infrahub-server 1.4.2__tar.gz → 1.4.4__tar.gz

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: infrahub-server
-Version: 1.4.2
+Version: 1.4.4
 Summary: Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run.
 License: Apache-2.0
 Author: OpsMill
@@ -97,7 +97,7 @@ If you just want to try Infrahub out, you can use our [Infrahub Sandbox](https:/
 
 **Service Catalog** - Infrahub acts as the underlying system to provide infrastructure-as-a-service, allowing you to manage your services and lifecycle them as the services evolve.
 
-**Infrastructure Automation** - Provide infrastructure and network automation workflows with Infrahub rendering configurations and artifacts via Jinja2 and python,then passing to deployment tools such as [Nornir](https://www.opsmill.com/simplifying-network-automation-workflows-with-infrahub-nornir-and-jinja2/), [Ansible](https://docs.infrahub.app/ansible/ansible/), Terraform, or vendor-specific tools.
+**Infrastructure Automation** - Provide infrastructure and network automation workflows with Infrahub rendering configurations and artifacts via Jinja2 and python,then passing to deployment tools such as [Nornir](https://www.opsmill.com/simplifying-network-automation-workflows-with-infrahub-nornir-and-jinja2/), [Ansible](https://docs.infrahub.app/ansible), Terraform, or vendor-specific tools.
 
 **Inventory Management** - Infrahub serves as a centralized inventory system for your infrastructure, allowing you to manage your inventory and track changes to your infrastructure. It provides a WebUI and API for other teams to self-service the information needed to allow the organization to operate.
 
@@ -119,7 +119,7 @@ For longer term tests, you can deploy a local instance of Infrahub by referring
 
 If you'd like to learn more about Infrahub, please refer to the following resources:
 
-- [Infrahub Overview](https://docs.infrahub.app/overview/)
+- [Infrahub Overview](https://docs.infrahub.app/getting-started/overview)
 - [Infrahub Documentation](https://docs.infrahub.app/)
 - [FAQ](https://docs.infrahub.app/faq/)
 

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/README.md

@@ -32,7 +32,7 @@ If you just want to try Infrahub out, you can use our [Infrahub Sandbox](https:/
 
 **Service Catalog** - Infrahub acts as the underlying system to provide infrastructure-as-a-service, allowing you to manage your services and lifecycle them as the services evolve.
 
-**Infrastructure Automation** - Provide infrastructure and network automation workflows with Infrahub rendering configurations and artifacts via Jinja2 and python,then passing to deployment tools such as [Nornir](https://www.opsmill.com/simplifying-network-automation-workflows-with-infrahub-nornir-and-jinja2/), [Ansible](https://docs.infrahub.app/ansible/ansible/), Terraform, or vendor-specific tools.
+**Infrastructure Automation** - Provide infrastructure and network automation workflows with Infrahub rendering configurations and artifacts via Jinja2 and python,then passing to deployment tools such as [Nornir](https://www.opsmill.com/simplifying-network-automation-workflows-with-infrahub-nornir-and-jinja2/), [Ansible](https://docs.infrahub.app/ansible), Terraform, or vendor-specific tools.
 
 **Inventory Management** - Infrahub serves as a centralized inventory system for your infrastructure, allowing you to manage your inventory and track changes to your infrastructure. It provides a WebUI and API for other teams to self-service the information needed to allow the organization to operate.
 
@@ -54,7 +54,7 @@ For longer term tests, you can deploy a local instance of Infrahub by referring
 
 If you'd like to learn more about Infrahub, please refer to the following resources:
 
-- [Infrahub Overview](https://docs.infrahub.app/overview/)
+- [Infrahub Overview](https://docs.infrahub.app/getting-started/overview)
 - [Infrahub Documentation](https://docs.infrahub.app/)
 - [FAQ](https://docs.infrahub.app/faq/)
 

infrahub_server-1.4.4/backend/infrahub/cli/__init__.py

@@ -0,0 +1,127 @@
+import typer
+from infrahub_sdk.async_typer import AsyncTyper
+
+from infrahub import config
+from infrahub.core.initialization import initialization
+
+from ..workers.dependencies import get_database
+from .context import CliContext
+from .db import app as db_app
+from .events import app as events_app
+from .git_agent import app as git_app
+from .server import app as server_app
+from .tasks import app as tasks_app
+from .upgrade import upgrade_cmd
+
+app = AsyncTyper(name="Infrahub CLI", pretty_exceptions_enable=False)
+
+
+@app.callback()
+def common(ctx: typer.Context) -> None:
+    """Infrahub CLI"""
+    ctx.obj = CliContext()
+
+
+app.add_typer(server_app, name="server")
+app.add_typer(git_app, name="git-agent", hidden=True)
+app.add_typer(db_app, name="db")
+app.add_typer(events_app, name="events", help="Interact with the events system.", hidden=True)
+app.add_typer(tasks_app, name="tasks", hidden=True)
+app.command(name="upgrade")(upgrade_cmd)
+
+
+async def _init_shell(config_file: str) -> None:
+    """Launch a Python Interactive shell."""
+    config.load_and_exit(config_file_name=config_file)
+
+    db = await get_database()
+
+    async with db.start_session() as db:
+        await initialization(db=db)
+
+
+@app.command()
+def shell() -> None:
+    """Start a python shell within Infrahub context (requires IPython)."""
+    from infrahub_sdk import InfrahubClient
+    from IPython import start_ipython
+    from traitlets.config import Config
+
+    from infrahub import config
+    from infrahub.components import ComponentType
+    from infrahub.core.branch import Branch
+    from infrahub.core.initialization import initialization
+    from infrahub.core.manager import NodeManager
+    from infrahub.core.registry import registry
+    from infrahub.dependencies.registry import build_component_registry
+    from infrahub.lock import initialize_lock
+    from infrahub.services import InfrahubServices
+    from infrahub.workers.dependencies import (
+        get_cache,
+        get_component,
+        get_database,
+        get_workflow,
+        set_component_type,
+    )
+
+    async def initialize_service() -> InfrahubServices:
+        config.load_and_exit()
+        client = InfrahubClient()
+
+        component_type = ComponentType.GIT_AGENT
+        set_component_type(component_type=component_type)
+
+        database = await get_database()
+
+        build_component_registry()
+
+        workflow = get_workflow()
+        cache = await get_cache()
+        component = await get_component()
+        service = await InfrahubServices.new(
+            cache=cache,
+            client=client,
+            database=database,
+            workflow=workflow,
+            component=component,
+            component_type=component_type,
+        )
+        initialize_lock(service=service)
+
+        async with service.database as db:
+            await initialization(db=db)
+        await service.component.refresh_schema_hash()
+
+        return service
+
+    def welcome() -> None:
+        print("--------------------------------------")
+        print("infrahub interactive shell initialized")
+        print("--------------------------------------")
+        print("Available objects:")
+        print("* db: InfrahubDatabase")
+        print("* Branch: Branch")
+        print("* NodeManager: NodeManager")
+        print("* registry: Registry")
+        print("* service: InfrahubServices")
+        print()
+        print("Example use:")
+        print("In [1] tags = await NodeManager.query(schema='BuiltinTag', db=db)")
+
+    c = Config()
+    c.InteractiveShellApp.exec_lines = [
+        "service = await initialize_service()",
+        "db = service.database",
+        "welcome()",
+    ]
+    c.TerminalInteractiveShell.colors = "Neutral"
+
+    user_ns = {
+        "initialize_service": initialize_service,
+        "welcome": welcome,
+        "NodeManager": NodeManager,
+        "Branch": Branch,
+        "registry": registry,
+    }
+
+    start_ipython(argv=[], config=c, user_ns=user_ns)

infrahub_server-1.4.4/backend/infrahub/core/graph/__init__.py

@@ -0,0 +1 @@
+GRAPH_VERSION = 38

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/backend/infrahub/core/migrations/graph/__init__.py

@@ -39,6 +39,7 @@ from .m034_find_orphaned_schema_fields import Migration034
 from .m035_orphan_relationships import Migration035
 from .m036_drop_attr_value_index import Migration036
 from .m037_index_attr_vals import Migration037
+from .m038_redo_0000_prefix_fix import Migration038
 
 if TYPE_CHECKING:
     from infrahub.core.root import Root
@@ -83,6 +84,7 @@ MIGRATIONS: list[type[GraphMigration | InternalSchemaMigration | ArbitraryMigrat
     Migration035,
     Migration036,
     Migration037,
+    Migration038,
 ]
 
 

infrahub_server-1.4.4/backend/infrahub/core/migrations/graph/m038_redo_0000_prefix_fix.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import ipaddress
+from typing import TYPE_CHECKING, Sequence
+
+from infrahub.core.branch.models import Branch
+from infrahub.core.initialization import initialization
+from infrahub.core.ipam.reconciler import IpamReconciler
+from infrahub.core.manager import NodeManager
+from infrahub.core.migrations.shared import MigrationResult
+from infrahub.core.timestamp import Timestamp
+from infrahub.lock import initialize_lock
+from infrahub.log import get_logger
+
+from ..shared import InternalSchemaMigration, SchemaMigration
+
+if TYPE_CHECKING:
+    from infrahub.database import InfrahubDatabase
+
+log = get_logger()
+
+
+class Migration038(InternalSchemaMigration):
+    """
+    Re-run migration 026 after Migration037 updates AttributeValueIndexed vertices correctly so that the call to
+    NodeManager.query will work
+
+    If someone is upgrading from 1.2.4 (release before migration 026) or earlier to 1.4.x or later, then migration 026
+    fail to find any 0.0.0.0 prefix nodes even if they exist. So we run it again here after migration 037 makes the
+    AttributeValueIndexed changes to be sure it completes correctly.
+    """
+
+    name: str = "038_prefix_0000_fix"
+    minimum_version: int = 37
+    migrations: Sequence[SchemaMigration] = []
+
+    async def validate_migration(self, db: InfrahubDatabase) -> MigrationResult:  # noqa: ARG002
+        return MigrationResult()
+
+    async def execute(self, db: InfrahubDatabase) -> MigrationResult:
+        # load schemas from database into registry
+        initialize_lock()
+        await initialization(db=db)
+
+        at = Timestamp()
+        for branch in await Branch.get_list(db=db):
+            prefix_0000s = await NodeManager.query(
+                db=db, schema="BuiltinIPPrefix", branch=branch, filters={"prefix__values": ["0.0.0.0/0", "::/0"]}
+            )
+            if not prefix_0000s:
+                continue
+            ipam_reconciler = IpamReconciler(db=db, branch=branch)
+            for prefix in prefix_0000s:
+                ip_namespace = await prefix.ip_namespace.get_peer(db=db)
+                ip_network = ipaddress.ip_network(prefix.prefix.value)
+                await ipam_reconciler.reconcile(
+                    ip_value=ip_network,
+                    namespace=ip_namespace,
+                    node_uuid=prefix.get_id(),
+                    at=at,
+                )
+
+        return MigrationResult()

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/backend/infrahub/core/models.py

@@ -73,6 +73,15 @@ class SchemaBranchHash(BaseModel):
     nodes: dict[str, str] = Field(default_factory=dict)
     generics: dict[str, str] = Field(default_factory=dict)
 
+    @property
+    def is_valid(self) -> bool:
+        """
+        TODO: This is a temporary solution to avoid comparing schema hashes if there are less than 2 nodes or generics.
+        """
+        if len(self.nodes) < 2 and len(self.generics) < 2:
+            return False
+        return True
+
     def compare(self, other: SchemaBranchHash) -> SchemaBranchDiff | None:
         if other.main == self.main:
             return None

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/backend/infrahub/core/schema/manager.py

@@ -615,7 +615,9 @@ class SchemaManager(NodeManager):
                 return new_branch_schema
 
         current_schema = self.get_schema_branch(name=branch.name)
-        schema_diff = current_schema.get_hash_full().compare(branch.active_schema_hash)
+        schema_diff = None
+        if branch.active_schema_hash.is_valid and current_schema.get_hash_full().is_valid:
+            schema_diff = current_schema.get_hash_full().compare(branch.active_schema_hash)
         branch_schema = await self.load_schema_from_db(
             db=db, branch=branch, schema=current_schema, schema_diff=schema_diff
         )

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/backend/infrahub/graphql/auth/query_permission_checker/object_permission_checker.py

@@ -7,7 +7,7 @@ from infrahub.core.constants import GLOBAL_BRANCH_NAME, GlobalPermissions, Infra
 from infrahub.core.manager import get_schema
 from infrahub.core.schema.node_schema import NodeSchema
 from infrahub.database import InfrahubDatabase
-from infrahub.graphql.analyzer import InfrahubGraphQLQueryAnalyzer
+from infrahub.graphql.analyzer import GraphQLOperation, InfrahubGraphQLQueryAnalyzer
 from infrahub.graphql.initialization import GraphqlParams
 from infrahub.permissions.constants import PermissionDecisionFlag
 from infrahub.utils import extract_camelcase_words
@@ -119,34 +119,46 @@ class PermissionManagerPermissionChecker(GraphQLQueryPermissionCheckerInterface)
     permission_required = GlobalPermission(
         action=GlobalPermissions.MANAGE_PERMISSIONS.value, decision=PermissionDecision.ALLOW_ALL.value
     )
+    # Map kinds and the relationship to protect from being read
+    kind_relationship_to_check = {
+        InfrahubKind.ACCOUNTROLE: "permissions",
+        InfrahubKind.BASEPERMISSION: "roles",
+        InfrahubKind.GLOBALPERMISSION: "roles",
+        InfrahubKind.OBJECTPERMISSION: "roles",
+    }
 
     async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
-        db: InfrahubDatabase,
+        db: InfrahubDatabase,  # noqa: ARG002
         account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
-        branch: Branch,
+        branch: Branch,  # noqa: ARG002
     ) -> CheckerResolution:
-        is_permission_operation = False
-        kinds = analyzed_query.query_report.impacted_models
-
-        for kind in kinds:
-            schema = get_schema(db=db, branch=branch, node_schema=kind)
-            if is_permission_operation := kind in (
-                InfrahubKind.BASEPERMISSION,
-                InfrahubKind.GLOBALPERMISSION,
-                InfrahubKind.OBJECTPERMISSION,
-            ) or (isinstance(schema, NodeSchema) and InfrahubKind.BASEPERMISSION in schema.inherit_from):
-                break
-
-        if not is_permission_operation:
-            return CheckerResolution.NEXT_CHECKER
-
-        query_parameters.context.active_permissions.raise_for_permission(permission=self.permission_required)
+        for kind, relationship in self.kind_relationship_to_check.items():
+            if (
+                kind in analyzed_query.query_report.requested_read
+                and relationship in analyzed_query.query_report.requested_read[kind].relationships
+            ):
+                query_parameters.context.active_permissions.raise_for_permission(permission=self.permission_required)
+
+        for query in analyzed_query.query_report.queries:
+            if not query.infrahub_model:
+                continue
+
+            # Prevent mutations on permissions and account roles
+            if (
+                query.operation == GraphQLOperation.MUTATION
+                and isinstance(query.infrahub_model, NodeSchema)
+                and (
+                    InfrahubKind.BASEPERMISSION in query.infrahub_model.inherit_from
+                    or query.infrahub_model.kind == InfrahubKind.ACCOUNTROLE
+                )
+            ):
+                query_parameters.context.active_permissions.raise_for_permission(permission=self.permission_required)
 
         return CheckerResolution.NEXT_CHECKER
 

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/backend/infrahub/lock.py

@@ -13,6 +13,7 @@ from redis.asyncio.lock import Lock as GlobalLock
 
 from infrahub import config
 from infrahub.core.timestamp import current_timestamp
+from infrahub.worker import WORKER_IDENTITY
 
 if TYPE_CHECKING:
     from types import TracebackType
@@ -92,7 +93,7 @@ class NATSLock:
         await self.release()
 
     async def acquire(self) -> None:
-        token = current_timestamp()
+        token = f"{current_timestamp()}::{WORKER_IDENTITY}"
         while True:
             if await self.do_acquire(token):
                 self.token = token
@@ -138,9 +139,9 @@ class InfrahubLock:
         if self.use_local:
             self.local = LocalLock()
         elif config.SETTINGS.cache.driver == config.CacheDriver.Redis:
-            self.remote = GlobalLock(redis=self.connection, name=self.name)
+            self.remote = GlobalLock(redis=self.connection, name=f"lock.{self.name}")
         else:
-            self.remote = NATSLock(service=self.connection, name=self.name)
+            self.remote = NATSLock(service=self.connection, name=f"lock.{self.name}")
 
     async def __aenter__(self):
         await self.acquire()
@@ -156,7 +157,7 @@ class InfrahubLock:
     async def acquire(self) -> None:
         with LOCK_ACQUIRE_TIME_METRICS.labels(self.name, self.lock_type).time():
             if not self.use_local:
-                await self.remote.acquire(token=current_timestamp())
+                await self.remote.acquire(token=f"{current_timestamp()}::{WORKER_IDENTITY}")
             else:
                 await self.local.acquire()
         self.acquire_time = time.time_ns()

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/backend/infrahub/tasks/registry.py

@@ -42,7 +42,7 @@ async def create_branch_registry(db: InfrahubDatabase, branch: Branch) -> None:
 
 
 async def update_branch_registry(db: InfrahubDatabase, branch: Branch) -> None:
-    """Update the registry for a branch if the schema hash has changed."""
+    """Update the registry for a branch if the schema hash has changed or the branch was rebased."""
 
     existing_branch: Branch = registry.branch[branch.name]
 
@@ -50,13 +50,23 @@ async def update_branch_registry(db: InfrahubDatabase, branch: Branch) -> None:
         log.warning("Branch schema hash is not set, cannot update branch registry")
         return
 
-    if existing_branch.schema_hash and existing_branch.schema_hash.main == branch.active_schema_hash.main:
+    if existing_branch.schema_hash.main == branch.active_schema_hash.main:
         log.debug(
-            "Branch schema hash is the same, no need to update branch registry",
+            "Branch schema hash is the same, no need to refresh the GraphQL schema within the registry",
             branch=branch.name,
             hash=existing_branch.schema_hash.main,
             worker=WORKER_IDENTITY,
         )
+        if existing_branch.branched_from != branch.branched_from:
+            # If the hash is the same but the branched_from timestamp differs it means
+            # that the branch has been rebased and these timestamps need to be refreshed
+            # in the registry even though the schema doesn't need to be reloaded.
+            log.info(
+                "Updating branched_from property in registry for rebased branch",
+                branch=branch.name,
+                worker=WORKER_IDENTITY,
+            )
+            registry.branch[branch.name] = branch
         return
 
     log.info(

{infrahub_server-1.4.2 → infrahub_server-1.4.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "infrahub-server"
-version = "1.4.2"
+version = "1.4.4"
 description = "Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run."
 authors = ["OpsMill <info@opsmill.com>"]
 readme = "README.md"

infrahub_server-1.4.2/backend/infrahub/cli/__init__.py

@@ -1,60 +0,0 @@
-from asyncio import run as aiorun
-
-import typer
-from infrahub_sdk.async_typer import AsyncTyper
-
-from infrahub import config
-from infrahub.core.initialization import initialization
-
-from ..workers.dependencies import get_database
-from .context import CliContext
-from .db import app as db_app
-from .events import app as events_app
-from .git_agent import app as git_app
-from .server import app as server_app
-from .tasks import app as tasks_app
-from .upgrade import upgrade_cmd
-
-app = AsyncTyper(name="Infrahub CLI", pretty_exceptions_enable=False)
-
-
-@app.callback()
-def common(ctx: typer.Context) -> None:
-    """Infrahub CLI"""
-    ctx.obj = CliContext()
-
-
-app.add_typer(server_app, name="server")
-app.add_typer(git_app, name="git-agent", hidden=True)
-app.add_typer(db_app, name="db")
-app.add_typer(events_app, name="events", help="Interact with the events system.", hidden=True)
-app.add_typer(tasks_app, name="tasks", hidden=True)
-app.command(name="upgrade")(upgrade_cmd)
-
-
-async def _init_shell(config_file: str) -> None:
-    """Launch a Python Interactive shell."""
-    config.load_and_exit(config_file_name=config_file)
-
-    db = await get_database()
-
-    async with db.start_session() as db:
-        await initialization(db=db)
-
-
-@app.command()
-def shell(config_file: str = typer.Argument("infrahub.toml", envvar="INFRAHUB_CONFIG")) -> None:
-    """Start a python shell within Infrahub context."""
-    aiorun(_init_shell(config_file=config_file))
-
-    # TODO add check to properly exit of ipython is not installed
-    from IPython import embed
-    from rich import pretty
-    from traitlets.config import get_config
-
-    pretty.install()
-
-    c = get_config()
-    c.InteractiveShellEmbed.colors = "Linux"
-    c.InteractiveShellApp.extensions.append("rich")
-    embed(config=c)

infrahub_server-1.4.2/backend/infrahub/core/graph/__init__.py

@@ -1 +0,0 @@
-GRAPH_VERSION = 37