leverage 2.2.0rc1__tar.gz → 2.2.0rc2__tar.gz

{leverage-2.2.0rc1 → leverage-2.2.0rc2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: leverage
-Version: 2.2.0rc1
+Version: 2.2.0rc2
 Summary: Binbash Leverage Command-Line tool.
 Home-page: https://github.com/binbashar/leverage
 License: MIT
@@ -25,7 +25,6 @@ Requires-Dist: docker (==6.1.0)
 Requires-Dist: dockerpty (==0.4.1)
 Requires-Dist: docutils (==0.17.1)
 Requires-Dist: jinja2 (==3.0.1)
-Requires-Dist: python-dateutil (>=2.9.0.post0,<3.0.0)
 Requires-Dist: python-hcl2 (==7.3.1)
 Requires-Dist: questionary (==1.10.0)
 Requires-Dist: requests (==2.31)

{leverage-2.2.0rc1 → leverage-2.2.0rc2}/leverage/__init__.py

@@ -4,7 +4,13 @@
 
 # pylint: disable=wrong-import-position
 
-__version__ = "2.2.0rc1"
+__version__ = "2.2.0rc2"
+__toolbox_version__ = "1.3.5-0.2.0"
+
+MINIMUM_VERSIONS = {
+    "TERRAFORM": "1.3.5",
+    "TOOLBOX": "0.2.4",
+}
 
 import sys
 from shutil import which

{leverage-2.2.0rc1 → leverage-2.2.0rc2}/leverage/_internals.py

@@ -27,9 +27,7 @@ class State:
     def __init__(self):
         self._verbosity = None
         self.module = Module()
-        self.config = None
-        self.paths = None
-        self.runner = None
+        self.container = None
 
     @property
     def verbosity(self):
@@ -43,25 +41,13 @@ class State:
 pass_state = click.make_pass_decorator(State, ensure=True)
 
 
-def pass_runner(command):
-    """Decorator to pass the current runner (Terraform/OpenTofu runner) to the command."""
+def pass_container(command):
+    """Decorator to pass the current container to the command."""
 
     @wraps(command)
     def new_command(*args, **kwargs):
         ctx = click.get_current_context()
 
-        return command(ctx.obj.runner, *args, **kwargs)
-
-    return new_command
-
-
-def pass_paths(command):
-    """Decorator to pass the current project paths to the command."""
-
-    @wraps(command)
-    def new_command(*args, **kwargs):
-        ctx = click.get_current_context()
-
-        return command(ctx.obj.paths, *args, **kwargs)
+        return command(ctx.obj.container, *args, **kwargs)
 
     return new_command

{leverage-2.2.0rc1 → leverage-2.2.0rc2}/leverage/_utils.py

@@ -3,8 +3,8 @@
 """
 
 from pathlib import Path
-from subprocess import PIPE, run
-from typing import List, Optional
+from subprocess import run
+from subprocess import PIPE
 
 import hcl2
 import lark
@@ -153,12 +153,12 @@ class ContainerSession:
         self.docker_client.api.remove_container(self.container_data)
 
 
-def key_finder(d: dict, target: str, avoid: Optional[str] = None) -> List[str]:
+def key_finder(d: dict, target: str, avoid: str = None):
     """
     Iterate over a dict of dicts and/or lists of dicts, looking for a key with value "target".
     Collect and return all the values that matches "target" as key.
     """
-    values: List[str] = []
+    values = []
 
     for key, value in d.items():
         if isinstance(value, dict):

leverage-2.2.0rc2/leverage/leverage.py

@@ -0,0 +1,68 @@
+"""
+    Binbash Leverage Command-line tool.
+"""
+
+import rich
+from packaging.version import Version
+
+import click
+
+from leverage import __version__, conf, MINIMUM_VERSIONS
+from leverage._internals import pass_state
+from leverage.modules.aws import aws
+from leverage.modules.credentials import credentials
+from leverage.modules import run, project, tofu, terraform, tfautomv, kubectl, shell
+from leverage.path import NotARepositoryError
+
+
+@click.group(invoke_without_command=True)
+@click.option("-v", "--verbose", is_flag=True, help="Increase output verbosity.")
+@click.version_option(version=__version__)
+@pass_state
+@click.pass_context
+def leverage(context, state, verbose):
+    """Leverage Reference Architecture projects command-line tool."""
+    # --verbose | -v
+    state.verbosity = verbose
+    if context.invoked_subcommand is None:
+        # leverage called with no subcommand
+        click.echo(context.get_help())
+
+    # if there is a version restriction set, make sure we satisfy it
+    try:
+        config = conf.load()
+    except NotARepositoryError:
+        # restrictions are only verified within a leverage project
+        return
+
+    # check if the current versions are lower than the minimum required
+    if not (image_tag := config.get("TF_IMAGE_TAG", config.get("TERRAFORM_IMAGE_TAG"))):
+        # at some points of the project (the init), the config file is not created yet
+        return
+
+    # validate both TOOLBOX and TF versions
+    image_versions = image_tag.split("-")
+    if "tofu" not in image_versions:
+        versions = zip(MINIMUM_VERSIONS, image_versions)
+    else:
+        versions = {"TOOLBOX": image_versions[-1]}.items()
+
+    for key, current in versions:
+        if Version(current) < Version(MINIMUM_VERSIONS[key]):
+            rich.print(
+                f"[red]WARNING[/red]\tYour current {key} version ({current}) is lower than the required minimum ({MINIMUM_VERSIONS[key]})."
+            )
+
+
+# Add modules to leverage
+leverage.add_command(run)
+leverage.add_command(project)
+leverage.add_command(tofu)
+leverage.add_command(tofu, name="tf")
+leverage.add_command(terraform)
+leverage.add_command(credentials)
+leverage.add_command(aws)
+leverage.add_command(tfautomv)
+leverage.add_command(kubectl)
+leverage.add_command(kubectl, name="kc")
+leverage.add_command(shell)

leverage-2.2.0rc2/leverage/modules/__init__.py

@@ -0,0 +1,6 @@
+from .run import run
+from .project import project
+from .tf import tofu, terraform
+from .tfautomv import tfautomv
+from .kubectl import kubectl
+from .shell import shell

{leverage-2.2.0rc1 → leverage-2.2.0rc2}/leverage/modules/auth.py

@@ -1,8 +1,5 @@
 import time
-import json
 from pathlib import Path
-from datetime import datetime
-from dateutil.tz import tzutc
 from configparser import NoSectionError, NoOptionError
 
 import boto3
@@ -10,7 +7,6 @@ from botocore.exceptions import ClientError
 from configupdater import ConfigUpdater
 
 from leverage import logger
-from leverage.path import PathsHandler
 from leverage._utils import key_finder, ExitError, get_or_create_section, parse_tf_file
 
 
@@ -25,14 +21,10 @@ def get_layer_profile(raw_profile: str, config_updater: ConfigUpdater, tf_profil
         raise SkipProfile
 
     # if it is exactly that variable, we already know the layer profile is tf_profile
-    layer_profile = tf_profile if raw_profile in ("${var.profile}", "each.value.profile") else None
+    layer_profile = tf_profile if raw_profile == "${var.profile}" else None
 
     # replace variables with their corresponding values
-    raw = (
-        raw_profile.replace("${var.profile}", tf_profile)
-        .replace("${var.project}", project)
-        .replace("each.value.profile", tf_profile)
-    )
+    raw = raw_profile.replace("${var.profile}", tf_profile).replace("${var.project}", project)
 
     # the project and the role are at the beginning and end of the string
     _, *account_name, _ = raw.split("-")
@@ -65,15 +57,15 @@ def update_config_section(updater: ConfigUpdater, layer_profile: str, data: dict
     updater.update_file()
 
 
-def get_profiles(paths: PathsHandler):
+def get_profiles(cli):
     """
     Get the AWS profiles present on the layer by parsing some tf files.
     """
     raw_profiles = set()
     # these are files from the layer we are currently on
-    for name in ("config.tf", "locals.tf", "runtime.tf"):
+    for name in ("config.tf", "locals.tf"):
         try:
-            tf_config = parse_tf_file(Path(paths.cwd / name))
+            tf_config = parse_tf_file(Path(cli.paths.cwd / name))
         except FileNotFoundError:
             continue
 
@@ -82,65 +74,25 @@ def get_profiles(paths: PathsHandler):
         raw_profiles.update(set(key_finder(tf_config, "profile", "lookup")))
 
     # the profile value from <layer>/config/backend.tfvars
-    backend_config = parse_tf_file(paths.backend_tfvars)
+    backend_config = parse_tf_file(cli.paths.local_backend_tfvars)
     tf_profile = backend_config["profile"]
 
     return tf_profile, raw_profiles
 
 
-def get_sso_access_token(sso_token_file: Path) -> str:
-    """
-    Get the SSO access token from the token file.
-    """
-    return json.loads(sso_token_file.read_text())["accessToken"]
-
-
-def check_sso_token(paths: PathsHandler):
-    """Check for the existence and validity of the SSO token to be used to get credentials."""
-
-    # Adding `token` file name to this function in order to
-    # meet the requirement regarding to have just one
-    # token file in the sso/cache
-    sso_role = paths.account_conf.get("sso_role")
-    token_file = paths.sso_cache / sso_role
-
-    token_files = list(paths.sso_cache.glob("*"))
-    if not token_files:
-        raise ExitError(1, "No AWS SSO token found. Please log in or configure SSO.")
-
-    if token_file not in token_files and paths.sso_token_file not in token_files:
-        raise ExitError(
-            1,
-            "No valid AWS SSO token found for current account.\n"
-            "Please log out and reconfigure SSO before proceeding.",
-        )
-
-    token = json.loads(paths.sso_token_file.read_text())
-    expiry = datetime.strptime(token.get("expiresAt"), "%Y-%m-%dT%H:%M:%SZ")
-    renewal = datetime.now()
-
-    if expiry < renewal:
-        raise ExitError(
-            1,
-            "AWS SSO token has expired, please log back in by running [bold]leverage aws sso login[/bold]"
-            " to refresh your credentials before re-running the last command.",
-        )
-
-
-def refresh_layer_credentials(paths: PathsHandler):
-    tf_profile, raw_profiles = get_profiles(paths)
+def refresh_layer_credentials(cli):
+    tf_profile, raw_profiles = get_profiles(cli)
     config_updater = ConfigUpdater()
-    config_updater.read(paths.aws_config_file)
+    config_updater.read(cli.paths.host_aws_profiles_file)
 
-    region = config_updater.get(f"profile {paths.project}-sso", "sso_region").value
-    client = boto3.client("sso", region_name=region)
+    client = boto3.client("sso", region_name=cli.sso_region_from_main_profile)
     for raw in raw_profiles:
         try:
             account_id, account_name, sso_role, layer_profile = get_layer_profile(
                 raw,
                 config_updater,
                 tf_profile,
-                paths.project,
+                cli.project,
             )
         except SkipProfile:
             continue
@@ -167,7 +119,7 @@ def refresh_layer_credentials(paths: PathsHandler):
             credentials = client.get_role_credentials(
                 roleName=sso_role,
                 accountId=account_id,
-                accessToken=get_sso_access_token(paths.sso_token_file),
+                accessToken=cli.get_sso_access_token(),
             )["roleCredentials"]
         except ClientError as error:
             if error.response["Error"]["Code"] in ("AccessDeniedException", "ForbiddenException"):
@@ -177,8 +129,6 @@ def refresh_layer_credentials(paths: PathsHandler):
                     " in this account.\nPlease check with your administrator or try"
                     " running [bold]leverage aws configure sso[/bold].",
                 )
-            else:
-                raise ExitError(50, f"Error retrieving role credentials: {error}")
 
         # update expiration on aws/<project>/config
         logger.info(f"Writing {layer_profile} profile")
@@ -190,9 +140,10 @@ def refresh_layer_credentials(paths: PathsHandler):
             },
         )
         # write credentials on aws/<project>/credentials (create the file if it doesn't exist first)
-        paths.aws_credentials_file.touch(exist_ok=True)
+        creds_path = Path(cli.paths.host_aws_credentials_file)
+        creds_path.touch(exist_ok=True)
         credentials_updater = ConfigUpdater()
-        credentials_updater.read(paths.aws_credentials_file)
+        credentials_updater.read(cli.paths.host_aws_credentials_file)
 
         update_config_section(
             credentials_updater,

leverage-2.2.0rc2/leverage/modules/aws.py

@@ -0,0 +1,225 @@
+import boto3
+import click
+from click.exceptions import Exit
+from configupdater import ConfigUpdater
+
+from leverage import logger
+from leverage._internals import pass_state
+from leverage._internals import pass_container
+from leverage._utils import get_or_create_section
+from leverage.container import get_docker_client, SSOContainer
+from leverage.container import AWSCLIContainer
+from leverage.modules.utils import _handle_subcommand
+
+CONTEXT_SETTINGS = {"ignore_unknown_options": True}
+
+
+def get_account_roles(sso_client, access_token: str) -> dict:
+    """
+    Fetch the accounts and roles from the user.
+    """
+    account_roles = {}
+
+    accounts = sso_client.list_accounts(accessToken=access_token)
+    for account in accounts["accountList"]:
+        acc_role = sso_client.list_account_roles(
+            accessToken=access_token,
+            accountId=account["accountId"],
+            maxResults=1,  # assume the first role is always the correct one
+        )["roleList"][0]
+
+        account_roles[account["accountName"]] = {
+            "account_id": account["accountId"],
+            "role_name": acc_role["roleName"],
+        }
+
+    return account_roles
+
+
+def add_sso_profile(
+    config_updater: ConfigUpdater, section_name: str, role_name: str, account_id: str, region: str, start_url: str
+):
+    """
+    Add a profile to the config file.
+    """
+    section = get_or_create_section(config_updater, section_name)
+
+    data = {
+        "role_name": role_name,
+        "account_id": account_id,
+        "sso_region": region,
+        "sso_start_url": start_url,
+    }
+    for k, v in data.items():
+        # can't set a dict directly, so we need to go field by field
+        section[k] = v
+
+
+def configure_sso_profiles(cli: SSOContainer):
+    """
+    Populate the ~./aws/<project>/config file with the sso profiles from the accounts.
+    """
+    updater = ConfigUpdater()
+    updater.read(cli.paths.host_aws_profiles_file)
+
+    # get values from the default profile first
+    default_sso_profile_name = f"profile {cli.project}-sso"
+    default_profile = updater[default_sso_profile_name]
+    region = default_profile["sso_region"].value
+    start_url = default_profile["sso_start_url"].value
+
+    # then set a profile for each account
+    access_token = cli.get_sso_access_token()
+    logger.info(f"Fetching accounts and roles...")
+    client = boto3.client("sso", region_name=region)
+    account_roles = get_account_roles(client, access_token)
+    for acc_name, values in account_roles.items():
+        # account names comes in the form of: {long project name}-{account name}
+        short_acc_name = acc_name.replace(cli.paths.project_long + "-", "")
+        section_name = f"profile {cli.project}-sso-{short_acc_name}"
+        logger.info(f"Adding {section_name}")
+        add_sso_profile(updater, section_name, values["role_name"], values["account_id"], region, start_url)
+
+    # save/update the profile file
+    updater.update_file()
+
+
+@click.group(invoke_without_command=True, add_help_option=False, context_settings=CONTEXT_SETTINGS)
+@click.argument("args", nargs=-1, type=click.UNPROCESSED)
+@pass_state
+@click.pass_context
+def aws(context, state, args):
+    """Run AWS CLI commands in a custom containerized environment."""
+    cli = AWSCLIContainer(get_docker_client())
+    state.container = cli
+    state.container.ensure_image()
+
+    _handle_subcommand(context=context, cli_container=cli, args=args)
+
+
+@aws.group(invoke_without_command=True, add_help_option=False, context_settings=CONTEXT_SETTINGS)
+@click.argument("args", nargs=-1, type=click.UNPROCESSED)
+@pass_container
+@click.pass_context
+def configure(context, cli, args):
+    """configure"""
+    _handle_subcommand(context=context, cli_container=cli, args=args, caller_name="configure")
+
+
+@configure.command("sso")
+@pass_container
+@click.pass_context
+def _sso(context, cli):
+    """configure sso"""
+    cli.paths.check_for_layer_location()
+
+    # region_primary was added in refarch v1
+    # for v2 it was replaced by region at project level
+    region_primary = "region_primary"
+    if "region_primary" not in cli.paths.common_conf:
+        region_primary = "region"
+    default_region = cli.paths.common_conf.get(region_primary, cli.paths.common_conf.get("sso_region"))
+    if default_region is None:
+        logger.error("No primary region configured in global config file.")
+        raise Exit(1)
+
+    logger.info("Configuring default profile.")
+    default_profile = {"region": default_region, "output": "json"}
+    for key, value in default_profile.items():
+        cli.exec(f"configure set {key} {value}", profile="default")
+
+    if not all(sso_key in cli.paths.common_conf for sso_key in ("sso_start_url", "sso_region")):
+        logger.error("Missing configuration values for SSO in global config file.")
+        raise Exit(1)
+
+    sso_role = cli.paths.account_conf.get("sso_role")
+    if not sso_role:
+        logger.error("Missing SSO role in account config file.")
+        raise Exit(1)
+
+    current_account = cli.paths.account_conf.get("environment")
+    try:
+        # this is for refarch v1
+        account_id = cli.paths.common_conf.get("accounts").get(current_account).get("id")
+    except AttributeError:
+        # this is for refarch v2
+        try:
+            # this is for accounts with no org unit on top of it
+            account_id = cli.paths.common_conf.get("organization").get("accounts").get(current_account).get("id")
+        except AttributeError:
+            try:
+                # this is for accounts with no org unit on top of it
+                found = False
+                for ou in cli.paths.common_conf.get("organization").get("organizational_units"):
+                    if current_account in cli.paths.common_conf.get("organization").get("organizational_units").get(
+                        ou
+                    ).get("accounts"):
+                        account_id = (
+                            cli.paths.common_conf.get("organization")
+                            .get("organizational_units")
+                            .get(ou)
+                            .get("accounts")
+                            .get(current_account)
+                            .get("id")
+                        )
+                        found = True
+                        break
+                if not found:
+                    raise AttributeError
+            except AttributeError:
+                logger.error(f"Missing account configuration for [bold]{current_account}[/bold] in global config file.")
+                raise Exit(1)
+    if not account_id:
+        logger.error(f"Missing id for account [bold]{current_account}[/bold].")
+        raise Exit(1)
+
+    logger.info(f"Configuring [bold]{cli.project}-sso[/bold] profile.")
+    sso_profile = {
+        "sso_start_url": cli.paths.common_conf.get("sso_start_url"),
+        "sso_region": cli.paths.common_conf.get("sso_region", cli.paths.common_conf.get(region_primary)),
+        "sso_account_id": account_id,
+        "sso_role_name": sso_role,
+    }
+    for key, value in sso_profile.items():
+        cli.exec(f"configure set {key} {value}", profile=f"{cli.project}-sso")
+
+    context.invoke(login)
+
+    logger.info("Storing account information.")
+    configure_sso_profiles(cli)
+
+
+@aws.group(invoke_without_command=True, add_help_option=False, context_settings=CONTEXT_SETTINGS)
+@click.argument("args", nargs=-1, type=click.UNPROCESSED)
+@pass_container
+@click.pass_context
+def sso(context, cli, args):
+    """sso"""
+    _handle_subcommand(context=context, cli_container=cli, args=args, caller_name="sso")
+
+
+@sso.command()
+@pass_container
+def login(cli):
+    """Login"""
+    exit_code, region = cli.exec(f"configure get sso_region --profile {cli.project}-sso")
+    if exit_code:
+        logger.error(f"Region configuration for [bold]{cli.project}-sso[/bold] profile not found.")
+        raise Exit(1)
+
+    if exit_code := cli.sso_login():
+        raise Exit(exit_code)
+
+
+@sso.command()
+@pass_container
+def logout(cli):
+    """Logout"""
+    exit_code = cli.system_start(cli.AWS_SSO_LOGOUT_SCRIPT)
+    if exit_code:
+        raise Exit(exit_code)
+
+    logger.info(
+        f"Don't forget to log out of your [bold]AWS SSO[/bold] start page {cli.paths.common_conf.get('sso_start_url')}"
+        " and your external identity provider portal."
+    )

{leverage-2.2.0rc1 → leverage-2.2.0rc2}/leverage/modules/credentials.py

@@ -14,6 +14,7 @@ from click.exceptions import Exit
 from questionary import Choice
 from ruamel.yaml import YAML
 
+from leverage import __toolbox_version__
 from leverage import logger
 from leverage._internals import pass_state
 from leverage._utils import ExitError
@@ -264,6 +265,8 @@ def credentials(state):
         if short_name is None or not re.match("^[a-z]{2,4}$", short_name):
             logger.error("Invalid or missing project short name in project.yaml file.")
             raise Exit(1)
+        if not build_env.exists():
+            build_env.write_text(f"PROJECT={short_name}\nTF_IMAGE_TAG={__toolbox_version__}")
     elif not build_env.exists():
         # project_config is not empty
         # and build.env does not exist

leverage-2.2.0rc2/leverage/modules/shell.py

@@ -0,0 +1,44 @@
+import click
+
+from leverage._utils import CustomEntryPoint
+from leverage.container import get_docker_client, TFContainer
+from leverage.modules.utils import env_var_option, mount_option, auth_sso, auth_mfa
+
+
+@click.command()
+@mount_option
+@env_var_option
+@auth_mfa
+@auth_sso
+def shell(mount, env_var, mfa, sso):
+    """
+    Run a shell in a generic container. It supports mounting local paths and injecting arbitrary environment variables.
+    It also supports AWS credentials injection via mfa/sso.
+
+    Syntax:
+    leverage shell --mount <local-path> <container-path> --env-var <name> <value>
+
+    Example:
+    leverage shell --mount /home/user/bin/ /usr/bin/ --env-var env dev
+
+    Both mount and env-var parameters can be provided multiple times.
+
+    Example:
+    leverage shell --mount /home/user/bin/ /usr/bin/ --mount /etc/config.ini /etc/config.ini --env-var init 5 --env-var env dev
+    """
+    if env_var:
+        env_var = dict(env_var)
+    # TODO: TFContainer is the only class supporting sso/mfa auth automagically
+    #       Move this capacity into a mixin later
+    container = TFContainer(get_docker_client(), mounts=mount, env_vars=env_var)
+    container.ensure_image()
+
+    # auth
+    container.disable_authentication()
+    if sso:
+        container.enable_sso()
+    if mfa:
+        container.enable_mfa()
+
+    with CustomEntryPoint(container, entrypoint=""):
+        container._start(container.SHELL)