fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/standalone_planned_outputs.py

@@ -0,0 +1,147 @@
+"""Read shared-root Terraform outputs that targeted applies do not persist.
+
+Terraform writes a root output during ``apply -target`` only when that output depends on a
+targeted resource. Outputs derived only from variables and locals, such as logical topic names,
+stay absent from state even though their values are fully determined by the verified
+configuration. When state lacks such an output, this module evaluates one refresh-free,
+lock-free, non-targeted plan of the same root and accepts only outputs whose planned values are
+known. Unknown values mean the backing resource was never applied, so readback fails closed.
+The plan is read-only, private, cached per process, and deleted after evaluation.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+
+_MISSING = "not found"
+
+
+@dataclass(frozen=True, slots=True)
+class _Source:
+    variables: Path
+    data_dir: Path
+
+
+_SOURCES: dict[Path, _Source] = {}
+_CACHE: dict[Path, dict[str, object]] = {}
+
+
+def bind(infra: Path, *, variables: Path, data_dir: Path) -> None:
+    """Allow planned-output evaluation for one shared root with its exact inputs."""
+
+    _SOURCES[infra.resolve()] = _Source(variables=variables, data_dir=data_dir)
+
+
+def read_output(infra: Path, name: str, *, raw: bool, reason: str) -> object:
+    """Return a state output, or a known planned value when state never recorded it."""
+
+    command = ("terraform", "output", "-raw" if raw else "-json", name)
+    result = subprocess.run(
+        command, cwd=infra, check=False, capture_output=True, text=True, timeout=120
+    )
+    if result.returncode == 0:
+        return result.stdout.strip() if raw else _json(result.stdout)
+    source = _SOURCES.get(infra.resolve())
+    if source is None or _MISSING not in result.stderr:
+        raise ValueError(reason)
+    outputs = _CACHE.get(infra.resolve())
+    if outputs is None:
+        outputs = _planned_outputs(infra, source)
+        _CACHE[infra.resolve()] = outputs
+    if name not in outputs:
+        raise ValueError(f"{reason}: output is unknown until its resource is applied")
+    value = outputs[name]
+    if not raw:
+        return value
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, str | int | float):
+        return str(value)
+    raise ValueError(f"{reason}: output is not a primitive value")
+
+
+def _planned_outputs(infra: Path, source: _Source) -> dict[str, object]:
+    environment = {**os.environ, "TF_DATA_DIR": str(source.data_dir)}
+    scratch = Path(tempfile.mkdtemp(prefix="planned-outputs-", dir=source.variables.parent))
+    plan = scratch / "outputs.tfplan"
+    try:
+        planned = subprocess.run(
+            (
+                "terraform",
+                "plan",
+                "-refresh=false",
+                "-lock=false",
+                "-input=false",
+                "-no-color",
+                f"-var-file={source.variables}",
+                f"-out={plan}",
+            ),
+            cwd=infra,
+            env=environment,
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=1800,
+        )
+        if planned.returncode != 0:
+            raise ValueError("planned Terraform output evaluation failed")
+        shown = subprocess.run(
+            ("terraform", "show", "-json", str(plan)),
+            cwd=infra,
+            env=environment,
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=300,
+        )
+        if shown.returncode != 0:
+            raise ValueError("planned Terraform output evaluation failed")
+        document = _json(shown.stdout)
+    finally:
+        shutil.rmtree(scratch, ignore_errors=True)
+    if not isinstance(document, dict):
+        raise ValueError("planned Terraform output document is invalid")
+    return known_planned_outputs(document)
+
+
+def known_planned_outputs(document: dict[str, object]) -> dict[str, object]:
+    """Select planned root outputs whose values are fully known."""
+
+    planned = document.get("planned_values")
+    changes = document.get("output_changes")
+    outputs = planned.get("outputs") if isinstance(planned, dict) else None
+    if not isinstance(outputs, dict) or not isinstance(changes, dict):
+        raise ValueError("planned Terraform output document is invalid")
+    known: dict[str, object] = {}
+    for name, output in outputs.items():
+        change = changes.get(name)
+        if not isinstance(output, dict) or "value" not in output:
+            continue
+        if isinstance(change, dict) and _has_unknown(change.get("after_unknown")):
+            continue
+        known[str(name)] = output["value"]
+    return known
+
+
+def _has_unknown(marker: object) -> bool:
+    if isinstance(marker, dict):
+        return any(_has_unknown(item) for item in marker.values())
+    if isinstance(marker, list):
+        return any(_has_unknown(item) for item in marker)
+    return marker is True
+
+
+def _json(raw: str) -> object:
+    try:
+        return json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ValueError("Terraform JSON output is invalid") from exc
+
+
+__all__ = ["bind", "known_planned_outputs", "read_output"]

fdai_deployment_cli/standalone_private_access_probe.py

@@ -0,0 +1,100 @@
+"""Wait for the managed host's selected private application data planes."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import time
+from collections.abc import Callable
+from pathlib import Path
+
+_RESOURCE_NAME = re.compile(r"[a-z0-9-]{3,63}")
+
+
+def wait_for_private_data_planes(
+    *,
+    context: dict[str, object],
+    work_dir: Path,
+    timeout_seconds: float = 600,
+    interval_seconds: float = 15,
+    clock: Callable[[], float] = time.monotonic,
+    sleep: Callable[[float], None] = time.sleep,
+    run: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run,
+) -> dict[str, object]:
+    """Require Key Vault and Data Lake access before a residual can consume authority."""
+
+    vault = _name(context, "key_vault_name")
+    storage = _name(context, "document_storage_account_name")
+    if (
+        context.get("key_vault_private_access") is not True
+        or context.get("document_storage_private_access") is not True
+        or timeout_seconds <= 0
+        or interval_seconds <= 0
+    ):
+        raise ValueError("private application data-plane probe context is invalid")
+    commands = (
+        (
+            "az",
+            "keyvault",
+            "secret",
+            "list",
+            "--vault-name",
+            vault,
+            "--query",
+            "length(@)",
+            "--output",
+            "tsv",
+            "--only-show-errors",
+        ),
+        (
+            "az",
+            "storage",
+            "fs",
+            "list",
+            "--account-name",
+            storage,
+            "--auth-mode",
+            "login",
+            "--query",
+            "length(@)",
+            "--output",
+            "tsv",
+            "--only-show-errors",
+        ),
+    )
+    deadline = clock() + timeout_seconds
+    attempts = 0
+    while True:
+        attempts += 1
+        results = [
+            run(
+                command,
+                cwd=work_dir,
+                check=False,
+                capture_output=True,
+                text=True,
+                timeout=60,
+            )
+            for command in commands
+        ]
+        if all(result.returncode == 0 and result.stdout.strip().isdigit() for result in results):
+            return {
+                "schema_version": "fdai.private-data-plane-probe.v1",
+                "state": "ready",
+                "key_vault_verified": True,
+                "document_storage_verified": True,
+                "attempts": attempts,
+                "mutation_performed": False,
+                "subscription_ready": False,
+            }
+        remaining = deadline - clock()
+        if remaining <= 0:
+            raise ValueError("private application data planes did not become ready")
+        sleep(min(interval_seconds, remaining))
+
+
+def _name(context: dict[str, object], field: str) -> str:
+    value = context.get(field)
+    if not isinstance(value, str) or _RESOURCE_NAME.fullmatch(value) is None:
+        raise ValueError("private application data-plane resource name is invalid")
+    return value

fdai_deployment_cli/standalone_product_profile.py

@@ -0,0 +1,110 @@
+"""Compile one product profile into authority-neutral Terraform values."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Callable
+from typing import Any
+
+from fdai_service_contracts.product_profile import (
+    AzureObservationRole,
+    ProductAddOn,
+    ProductProfile,
+)
+
+from fdai_deployment_cli.runtime_profile import RuntimeDeploymentProfile
+
+_STEWARD_AGENT_NAMES = (
+    "Odin",
+    "Thor",
+    "Forseti",
+    "Huginn",
+    "Heimdall",
+    "Vidar",
+    "Var",
+    "Bragi",
+    "Saga",
+    "Mimir",
+    "Muninn",
+    "Norns",
+    "Njord",
+    "Freyr",
+)
+
+
+def product_terraform_values(
+    runtime_profile: RuntimeDeploymentProfile,
+    entra: dict[str, Any],
+    *,
+    require_guid: Callable[[dict[str, Any], str], str],
+) -> dict[str, object]:
+    """Return only bindings selected by the immutable product profile."""
+
+    profile = runtime_profile.product_profile
+    console = profile.selects(ProductAddOn.READ_ONLY_CONSOLE)
+    governed_execution = profile.selects(ProductAddOn.GOVERNED_EXECUTION)
+    notifications = profile.selects(ProductAddOn.NOTIFICATIONS)
+    enterprise_identity = profile.selects(ProductAddOn.ENTERPRISE_IDENTITY_GOVERNANCE)
+    permissions = profile.observation_permissions
+    values: dict[str, object] = {
+        "enable_console": console,
+        "enable_operator_api": console or enterprise_identity,
+        "enable_isolated_executor": governed_execution,
+        "enable_governed_execution": governed_execution,
+        "enable_email_notifications": notifications,
+        "enable_document_ingestion": console and runtime_profile.runtime_platform.value == "aks",
+        "enable_inventory_monitoring_reader": permissions.selects(
+            AzureObservationRole.MONITORING_READER
+        ),
+        "enable_inventory_log_analytics_reader": permissions.selects(
+            AzureObservationRole.LOG_ANALYTICS_READER
+        ),
+        "enable_inventory_cost_management_reader": permissions.selects(
+            AzureObservationRole.COST_MANAGEMENT_READER
+        ),
+        "enable_inventory_aks_reader": permissions.selects(AzureObservationRole.AKS_READ_ONLY),
+        "inventory_kubernetes_subscription_discovery_enabled": permissions.selects(
+            AzureObservationRole.AKS_READ_ONLY
+        ),
+        "enable_inventory_evidence_store_reader": permissions.selects(
+            AzureObservationRole.EVIDENCE_STORE_DATA_READER
+        ),
+        "product_profile_json": json.dumps(
+            profile.model_dump(mode="json"),
+            sort_keys=True,
+            separators=(",", ":"),
+        ),
+    }
+    if runtime_profile.database_sku is not None:
+        values["postgres_sku_name"] = runtime_profile.database_sku
+    if not enterprise_identity:
+        return values
+    operator_id = require_guid(entra, "CURRENT_OPERATOR_OBJECT_ID")
+    values.update(
+        operator_api_audience=str(entra["OPERATOR_API_AUDIENCE"]),
+        rbac_readers_group_id=str(entra["RBAC_READERS_GROUP_ID"]),
+        rbac_contributors_group_id=str(entra["RBAC_CONTRIBUTORS_GROUP_ID"]),
+        rbac_approvers_group_id=str(entra["RBAC_APPROVERS_GROUP_ID"]),
+        rbac_owners_group_id=str(entra["RBAC_OWNERS_GROUP_ID"]),
+        rbac_break_glass_group_id=str(entra["RBAC_BREAK_GLASS_GROUP_ID"]),
+        stewardship_maintainers=operator_id,
+        stewardship_agent_bindings={name: f"user:{operator_id}" for name in _STEWARD_AGENT_NAMES},
+    )
+    return values
+
+
+def context_selects_add_on(context: dict[str, Any], add_on: ProductAddOn) -> bool:
+    """Report whether the recorded deployment context explicitly selected one add-on."""
+
+    runtime = context.get("runtime_profile")
+    if not isinstance(runtime, dict):
+        return False
+    product = runtime.get("product_profile")
+    if product is None:
+        return False
+    if not isinstance(product, dict):
+        raise ValueError("product profile is invalid")
+    return ProductProfile.model_validate(product).selects(add_on)
+
+
+__all__ = ["context_selects_add_on", "product_terraform_values"]