leverage 2.2.0rc1__tar.gz → 2.2.0rc3__tar.gz

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: leverage
-Version: 2.2.0rc1
+Version: 2.2.0rc3
 Summary: Binbash Leverage Command-Line tool.
 Home-page: https://github.com/binbashar/leverage
 License: MIT
@@ -21,10 +21,9 @@ Classifier: Topic :: Software Development :: Build Tools
 Requires-Dist: boto3 (==1.33.2)
 Requires-Dist: click (==8.0.1)
 Requires-Dist: configupdater (==3.2)
-Requires-Dist: docker (==6.1.0)
-Requires-Dist: dockerpty (==0.4.1)
 Requires-Dist: docutils (==0.17.1)
 Requires-Dist: jinja2 (==3.0.1)
+Requires-Dist: prompt-toolkit (==3.0.51)
 Requires-Dist: python-dateutil (>=2.9.0.post0,<3.0.0)
 Requires-Dist: python-hcl2 (==7.3.1)
 Requires-Dist: questionary (==1.10.0)

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/leverage/__init__.py

@@ -4,7 +4,7 @@
 
 # pylint: disable=wrong-import-position
 
-__version__ = "2.2.0rc1"
+__version__ = "2.2.0rc3"
 
 import sys
 from shutil import which

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/leverage/_utils.py

@@ -8,10 +8,8 @@ from typing import List, Optional
 
 import hcl2
 import lark
-from click.exceptions import Exit
+from click.exceptions import ClickException
 from configupdater import ConfigUpdater
-from docker import DockerClient
-from docker.models.containers import Container
 
 from leverage import logger
 
@@ -64,56 +62,17 @@ def git(command):
     run(command, stdout=PIPE, stderr=PIPE, check=True)
 
 
-class CustomEntryPoint:
-    """
-    Set a custom entrypoint on the container while entering the context.
-    Once outside, return it to its original value.
-    """
-
-    def __init__(self, container, entrypoint):
-        self.container = container
-        self.old_entrypoint = container.entrypoint
-        self.new_entrypoint = entrypoint
-
-    def __enter__(self):
-        self.container.entrypoint = self.new_entrypoint
-
-    def __exit__(self, *args, **kwargs):
-        self.container.entrypoint = self.old_entrypoint
-
-
-class AwsCredsEntryPoint(CustomEntryPoint):
-    """
-    Fetching AWS credentials by setting the SSO/MFA entrypoints.
-    """
-
-    def __init__(self, container, override_entrypoint=None):
-        auth_method = container.auth_method()
-
-        new_entrypoint = f"{auth_method}{container.entrypoint if override_entrypoint is None else override_entrypoint}"
-        super(AwsCredsEntryPoint, self).__init__(container, entrypoint=new_entrypoint)
-
-    def __exit__(self, *args, **kwargs):
-        super(AwsCredsEntryPoint, self).__exit__(*args, **kwargs)
-        if self.container.mfa_enabled:
-            self.container.environment.update(
-                {
-                    "AWS_SHARED_CREDENTIALS_FILE": self.container.environment["AWS_SHARED_CREDENTIALS_FILE"].replace(
-                        ".aws", "tmp"
-                    ),
-                    "AWS_CONFIG_FILE": self.container.environment["AWS_CONFIG_FILE"].replace(".aws", "tmp"),
-                }
-            )
-
-
-class ExitError(Exit):
+class ExitError(ClickException):
     """
     Raise an Exit exception but also print an error description.
     """
 
     def __init__(self, exit_code: int, error_description: str):
-        logger.error(error_description)
-        super(ExitError, self).__init__(exit_code)
+        self.exit_code = exit_code
+        super(ExitError, self).__init__(message=error_description)
+
+    def show(self):
+        logger.error(self.message)
 
 
 def parse_tf_file(file: Path):
@@ -134,25 +93,6 @@ def parse_tf_file(file: Path):
         return parsed
 
 
-class ContainerSession:
-    """
-    Handle the start/stop cycle of a container.
-    Useful when you need to keep your container alive to share context between multiple commands.
-    """
-
-    def __init__(self, docker_client: DockerClient, container_data):
-        self.docker_client = docker_client
-        self.container_data = container_data
-
-    def __enter__(self) -> Container:
-        self.docker_client.api.start(self.container_data)
-        return self.docker_client.containers.get(self.container_data["Id"])
-
-    def __exit__(self, exc_type, exc_value, exc_tb):
-        self.docker_client.api.stop(self.container_data)
-        self.docker_client.api.remove_container(self.container_data)
-
-
 def key_finder(d: dict, target: str, avoid: Optional[str] = None) -> List[str]:
     """
     Iterate over a dict of dicts and/or lists of dicts, looking for a key with value "target".

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/leverage/leverage.py

@@ -2,19 +2,12 @@
     Binbash Leverage Command-line tool.
 """
 
-import rich
-from packaging.version import Version
-
 import click
 
 from leverage import __version__, conf
 from leverage._internals import pass_state
-
-# from leverage.modules.credentials import credentials
-from leverage.modules import aws, run, tofu, terraform
-
-# from leverage.modules import run, project, tofu, terraform, tfautomv, kubectl, shell
 from leverage.path import NotARepositoryError, PathsHandler
+from leverage.modules import aws, credentials, run, project, tofu, terraform, tfautomv, kubectl
 
 
 @click.group(invoke_without_command=True)
@@ -39,12 +32,12 @@ def leverage(context, state, verbose):
 
 # Add modules to leverage
 leverage.add_command(run)
-# leverage.add_command(project)
+leverage.add_command(project)
 leverage.add_command(tofu)
 leverage.add_command(tofu, name="tf")
 leverage.add_command(terraform)
-# leverage.add_command(credentials)
+leverage.add_command(credentials)
 leverage.add_command(aws)
-# leverage.add_command(tfautomv)
-# leverage.add_command(kubectl)
-# leverage.add_command(kubectl, name="kc")
+leverage.add_command(tfautomv)
+leverage.add_command(kubectl)
+leverage.add_command(kubectl, name="kc")

leverage-2.2.0rc3/leverage/modules/__init__.py

@@ -0,0 +1,7 @@
+from .run import run
+from .project import project
+from .aws import aws
+from .tf import tofu, terraform
+from .credentials import credentials
+from .tfautomv import tfautomv
+from .kubectl import kubectl

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/leverage/modules/auth.py

@@ -2,7 +2,6 @@ import time
 import json
 from pathlib import Path
 from datetime import datetime
-from dateutil.tz import tzutc
 from configparser import NoSectionError, NoOptionError
 
 import boto3

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/leverage/modules/aws.py

@@ -13,9 +13,9 @@ from leverage import logger
 from leverage.path import PathsHandler
 from leverage.modules.runner import Runner
 from leverage.modules.utils import _handle_subcommand
-from leverage.modules.auth import get_sso_access_token
 from leverage._utils import get_or_create_section, ExitError
 from leverage._internals import pass_state, pass_runner, pass_paths
+from leverage.modules.auth import get_sso_access_token, check_sso_token, refresh_layer_credentials
 
 
 CONTEXT_SETTINGS = {"ignore_unknown_options": True}
@@ -24,6 +24,21 @@ CONTEXT_SETTINGS = {"ignore_unknown_options": True}
 AWS_SSO_LOGIN_URL = "{sso_url}/#/device?user_code={user_code}"
 
 
+@pass_paths
+def refresh_aws_credentials(paths: PathsHandler) -> None:
+    """
+    Refresh the AWS credentials for the current project.
+    """
+    check_sso_token(paths)
+
+    try:  # if we are not in a layer, we don't need to refresh the credentials
+        paths.check_for_layer_location()
+    except ExitError:
+        return
+
+    refresh_layer_credentials(paths)
+
+
 def get_account_roles(sso_client: Any, access_token: str) -> Dict[str, Dict[str, str]]:
     """
     Fetch the accounts and roles from the user.
@@ -100,7 +115,7 @@ def configure_sso_profiles(paths: PathsHandler) -> None:
 @pass_state
 @click.pass_context
 def aws(context: click.Context, state: Any, args: Tuple[str, ...]) -> None:
-    """Run AWS CLI commands in a custom containerized environment."""
+    """Run AWS CLI commands in the context of the current project."""
 
     credentials_env_vars = {
         "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
@@ -115,7 +130,7 @@ def aws(context: click.Context, state: Any, args: Tuple[str, ...]) -> None:
         env_vars=credentials_env_vars,
     )
 
-    _handle_subcommand(context=context, runner=state.runner, args=args)
+    _handle_subcommand(context=context, runner=state.runner, args=args, pre_invocation_callback=refresh_aws_credentials)
 
 
 @aws.group(invoke_without_command=True, add_help_option=False, context_settings=CONTEXT_SETTINGS)

{leverage-2.2.0rc1 → leverage-2.2.0rc3}/leverage/modules/credentials.py

@@ -5,23 +5,26 @@
 import csv
 import json
 import re
-from functools import wraps
 from pathlib import Path
+from functools import wraps
+from typing import Optional, Union
 
 import click
 import questionary
-from click.exceptions import Exit
-from questionary import Choice
 from ruamel.yaml import YAML
+from questionary import Choice
+from click.exceptions import Exit
 
 from leverage import logger
-from leverage._internals import pass_state
 from leverage._utils import ExitError
-from leverage.container import AWSCLIContainer
-from leverage.container import get_docker_client
-from leverage.path import NotARepositoryError
-from leverage.path import get_global_config_path
-from leverage.path import get_project_root_or_current_dir_path
+from leverage.modules.runner import Runner
+from leverage._internals import State, pass_runner, pass_paths, pass_state
+from leverage.path import (
+    NotARepositoryError,
+    PathsHandler,
+    get_global_config_path,
+    get_project_root_or_current_dir_path,
+)
 
 # Regexes for general validation
 PROJECT_SHORT = r"[a-z]{2,4}"
@@ -212,9 +215,6 @@ def _ask_for_credentials():
     return list(credentials.values())
 
 
-AWSCLI = None
-
-
 def _load_project_yaml():
     """Load project.yaml file contents."""
     if not PROJECT_CONFIG.exists():
@@ -252,7 +252,7 @@ def credentials(state):
             raise an exception
 
     If we reached the only common.tfvars scenario, we have no project name nor TF_IMAGE_TAG.
-    So the best chance is to read the common.tfvars directly without a conatiner, e.g. with sed or grep
+    So the best chance is to read the common.tfvars directly without a container, e.g. with sed or grep
     """
     project_config = _load_project_yaml()
     build_env = Path(f"{PROJECT_ROOT}/build.env")
@@ -287,13 +287,23 @@ def credentials(state):
     else:
         logger.info("Reading info from build.env")
 
-    state.container = AWSCLIContainer(get_docker_client())
-    state.container.ensure_image()
-    global AWSCLI
-    AWSCLI = state.container
+    credentials_env_vars = {
+        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
+        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
+    }
+    state.runner = Runner(
+        binary="aws",
+        error_message=(
+            f"AWS CLI not found on system. "
+            f"Please install it following the instructions at: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"
+        ),
+        env_vars=credentials_env_vars,
+    )
 
 
-def _load_configs_for_credentials():
+@pass_state
+@pass_paths
+def _load_configs_for_credentials(paths: PathsHandler, state: State):
     """Load all required values to configure credentials.
 
     Raises:
@@ -306,11 +316,11 @@ def _load_configs_for_credentials():
     project_config = _load_project_yaml()
 
     logger.info("Loading project environment configuration file.")
-    env_config = AWSCLI.env_conf
+    env_config = state.config
 
     terraform_config = {}
     logger.info("Loading tf common configuration.")
-    terraform_config = AWSCLI.paths.common_conf
+    terraform_config = paths.common_conf
 
     config_values = {}
     config_values["short_name"] = (
@@ -321,7 +331,7 @@ def _load_configs_for_credentials():
     )
     config_values["project_name"] = project_config.get("project_name") or terraform_config.get("project_long")
 
-    # region_primary was added in refarch v1
+    # region_primary was added in ref-arch v1
     # for v2 it was replaced by region at project level
     region_primary = "region_primary"
     if not "region_primary" in project_config and not "region_primary" in terraform_config:
@@ -355,7 +365,8 @@ def _load_configs_for_credentials():
     return config_values
 
 
-def _profile_is_configured(profile):
+@pass_runner
+def _profile_is_configured(awscli: Runner, profile: str):
     """Check if given profile is already configured.
 
     Args:
@@ -364,7 +375,7 @@ def _profile_is_configured(profile):
     Returns:
         bool: Whether the profile was already configured or not.
     """
-    exit_code, _ = AWSCLI.exec("configure list", profile)
+    exit_code, _ = awscli.exec("configure", "list", "--profile", profile)
 
     return not exit_code
 
@@ -384,7 +395,7 @@ def _extract_credentials(file):
     Returns:
         str, str: Key ID, Secret Key
     """
-    with open(file) as access_keys_file:
+    with open(file, encoding="utf-8-sig") as access_keys_file:
         try:
             keys = next(csv.DictReader(access_keys_file))
 
@@ -407,19 +418,15 @@ def _extract_credentials(file):
     return access_key_id, secret_access_key
 
 
-def _backup_file(filename):
-    """Create backup of a credential file using docker image.
-
-    Args:
-        filename (str): File to backup, either `config` or `credentials`
-    """
-    credential_files_env_vars = {"config": "AWS_CONFIG_FILE", "credentials": "AWS_SHARED_CREDENTIALS_FILE"}
-    env_var = credential_files_env_vars.get(filename)
-
-    AWSCLI.system_exec(f"sh -c 'cp ${env_var} \"${{{env_var}}}.bkp\"'")
-
-
-def configure_credentials(profile, file=None, make_backup=False):
+@pass_paths
+@pass_runner
+def configure_credentials(
+    awscli: Runner,
+    paths: PathsHandler,
+    profile: str,
+    file: Optional[Union[Path, str]] = None,
+    make_backup: bool = False,
+):
     """Set credentials in `credentials` file for AWS cli. Make backup if required.
 
     Args:
@@ -437,17 +444,18 @@ def configure_credentials(profile, file=None, make_backup=False):
 
     if make_backup:
         logger.info("Backing up credentials file.")
-        _backup_file("credentials")
+        Path(paths.aws_credentials_file).copy(Path(paths.aws_credentials_file).with_suffix(".bkp"))
 
     values = {"aws_access_key_id": key_id, "aws_secret_access_key": secret_key}
 
     for key, value in values.items():
-        exit_code, output = AWSCLI.exec(f"configure set {key} {value}", profile)
+        exit_code, output = awscli.exec("configure", "set", key, value, "--profile", profile)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
 
-def _credentials_are_valid(profile):
+@pass_runner
+def _credentials_are_valid(awscli: Runner, profile: str):
     """Check if credentials for given profile are valid.
     If credentials are invalid, the command output will be as follows:
     Exit code:
@@ -462,12 +470,13 @@ def _credentials_are_valid(profile):
     Returns:
         bool: Whether the credentials are valid.
     """
-    error_code, output = AWSCLI.exec("sts get-caller-identity", profile)
+    error_code, output = awscli.exec("sts", "get-caller-identity", "--profile", profile)
 
     return error_code != 255 and "InvalidClientTokenId" not in output
 
 
-def _get_management_account_id(profile):
+@pass_runner
+def _get_management_account_id(awscli: Runner, profile: str):
     """Get management account id through AWS cli.
 
     Args:
@@ -476,7 +485,7 @@ def _get_management_account_id(profile):
     Returns:
         str: Management account id.
     """
-    exit_code, caller_identity = AWSCLI.exec("--output json sts get-caller-identity", profile)
+    exit_code, caller_identity = awscli.exec("sts", "get-caller-identity", "--output", "json", "--profile", profile)
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {caller_identity}")
 
@@ -484,7 +493,8 @@ def _get_management_account_id(profile):
     return caller_identity["Account"]
 
 
-def _get_organization_accounts(profile, project_name):
+@pass_runner
+def _get_organization_accounts(awscli: Runner, profile: str, project_name: str):
     """Get organization accounts names and ids. Removing the prefixed project name from the account names.
 
     Args:
@@ -494,7 +504,9 @@ def _get_organization_accounts(profile, project_name):
     Returns:
         dict: Mapping of organization accounts names to ids.
     """
-    exit_code, organization_accounts = AWSCLI.exec("--output json organizations list-accounts", profile)
+    exit_code, organization_accounts = awscli.exec(
+        "organizations", "list-accounts", "--output", "json", "--profile", profile
+    )
 
     if exit_code:
         return {}
@@ -511,7 +523,8 @@ def _get_organization_accounts(profile, project_name):
     return accounts
 
 
-def _get_mfa_serial(profile):
+@pass_runner
+def _get_mfa_serial(awscli: Runner, profile: str):
     """Get MFA serial for the given profile credentials.
 
     Args:
@@ -520,7 +533,7 @@ def _get_mfa_serial(profile):
     Returns:
         str: MFA device serial.
     """
-    exit_code, mfa_devices = AWSCLI.exec("--output json iam list-mfa-devices", profile)
+    exit_code, mfa_devices = awscli.exec("iam", "list-mfa-devices", "--output", "json", "--profile", profile)
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {mfa_devices}")
     mfa_devices = json.loads(mfa_devices)
@@ -538,7 +551,8 @@ def _get_mfa_serial(profile):
     )
 
 
-def configure_profile(profile, values):
+@pass_runner
+def configure_profile(awscli: Runner, profile: str, values: dict):
     """Set profile in `config` file for AWS cli.
 
     Args:
@@ -547,12 +561,20 @@ def configure_profile(profile, values):
     """
     logger.info(f"\tConfiguring profile [bold]{profile}[/bold]")
     for key, value in values.items():
-        exit_code, output = AWSCLI.exec(f"configure set {key} {value}", profile)
+        exit_code, output = awscli.exec("configure", "set", key, value, "--profile", profile)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
 
-def configure_accounts_profiles(profile, region, organization_accounts, project_accounts, fetch_mfa_device):
+@pass_paths
+def configure_accounts_profiles(
+    paths: PathsHandler,
+    profile: str,
+    region: str,
+    organization_accounts: dict,
+    project_accounts: list,
+    fetch_mfa_device: bool,
+):
     """Set up the required profiles for all accounts to be used with AWS cli. Backup previous profiles.
 
     Args:
@@ -595,16 +617,16 @@ def configure_accounts_profiles(profile, region, organization_accounts, project_
         account_profiles[f"{short_name}-{account_name}-{PROFILES[_type]['profile_role']}"] = account_profile
 
     logger.info("Backing up account profiles file.")
-    _backup_file("config")
+    Path(paths.aws_config_file).copy(Path(paths.aws_config_file).with_suffix(".bkp"))
 
     for profile_identifier, profile_values in account_profiles.items():
         configure_profile(profile_identifier, profile_values)
 
 
-def _update_account_ids(config):
+@pass_paths
+def _update_account_ids(paths: PathsHandler, config: dict):
     """Update accounts ids in global configuration file.
-    It updates both `[account name]_account_id` and `accounts` variables.
-    This last one maintaning the format:
+    It updates `accounts` variables maintaining the format:
     ```
     account = {
       account_name = {
@@ -617,24 +639,15 @@ def _update_account_ids(config):
     Args:
         config (dict): Project configuration values.
     """
-    if not PROJECT_COMMON_TFVARS.exists():
+    if not paths.common_tfvars.exists():
         return
 
-    container_base_dir = f"/{config['project_name']}/config"
-    container_common_tfvars_file = f"{container_base_dir}/{PROJECT_COMMON_TFVARS_FILE}"
-
     accs = []
     for account in config["organization"]["accounts"]:
         acc_name, acc_email, acc_id = account.values()
 
         acc = [f'\n    email = "{acc_email}"']
         if acc_id:
-            AWSCLI.system_exec(
-                "hcledit "
-                f"-f {container_common_tfvars_file} -u"
-                f' attribute set {acc_name}_account_id "\\"{acc_id}\\""'
-            )
-
             acc.append(f'    id = "{acc_id}"')
         acc = ",\n".join(acc)
 
@@ -643,7 +656,11 @@ def _update_account_ids(config):
     accs = ",".join(accs)
     accs = f"{{{accs}\n}}"
 
-    AWSCLI.system_exec("hcledit " f"-f {container_common_tfvars_file} -u" f" attribute set accounts '{accs}'")
+    common_tfvars = paths.common_tfvars.read_text()
+    common_tfvars = re.sub(
+        r"accounts\s*=\s*\{.*?\}(?=\s*(?:\n|$))", f"accounts = {accs}", common_tfvars, flags=re.DOTALL
+    )
+    paths.common_tfvars.write_text(common_tfvars)
 
 
 def mutually_exclusive(context, param, value):