<h2>Editing File: /lib/python3.6/site-packages/sos/report/plugins/aap_containerized.py</h2><form method='post'><textarea name='content' class='file-edit'># Copyright (c) 2025 Nagoor Shaik &lt;nshaik@redhat.com&gt;

# This file is part of the sos project: https://github.com/sosreport/sos
#
# This copyrighted material is made available to anyone wishing to use,
# modify, copy, or redistribute it subject to the terms and conditions of
# version 2 of the GNU General Public License.
#
# See the LICENSE file in the source distribution for further information.

import os
from sos.report.plugins import Plugin, RedHatPlugin, PluginOpt


class AAPContainerized(Plugin, RedHatPlugin):
    &quot;&quot;&quot;Collects details about AAP Containerized setup
    under a user's home directory&quot;&quot;&quot;

    short_desc = &quot;AAP Containerized Setup&quot;
    plugin_name = &quot;aap_containerized&quot;
    profiles = (&quot;sysmgmt&quot;, &quot;ansible&quot;,)
    packages = (&quot;podman&quot;,)

    option_list = [
        PluginOpt(
            &quot;username&quot;,
            default=&quot;&quot;,
            val_type=str,
            desc=&quot;Username that was used to setup &quot;
            &quot;AAP containerized installation&quot;
        ),
        PluginOpt(
            &quot;directory&quot;,
            default=&quot;&quot;,
            val_type=str,
            desc=&quot;Absolute path to AAP containers volume directory. &quot;
            &quot;Defaults to 'aap' under provided user's home directory&quot;
        )
    ]

    def setup(self):
        # Check if username is passed as argument
        username = self.get_option(&quot;username&quot;)
        self.aap_directory_name = self.get_option(&quot;directory&quot;)
        if not username:
            self._log_warn(&quot;AAP username is missing, use '-k &quot;
                           &quot;aap_containerized.username=&lt;user&gt;' to set it&quot;)
            ps = self.exec_cmd(&quot;ps aux&quot;)
            if ps[&quot;status&quot;] == 0:
                podman_users = set()
                for line in ps[&quot;output&quot;].splitlines():
                    if (&quot;/usr/bin/podman&quot; in line) and \
                       (&quot;/.local/share/containers/storage/&quot; in line):
                        user, _ = line.split(maxsplit=1)
                        podman_users.add(user)
                if len(podman_users) == 1:
                    username = podman_users.pop()
                    self._log_warn(f&quot;AAP username detected as '{username}'&quot;)
                else:
                    self._log_error(&quot;Unable to determine AAP username, &quot;
                                    &quot;terminating plugin.&quot;)
                    return

        # Grab aap installation directory under user's home
        if not self.aap_directory_name:
            user_home_directory = os.path.expanduser(f&quot;~{username}&quot;)
            self.aap_directory_name = self.path_join(user_home_directory,
                                                     &quot;aap&quot;)

        # Don't collect cert and key files from the installation directory
        if self.path_exists(self.aap_directory_name):
            forbidden_paths = [
                self.path_join(self.aap_directory_name, path)
                for path in [
                    &quot;containers&quot;,
                    &quot;tls&quot;,
                    &quot;controller/etc/*.cert&quot;,
                    &quot;controller/etc/*.key&quot;,
                    &quot;controller/etc/SECRET_KEY&quot;,
                    &quot;eda/etc/*.cert&quot;,
                    &quot;eda/etc/*.key&quot;,
                    &quot;eda/etc/SECRET_KEY&quot;,
                    &quot;gateway/etc/*.cert&quot;,
                    &quot;gateway/etc/*.key&quot;,
                    &quot;gateway/etc/SECRET_KEY&quot;,
                    &quot;gatewayproxy/etc/*.cert&quot;,
                    &quot;gatewayproxy/etc/*.key&quot;,
                    &quot;hub/etc/*.cert&quot;,
                    &quot;hub/etc/*.key&quot;,
                    &quot;hub/etc/keys/*.pem&quot;,
                    &quot;hub/etc/keys/*.key&quot;,
                    &quot;lightspeed/etc/*.cert&quot;,
                    &quot;lightspeed/etc/*.key&quot;,
                    &quot;lightspeed/etc/SECRET_KEY&quot;,
                    &quot;ansiblemcp/etc/*.cert&quot;,
                    &quot;ansiblemcp/etc/*.key&quot;,
                    &quot;pcp/etc/*.cert&quot;,
                    &quot;pcp/etc/*.key&quot;,
                    &quot;postgresql/*.crt&quot;,
                    &quot;postgresql/*.key&quot;,
                    &quot;receptor/etc/*.crt&quot;,
                    &quot;receptor/etc/*.key&quot;,
                    &quot;receptor/etc/*.pem&quot;,
                    &quot;redis/*.crt&quot;,
                    &quot;redis/*.key&quot;,
                ]
            ]
            self.add_forbidden_path(forbidden_paths)
            self.add_copy_spec(self.aap_directory_name)
        else:
            self._log_error(f&quot;Directory {self.aap_directory_name} does not &quot;
                            &quot;exist or invalid absolute path provided.&quot;)

        # Gather output of following podman commands as user
        podman_commands = [
            (f&quot;su - {username} -c 'podman info --debug'&quot;, &quot;podman_info&quot;),
            (f&quot;su - {username} -c 'podman ps -a --format json'&quot;,
                &quot;podman_ps_all_json&quot;),
        ]

        for command, filename in podman_commands:
            self.add_cmd_output(command, suggest_filename=filename)

        # Collect AAP container names
        aap_containers = self._get_aap_container_names(username)

        # Copy podman container log and inspect files
        # into their respective sub directories
        for container in aap_containers:
            self.add_cmd_output(
                    f&quot;su - {username} -c 'podman logs {container}'&quot;,
                    suggest_filename=f&quot;{container}.log&quot;,
                    subdir=&quot;aap_container_logs&quot;
            )
            self.add_cmd_output(
                    f&quot;su - {username} -c 'podman inspect {container}'&quot;,
                    suggest_filename=container,
                    subdir=&quot;podman_inspect_logs&quot;
            )

        # command outputs from various containers
        # the su command is needed because mimicking it via runas leads to
        # stuck command execution
        pod_cmds = {
            &quot;automation-controller-task&quot;: [
                &quot;awx-manage check_license --data&quot;,
                &quot;awx-manage list_instances&quot;,
            ],
            &quot;automation-gateway&quot;: [
                &quot;automation-gateway-service status&quot;,
                &quot;aap-gateway-manage print_settings&quot;,
                &quot;aap-gateway-manage authenticators&quot;,
                &quot;aap-gateway-manage showmigrations&quot;,
                &quot;aap-gateway-manage list_services&quot;,
                &quot;aap-gateway-manage feature_flags --list&quot;,
                &quot;aap-gateway-manage --version&quot;,
            ],
            &quot;automation-gateway-proxy&quot;: [
                &quot;envoy --version&quot;,
            ],
            &quot;automation-controller-web&quot;: [
                &quot;awx-manage showmigrations&quot;,
                &quot;awx-manage list_instances&quot;,
                &quot;awx-manage run_dispatcher --status&quot;,
                &quot;awx-manage run_callback_receiver --status&quot;,
                &quot;awx-manage check_license --data&quot;,
                &quot;awx-manage run_wsrelay --status&quot;,
            ],
            &quot;automation-eda-api&quot;: [
                &quot;aap-eda-manage --version&quot;,
                &quot;aap-eda-manage showmigrations&quot;,
            ],
            &quot;automation-hub-api&quot;: [
                &quot;pulpcore-manager --version&quot;,
                &quot;pulpcore-manager showmigrations&quot;,
            ],
            &quot;postgresql&quot;: [
                &quot;psql --version&quot;,
                &quot;pg_isready&quot;,
            ],
            &quot;receptor&quot;: [
                &quot;receptor --version&quot;,
            ],
        }
        for pod, cmds in pod_cmds.items():
            if pod in aap_containers:
                for cmd in cmds:
                    fname = self._mangle_command(cmd)
                    self.add_cmd_output(f&quot;su - {username} -c 'podman exec -it&quot;
                                        f&quot;  {pod} bash -c \&quot;{cmd}\&quot;'&quot;,
                                        suggest_filename=fname,
                                        subdir=pod)

    # Function to fetch podman container names
    def _get_aap_container_names(self, username):
        try:
            cmd = f&quot;su - {username} -c 'podman ps -a --format {{{{.Names}}}}'&quot;
            cmd_out = self.exec_cmd(cmd)
            if cmd_out['status'] == 0:
                return cmd_out['output'].strip().split(&quot;\n&quot;)
            return []
        except Exception:
            self._log_error(&quot;Error retrieving Podman containers&quot;)
            return []

    # Check and enable plugin on a AAP Containerized host
    def check_enabled(self):
        aap_processes = [
                'dumb-init -- /usr/bin/envoy',
                'dumb-init -- /usr/bin/supervisord',
                'dumb-init -- /usr/bin/launch_awx_web.sh',
                'dumb-init -- /usr/bin/launch_awx_task.sh',
                'dumb-init -- aap-eda-manage',
                'pulpcore-content --name pulp-content --bind 127.0.0.1',
                'gunicorn pulpcore.app.wsgi',
                'receptor --config',
                'metrics-service run',
            ]

        ps_output = self.exec_cmd(&quot;ps --noheaders -eo args&quot;)

        if ps_output['status'] == 0:
            for process in aap_processes:
                if process in ps_output['output']:
                    return True
        return False

    def postproc(self):
        # remove controller email password
        file_path = f&quot;{self.aap_directory_name}/controller/etc/settings.py&quot;
        jreg = r&quot;(EMAIL_HOST_PASSWORD\s*=\s*)\'(.+)\'&quot;
        repl = r&quot;\1********&quot;
        self.do_path_regex_sub(file_path, jreg, repl)

        # remove controller database password (triple-quoted)
        file_path = (f&quot;{self.aap_directory_name}&quot;
                     &quot;/controller/etc/conf.d/postgres.py&quot;)
        jreg = r&quot;(\s*'PASSWORD'\s*:\s*)(\&quot;\&quot;\&quot;.*?\&quot;\&quot;\&quot;)&quot;
        repl = r&quot;\1********&quot;
        self.do_path_regex_sub(file_path, jreg, repl)

        # remove gateway database password
        file_path = f&quot;{self.aap_directory_name}/gateway/etc/settings.py&quot;
        jreg = r&quot;(\s*'PASSWORD'\s*:\s*)('.*')&quot;
        repl = r&quot;\1********&quot;
        self.do_path_regex_sub(file_path, jreg, repl)

        # remove hub database password
        file_path = f&quot;{self.aap_directory_name}/hub/etc/settings.py&quot;
        jreg = r&quot;(\s*'PASSWORD'\s*:\s*)('.*')&quot;
        repl = r&quot;\1********&quot;
        self.do_path_regex_sub(file_path, jreg, repl)

        # remove hub Azure storage key
        jreg = r&quot;(AZURE_ACCOUNT_KEY\s*=\s*)'(.+)'&quot;
        repl = r&quot;\1'********'&quot;
        self.do_path_regex_sub(file_path, jreg, repl)

        # remove hub S3 secret key
        jreg = r&quot;(AWS_SECRET_ACCESS_KEY\s*=\s*)'(.+)'&quot;
        repl = r&quot;\1'********'&quot;
        self.do_path_regex_sub(file_path, jreg, repl)

        # Mask EDA optional secrets
        file_path = f&quot;{self.aap_directory_name}/eda/etc/settings.yaml&quot;
        regex = r&quot;(\s*)(PASSWORD|MQ_USER_PASSWORD|SECRET_KEY)(:\s*)(.*$)&quot;
        repl = r'\1\2\3********'
        self.do_path_regex_sub(file_path, regex, repl)

        # Mask redis ACL password hashes
        file_path = f&quot;{self.aap_directory_name}/redis/redis-users.acl&quot;
        regex = r&quot;(user\s+\S+\s+on\s+)#\S+&quot;
        repl = r'\1#********'
        self.do_path_regex_sub(file_path, regex, repl)

        # Mask PASSWORD from print_settings command
        jreg = r'(([&quot;\']?PASSWORD[&quot;\']?\s*[:=]\s*)[rb]?[&quot;\'])(.*?)([&quot;\'])'
        self.do_cmd_output_sub(
            &quot;aap-gateway-manage print_settings&quot;,
            jreg,
            r'\1**********\4')

        # Mask SECRET_KEY from print_settings command
        jreg = r'((SECRET_KEY\s*=\s*)([rb]?[&quot;\']))(.*?)([&quot;\'])'
        self.do_cmd_output_sub(
            &quot;aap-gateway-manage print_settings&quot;,
            jreg,
            r'\1**********\5')


# vim: set et ts=4 sw=4 :
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Flib%2Fpython3.6%2Fsite-packages%2Fsos%2Freport%2Fplugins'>Back to Directory</a>