fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/bootstrap_executor.py

@@ -0,0 +1,311 @@
+"""Customer-local adapter over the existing AKS source and signed-image coordinator."""
+
+from __future__ import annotations
+
+import importlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlsplit
+from uuid import UUID
+
+from fdai_deployment_cli.bootstrap_approval import approval_source
+from fdai_deployment_cli.bootstrap_channel import _read, _write, prepare_directory
+
+
+class BootstrapBlocked(ValueError):
+    """A safe, actionable prerequisite failure, with no raw process output."""
+
+
+class BootstrapExecutor:
+    """One bounded first-install precursor, not a lifecycle reconciliation loop."""
+
+    def __init__(
+        self,
+        area: Path,
+        decide: Callable[[dict[str, object]], dict[str, object]],
+        *,
+        run: Callable[..., Any] = subprocess.run,
+        planner: Callable[..., Any] | None = None,
+        hub_source: Callable[..., Any] | None = None,
+    ):
+        self.area, self.decide, self.run = area, decide, run
+        self.planner, self.hub_source = planner, hub_source
+        prepare_directory(area)
+        self.azure = area / "azure"
+        prepare_directory(self.azure)
+        self.environment = {
+            key: value
+            for key, value in os.environ.items()
+            if key
+            in {
+                "HOME",
+                "PATH",
+                "LANG",
+                "SSL_CERT_FILE",
+                "REQUESTS_CA_BUNDLE",
+                "DISPLAY",
+                "WAYLAND_DISPLAY",
+                "XDG_RUNTIME_DIR",
+                "DBUS_SESSION_BUS_ADDRESS",
+            }
+        }
+        self.environment.update(
+            AZURE_CONFIG_DIR=str(self.azure),
+            AZURE_CORE_COLLECT_TELEMETRY="false",
+            AZURE_CORE_ONLY_SHOW_ERRORS="true",
+            AZURE_CORE_LOGIN_EXPERIENCE_V2="off",
+        )
+
+    def _az(self, *args: str, timeout: int = 60) -> object:
+        if self.run is subprocess.run and shutil.which("az") is None:
+            raise BootstrapBlocked(
+                "Install Azure CLI on this customer machine, then retry sign-in."
+            )
+        result = self.run(
+            ["az", *args, "--output", "json", "--only-show-errors"],
+            env=self.environment,
+            stdin=subprocess.DEVNULL,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            check=False,
+        )
+        if result.returncode:
+            raise BootstrapBlocked(
+                "Azure CLI operation failed. Sign in locally and inspect private diagnostics."
+            )
+        if args[0] == "login":
+            # Login output can contain identity and authorization data; never retain it.
+            return None
+        try:
+            return json.loads(result.stdout or "null")
+        except ValueError as exc:
+            raise BootstrapBlocked(
+                "Azure CLI returned an invalid response; no deployment was started."
+            ) from exc
+
+    def accounts(self) -> list[dict[str, str]]:
+        result = self._az(
+            "account",
+            "list",
+            "--query",
+            "[?state=='Enabled'].{id:id,name:name,tenantId:tenantId,state:state}",
+        )
+        if not isinstance(result, list) or len(result) > 100:
+            raise BootstrapBlocked("Azure subscription listing is invalid or exceeds 100 entries.")
+        accounts = []
+        for item in result:
+            if not isinstance(item, dict) or item.get("state") != "Enabled":
+                continue
+            try:
+                account_id, tenant = str(UUID(item["id"])), str(UUID(item["tenantId"]))
+            except (ValueError, KeyError, TypeError, AttributeError) as exc:
+                raise BootstrapBlocked(
+                    "Azure subscription listing contains invalid identifiers."
+                ) from exc
+            name = item.get("name")
+            if not isinstance(name, str) or len(name) > 256 or any(ord(char) < 32 for char in name):
+                raise BootstrapBlocked(
+                    "Azure subscription listing contains an invalid display name."
+                )
+            accounts.append({"id": account_id, "name": name, "tenant_id": tenant})
+        return accounts
+
+    def _target(self, subscription: str, tenant: str | None = None) -> dict[str, str]:
+        value = self._az(
+            "account",
+            "show",
+            "--query",
+            "{id:id,tenantId:tenantId,user:{type:user.type}}",
+        )
+        if (
+            not isinstance(value, dict)
+            or value.get("id", "").lower() != subscription.lower()
+            or not isinstance(value.get("user"), dict)
+            or value["user"].get("type") != "user"
+            or (tenant is not None and value.get("tenantId") != tenant)
+        ):
+            raise BootstrapBlocked(
+                "Azure human identity or selected subscription changed. No approval was granted."
+            )
+        try:
+            tenant_id = str(UUID(value["tenantId"]))
+        except (ValueError, KeyError, TypeError, AttributeError) as exc:
+            raise BootstrapBlocked("Azure tenant identity is unavailable.") from exc
+        return {"subscription_id": subscription, "tenant_id": tenant_id}
+
+    def execute(self, action: str, payload: dict[str, object]) -> dict[str, object]:
+        if action == "login":
+            self._az("login", timeout=600)
+            return {
+                "accounts": self.accounts(),
+                "message": "Signed in. Select the intended subscription.",
+            }
+        if action == "accounts":
+            return {
+                "accounts": self.accounts(),
+                "message": "Available Azure subscriptions refreshed.",
+            }
+        if action == "inspect":
+            retained = _read(self.area, "configuration.json")
+            receipt = _read(self.area, "acceptance.json")
+            if retained:
+                self._target(str(retained["subscription_id"]), str(retained["tenant_id"]))
+            # A saved success is historical, not an independent current health observation.
+            return {
+                "message": "Retained installation exists. Explicitly resume to refresh plans and health."
+                if retained
+                else "No first-install configuration has been retained.",
+                "retained_acceptance": receipt.get("deployment_ready") is True,
+            }
+        return self._install(payload, resume=action == "resume")
+
+    def _install(self, payload: dict[str, object], *, resume: bool) -> dict[str, object]:
+        retained = _read(self.area, "configuration.json")
+        if resume:
+            if not retained:
+                raise BootstrapBlocked("No retained installation exists to resume.")
+            config = retained
+            self._target(str(config["subscription_id"]), str(config["tenant_id"]))
+        else:
+            if retained:
+                raise BootstrapBlocked(
+                    "An installation is retained. Use resume without replacing its inputs."
+                )
+            config = dict(payload)
+            subscription = str(config["subscription_id"])
+            accounts = self.accounts()
+            if not any(item["id"] == subscription.lower() for item in accounts):
+                raise BootstrapBlocked(
+                    "Selected subscription is not available to the signed-in user."
+                )
+            self._az("account", "set", "--subscription", subscription)
+            config.update(self._target(subscription))
+            _write(self.area, config, "configuration.json")
+        if (self.area / "native-ownership.json").exists():
+            raise BootstrapBlocked(
+                "Native lifecycle ownership was accepted; Bootstrap cannot mutate this installation."
+            )
+        mode = config["artifact_source"]
+        selection = None
+        if mode == "hub":
+            from fdai_deployment_cli.bootstrap_support import resolve_hub_source
+
+            try:
+                source, selection = (self.hub_source or resolve_hub_source)(
+                    self.area,
+                    str(config["hub_public_key"]),
+                    config.get("source_root"),
+                )
+            except (ValueError, OSError) as exc:
+                raise BootstrapBlocked(
+                    "Signed Hub selection or pinned support source is unavailable. "
+                    "Verify independent Release trust and support compatibility; no source-build fallback."
+                ) from exc
+        else:
+            source = Path(str(config["source_root"])).absolute()
+        from fdai_deployment_cli.source_input import inspect_source
+
+        try:
+            snapshot = inspect_source(source, expected_commit=config.get("source_commit"))
+        except (ValueError, OSError) as exc:
+            raise BootstrapBlocked(
+                "Provide the same clean committed FDAI checkout at the retained source root. "
+                "Source revision changes cannot resume this installation."
+            ) from exc
+        scripts = source / "scripts/deployment/azure"
+        sys.path.insert(0, str(scripts))
+        try:
+            prompt = importlib.import_module("genesis_approval_prompt")
+            if (
+                getattr(prompt, "BOOTSTRAP_APPROVAL_PROTOCOL", None) != 1
+                or Path(str(prompt.__file__)).resolve().parent != scripts.resolve()
+            ):
+                raise BootstrapBlocked(
+                    "Selected support source lacks the Bootstrap approval adapter. "
+                    "Use compatible pinned support source; no terminal approval fallback is allowed."
+                )
+        finally:
+            sys.path.remove(str(scripts))
+        config.update(source_root=str(source), source_commit=snapshot.commit)
+        _write(self.area, config, "configuration.json")
+        from fdai_deployment_cli.runtime_profile import RuntimeDeploymentProfile
+        from fdai_deployment_cli.source_azure import plan_source_installation
+
+        profile = RuntimeDeploymentProfile.create(
+            runtime_platform="aks",
+            database_placement="postgres-flex",
+            product_add_ons=("read-only-console", "enterprise-identity-governance"),
+        )
+
+        def exact_decision(review: dict[str, object]) -> dict[str, object]:
+            self._target(str(config["subscription_id"]), str(config["tenant_id"]))
+            if (self.area / "native-ownership.json").exists():
+                raise BootstrapBlocked("Native lifecycle ownership superseded Bootstrap.")
+            result = self.decide(review)
+            self._target(str(config["subscription_id"]), str(config["tenant_id"]))
+            return result
+
+        original_environment = dict(os.environ)
+        try:
+            os.environ.clear()
+            os.environ.update(self.environment)
+            with approval_source(exact_decision):
+                result = (self.planner or plan_source_installation)(
+                    source_root=source,
+                    work_dir=self.area / "deployment",
+                    runtime_profile=profile,
+                    region=str(config["region"]),
+                    monthly_cost_ceiling=int(config["monthly_cost_ceiling"]),
+                    timeout_seconds=14400,
+                    hub_selection=selection,
+                )
+        finally:
+            os.environ.clear()
+            os.environ.update(original_environment)
+        self._target(str(config["subscription_id"]), str(config["tenant_id"]))
+        ready = result.get("deployment_ready") is True
+        console = result.get("console_url") if ready else None
+        if ready and console is None and result.get("browser_access_verified") is True:
+            from fdai_deployment_cli.contracts import canonical_digest
+
+            publication = _read(
+                self.area / "deployment/foundation", "console-publication-receipt.json"
+            )
+            digest = publication.pop("receipt_digest", None)
+            if (
+                digest != result.get("console_publication_receipt_digest")
+                or canonical_digest(publication) != digest
+            ):
+                raise BootstrapBlocked(
+                    "Console publication receipt differs from independent acceptance."
+                )
+            console = publication.get("console_origin")
+        if isinstance(console, str):
+            parsed = urlsplit(console)
+            if (
+                parsed.scheme != "https"
+                or not parsed.hostname
+                or parsed.username
+                or parsed.password
+                or parsed.query
+                or parsed.fragment
+            ):
+                console = None
+        else:
+            console = None
+        safe: dict[str, object] = {
+            "deployment_ready": ready,
+            "console_url": console,
+            "message": "Independent health and zero-change acceptance completed."
+            if ready
+            else "Installation is not accepted. Inspect retained private evidence before resuming.",
+        }
+        _write(self.area, safe, "acceptance.json")
+        return safe

fdai_deployment_cli/bootstrap_plan.py

@@ -0,0 +1,237 @@
+"""Sealed intent and sanitized observations for Azure bootstrap reconciliation."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from enum import StrEnum
+
+from fdai_deployment_cli.contracts import ProvisionProfile, canonical_digest
+
+FOUNDATION_PROVIDER_NAMESPACES = (
+    "Microsoft.Authorization",
+    "Microsoft.Compute",
+    "Microsoft.DevTestLab",
+    "Microsoft.EventGrid",
+    "Microsoft.ManagedIdentity",
+    "Microsoft.Network",
+    "Microsoft.Resources",
+    "Microsoft.Storage",
+)
+
+_RESOURCE_GROUP_NAME = re.compile(r"^[A-Za-z0-9._()\-]{1,90}$")
+_STORAGE_ACCOUNT_NAME = re.compile(r"^[a-z0-9]{3,24}$")
+_SHA = re.compile(r"^[0-9a-f]{40}$")
+
+
+class Classification(StrEnum):
+    """Disposition of one read-only bootstrap observation."""
+
+    COMPATIBLE = "compatible"
+    MISSING = "missing"
+    CONFLICT = "conflict"
+    INDETERMINATE = "indeterminate"
+
+
+@dataclass(frozen=True, slots=True)
+class BootstrapObservation:
+    """Sanitized classification that contains no Azure resource identifiers."""
+
+    entry_id: str
+    classification: Classification
+    reason_code: str
+
+    def to_mapping(self) -> dict[str, str]:
+        """Return canonical observation data."""
+
+        return {
+            "entry_id": self.entry_id,
+            "classification": self.classification.value,
+            "reason_code": self.reason_code,
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class BootstrapReconcileResult:
+    """Sealed bootstrap intent plus separate time-bound observations."""
+
+    intent: Mapping[str, object]
+    observations: tuple[BootstrapObservation, ...]
+    created_at: str
+    expires_at: str
+
+    @property
+    def plan_digest(self) -> str:
+        """Return the replay-stable digest of bootstrap intent only."""
+
+        return canonical_digest(self.intent)
+
+    @property
+    def observation_digest(self) -> str:
+        """Return the digest of the time-bound observed state."""
+
+        return canonical_digest(
+            {
+                "created_at": self.created_at,
+                "expires_at": self.expires_at,
+                "observations": [item.to_mapping() for item in self.observations],
+            }
+        )
+
+    @property
+    def blockers(self) -> tuple[str, ...]:
+        """Return conflicts and unknown state that block approval."""
+
+        return tuple(
+            item.reason_code
+            for item in self.observations
+            if item.classification in {Classification.CONFLICT, Classification.INDETERMINATE}
+        )
+
+    def to_mapping(self) -> dict[str, object]:
+        """Return a private artifact without raw tenant or subscription identifiers."""
+
+        return {
+            "schema_version": "fdai.bootstrap-reconcile-plan.v1",
+            "state": "review" if not self.blockers else "incomplete",
+            "plan": dict(self.intent),
+            "plan_digest": self.plan_digest,
+            "observation": {
+                "created_at": self.created_at,
+                "expires_at": self.expires_at,
+                "digest": self.observation_digest,
+                "entries": [item.to_mapping() for item in self.observations],
+            },
+            "reason_codes": list(self.blockers),
+            "mutation_performed": False,
+        }
+
+
+def build_intent(
+    *,
+    profile: ProvisionProfile,
+    source_commit: str,
+    ops_resource_group: str,
+    app_resource_group: str,
+    state_storage_account: str,
+) -> dict[str, object]:
+    """Build deterministic foundation intent without live observations."""
+
+    operations = [
+        {
+            "entry_id": f"provider.{namespace.casefold()}",
+            "action": "ensure_registered",
+            "postcondition": "provider.registered",
+            "rollback_ref": "rollback.provider-registration",
+        }
+        for namespace in FOUNDATION_PROVIDER_NAMESPACES
+    ]
+    operations.extend(
+        (
+            {
+                "entry_id": "ops-resource-group",
+                "action": "ensure",
+                "postcondition": "resource-group.compatible",
+                "rollback_ref": "rollback.ops-resource-group",
+            },
+            {
+                "entry_id": "application-resource-group",
+                "action": "ensure",
+                "postcondition": "resource-group.compatible",
+                "rollback_ref": "rollback.application-resource-group",
+            },
+            {
+                "entry_id": "state-storage",
+                "action": "ensure",
+                "postcondition": "state-storage.private-keyless-versioned",
+                "rollback_ref": "rollback.state-storage",
+            },
+            {
+                "entry_id": "ops-network",
+                "action": "ensure",
+                "postcondition": "ops-network.private-runner-ready",
+                "rollback_ref": "rollback.ops-network",
+            },
+            {
+                "entry_id": "deploy-identity",
+                "action": "ensure",
+                "postcondition": "deploy-identity.roles-effective",
+                "rollback_ref": "rollback.deploy-identity",
+            },
+            {
+                "entry_id": "runner",
+                "action": "ensure",
+                "postcondition": "runner.attested",
+                "rollback_ref": "rollback.runner",
+            },
+            {
+                "entry_id": "state-containers",
+                "action": "ensure",
+                "postcondition": "state-containers.private",
+                "rollback_ref": "rollback.state-containers",
+            },
+            {
+                "entry_id": "state-handoff",
+                "action": "verify",
+                "postcondition": "state-handoff.zero-change",
+                "rollback_ref": "rollback.state-handoff",
+            },
+        )
+    )
+    return {
+        "schema_version": "fdai.bootstrap-reconcile-intent.v1",
+        "source_commit": source_commit,
+        "profile_digest": canonical_digest(profile.to_mapping()),
+        "target_binding": profile.target_binding,
+        "environment": profile.environment,
+        "region": profile.region,
+        "resource_names": {
+            "ops_resource_group": ops_resource_group,
+            "application_resource_group": app_resource_group,
+            "state_storage_account": state_storage_account,
+        },
+        "state_storage_posture": {
+            "kind": "StorageV2",
+            "sku": "Standard_LRS",
+            "minimum_tls_version": "TLS1_2",
+            "public_network_access": "Disabled",
+            "shared_key_access": False,
+            "blob_public_access": False,
+            "cross_tenant_replication": False,
+            "blob_versioning": True,
+            "blob_delete_retention": True,
+            "container_delete_retention": True,
+            "containers": ["tfstate", "deployment-plans"],
+        },
+        "provider_namespaces": list(FOUNDATION_PROVIDER_NAMESPACES),
+        "operations": operations,
+    }
+
+
+def validate_inputs(
+    *,
+    source_commit: str,
+    ops_resource_group: str,
+    app_resource_group: str,
+    state_storage_account: str,
+    ttl_seconds: int,
+) -> None:
+    """Reject names and bounds that Azure cannot safely apply later."""
+
+    if _SHA.fullmatch(source_commit) is None:
+        raise ValueError("source_commit MUST be a lowercase 40-character SHA")
+    for value in (ops_resource_group, app_resource_group):
+        if _RESOURCE_GROUP_NAME.fullmatch(value) is None or value.endswith("."):
+            raise ValueError("Azure resource group name is invalid")
+    if _STORAGE_ACCOUNT_NAME.fullmatch(state_storage_account) is None:
+        raise ValueError("Azure storage account name is invalid")
+    if not 60 <= ttl_seconds <= 3600:
+        raise ValueError("bootstrap plan ttl MUST be from 60 through 3600 seconds")
+
+
+def timestamp(moment: datetime) -> str:
+    """Render one canonical UTC timestamp."""
+
+    return moment.astimezone(UTC).isoformat().replace("+00:00", "Z")