�r�rXr}r�rr�r:r�r�rr?r9rrrrrP��K�rPcCr)a�
    .. versionadded:: 2015.5.0

    Run :mod:`cmd.run_stdout <salt.modules.cmdmod.run_stdout>` within a container

    .. warning::

        Many shell builtins do not work, failing with stderr similar to the
        following:

        .. code-block:: bash

            lxc_container: No such file or directory - failed to exec 'command'

        The same error will be displayed in stderr if the command being run
        does not exist. If no output is returned using this function, try using
        :mod:`lxc.run_stderr <salt.modules.lxc.run_stderr>` or
        :mod:`lxc.run_all <salt.modules.lxc.run_all>`.

    name
        Name of the container in which to run the command

    cmd
        Command to run

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    no_start : False
        If the container is not running, don't start it

    preserve_state : True
        After running the command, return the container to its previous state

    stdin : None
        Standard input to be used for the command

    output_loglevel : debug
        Level at which to log the output from the command. Set to ``quiet`` to
        suppress logging.

    use_vt : False
        Use SaltStack's utils.vt to stream output to console
        ``output=all``.

    keep_env : http_proxy,https_proxy,no_proxy
        A list of env vars to preserve. May be passed as commma-delimited list.

    chroot_fallback
        if the container is not running, try to run the command using chroot
        default: false

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.run_stdout mycontainer 'ifconfig -a'
    rrrrrrrr��rr�cCr)a�
    .. versionadded:: 2015.5.0

    Run :mod:`cmd.run_stderr <salt.modules.cmdmod.run_stderr>` within a container

    .. warning::

        Many shell builtins do not work, failing with stderr similar to the
        following:

        .. code-block:: bash

            lxc_container: No such file or directory - failed to exec 'command'

        The same error will be displayed if the command being run does not
        exist.

    name
        Name of the container in which to run the command

    cmd
        Command to run

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    no_start : False
        If the container is not running, don't start it

    preserve_state : True
        After running the command, return the container to its previous state

    stdin : None
        Standard input to be used for the command

    output_loglevel : debug
        Level at which to log the output from the command. Set to ``quiet`` to
        suppress logging.

    use_vt : False
        Use SaltStack's utils.vt to stream output to console
        ``output=all``.

    keep_env : http_proxy,https_proxy,no_proxy
        A list of env vars to preserve. May be passed as commma-delimited list.

    chroot_fallback
        if the container is not running, try to run the command using chroot
        default: false

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.run_stderr mycontainer 'ip addr show'
    ryrrrrrr�
run_stderrOsI�rcCs"t||d||||||||	|
|d�
S)a�
    .. versionadded:: 2015.5.0

    Run :mod:`cmd.retcode <salt.modules.cmdmod.retcode>` within a container

    .. warning::

        Many shell builtins do not work, failing with stderr similar to the
        following:

        .. code-block:: bash

            lxc_container: No such file or directory - failed to exec 'command'

        The same error will be displayed in stderr if the command being run
        does not exist. If the retcode is nonzero and not what was expected,
        try using :mod:`lxc.run_stderr <salt.modules.lxc.run_stderr>`
        or :mod:`lxc.run_all <salt.modules.lxc.run_all>`.

    name
        Name of the container in which to run the command

    cmd
        Command to run

    no_start : False
        If the container is not running, don't start it

    preserve_state : True
        After running the command, return the container to its previous state

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    stdin : None
        Standard input to be used for the command

    output_loglevel : debug
        Level at which to log the output from the command. Set to ``quiet`` to
        suppress logging.

    use_vt : False
        Use SaltStack's utils.vt to stream output to console
        ``output=all``.

    keep_env : http_proxy,https_proxy,no_proxy
        A list of env vars to preserve. May be passed as commma-delimited list.

    chroot_fallback
        if the container is not running, try to run the command using chroot
        default: false

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.retcode mycontainer 'ip addr show'
    r)rHrr�rr�r:r�r�r?r9rrrrrrr�rrcCs"t||d||||||||	|
|d�
S)a�
    .. versionadded:: 2015.5.0

    Run :mod:`cmd.run_all <salt.modules.cmdmod.run_all>` within a container

    .. note::

        While the command is run within the container, it is initiated from the
        host. Therefore, the PID in the return dict is from the host, not from
        the container.

    .. warning::

        Many shell builtins do not work, failing with stderr similar to the
        following:

        .. code-block:: bash

            lxc_container: No such file or directory - failed to exec 'command'

        The same error will be displayed in stderr if the command being run
        does not exist.

    name
        Name of the container in which to run the command

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    cmd
        Command to run

    no_start : False
        If the container is not running, don't start it

    preserve_state : True
        After running the command, return the container to its previous state

    stdin : None
        Standard input to be used for the command

    output_loglevel : debug
        Level at which to log the output from the command. Set to ``quiet`` to
        suppress logging.

    use_vt : False
        Use SaltStack's utils.vt to stream output to console
        ``output=all``.

    keep_env : http_proxy,https_proxy,no_proxy
        A list of env vars to preserve. May be passed as commma-delimited list.

    chroot_fallback
        if the container is not running, try to run the command using chroot
        default: false

    CLI Example:

    .. code-block:: bash

        salt myminion lxc.run_all mycontainer 'ip addr show'
    r
)rHr�rr�r:r�r�rr?r9rrrrrrr�sO�r�cCs<t|d|�d�ddd�}z|��dWStyYdSw)z9
    Get the MD5 checksum of a file from a container
    zmd5sum "r=T)r9r?rN)r�rA�
IndexError)rXrrHrrr�_get_md5es��rc
Cs*t|d|d�td|||t|t||d�S)a�
    .. versionchanged:: 2015.8.0
        Function renamed from ``lxc.cp`` to ``lxc.copy_to`` for consistency
        with other container types. ``lxc.cp`` will continue to work, however.
        For versions 2015.2.x and earlier, use ``lxc.cp``.

    Copy a file or directory from the host into a container

    name
        Container name

    source
        File to be copied to the container

    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    dest
        Destination on the container. Must be an absolute path.

        .. versionchanged:: 2015.5.0
            If the destination is a directory, the file will be copied into
            that directory.

    overwrite : False
        Unless this option is set to ``True``, then if a file exists at the
        location specified by the ``dest`` argument, an error will be raised.

        .. versionadded:: 2015.8.0

    makedirs : False

        Create the parent directory on the container if it does not already
        exist.

        .. versionadded:: 2015.5.0

    CLI Example:

    .. code-block:: bash

        salt 'minion' lxc.copy_to /tmp/foo /root/foo
        salt 'minion' lxc.cp /tmp/foo /root/foo
    T)r�rzcontainer_resource.copy_to)r
rr�	overwriter�)r�r rr)rX�source�destrr�rrrrrss0�r�cp�simplec
Csg}i}tjj�|d��q}tjj�|���D]_}d|vr"|�|�q|�d�}d�	|dd���
�}d}|�
��d�rb|�
��d�}	|	d�
�}d�	|	dd���
�}|�|d�
�||d�i�q|�|d�
�|i�|||d�
�<qWd�n1s�wY|dkr�|S|S)	a
    Read in an LXC configuration file. By default returns a simple, unsorted
    dict, but can also return a more detailed structure including blank lines
    and comments.

    out_format:
        set to 'simple' if you need the old and unsupported behavior.
        This won't support the multiple lxc values (eg: multiple network nics)

    CLI Examples:

    .. code-block:: bash

        salt 'minion' lxc.read_conf /etc/lxc/mycontainer.conf
        salt 'minion' lxc.read_conf /etc/lxc/mycontainer.conf out_format=commented
    r�r�r4Nr�r)r�r1r)rrr�r�r�r�r�r�rAr�rBr&)
r�rZ
ret_commentedZ
ret_simpler�rIr�r�r1ZvcompsrrrrN�s0

���rNcCs.t|t�s	td��d}|D]d}t|ttff�r||7}q
t|t�rqt|���D]I}d}t||ttftftf�rCd�|||�f�}n#t||t�rfd�|||df�}d||vrfd�|||df�}|rp||7}|d7}q'q
t	j
j�|d	��}|�
t	j
j�|��Wd�iS1s�wYiS)
a
    Write out an LXC configuration file

    This is normally only used internally. The format of the data structure
    must match that which is returned from ``lxc.read_conf()``, with
    ``out_format`` set to ``commented``.

    An example might look like:

    .. code-block:: python

        [
            {'lxc.utsname': '$CONTAINER_NAME'},
            '# This is a commented line\n',
            '\n',
            {'lxc.mount': '$CONTAINER_FSTAB'},
            {'lxc.rootfs': {'comment': 'This is another test',
                            'value': 'This is another test'}},
            '\n',
            {'lxc.network.type': 'veth'},
            {'lxc.network.flags': 'up'},
            {'lxc.network.link': 'br0'},
            {'lxc.network.mac': '$CONTAINER_MACADDR'},
            {'lxc.network.ipv4': '$CONTAINER_IPADDR'},
            {'lxc.network.name': '$CONTAINER_DEVICENAME'},
        ]

    CLI Example:

    .. code-block:: bash

        salt 'minion' lxc.write_conf /etc/lxc/mycontainer.conf \
            out_format=commented
    z&Configuration must be passed as a listrYNr�r�r1z # r�r)r�rrr�r�r�r��floatr�rrr�r�rrr)r�r�rrIr<Zout_liner�rrr�
write_conf�s8
#

��
��rcKsg}zt||d�}Wntyg}Ynw|sg}t�|�}g}||gD],}i}	dd�|D�D]}
|
�d�r9q1|
�d�rJ||
|	|
<|�|
d�q1|	rR|�|	�q&tjj	�
�}|D]+}|�dt�}
|�
|
tjj	�
��}|D]}|�dd�}d	d
i�||�}||||<qoq[g}|r�t|fddit|d
���}|r�|�|�|D]D}t|t�s�|�|�q�t|���D]0}||}|r�|�d�r�q�d}|D]}||vr�d}|�|||i�||=q�|s�|�||i�q�q�|D]}|D]}
|�|
||
i�q�q�|r�|St||�t||�S)a�
    Edit an LXC configuration file. If a setting is already present inside the
    file, its value will be replaced. If it does not exist, it will be appended
    to the end of the file. Comments and blank lines will be kept in-tact if
    they already exist in the file.

    out_format:
        Set to simple if you need backward compatibility (multiple items for a
        simple key is not supported)
    read_only:
        return only the edited configuration without applying it
        to the underlying lxc configuration file
    lxc_config:
        List of dict containning lxc configuration items
        For network configuration, you also need to add the device it belongs
        to, otherwise it will default to eth0.
        Also, any change to a network parameter will result in the whole
        network reconfiguration to avoid mismatchs, be aware of that !

    After the file is edited, its contents will be returned. By default, it
    will be returned in ``simple`` format, meaning an unordered dict (which
    may not represent the actual file order). Passing in an ``out_format`` of
    ``commented`` will return a data structure which accurately represents the
    order and content of the file.

    CLI Example:

    .. code-block:: bash

        salt 'minion' lxc.edit_conf /etc/lxc/mycontainer.conf \
            out_format=commented lxc.network.type=veth
        salt 'minion' lxc.edit_conf /etc/lxc/mycontainer.conf \
            out_format=commented \
            lxc_config="[{'lxc.network.name': 'eth0', \
                          'lxc.network.ipv4': '1.2.3.4'},
                         {'lxc.network.name': 'eth2', \
                          'lxc.network.ipv4': '1.2.3.5',\
                          'lxc.network.gateway': '1.2.3.1'}]"
    r3cSr}rrr~rrrr*Xrzedit_conf.<locals>.<listcomp>�__r�Nr�rYr|rxr�T)rprqF)rN�	Exceptionr�r�r&r,r�rrr�r�rr�rNr�r�r�r�r�rr�r)r�rZ	read_onlyr5rPr�r�Z
net_configZlxc_kwsZ
net_params�kwargrq�paramsr�Zdev_optsrr�Znet_changesrIr<r��found�kwrrrr$s�*�


�
�����


���
�

r$c
Cs�di|�d�d�}t||d�}|rCt||d�dkrCzt||d�Wn!ttfyB}zd|��|d<d|d	<|WYd
}~Sd
}~ww|rwt||d�dkrwzt||d�Wn!ttfyv}zd|��|d<d|d	<|WYd
}~Sd
}~wwd|d|<|S)
z�
    Reboot a container.


    path
        path to the container parent
        default: /var/lib/lxc (system default)

        .. versionadded:: 2015.8.0

    CLI Examples:

    .. code-block:: bash

        salt 'minion' lxc.reboot myvm

    Tz	 rebooted)r2r(r1rr7r6r1Fr2NZrebootedr()rFrJrOrrr,)rXrr�r[rZrrr�reboot�s,����r&c
s�i}t|
�}tj�||d�}
|d|�d�d|d�}tt�����t�|��d��fdd�	}|dur5|s5t}|
dur?|d	|
�}
nd
}
|sH|d|�}tj�|
�r�t	|
dd
�}t
jj�
d|fd|fd	|
fd|fd|	fd|fd|fd|fd|fd|fg
�}|r||d<t
jj�
�}|��D]\}}|dur�|||<q�tdd|i|��}|r�t|
d|d�t	|
dd
�}||kr�|�d�|d<t||
d�dkr�t||
d�}|d|d<|S) a�
    Reconfigure a container.

    This only applies to a few property

    name
        Name of the container.
    utsname
        utsname of the container.

        .. versionadded:: 2016.3.0

    rootfs
        rootfs of the container.

        .. versionadded:: 2016.3.0

    cpu
        Select a random number of cpu cores and assign it to the cpuset, if the
        cpuset option is set then this option will be ignored
    cpuset
        Explicitly define the cpus this container will be bound to
    cpushare
        cgroups cpu shares.
    autostart
        autostart container on reboot
    memory
        cgroups memory limit, in MB.
        (0 for nolimit, None for old default 1024MB)
    gateway
        the ipv4 gateway to use
        the default does nothing more than lxcutils does
    bridge
        the bridge to use
        the default does nothing more than lxcutils does
    nic
        Network interfaces profile (defined in config or pillar).

    nic_opts
        Extra options for network interfaces, will override

        ``{"eth0": {"mac": "aa:bb:cc:dd:ee:ff", "ipv4": "10.1.1.1", "ipv6": "2001:db8::ff00:42:8329"}}``

        or

        ``{"eth0": {"mac": "aa:bb:cc:dd:ee:ff", "ipv4": "10.1.1.1/24", "ipv6": "2001:db8::ff00:42:8329"}}``

    path
        path to the container parent

        .. versionadded:: 2015.8.0

    CLI Example:

    .. code-block:: bash

        salt-call -lall mc_lxc_fork.reconfigure foobar nic_opts="{'eth1': {'mac': '00:16:3e:dd:ee:44'}}" memory=4

    rOzconfig for z up to dateT)rXr1r2r(NcrrSrrrrrrrzreconfigure.<locals>.selectrar�r�rr3r�r�rtr�r�rprqrsr�r�r4z lxc config updatedr1rr7r2rSr)rrErr�r�r�r�r�rFrNrrr�r�rDr�r$rJr&)rXr�r�r�r�rRrprqrsrtrar�r�rrPr(r^r�rr\Zmake_kwr%r<r�r_rrbrrr�reconfigure�sdL
�

���r'cCs t|�}tj�||d�}g}tjj�|d��}|D]}|�|�qWd�n1s+wYt	||d�}	|	�
d�}
i}t|
||d�D]}|�|�qD|rXt
|fddi|��g}
tjj�|d��}|D]}|
�|�qeWd�n1swwYd	}tj||
d
dd�D]}||7}q�|S)
a�
    .. versionadded:: 2015.5.0

    Apply a network profile to a container

    network_profile
        profile name or default values (dict)

    nic_opts
        values to override in defaults (dict)
        indexed by nic card names

    path
        path to the container parent

        .. versionadded:: 2015.8.0

    CLI Examples:

    .. code-block:: bash

        salt 'minion' lxc.apply_network_profile web1 centos
        salt 'minion' lxc.apply_network_profile web1 centos \
                nic_opts="{'eth0': {'mac': 'xx:xx:xx:xx:xx:xx'}}"
        salt 'minion' lxc.apply_network_profile web1 \
                "{'eth0': {'mac': 'xx:xx:xx:xx:xx:yy'}}"
                nic_opts="{'eth0': {'mac': 'xx:xx:xx:xx:xx:xx'}}"

    The special case to disable use of ethernet nics:

    .. code-block:: bash

        salt 'minion' lxc.apply_network_profile web1 centos \
                "{eth0: {disable: true}}"
    rOr�NrAr�)r�rprqrrrY�before�after)�fromfile�tofile)rrErr�rrr�r�r�r�r�r�r�r$�difflibZunified_diff)rXrprqrr^Zcfgpathr(r�rIZ	lxcconfigr�Znetwork_paramsrr)�diffrrrrz@s6$��

���
rzcCsN|td|d�vrtd|�d���tdd|����d�}dd	�|D�d
}|S)z�
    Returns a container pid.
    Throw an exception if the container isn't running.

    CLI Example:

    .. code-block:: bash

        salt '*' lxc.get_pid name
    r7)r�rr�z$ is not running, can't determine PIDr�zlxc-info -n r�cSs.g|]}t�d|�dur|�d�d���qS)z\s*PIDNr�r4)rr�rArB)r(rIrrrr*�s
�zget_pid.<locals>.<listcomp>r)rrr rA)rXrr��pidrrr�get_pid�s
���r/cCs�t||d�}	dd�dd�td�D��}|td���vrnqtd	d
�s*td��tdd
|�d��s<td|�d���td	d�sHtdd�tdd|���rZtdd|���tdd
|�d�d|���dtddj||d��k}|r�tdj||d���tddj|d��dkr�td|����tdd |�d!��dkr�td"|����dtdd#j|||d$��k}|s�td%j||d&���tdd|���|d'ur�td(||�d'Sd'S))a�
    Add a veth to a container.
    Note : this function doesn't update the container config, just add the interface at runtime

    name
        Name of the container

    interface_name
        Name of the interface in the container

    bridge
        Name of the bridge to attach the interface to (facultative)

    CLI Examples:

    .. code-block:: bash

        salt '*' lxc.add_veth container_name eth1 br1
        salt '*' lxc.add_veth container_name eth1
    rTr�rYcss"�|]}t�tjtj�VqdSrS)r�r��string�ascii_uppercase�digits)r(r9rrrr��s�
�zadd_veth.<locals>.<genexpr>�znetwork.interfaceszfile.directory_existsz	/var/run/z;Directory /var/run required for lxc.add_veth doesn't existszfile.file_existsz/proc/z/ns/netzProc file for container z! network namespace doesn't existsz/var/run/netnsz
file.mkdirzfile.is_linkz/var/run/netns/zfile.removezfile.symlinkrrwz1ip netns exec {netns} ip address list {interface})Znetns�	interfacez3Interface {interface} already exists in {container})r4r�z4ip link add name {veth} type veth peer name {veth}_c)r�z#Error while creating the veth pair zip link set dev z upz'Error while bringing up host-side veth z@ip link set dev {veth}_c netns {container} name {interface_name})r�r��interface_namez>Error while attaching the veth {veth} to container {container})r�r�Nzbridge.addif)r/r��ranger r�rr�)rXr5rsrr.Zrandom_vethZinterface_existsZattachedrrr�add_veth�sv
���
��������������r7rS)NF)NNNNNNNNTNNNNNNNNNFFNNNN)NNNN)NNN)NTN)FNN)FN)NNF)NN)TN)Nr�)NTTNNNFFNNNN)NFTNTrTFNFNr	)
FTNTrTFNFFr	)FFN)r)rFN)
NNNNNNNNNNNNN)yrr�r�r,�loggingrEr�rr{rr0r	r�r��urllib.parserZsalt.configrZsalt.utils.argsZsalt.utils.cloudZsalt.utils.dataZsalt.utils.dictupdateZsalt.utils.filesZsalt.utils.functoolsZsalt.utils.hashutilsZsalt.utils.networkZsalt.utils.odictZsalt.utils.pathZsalt.utils.stringutilsZsalt.exceptionsrrZsalt.utils.versionsr�	getLoggerrr+Z__func_alias__rr�r?rQrr�objectrrrr#r.r3rJrKrQr�r�r�r�r�r�r�r�r�r�r'r)rdrmrrrr#r�rrr�r�r�r�r,rOr�r�r�r�	functoolsZalias_functionr�rFrJr�r�r�rSr�r�rUr�r�r�r�r�rrIrrrPr�rrr�rrrrNrr$r&r'rzr/r7rrrr�<module>s�	

	1
5

)<
Q
&'"UA
�
A
4"
�
I
m
)V
�
D

+
8,
/
%


-


F

`
d
R



3
�
d*
�L
�_
�_
�]
�_
�`
=
+A
�
p(
�

B