qontract-development-cli 0.18.1__tar.gz → 0.19.0__tar.gz

{qontract_development_cli-0.18.1 → qontract_development_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-development-cli
-Version: 0.18.1
+Version: 0.19.0
 Summary: Helper tool for qontract-reconcile development
 Project-URL: homepage, http://github.com/chassing/qontract-development-cli
 Project-URL: repository, http://github.com/chassing/qontract-development-cli

{qontract_development_cli-0.18.1 → qontract_development_cli-0.19.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "qontract-development-cli"
-version = "0.18.1"
+version = "0.19.0"
 description = "Helper tool for qontract-reconcile development"
 authors = [{ name = "Christian Assing", email = "cassing@redhat.com" }]
 license = { text = "MIT" }

{qontract_development_cli-0.18.1 → qontract_development_cli-0.19.0}/qontract_development_cli/commands/profile.py

@@ -265,6 +265,7 @@ def run(  # noqa: C901, PLR0912, PLR0913, PLR0915
     compose_template_files = profile.settings.compose_template_files(
         api=env.settings.run_qontract_api,
         cache=env.settings.run_cache,
+        opa=env.settings.run_opa,
         reconcile=env.settings.run_qontract_reconcile,
         server=env.settings.run_qontract_server,
         subscriber=env.settings.run_qontract_api_subscriber,

{qontract_development_cli-0.18.1 → qontract_development_cli-0.19.0}/qontract_development_cli/models.py

@@ -21,6 +21,7 @@ class EnvSettings(BaseModel):
     run_qontract_api_subscriber: bool = False
     run_qontract_api_worker: bool = False
     run_cache: bool = False
+    run_opa: bool = False
     run_qontract_reconcile: bool = True
     run_qontract_server: bool = True
     run_vault: bool = False
@@ -103,6 +104,12 @@ class ProfileSettings(BaseModel):
     localstack: bool = False
     localstack_compose_file: Path | None
 
+    # opa
+    opa_build_image: bool = True
+    opa_image: str = "openpolicyagent/opa:latest"
+    opa_container_platform: str | None = None
+    opa_compose_file: str = "opa.yml.j2"
+
     # vault
     vault_image: str = "vault:1.5.4"
     vault_container_platform: str | None = None
@@ -120,11 +127,16 @@ class ProfileSettings(BaseModel):
     def qontract_api_path(self) -> Path | None:
         return self.qontract_reconcile_path / "qontract_api"
 
+    @property
+    def opa_path(self) -> Path | None:
+        return self.qontract_reconcile_path / "opa"
+
     def compose_template_files(  # noqa: PLR0913
         self,
         *,
         api: bool,
         cache: bool,
+        opa: bool,
         reconcile: bool,
         server: bool,
         subscriber: bool,
@@ -135,6 +147,7 @@ class ProfileSettings(BaseModel):
         files += [self.qontract_api_subscriber_compose_file] if subscriber else []
         files += [self.qontract_api_worker_compose_file] if worker else []
         files += [self.cache_compose_file] if cache else []
+        files += [self.opa_compose_file] if opa else []
         files += [self.qontract_reconcile_compose_file] if reconcile else []
         files += [self.qontract_server_compose_file] if server else []
         files += [self.vault_compose_file] if vault else []

{qontract_development_cli-0.18.1 → qontract_development_cli-0.19.0}/qontract_development_cli/templates/api.yml.j2

@@ -19,6 +19,11 @@ services:
     environment:
     - QAPI_START_MODE=api
     - QAPI_CACHE_BROKER_URL=redis://cache:6379/0
+    {% if env.settings.run_opa %}
+    - QAPI_OPA__HOST=http://opa:8181
+    {% else %}
+    - QAPI_OPA__ENABLED=false
+    {% endif %}
     # Enable debugpy
     - DEBUGGER_ENABLED={% if profile.settings.debugger %}true{% else %}false{% endif %}
     # Hot reload for development

{qontract_development_cli-0.18.1 → qontract_development_cli-0.19.0}/qontract_development_cli/templates/compose.override.yml.j2

@@ -8,19 +8,37 @@ services:
 {% endif %}
 
 
+{% if env.settings.run_opa %}
+  opa:
+    networks:
+    - qontract-development
+{% endif %}
+
+
 {% if env.settings.run_qontract_api %}
   qontract-api:
     networks:
     - qontract-development
 
-    {% if env.settings.run_cache %}
+    {% if env.settings.run_cache or env.settings.run_opa %}
     depends_on:
+      {% if env.settings.run_cache %}
       cache:
         condition: service_healthy
+      {% endif %}
+      {% if env.settings.run_opa %}
+      opa:
+        condition: service_started
+      {% endif %}
 
     links:
+    {% if env.settings.run_cache %}
     - cache
     {% endif %}
+    {% if env.settings.run_opa %}
+    - opa
+    {% endif %}
+    {% endif %}
 {% endif %}
 
 

qontract_development_cli-0.19.0/qontract_development_cli/templates/opa.yml.j2

@@ -0,0 +1,37 @@
+services:
+  # OPA (Open Policy Agent) sidecar for qontract-api authorization
+  opa:
+    container_name: opa
+    platform: {{ profile.settings.opa_container_platform or env.settings.container_platform }}
+    {% if profile.settings.opa_build_image %}
+    build:
+      context: {{ profile.settings.qontract_reconcile_path.expanduser().absolute() }}
+      dockerfile: {{ profile.settings.opa_path.expanduser().absolute() }}/Dockerfile
+      target: prod
+    {% else %}
+    image: {{ profile.settings.opa_image }}
+    {% endif %}
+
+    entrypoint: ["/opa"]
+    command:
+    - run
+    - --server
+    - --addr=0.0.0.0:8181
+    - --config-file=/config/config.yaml
+    - --log-level=info
+    - --disable-telemetry
+    - --watch
+    - /authz
+    - /data
+
+    ports:
+    - 8181:8181
+
+    # /authz is baked into the image (Rego policies)
+    # /data is mounted from dev/ (dev policy data, NOT in the prod image)
+    # --watch uses fsnotify: works on Linux, not on macOS/Colima.
+    # On macOS, run: docker restart opa
+    volumes:
+    - {{ profile.settings.opa_path.expanduser().absolute() }}/authz:/authz:z
+    - {{ profile.settings.opa_path.expanduser().absolute() }}/dev:/data:z
+    - {{ profile.settings.opa_path.expanduser().absolute() }}/dev/config.yaml:/config/config.yaml:z