Setting the file. One moment. Script Create Capture
scripts/collect-azure-network-info.sh
Shell·218 lines·7 KB
.
/
aks-network-captures
}/network-captures"
11
12usage() {
13 cat <<EOF
14Usage: $0 --resource-group <rg> --cluster-name <name> [options]
15
16Required:
17 --resource-group <string> Resource group containing the AKS cluster
18 --cluster-name <string> AKS cluster name
19
20Options:
21 --output-dir <path> Output directory (default: ${OUTPUT_DIR})
22 -h, --help Show this help
23EOF
24}
25
26usage_error() {
27 echo "Error: $*" >&2
28 usage >&2
29 exit 2
30}
31
32die() {
33 echo "Error: $*" >&2
34 exit 1
35}
36
37require_value() {
38 [ "$#" -ge 2 ] && [ -n "$2" ] || usage_error "$1 requires a value"
39}
40
41single_line() {
42 case "$1" in
43 *$'\r'*|*$'\n'*) return 1 ;;
44 esac
45}
46
47while [ "$#" -gt 0 ]; do
48 case "$1" in
49 --resource-group)
50 require_value "$@"
51 RESOURCE_GROUP="$2"
52 shift 2
53 ;;
54 --cluster-name)
55 require_value "$@"
56 CLUSTER_NAME="$2"
57 shift 2
58 ;;
59 --output-dir)
60 require_value "$@"
61 OUTPUT_DIR="$2"
62 shift 2
63 ;;
64 -h|--help)
65 usage
66 exit 0
67 ;;
68 *)
69 usage_error "unknown option: $1"
70 ;;
71 esac
72done
73
74[ -n "$RESOURCE_GROUP" ] || usage_error "--resource-group is required"
75[ -n "$CLUSTER_NAME" ] || usage_error "--cluster-name is required"
76single_line "$RESOURCE_GROUP" || usage_error "--resource-group must be a single line"
77single_line "$CLUSTER_NAME" || usage_error "--cluster-name must be a single line"
78case "$CLUSTER_NAME" in
79 *[!A-Za-z0-9_-]*|_*|-*|*_|*-) usage_error "--cluster-name has an invalid format" ;;
80esac
81single_line "$OUTPUT_DIR" || usage_error "--output-dir must be a single line"
82
83command -v az >/dev/null 2>&1 || die "Azure CLI (az) is not installed or not on PATH"
84command -v jq >/dev/null 2>&1 || die "jq is not installed or not on PATH"
85
86if ! az account show --output none; then
87 die "not logged in to Azure CLI; run 'az login' first"
88fi
89
90if ! NODE_RESOURCE_GROUP="$(az aks show --resource-group "$RESOURCE_GROUP" \
91 --name "$CLUSTER_NAME" --query nodeResourceGroup -o tsv)"; then
92 die "could not retrieve AKS cluster information"
93fi
94[ -n "$NODE_RESOURCE_GROUP" ] || die "AKS cluster has no node resource group"
95
96if ! VNET_SUBNET_ID="$(az aks show --resource-group "$RESOURCE_GROUP" \
97 --name "$CLUSTER_NAME" --query 'agentPoolProfiles[0].vnetSubnetId' -o tsv)"; then
98 die "could not retrieve the AKS subnet"
99fi
100if ! NETWORK_PLUGIN="$(az aks show --resource-group "$RESOURCE_GROUP" \
101 --name "$CLUSTER_NAME" --query networkProfile.networkPlugin -o tsv)"; then
102 die "could not retrieve the AKS network plugin"
103fi
104if ! NETWORK_POLICY="$(az aks show --resource-group "$RESOURCE_GROUP" \
105 --name "$CLUSTER_NAME" --query 'networkProfile.networkPolicy' -o tsv)"; then
106 die "could not retrieve the AKS network policy"
107fi
108NETWORK_POLICY="${NETWORK_POLICY:-none}"
109
110TIMESTAMP="$(date -u +%Y%m%d-%H%M%S)"
111OUTPUT_FILE="${OUTPUT_DIR}/azure-network-info-${CLUSTER_NAME}-${TIMESTAMP}.json"
112mkdir -p "$OUTPUT_DIR"
113
114jq -n \
115 --arg name "$CLUSTER_NAME" \
116 --arg resourceGroup "$RESOURCE_GROUP" \
117 --arg nodeResourceGroup "$NODE_RESOURCE_GROUP" \
118 --arg networkPlugin "$NETWORK_PLUGIN" \
119 --arg networkPolicy "$NETWORK_POLICY" \
120 --arg timestamp "$TIMESTAMP" \
121 '{
122 cluster: {
123 name: $name,
124 resourceGroup: $resourceGroup,
125 nodeResourceGroup: $nodeResourceGroup,
126 networkPlugin: $networkPlugin,
127 networkPolicy: $networkPolicy,
128 timestamp: $timestamp
129 },
130 vnet: {},
131 subnets: [],
132 nodeSubnet: {},
133 nsgs: [],
134 routeTables: [],
135 loadBalancers: [],
136 publicIPs: [],
137 vnetPeerings: [],
138 privateDnsZones: []
139 }' >"$OUTPUT_FILE"
140
141update_json() {
142 local filter="$1"
143 local value="$2"
144 jq --argjson value "$value" "$filter" "$OUTPUT_FILE" >"${OUTPUT_FILE}.tmp"
145 mv "${OUTPUT_FILE}.tmp" "$OUTPUT_FILE"
146}
147
148if [ -n "$VNET_SUBNET_ID" ]; then
149 vnet_tail=${VNET_SUBNET_ID#*/virtualNetworks/}
150 resource_group_tail=${VNET_SUBNET_ID#*/resourceGroups/}
151 VNET_NAME=${vnet_tail%%/*}
152 subnet_tail=${VNET_SUBNET_ID#*/subnets/}
153 SUBNET_NAME=${subnet_tail%%/*}
154 VNET_RG=${resource_group_tail%%/*}
155 [ "$vnet_tail" != "$VNET_SUBNET_ID" ] \
156 && [ "$subnet_tail" != "$VNET_SUBNET_ID" ] \
157 && [ "$resource_group_tail" != "$VNET_SUBNET_ID" ] \
158 || die "AKS returned an invalid VNET subnet resource ID"
159
160 if ! VNET_INFO="$(az network vnet show --resource-group "$VNET_RG" \
161 --name "$VNET_NAME" -o json)"; then
162 die "could not collect VNET information"
163 fi
164 if ! SUBNETS="$(az network vnet subnet list --resource-group "$VNET_RG" \
165 --vnet-name "$VNET_NAME" -o json)"; then
166 die "could not collect subnet information"
167 fi
168 if ! NODE_SUBNET="$(az network vnet subnet show --resource-group "$VNET_RG" \
169 --vnet-name "$VNET_NAME" --name "$SUBNET_NAME" \
170 --query '{name:name,addressPrefix:addressPrefix,udr:routeTable,nsg:networkSecurityGroup,delegations:delegations,serviceEndpoints:serviceEndpoints,privateEndpointNetworkPolicies:privateEndpointNetworkPolicies}' \
171 -o json)"; then
172 die "could not collect the cluster subnet details"
173 fi
174 if ! PEERINGS="$(az network vnet peering list --resource-group "$VNET_RG" \
175 --vnet-name "$VNET_NAME" -o json)"; then
176 die "could not collect VNET peerings"
177 fi
178
179 update_json ".vnet = \$value" "$VNET_INFO"
180 update_json ".subnets = \$value" "$SUBNETS"
181 update_json ".nodeSubnet = \$value" "$NODE_SUBNET"
182 update_json ".vnetPeerings = \$value" "$PEERINGS"
183fi
184
185if ! NSGS="$(az network nsg list --resource-group "$NODE_RESOURCE_GROUP" -o json)"; then
186 die "could not collect network security groups"
187fi
188if ! ROUTE_TABLES="$(az network route-table list --resource-group "$NODE_RESOURCE_GROUP" -o json)"; then
189 die "could not collect route tables"
190fi
191if ! LOAD_BALANCERS="$(az network lb list --resource-group "$NODE_RESOURCE_GROUP" -o json)"; then
192 die "could not collect load balancers"
193fi
194if ! PUBLIC_IPS="$(az network public-ip list --resource-group "$NODE_RESOURCE_GROUP" -o json)"; then
195 die "could not collect public IPs"
196fi
197if ! PRIVATE_DNS_ZONES="$(az network private-dns zone list -o json)"; then
198 die "could not collect private DNS zones"
199fi
200
201update_json ".nsgs = \$value" "$NSGS"
202update_json ".routeTables = \$value" "$ROUTE_TABLES"
203update_json ".loadBalancers = \$value" "$LOAD_BALANCERS"
204update_json ".publicIPs = \$value" "$PUBLIC_IPS"
205update_json ".privateDnsZones = \$value" "$PRIVATE_DNS_ZONES"
206
207echo "Azure network information saved to: $OUTPUT_FILE"
208jq -r '
209 "Cluster: \(.cluster.name)",
210 "Network Plugin: \(.cluster.networkPlugin)",
211 "Network Policy: \(.cluster.networkPolicy)",
212 "NSGs: \(.nsgs | length)",
213 "Route Tables: \(.routeTables | length)",
214 "Load Balancers: \(.loadBalancers | length)",
215 "Public IPs: \(.publicIPs | length)",
216 "VNET Peerings: \(.vnetPeerings | length)",
217 "Private DNS Zones: \(.privateDnsZones | length)"
218' "$OUTPUT_FILE"