fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/standalone_stage_targets.py

@@ -0,0 +1,325 @@
+"""Select bounded Terraform targets for standalone deployment stages."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+from typing import Final
+
+_SUBSTRATE_TARGETS: Final = (
+    "module.resource_group",
+    # Every later stage reads installation_binding, and on AKS no untargeted apply runs.
+    "terraform_data.installation",
+    "module.log_analytics",
+    "azurerm_application_insights.core",
+    "module.network",
+    "module.container_registry",
+    "module.acr_private_endpoint",
+    "azurerm_role_assignment.deploy_runner_acr_push",
+    "module.identity",
+    "module.identity_change",
+    "module.identity_resilience",
+    "module.identity_finops",
+    "module.command_api_identity",
+    "module.inventory_identity",
+    "module.canary_identity",
+    "module.operational_evidence_verifier_identity",
+    "module.operator_api_identity",
+    "module.isolated_executor_identity",
+    "module.ingestion_identity",
+    "module.ingestion_worker_identity",
+    "module.key_vault",
+    "azurerm_role_assignment.kv_officer_self",
+    "module.kv_private_endpoint",
+    "module.state_store",
+    "module.postgres_public_mode_private_endpoint",
+    "module.event_bus",
+    "module.event_bus_auxiliary",
+    "module.event_bus_private_endpoint",
+    "azurerm_key_vault_secret.state_store_dsn",
+    "azurerm_key_vault_secret.application_insights_connection_string",
+    "azurerm_role_assignment.core_application_insights_secret_reader",
+    "azurerm_key_vault_secret.github_app_private_key",
+    "azurerm_role_assignment.core_github_app_private_key_reader",
+    "azurerm_role_assignment.command_api_eventhubs_sender",
+    "azurerm_role_assignment.command_api_eventhubs_receiver",
+    "azurerm_role_assignment.inventory_reader",
+    "azurerm_role_assignment.inventory_monitoring_reader",
+    "azurerm_role_assignment.inventory_log_analytics_reader",
+    "azurerm_role_assignment.inventory_cost_reader",
+    "azurerm_role_assignment.inventory_kubernetes_reader",
+    "azurerm_role_assignment.inventory_eventhubs_sender",
+    "azurerm_role_assignment.inventory_stage_sender",
+    "azurerm_role_assignment.inventory_eventhubs_raw_sender",
+    "azurerm_role_assignment.canary_eventhubs_sender",
+    "azurerm_role_assignment.operational_evidence_verifier_acr_pull",
+    "azurerm_role_assignment.operational_evidence_verifier_state_store_secret_reader",
+    "azurerm_role_assignment.operational_evidence_verifier_monitoring_reader",
+    "azurerm_role_assignment.inventory_kv_secrets_user",
+    "azurerm_role_assignment.operator_api_kv_secrets_user",
+    "azurerm_role_assignment.isolated_executor_kv_secrets_user",
+    "module.document_storage",
+    "module.document_blob_private_endpoint",
+    "module.document_dfs_private_endpoint",
+    "azurerm_private_dns_a_record.document_blob_ops",
+    "azurerm_role_assignment.ingestion_document_data",
+    "azurerm_role_assignment.ingestion_worker_document_data",
+    "azurerm_key_vault_secret.ingestion_api_dsn",
+    "azurerm_key_vault_secret.ingestion_worker_dsn",
+    "azurerm_role_assignment.ingestion_api_kv_secrets_user",
+    "azurerm_role_assignment.ingestion_worker_kv_secrets_user",
+    "azurerm_role_assignment.ingestion_aks_eventhubs_sender",
+    "azurerm_role_assignment.ingestion_worker_aks_eventhubs_receiver",
+    "azurerm_role_assignment.ingestion_worker_eventhubs_sender",
+    "azurerm_role_assignment.ingestion_worker_pantheon_receiver",
+    "azurerm_role_assignment.executor_eventhubs_data_owner",
+    "azurerm_role_assignment.isolated_executor_command_receiver",
+    "azurerm_role_assignment.isolated_executor_receipt_sender",
+    "azurerm_role_assignment.ingestion_eventhubs_sender",
+    "azurerm_role_assignment.operator_api_reader",
+    "module.console",
+    "module.operational_history_storage",
+    "random_id.cost_pseudonym_key",
+    "azurerm_key_vault_secret.cost_pseudonym_key",
+    "azurerm_role_assignment.operator_cost_pseudonym_secret_reader",
+    "random_id.operator_request_core_signing_seed",
+    "azurerm_key_vault_secret.operator_request_core_signing_seed",
+    "random_id.operator_request_operator_signing_seed",
+    "azurerm_key_vault_secret.operator_request_operator_signing_seed",
+    "azurerm_role_assignment.core_operator_request_core_seed_reader",
+    "azurerm_role_assignment.core_operator_request_operator_seed_reader",
+    "azurerm_role_assignment.operator_api_operator_request_seed_reader",
+    # Email notifications; every address is count 0 unless the add-on is selected.
+    "module.notification_identity",
+    "azurerm_communication_service.notifications",
+    "azurerm_email_communication_service.notifications",
+    "azurerm_email_communication_service_domain.notifications",
+    "azurerm_communication_service_email_domain_association.notifications",
+    "azurerm_role_assignment.notification_email_sender",
+)
+CONTAINER_INSIGHTS_ASSOCIATION_TARGET: Final = (
+    "azurerm_monitor_data_collection_rule_association.container_insights"
+)
+RUNTIME_CLUSTER_STATE_TARGET: Final = "azurerm_kubernetes_cluster.runtime"
+_AKS_RUNTIME_TARGETS: Final = (
+    "azurerm_public_ip.egress",
+    "azurerm_nat_gateway.egress",
+    "azurerm_nat_gateway_public_ip_association.egress",
+    "azurerm_subnet_nat_gateway_association.egress",
+    "azurerm_user_assigned_identity.cluster",
+    "azurerm_role_assignment.cluster_network",
+    "azurerm_role_assignment.cluster_api_network",
+    RUNTIME_CLUSTER_STATE_TARGET,
+    "azurerm_monitor_data_collection_rule.container_insights",
+    CONTAINER_INSIGHTS_ASSOCIATION_TARGET,
+    "azurerm_kubernetes_cluster_node_pool.user",
+    "azurerm_role_assignment.managed_host_cluster_user",
+    "azurerm_role_assignment.managed_host_cluster_admin",
+    "azurerm_role_assignment.kubelet_acr_pull",
+)
+
+
+def database_placement(context: dict[str, object]) -> str:
+    value = context.get("runtime_profile")
+    if value is None:
+        return "postgres-flex"
+    if not isinstance(value, dict) or any(not isinstance(key, str) for key in value):
+        raise ValueError("runtime deployment profile is invalid")
+    placement = value.get("database_placement")
+    if placement not in {"postgres-flex", "postgres-aks"}:
+        raise ValueError("database placement is invalid")
+    return str(placement)
+
+
+_MOVED = re.compile(r"moved\s*\{\s*from\s*=\s*(\S+)\s+to\s*=\s*(\S+)\s*\}")
+
+
+def stage_targets(stage: str, context: dict[str, object]) -> tuple[str, ...]:
+    if stage == "access":
+        base = focused_access_targets(context)
+    elif stage == "substrate":
+        base = substrate_targets(context)
+    else:
+        return ()
+    infra = context.get("infra")
+    moved = moved_state_targets(Path(infra)) if isinstance(infra, str) else ()
+    return base + tuple(target for target in moved if target not in base)
+
+
+def fresh_aks_runtime_targets() -> tuple[str, ...]:
+    """Return the first fresh-runtime target set without the Container Insights association."""
+
+    return tuple(
+        target for target in _AKS_RUNTIME_TARGETS if target != CONTAINER_INSIGHTS_ASSOCIATION_TARGET
+    )
+
+
+def runtime_operation(work_dir: Path, infra: Path) -> str:
+    if (work_dir / "runtime-cluster-review.json").exists() and not (
+        work_dir / "runtime-cluster-receipt.json"
+    ).exists():
+        return "runtime-cluster"
+    if terraform_state_contains(infra, RUNTIME_CLUSTER_STATE_TARGET):
+        return "runtime"
+    return "runtime-cluster"
+
+
+def terraform_state_contains(infra: Path, address: str) -> bool:
+    completed = subprocess.run(
+        ("terraform", "state", "list", address),
+        cwd=infra,
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=300,
+    )
+    return completed.returncode == 0 and address in completed.stdout.splitlines()
+
+
+def operation_targets(stage: str, context: dict[str, object], operation: str) -> tuple[str, ...]:
+    if operation == "runtime-cluster":
+        return fresh_aks_runtime_targets()
+    return stage_targets(stage, context)
+
+
+def not_required_recovery(stage: str) -> dict[str, object]:
+    return {
+        "schema_version": "fdai.standalone-application-recovery.v1",
+        "state": "not-required",
+        "stage": stage,
+        "mutation_performed": False,
+        "subscription_ready": False,
+    }
+
+
+def moved_state_targets(infra: Path) -> tuple[str, ...]:
+    """Return `moved` source and destination addresses whose source is still in Terraform state.
+
+    Terraform rejects a targeted plan that leaves such instances out, so every targeted stage
+    must include them. Without readable state, no destination is added and Terraform fails closed.
+    """
+
+    blocks = [
+        match.groups()
+        for path in sorted(infra.glob("*.tf"))
+        for match in _MOVED.finditer(path.read_text(encoding="utf-8"))
+    ]
+    if not blocks:
+        return ()
+    listed = subprocess.run(
+        ("terraform", "state", "list"),
+        cwd=infra,
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=300,
+    )
+    if listed.returncode != 0:
+        return ()
+    state = set(listed.stdout.split())
+    return tuple(
+        sorted(
+            {
+                address
+                for source, destination in blocks
+                if any(
+                    item == source or item.startswith((f"{source}.", f"{source}["))
+                    for item in state
+                )
+                for address in (source, destination)
+            }
+        )
+    )
+
+
+def focused_private_access(context: dict[str, object]) -> bool:
+    key_vault = context.get("key_vault_private_access")
+    document_storage = context.get("document_storage_private_access")
+    if type(key_vault) is not bool or type(document_storage) is not bool:
+        raise ValueError("focused private-access context is invalid")
+    return key_vault or document_storage
+
+
+def reconcile_retained_private_access(
+    retained: dict[str, object],
+    retained_values: dict[str, object],
+    key_vault_private_access: bool,
+    document_storage_private_access: bool,
+) -> bool:
+    changed = False
+    for key, variable, observed in (
+        (
+            "key_vault_private_access",
+            "enable_aks_key_vault_private_access",
+            key_vault_private_access,
+        ),
+        (
+            "document_storage_private_access",
+            "enable_aks_document_storage_private_access",
+            document_storage_private_access,
+        ),
+    ):
+        previous = retained.get(key)
+        if type(previous) is not bool:
+            raise ValueError("standalone host retained context differs")
+        if previous and not observed:
+            raise ValueError(f"standalone host retained private-access posture loosened: {key}")
+        tightened = previous or observed
+        if retained.get(key) is not tightened:
+            retained[key] = tightened
+            retained_values[variable] = tightened
+            changed = True
+    if changed:
+        retained["private_access_posture_transition"] = True
+    return changed
+
+
+def focused_access_targets(context: dict[str, object]) -> tuple[str, ...]:
+    if not focused_private_access(context):
+        raise ValueError("focused private-access plan was not selected")
+    targets: list[str] = []
+    if context["key_vault_private_access"] is True:
+        targets.extend(
+            (
+                "module.kv_private_endpoint",
+                "azurerm_role_assignment.kv_officer_self",
+            )
+        )
+    if context["document_storage_private_access"] is True:
+        targets.extend(
+            (
+                "module.document_blob_private_endpoint",
+                "module.document_dfs_private_endpoint",
+                "module.document_storage[0].azurerm_role_assignment.deployer_data_owner",
+                "azurerm_private_dns_a_record.document_blob_ops",
+            )
+        )
+    targets.extend(
+        (
+            "azurerm_virtual_network_peering.spoke_to_hub",
+            "azurerm_virtual_network_peering.hub_to_spoke",
+        )
+    )
+    return tuple(targets)
+
+
+def substrate_targets(context: dict[str, object]) -> tuple[str, ...]:
+    if database_placement(context) == "postgres-flex":
+        return _SUBSTRATE_TARGETS
+    # -target keeps every configuration dependency even at count 0, so the ingestion DSN
+    # secrets and their readers would plan the Flexible Server through module.state_store.
+    excluded = {
+        "module.state_store",
+        "module.postgres_public_mode_private_endpoint",
+        "azurerm_key_vault_secret.state_store_dsn",
+        "azurerm_key_vault_secret.ingestion_api_dsn",
+        "azurerm_key_vault_secret.ingestion_worker_dsn",
+        "azurerm_role_assignment.ingestion_api_kv_secrets_user",
+        "azurerm_role_assignment.ingestion_worker_kv_secrets_user",
+        "azurerm_role_assignment.inventory_kv_secrets_user",
+        "azurerm_role_assignment.operator_api_kv_secrets_user",
+        "azurerm_role_assignment.isolated_executor_kv_secrets_user",
+        "azurerm_role_assignment.operational_evidence_verifier_state_store_secret_reader",
+    }
+    return tuple(target for target in _SUBSTRATE_TARGETS if target not in excluded)

fdai_deployment_cli/standalone_status.py

@@ -0,0 +1,67 @@
+"""Bind Foundation supervision to a fresh, target-matched private status snapshot."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from fdai_deployment_cli.private_output import read_private_bytes
+
+
+def prior_attempt(path: Path) -> int:
+    """Read the existing attempt without treating absence as successful Foundation evidence."""
+
+    try:
+        value = _read(path)
+    except FileNotFoundError:
+        return 0
+    return _attempt(value)
+
+
+def current_status(
+    path: Path, *, previous: int, source_commit: str, run_binding: str
+) -> dict[str, Any]:
+    """Require a newer writer attempt and exact execution context after a successful child exit.
+
+    This validates the status handoff, not operational effects. Existing exact plan, approval,
+    receipt, and independent verification checks remain required by the caller.
+    """
+
+    try:
+        value = _read(path)
+    except FileNotFoundError as exc:
+        raise ValueError(
+            "orchestrator did not publish current Foundation status; inspect retained evidence"
+        ) from exc
+    sequence = value.get("sequence")
+    state = value.get("state")
+    if (
+        value.get("schema_version") != "fdai.genesis-orchestration-status.v2"
+        or _attempt(value) != previous + 1
+        or type(sequence) is not int
+        or sequence < 1
+        or value.get("source_commit") != source_commit
+        or value.get("target_binding") != run_binding
+        or value.get("mode") != "apply"
+        or not isinstance(state, str)
+        or state not in {"waiting", "complete"}
+    ):
+        raise ValueError(
+            "current Foundation status is stale or mismatched; inspect retained evidence"
+        )
+    return value
+
+
+def _attempt(value: dict[str, Any]) -> int:
+    attempt = value.get("attempt")
+    if type(attempt) is not int or attempt < 1:
+        raise ValueError("current Foundation status has an invalid attempt")
+    return attempt
+
+
+def _read(path: Path) -> dict[str, Any]:
+    value = json.loads(read_private_bytes(path, max_bytes=1_048_576))
+    if not isinstance(value, dict):
+        raise ValueError("current Foundation status must be an object")
+    return {str(key): item for key, item in value.items()}

fdai_deployment_cli/standalone_terraform_environment.py

@@ -0,0 +1,237 @@
+"""Bind standalone Terraform execution to verified local artifacts and one exact UAMI."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import shutil
+import subprocess
+from pathlib import Path
+
+from fdai_deployment_cli.private_output import read_private_bytes
+
+_CONFLICTING_AUTH = (
+    "ARM_USE_CLI",
+    "ARM_USE_OIDC",
+    "ARM_OIDC_TOKEN",
+    "ARM_CLIENT_SECRET",
+    "ARM_CLIENT_CERTIFICATE_PATH",
+    "ARM_CLIENT_CERTIFICATE_PASSWORD",
+    "ARM_USERNAME",
+    "ARM_PASSWORD",
+    "ARM_USE_AKS_WORKLOAD_IDENTITY",
+    "ARM_MSI_ENDPOINT",
+)
+_GUID = re.compile(r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}")
+
+
+def configure_terraform(context: dict[str, object]) -> None:
+    terraform = Path(str(context["terraform"]))
+    config = Path(str(context["terraform_config"]))
+    data = Path(str(context["terraform_data"]))
+    if not terraform.is_file() or not config.is_file():
+        raise ValueError("verified Terraform execution context is unavailable")
+    provider_mode = str(context.get("provider_installation", "filesystem_mirror"))
+    if provider_mode == "direct":
+        expected_config = source_terraform_configuration()
+    else:
+        provider_mirror = Path(str(context["provider_mirror"]))
+        expected_config = terraform_configuration(provider_mirror)
+    if read_private_bytes(config, max_bytes=16_384).decode("utf-8") != expected_config:
+        raise ValueError("Terraform provider configuration differs from the verified input")
+    data.mkdir(mode=0o700, exist_ok=True)
+    kit_bin = Path(str(context.get("kit_bin", terraform.parent)))
+    os.environ["PATH"] = os.pathsep.join(
+        (str(terraform.parent), str(kit_bin), "/usr/local/bin", "/usr/bin", "/bin")
+    )
+    os.environ["TF_CLI_CONFIG_FILE"] = str(config)
+    os.environ["TF_DATA_DIR"] = str(data)
+    os.environ["TF_IN_AUTOMATION"] = "1"
+    for variable in _CONFLICTING_AUTH:
+        os.environ.pop(variable, None)
+    os.environ["ARM_SUBSCRIPTION_ID"] = str(context["subscription_id"])
+    os.environ["ARM_TENANT_ID"] = str(context["tenant_id"])
+    os.environ["ARM_USE_MSI"] = "true"
+    os.environ["ARM_CLIENT_ID"] = str(context["client_id"])
+    os.environ["ARM_RESOURCE_PROVIDER_REGISTRATIONS"] = "none"
+
+
+def terraform_configuration(provider_mirror: Path) -> str:
+    return (
+        "provider_installation {\n"
+        "  filesystem_mirror {\n"
+        f'    path = "{provider_mirror}"\n'
+        '    include = ["*/*"]\n'
+        "  }\n"
+        "  direct {\n"
+        '    exclude = ["*/*"]\n'
+        "  }\n"
+        "}\n"
+    )
+
+
+def source_terraform_configuration() -> str:
+    """Resolve providers from public registries under committed lock files."""
+
+    return "provider_installation {\n  direct {}\n}\n"
+
+
+def requires_aks_key_vault_private_access(
+    *,
+    subscription_id: str,
+    resource_group_name: str,
+    vault_name: str,
+    work_dir: Path,
+) -> bool:
+    """Select only the focused private path required by an existing policy-locked vault."""
+
+    if (
+        _GUID.fullmatch(subscription_id) is None
+        or re.fullmatch(r"rg-[a-z0-9-]{3,80}", resource_group_name) is None
+        or re.fullmatch(r"[a-z0-9-]{3,24}", vault_name) is None
+    ):
+        raise ValueError("Key Vault private-access readback target is invalid")
+    return _requires_private_access(
+        subscription_id=subscription_id,
+        resource_group_name=resource_group_name,
+        resource_name=vault_name,
+        list_command=(
+            "az",
+            "keyvault",
+            "list",
+            "--subscription",
+            subscription_id,
+            "--resource-group",
+            resource_group_name,
+            "--output",
+            "json",
+            "--only-show-errors",
+        ),
+        label="Key Vault",
+        work_dir=work_dir,
+    )
+
+
+def requires_aks_document_storage_private_access(
+    *,
+    subscription_id: str,
+    resource_group_name: str,
+    account_name: str,
+    work_dir: Path,
+) -> bool:
+    """Select focused Blob/DFS access for one existing policy-locked document account."""
+
+    if (
+        _GUID.fullmatch(subscription_id) is None
+        or re.fullmatch(r"rg-[a-z0-9-]{3,80}", resource_group_name) is None
+        or re.fullmatch(r"[a-z0-9]{3,24}", account_name) is None
+    ):
+        raise ValueError("document storage private-access readback target is invalid")
+    return _requires_private_access(
+        subscription_id=subscription_id,
+        resource_group_name=resource_group_name,
+        resource_name=account_name,
+        list_command=(
+            "az",
+            "storage",
+            "account",
+            "list",
+            "--subscription",
+            subscription_id,
+            "--resource-group",
+            resource_group_name,
+            "--output",
+            "json",
+            "--only-show-errors",
+        ),
+        label="document storage",
+        work_dir=work_dir,
+    )
+
+
+def _requires_private_access(
+    *,
+    subscription_id: str,
+    resource_group_name: str,
+    resource_name: str,
+    list_command: tuple[str, ...],
+    label: str,
+    work_dir: Path,
+) -> bool:
+    group_exists = _capture(
+        (
+            "az",
+            "group",
+            "exists",
+            "--subscription",
+            subscription_id,
+            "--name",
+            resource_group_name,
+            "--output",
+            "tsv",
+            "--only-show-errors",
+        ),
+        cwd=work_dir,
+        reason="application resource-group readback failed",
+    )
+    if group_exists == "false":
+        return False
+    if group_exists != "true":
+        raise ValueError("application resource-group readback is invalid")
+    raw = _capture(list_command, cwd=work_dir, reason=f"{label} public-access readback failed")
+    if len(raw.encode()) > 4 * 1024 * 1024:
+        raise ValueError(f"{label} public-access readback exceeds its size limit")
+    try:
+        rows = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{label} public-access readback is invalid") from exc
+    if not isinstance(rows, list):
+        raise TypeError(f"{label} public-access readback is invalid")
+    matches = [row for row in rows if isinstance(row, dict) and row.get("name") == resource_name]
+    if not matches:
+        return False
+    if len(matches) != 1:
+        raise ValueError(f"{label} public-access readback is ambiguous")
+    public_access = matches[0].get("publicNetworkAccess")
+    if not isinstance(public_access, str):
+        properties = matches[0].get("properties")
+        public_access = (
+            properties.get("publicNetworkAccess") if isinstance(properties, dict) else None
+        )
+    if public_access == "Disabled":
+        return True
+    if public_access == "Enabled":
+        return False
+    raise ValueError(f"{label} public-access readback is invalid")
+
+
+def _capture(command: tuple[str, ...], *, cwd: Path, reason: str) -> str:
+    result = subprocess.run(
+        command,
+        cwd=cwd,
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=60,
+        umask=0o077,
+    )
+    if result.returncode != 0:
+        raise ValueError(reason)
+    return result.stdout.strip()
+
+
+__all__ = [
+    "configure_terraform",
+    "requires_aks_document_storage_private_access",
+    "requires_aks_key_vault_private_access",
+    "terraform_configuration",
+]
+
+
+def ensure_backend(infra: Path) -> None:
+    """Recreate the generated backend file that a re-extracted source snapshot lacks."""
+    backend = infra / "backend.tf"
+    if not backend.exists():
+        shutil.copyfile(infra / "backend.azurerm.tf.example", backend)
+        backend.chmod(0o600)