qontract-reconcile 0.10.0__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/unleash_feature_toggles/integration.py

@@ -0,0 +1,287 @@
+import logging
+from collections.abc import Callable, Iterable, Sequence, ValuesView
+from typing import Any
+
+from reconcile.gql_definitions.unleash_feature_toggles.feature_toggles import (
+    FeatureToggleUnleashV1,
+    UnleashInstanceV1,
+    UnleashProjectV1,
+)
+from reconcile.gql_definitions.unleash_feature_toggles.feature_toggles import (
+    query as unleash_instances_query,
+)
+from reconcile.utils import gql
+from reconcile.utils.differ import DiffPair, diff_any_iterables, diff_mappings
+from reconcile.utils.runtime.integration import (
+    PydanticRunParams,
+    QontractReconcileIntegration,
+)
+from reconcile.utils.semver_helper import make_semver
+from reconcile.utils.unleash.server import (
+    Environment,
+    FeatureToggle,
+    FeatureToggleType,
+    Project,
+    TokenAuth,
+    UnleashServer,
+)
+
+QONTRACT_INTEGRATION = "unleash-feature-toggles"
+QONTRACT_INTEGRATION_VERSION = make_semver(1, 0, 0)
+
+
+class UnleashTogglesIntegrationParams(PydanticRunParams):
+    instance: str | None
+
+
+def feature_toggle_equal(c: FeatureToggle, d: FeatureToggleUnleashV1) -> bool:
+    """Check if two feature toggles are different, but ignore the actual toggle state."""
+    assert d.unleash.q_type  # make mypy happy
+    return (
+        c.description == d.description
+        and c.type == FeatureToggleType[d.unleash.q_type]
+        and c.impression_data == bool(d.unleash.impression_data)
+    )
+
+
+class UnleashFeatureToggleException(Exception):
+    """Raised when a feature toggle is manually created."""
+
+
+class UnleashFeatureToggleDeleteError(Exception):
+    """Raised when a feature toggle is not marked for deletion."""
+
+
+class UnleashTogglesIntegration(
+    QontractReconcileIntegration[UnleashTogglesIntegrationParams]
+):
+    """Manage Unleash feature toggles."""
+
+    @property
+    def name(self) -> str:
+        return QONTRACT_INTEGRATION
+
+    def get_early_exit_desired_state(
+        self, query_func: Callable | None = None
+    ) -> dict[str, Any]:
+        """Return the desired state for early exit."""
+        if not query_func:
+            query_func = gql.get_api().query
+        return {
+            "toggles": [ft.dict() for ft in self.get_unleash_instances(query_func)],
+        }
+
+    def get_unleash_instances(
+        self, query_func: Callable, instance: str | None = None
+    ) -> list[UnleashInstanceV1]:
+        """Get all Unleash instances with their projects and feature toggles."""
+        instances = [
+            ui
+            for ui in unleash_instances_query(query_func).instances or []
+            if (not instance or ui.name == instance) and ui.admin_token
+        ]
+
+        # Set default values for all feature toggles
+        for inst in instances:
+            for project in inst.projects or []:
+                for feature_toggle in project.feature_toggles or []:
+                    feature_toggle.unleash.q_type = (
+                        feature_toggle.unleash.q_type or "release"
+                    )
+                    feature_toggle.unleash.impression_data = (
+                        feature_toggle.unleash.impression_data or False
+                    )
+        return instances
+
+    def fetch_current_state(self, client: UnleashServer) -> list[Project]:
+        """Fetch the current state of all Unleash projects including their feature toggles."""
+        return client.projects(include_feature_toggles=True)
+
+    def validate_unleash_projects(
+        self,
+        current_projects: Iterable[Project],
+        desired_projects: Iterable[UnleashProjectV1],
+    ) -> ValuesView[DiffPair[Project, UnleashProjectV1]]:
+        """Validate that all projects referenced in the desired state are actually exist."""
+        diff = diff_any_iterables(
+            current=current_projects,
+            desired=desired_projects,
+            current_key=lambda c: c.name.lower(),
+            desired_key=lambda d: d.name.lower(),
+            equal=lambda c, d: c.name.lower() == d.name.lower(),
+        )
+        if diff.add:
+            raise ValueError(f"Non-existing projects: {','.join(diff.add.keys())}")
+        return diff.identical.values()
+
+    def _reconcile_feature_toggles(
+        self,
+        client: UnleashServer,
+        instance: UnleashInstanceV1,
+        project_id: str,
+        dry_run: bool,
+        current_state: Sequence[FeatureToggle],
+        desired_state: Iterable[FeatureToggleUnleashV1],
+    ) -> None:
+        """Reconcile the feature toggles themselves."""
+        diff = diff_any_iterables(
+            current=current_state,
+            desired=[d for d in desired_state if d.delete is not True],
+            current_key=lambda c: c.name,
+            desired_key=lambda d: d.name,
+            equal=feature_toggle_equal,
+        )
+        for add in diff.add.values():
+            logging.info(
+                f"[{instance.name}/{project_id}] Adding feature toggle {add.name}"
+            )
+            try:
+                assert add.unleash.q_type  # make mypy happy
+                feature_type = FeatureToggleType[add.unleash.q_type]
+            except KeyError:
+                raise ValueError(
+                    f"[{instance.name}/{project_id}/{add.name}] Invalid feature toggle type '{add.unleash.q_type}', Possible values are: {', '.join(FeatureToggleType.__members__)}"
+                ) from None
+            if not dry_run:
+                client.create_feature_toggle(
+                    project_id=project_id,
+                    name=add.name,
+                    description=add.description,
+                    type=feature_type,
+                    impression_data=bool(add.unleash.impression_data),
+                )
+
+        for change in diff.change.values():
+            logging.info(
+                f"[{instance.name}/{project_id}] Changing feature toggle {change.desired.name}"
+            )
+            try:
+                assert change.desired.unleash.q_type  # make mypy happy
+                feature_type = FeatureToggleType[change.desired.unleash.q_type]
+            except KeyError:
+                raise ValueError(
+                    f"[{instance.name}/{project_id}/{change.current.name}] Invalid feature toggle type '{change.desired.unleash.q_type}', Possible values are: {', '.join(FeatureToggleType.__members__)}"
+                ) from None
+            if not dry_run:
+                client.update_feature_toggle(
+                    project_id=project_id,
+                    name=change.current.name,
+                    description=change.desired.description,
+                    type=feature_type,
+                    impression_data=bool(change.desired.unleash.impression_data),
+                )
+
+        for delete in diff.delete.values():
+            desired_toggle = next(
+                (d for d in desired_state if d.name == delete.name and d.delete), None
+            )
+            if desired_toggle:
+                logging.info(
+                    f"[{instance.name}/{project_id}] Deleting feature toggle {delete.name}"
+                )
+                if not dry_run:
+                    client.delete_feature_toggle(
+                        project_id=project_id,
+                        name=delete.name,
+                    )
+            elif not instance.allow_unmanaged_feature_toggles:
+                raise UnleashFeatureToggleDeleteError(
+                    f"[{instance.name}/{project_id}] Found unmanaged feature toggles '{[d.name for d in diff.delete.values()]}'"
+                )
+
+    def _reconcile_states(
+        self,
+        client: UnleashServer,
+        instance: UnleashInstanceV1,
+        project_id: str,
+        dry_run: bool,
+        current_state: Sequence[FeatureToggle],
+        desired_state: Iterable[FeatureToggleUnleashV1],
+        available_environments: Iterable[Environment],
+    ) -> None:
+        """Reconcile the feature toggle states."""
+        current_toggle_states = {
+            (state.name, env.name): env.enabled
+            for state in current_state
+            for env in state.environments
+        }
+        desired_toggle_states = {
+            (state.name, env_name): enabled
+            for state in desired_state
+            for env_name, enabled in (state.unleash.environments or {}).items()
+        }
+
+        diff_result = diff_mappings(
+            current=current_toggle_states, desired=desired_toggle_states
+        )
+        for (name, env), pair in diff_result.change.items():
+            if env not in available_environments:
+                raise ValueError(
+                    f"[{instance.name}/{project_id}/{name}] Environment '{env}' does not exist in Unleash!"
+                )
+            if not dry_run:
+                client.set_feature_toggle_state(
+                    project_id=project_id,
+                    name=name,
+                    environment=env,
+                    enabled=pair.desired,
+                )
+
+    def reconcile(
+        self,
+        client: UnleashServer,
+        instance: UnleashInstanceV1,
+        project_id: str,
+        dry_run: bool,
+        current_state: Sequence[FeatureToggle],
+        desired_state: Iterable[FeatureToggleUnleashV1],
+    ) -> None:
+        """Reconcile the feature toggles."""
+        self._reconcile_feature_toggles(
+            client=client,
+            instance=instance,
+            project_id=project_id,
+            dry_run=dry_run,
+            current_state=current_state,
+            desired_state=desired_state,
+        )
+        self._reconcile_states(
+            client=client,
+            instance=instance,
+            project_id=project_id,
+            dry_run=dry_run,
+            current_state=current_state,
+            desired_state=desired_state,
+            available_environments=client.environments(project_id),
+        )
+
+    def run(self, dry_run: bool) -> None:
+        gql_api = gql.get_api()
+        instances = self.get_unleash_instances(
+            gql_api.query, instance=self.params.instance
+        )
+
+        for instance in instances:
+            assert instance.admin_token  # make mypy happy
+            with UnleashServer(
+                host=instance.url,
+                auth=TokenAuth(self.secret_reader.read_secret(instance.admin_token)),
+            ) as client:
+                try:
+                    project_pairs = self.validate_unleash_projects(
+                        current_projects=self.fetch_current_state(client),
+                        desired_projects=instance.projects or [],
+                    )
+                except ValueError:
+                    logging.error(f"[{instance.name}] Missing projects!")
+                    raise
+
+                for pair in project_pairs:
+                    self.reconcile(
+                        client=client,
+                        instance=instance,
+                        project_id=pair.current.pk,
+                        dry_run=dry_run,
+                        current_state=pair.current.feature_toggles,
+                        desired_state=pair.desired.feature_toggles or [],
+                    )

reconcile/utils/acs/base.py

@@ -0,0 +1,81 @@
+import logging
+from collections.abc import Callable
+from typing import (
+    Any,
+    Self,
+)
+
+import requests
+from pydantic import BaseModel
+
+from reconcile.gql_definitions.acs.acs_instances import AcsInstanceV1
+from reconcile.gql_definitions.acs.acs_instances import query as acs_instances_query
+from reconcile.utils.exceptions import AppInterfaceSettingsError
+
+
+class AcsBaseApi(BaseModel):
+    url: str
+    token: str
+    timeout: int = 30
+    session: requests.Session = requests.Session()
+
+    class Config:
+        arbitrary_types_allowed = True
+
+    def __enter__(self) -> Self:
+        return self
+
+    def __exit__(self, exc_type: Any, exc_value: Any, traceback: Any) -> None:
+        self.session.close()
+
+    @staticmethod
+    def get_acs_instance(query_func: Callable) -> AcsInstanceV1:
+        """
+        Get an ACS instance
+
+        :param query_func: function which queries GQL Server
+        """
+        if instances := acs_instances_query(query_func=query_func).instances:
+            # mirroring logic for gitlab instances
+            # current assumption is for appsre to only utilize one instance
+            if len(instances) != 1:
+                raise AppInterfaceSettingsError("More than one ACS instance found!")
+            return instances[0]
+        raise AppInterfaceSettingsError("No ACS instance found!")
+
+    @staticmethod
+    def check_len_attributes(attrs: list[Any], api_data: Any) -> None:
+        # generic attribute check function for expected types with valid len()
+        for attr in attrs:
+            value = api_data.get(attr)
+            if value is None or len(value) == 0:
+                raise ValueError(
+                    f"Attribute '{attr}' must exist and not be empty\n\t{api_data}"
+                )
+
+    def generic_request(
+        self, path: str, verb: str, json: Any | None = None
+    ) -> requests.Response:
+        url = f"{self.url}{path}"
+        headers = {
+            "Authorization": f"Bearer {self.token}",
+        }
+        response = self.session.request(
+            verb,
+            url,
+            headers=headers,
+            json=json,
+            timeout=self.timeout,
+        )
+        try:
+            response.raise_for_status()
+        except requests.exceptions.HTTPError as e:
+            logging.error(f"{e!s}: {response.text}")
+            raise
+
+        return response
+
+    def generic_request_json(
+        self, path: str, verb: str, json: Any | None = None
+    ) -> Any:
+        return self.generic_request(path, verb, json=json).json()

reconcile/utils/acs/notifiers.py

@@ -0,0 +1,143 @@
+import json
+from typing import Any
+
+from pydantic import BaseModel
+
+from reconcile.gql_definitions.acs.acs_policies import AppEscalationPolicyV1
+from reconcile.utils.acs.base import AcsBaseApi
+
+
+class JiraCredentials(BaseModel):
+    url: str
+    username: str
+    token: str
+
+
+class SeverityPriorityMapping(BaseModel):
+    severity: str
+    priority: str
+
+    @staticmethod
+    def from_api(mapping: dict[str, str]) -> "SeverityPriorityMapping":
+        return SeverityPriorityMapping(
+            severity=mapping["severity"].replace("_SEVERITY", "").lower(),
+            priority=mapping["priorityName"],
+        )
+
+    def to_api(self) -> Any:
+        return {
+            "severity": f"{self.severity.upper()}_SEVERITY",
+            "priorityName": self.priority,
+        }
+
+
+class JiraNotifier(BaseModel):
+    name: str
+    board: str
+    url: str
+    issue_type: str | None
+    severity_priority_mappings: list[SeverityPriorityMapping]
+    custom_fields: dict[str, Any] | None
+
+    @staticmethod
+    def from_api(notifier: dict[str, Any]) -> "JiraNotifier":
+        notifier_jira = notifier["jira"]
+        return JiraNotifier(
+            name=notifier["name"],
+            board=notifier["labelDefault"],
+            url=notifier_jira["url"],
+            issue_type=notifier_jira["issueType"],
+            severity_priority_mappings=sorted(
+                [
+                    SeverityPriorityMapping.from_api(mapping)
+                    for mapping in notifier_jira["priorityMappings"]
+                ],
+                key=lambda m: m.severity,
+            ),
+            custom_fields=json.loads(notifier_jira.get("defaultFieldsJson") or "{}"),
+        )
+
+    def to_api(self, ui_endpoint: str, jira_credentials: JiraCredentials) -> Any:
+        return {
+            "name": self.name,
+            "type": "jira",
+            "uiEndpoint": ui_endpoint,
+            "labelDefault": self.board,
+            "jira": {
+                "url": jira_credentials.url,
+                "username": jira_credentials.username,
+                "password": jira_credentials.token,
+                "issueType": self.issue_type or "Task",
+                "priorityMappings": [
+                    mapping.to_api() for mapping in self.severity_priority_mappings
+                ],
+                "defaultFieldsJson": json.dumps(self.custom_fields or {}),
+            },
+        }
+
+    @staticmethod
+    def from_escalation_policy(
+        escalation_policy: AppEscalationPolicyV1,
+    ) -> "JiraNotifier":
+        jira_board = escalation_policy.channels.jira_board[0]
+
+        custom_fields: dict[str, Any] = {}
+        if jira_board.issue_security_id:
+            custom_fields["security"] = {"id": jira_board.issue_security_id}
+        if escalation_policy.channels.jira_component:
+            custom_fields["components"] = [
+                {"name": escalation_policy.channels.jira_component}
+            ]
+        if escalation_policy.channels.jira_labels:
+            custom_fields["labels"] = escalation_policy.channels.jira_labels
+
+        return JiraNotifier(
+            name=f"jira-{escalation_policy.name}",
+            board=jira_board.name,
+            url=jira_board.server.server_url,
+            issue_type=jira_board.issue_type or "Task",
+            severity_priority_mappings=sorted(
+                [
+                    SeverityPriorityMapping(**vars(sp))
+                    for sp in jira_board.severity_priority_mappings.mappings
+                ],
+                key=lambda m: m.severity,
+            ),
+            custom_fields=custom_fields,
+        )
+
+
+class AcsNotifiersApi(AcsBaseApi):
+    """
+    Implements methods to support reconcile operations against the ACS NotifiersService api
+    """
+
+    def get_notifiers(self) -> list[Any]:
+        return self.generic_request_json("/v1/notifiers", "GET")["notifiers"]
+
+    def get_jira_notifiers(self) -> list[JiraNotifier]:
+        return [
+            JiraNotifier.from_api(notifier)
+            for notifier in self.get_notifiers()
+            if notifier["type"] == "jira"
+        ]
+
+    def get_notifier_id_by_name(self, name: str) -> str:
+        return next(n["id"] for n in self.get_notifiers() if n["name"] == name)
+
+    def update_jira_notifier(
+        self, jira_notifier: JiraNotifier, jira_credentials: JiraCredentials
+    ) -> None:
+        notifier_id = self.get_notifier_id_by_name(jira_notifier.name)
+        body = jira_notifier.to_api(self.url, jira_credentials)
+        self.generic_request(f"/v1/notifiers/{notifier_id}", "PUT", body)
+
+    def create_jira_notifier(
+        self, jira_notifier: JiraNotifier, jira_credentials: JiraCredentials
+    ) -> None:
+        body = jira_notifier.to_api(self.url, jira_credentials)
+        self.generic_request("/v1/notifiers", "POST", body)
+
+    def delete_jira_notifier(self, jira_notifier: JiraNotifier) -> None:
+        notifier_id = self.get_notifier_id_by_name(jira_notifier.name)
+        self.generic_request(f"/v1/notifiers/{notifier_id}", "DELETE")

reconcile/utils/acs/policies.py

@@ -0,0 +1,163 @@
+from typing import Any
+
+from pydantic import BaseModel
+
+from reconcile.utils.acs.base import AcsBaseApi
+
+
+class Scope(BaseModel):
+    """
+    Scope represents a single cluster or namespace that an acs security policy is applied to.
+    """
+
+    cluster: str
+    namespace: str | None
+
+
+class PolicyCondition(BaseModel):
+    """
+    PolicyCondition represents a single condition criteria enforced within an ACS security policy.
+    Current attributes support subset of "build" lifecycle condition criteria.
+    See section 6.4.3 for table of all condition criteria:
+    https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_security_for_kubernetes/4.3/html/operating/manage-security-policies
+    """
+
+    field_name: str
+    negate: bool | None
+    values: list[str]
+
+
+class Policy(BaseModel):
+    """
+    Policy is minimum attributes required to represent an ACS security policy
+    https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_security_for_kubernetes/4.3/html/operating/manage-security-policies
+    """
+
+    name: str
+    description: str
+    notifiers: list[str]
+    categories: list[str]
+    severity: str
+    scope: list[Scope]
+    conditions: list[PolicyCondition]
+
+
+class AcsPolicyApi(AcsBaseApi):
+    """
+    Implements methods to support reconcile operations against the ACS PolicyService api
+    """
+
+    def _build_policy(
+        self, api_policy: Any, conditions: list[PolicyCondition]
+    ) -> Policy:
+        return Policy(
+            name=api_policy["name"],
+            description=api_policy["description"],
+            notifiers=sorted(api_policy["notifiers"]),
+            categories=sorted(api_policy["categories"]),
+            severity=api_policy["severity"],
+            scope=sorted(
+                [
+                    Scope(
+                        cluster=s["cluster"],
+                        namespace=s["namespace"],
+                    )
+                    for s in api_policy["scope"]
+                ],
+                key=lambda s: s.cluster,
+            ),
+            conditions=conditions,
+        )
+
+    def _build_policy_condition(self, api_policy_group: Any) -> PolicyCondition:
+        return PolicyCondition(
+            field_name=api_policy_group["fieldName"],
+            values=[v["value"] for v in api_policy_group["values"]],
+            negate=api_policy_group["negate"],
+        )
+
+    def list_custom_policies(self) -> list[Any]:
+        # retrieve summary data for each custom policy
+        return [
+            p
+            for p in self.generic_request("/v1/policies", "GET").json()["policies"]
+            if not p["isDefault"]
+        ]
+
+    def get_custom_policies(self) -> list[Policy]:
+        custom_policy_ids = [p["id"] for p in self.list_custom_policies()]
+        # make individual policy requests to obtain further details
+        custom_policies_api_result = [
+            self.generic_request(f"/v1/policies/{pid}", "GET").json()
+            for pid in custom_policy_ids
+        ]
+        return [
+            self._build_policy(
+                api_policy=cp,
+                conditions=[
+                    self._build_policy_condition(group)
+                    for section in cp["policySections"]
+                    for group in section.get("policyGroups", [])
+                ],
+            )
+            for cp in custom_policies_api_result
+        ]
+
+    def create_or_update_policy(self, desired: Policy, id: str = "") -> None:
+        body = {
+            "name": desired.name,
+            "description": desired.description,
+            "categories": desired.categories,
+            "severity": desired.severity,
+            "notifiers": desired.notifiers,
+            "isDefault": False,
+            "disabled": False,
+            "scope": [
+                {"cluster": s.cluster, "namespace": s.namespace} for s in desired.scope
+            ],
+            "lifecycleStages": [
+                "BUILD",
+                "DEPLOY",
+            ],  # all currently supported policy criteria are classified as 'build' or 'deploy'
+            # and created policies are evaluated at both stages
+            "policySections": [
+                {
+                    "sectionName": "primary",
+                    "policyGroups": [
+                        {
+                            "fieldName": c.field_name,
+                            "negate": c.negate,
+                            "values": [{"value": v} for v in c.values],
+                        }
+                        for c in desired.conditions
+                    ],
+                }
+            ],
+        }
+        if id:
+            self.generic_request(f"/v1/policies/{id}", "PUT", body)
+        else:
+            self.generic_request("/v1/policies", "POST", body)
+
+    def delete_policy(self, id: str) -> None:
+        self.generic_request(f"/v1/policies/{id}", "DELETE")
+
+    class NotifierIdentifiers(BaseModel):
+        id: str
+        name: str
+
+    def list_notifiers(self) -> list[NotifierIdentifiers]:
+        return [
+            self.NotifierIdentifiers(id=c["id"], name=c["name"])
+            for c in self.generic_request("/v1/notifiers", "GET").json()["notifiers"]
+        ]
+
+    class ClusterIdentifiers(BaseModel):
+        id: str
+        name: str
+
+    def list_clusters(self) -> list[ClusterIdentifiers]:
+        return [
+            self.ClusterIdentifiers(id=c["id"], name=c["name"])
+            for c in self.generic_request("/v1/clusters", "GET").json()["clusters"]
+        ]