qontract-reconcile 0.10.0__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/utils/rosa/rosa_cli.py

@@ -0,0 +1,310 @@
+import collections
+import itertools
+import os
+import textwrap
+from collections.abc import Callable, Iterable
+from typing import Any
+
+from kubernetes.client import (
+    V1Container,
+    V1EmptyDirVolumeSource,
+    V1EnvVar,
+    V1JobSpec,
+    V1ObjectMeta,
+    V1PodSpec,
+    V1PodTemplateSpec,
+    V1ProjectedVolumeSource,
+    V1SecretVolumeSource,
+    V1ServiceAccountTokenProjection,
+    V1Volume,
+    V1VolumeMount,
+    V1VolumeProjection,
+)
+from pydantic import BaseModel
+
+from reconcile.utils.jobcontroller.models import JobStatus, K8sJob
+
+SCRIPTS_MOUNT_PATH = "/scripts"
+EXEC_SCRIPT = "execute.sh"
+
+
+class LogHandle:
+    """
+    Represents a handle to a log file and offers convenience methods to consume
+    the log content in an efficient manner.
+    """
+
+    def __init__(self, log_file: str) -> None:
+        self.log_file = log_file
+
+    def get_log_lines(
+        self, max_lines: int = 5, from_file_end: bool = False
+    ) -> Iterable[str]:
+        if max_lines <= 0:
+            return []
+        with open(self.log_file, encoding="utf-8") as f:
+            if from_file_end:
+                return collections.deque(f, maxlen=max_lines)
+            return [line.rstrip() for line in itertools.islice(f, max_lines)]
+
+    def write_logs_to_logger(self, logger: Callable[..., None]) -> None:
+        with open(self.log_file, encoding="utf-8") as f:
+            logger(f.read())
+
+    def exists(self) -> bool:
+        return os.path.exists(self.log_file)
+
+    def cleanup(self) -> None:
+        os.remove(self.log_file)
+
+
+class RosaCliResult:
+    """
+    Represents the result of a ROSA CLI execution.
+    """
+
+    def __init__(
+        self,
+        status: JobStatus,
+        command: str,
+        log_handle: LogHandle | None = None,
+    ) -> None:
+        self.status = status
+        self.command = command
+        self.log_handle = log_handle
+
+    def get_log_lines(
+        self, max_lines: int = 5, from_file_end: bool = False
+    ) -> Iterable[str]:
+        if self.log_handle:
+            return self.log_handle.get_log_lines(
+                max_lines=max_lines, from_file_end=from_file_end
+            )
+        return []
+
+    def write_logs_to_logger(self, logger: Callable[..., None]) -> None:
+        if self.log_handle:
+            self.log_handle.write_logs_to_logger(logger)
+
+    def cleanup(self) -> None:
+        if self.log_handle:
+            self.log_handle.cleanup()
+
+
+class RosaCliException(Exception, RosaCliResult):
+    """
+    Represents an exception that occurred during a ROSA CLI execution.
+    """
+
+    def __init__(
+        self,
+        status: JobStatus,
+        command: str,
+        log_handle: LogHandle | None = None,
+    ) -> None:
+        Exception.__init__(
+            self, f"ROSA CLI execution failed with status: {status}, cmd: {command}"
+        )
+        RosaCliResult.__init__(self, status, command, log_handle)
+
+
+class RosaJob(K8sJob, BaseModel, frozen=True, arbitrary_types_allowed=True):
+    """
+    Represents a ROSA CLI job. It leverages the reconcile.utils.jobcontroller module
+    functionality to execute ROSA CLI commands in a Kubernetes cluster.
+
+    Since the ROSA CLI requires access to both AWS and OCM, the job is executed
+    with the required credentials and tokens.
+    """
+
+    aws_account_id: str
+    aws_region: str
+    aws_iam_role: str
+    ocm_org_id: str
+    ocm_token: str
+    cmd: str
+    image: str
+    service_account: str
+
+    extra_annotations: dict[str, str]
+
+    def name_prefix(self) -> str:
+        return "rosa-cli"
+
+    def unit_of_work_identity(self) -> Any:
+        return {
+            "cmd": self.cmd,
+            "aws_account_id": self.aws_account_id,
+            "aws_region": self.aws_region,
+            "image": self.image,
+            "service_account": self.service_account,
+        }
+
+    def annotations(self) -> dict[str, str]:
+        _annotations = {
+            "qontract.rosa.aws_account_id": self.aws_account_id,
+            "qontract.rosa.aws_region": self.aws_region,
+            "qontract.rosa.ocm_org_id": self.ocm_org_id,
+        }
+        _annotations.update(self.extra_annotations)
+        return _annotations
+
+    def secret_data(self) -> dict[str, str]:
+        return {"OCM_TOKEN": self.ocm_token}
+
+    def scripts(self) -> dict[str, str]:
+        return {EXEC_SCRIPT: self.cmd}
+
+    def assume_role_arn(self) -> str:
+        return f"arn:aws:iam::{self.aws_account_id}:role/{self.aws_iam_role}"
+
+    def assume_role_profile(self) -> str:
+        return textwrap.dedent(
+            f"""\
+            [default]
+            source_profile = jump-role
+            role_arn = {self.assume_role_arn()}
+            role_session_name = rosa-automation
+            """
+        )
+
+    def job_spec(self) -> V1JobSpec:
+        # this command formats the output of `aws sts assume-role` into an AWS credentials file
+        prepare_aws_creds_cmd = f'cp $AWS_SHARED_CREDENTIALS_FILE /.config/aws-credentials ; echo -e "\n{self.assume_role_profile()}" >> /.config/aws-credentials'
+
+        return V1JobSpec(
+            backoff_limit=1,
+            ttl_seconds_after_finished=3600,
+            template=V1PodTemplateSpec(
+                metadata=V1ObjectMeta(
+                    annotations=self.annotations(), labels=self.labels()
+                ),
+                spec=V1PodSpec(
+                    init_containers=[
+                        # prepare the AWS credentials file to assume role into the ROSA clusters AWS account
+                        V1Container(
+                            name="prepare-aws-creds",
+                            image=self.image,
+                            command=["/bin/bash"],
+                            args=["-c", prepare_aws_creds_cmd],
+                            env=[
+                                V1EnvVar(
+                                    name="AWS_SHARED_CREDENTIALS_FILE",
+                                    value="/jump-role/credentials",
+                                ),
+                                V1EnvVar(
+                                    name="HOME",
+                                    value="/tmp",
+                                ),
+                            ],
+                            volume_mounts=[
+                                V1VolumeMount(
+                                    name="aws-credentials",
+                                    mount_path="/jump-role",
+                                ),
+                                V1VolumeMount(
+                                    name="workdir",
+                                    mount_path="/.config",
+                                ),
+                            ],
+                        ),
+                        # call `rosa login``
+                        V1Container(
+                            name="rosa-login",
+                            image=self.image,
+                            command=["/bin/bash", "-c"],
+                            args=["rosa login"],
+                            env=[
+                                V1EnvVar(
+                                    name="AWS_SHARED_CREDENTIALS_FILE",
+                                    value="/.config/aws-credentials",
+                                ),
+                                V1EnvVar(
+                                    name="AWS_REGION",
+                                    value=self.aws_region,
+                                ),
+                            ]
+                            + self.secret_data_to_env_vars_secret_refs(),
+                            volume_mounts=[
+                                V1VolumeMount(
+                                    name="workdir",
+                                    mount_path="/.config",
+                                ),
+                                V1VolumeMount(
+                                    name="bound-sa-token",
+                                    mount_path="/var/run/secrets/openshift/serviceaccount",
+                                    read_only=True,
+                                ),
+                            ],
+                        ),
+                    ],
+                    containers=[
+                        # the actual job... do whatever `cmd` defines
+                        V1Container(
+                            name="rosa-cli",
+                            image=self.image,
+                            command=["/bin/bash"],
+                            args=[f"{SCRIPTS_MOUNT_PATH}/{EXEC_SCRIPT}"],
+                            env=[
+                                V1EnvVar(
+                                    name="AWS_SHARED_CREDENTIALS_FILE",
+                                    value="/.config/aws-credentials",
+                                ),
+                                V1EnvVar(
+                                    name="AWS_REGION",
+                                    value=self.aws_region,
+                                ),
+                            ]
+                            + self.secret_data_to_env_vars_secret_refs(),
+                            volume_mounts=[
+                                V1VolumeMount(
+                                    name="workdir",
+                                    mount_path="/.config",
+                                ),
+                                V1VolumeMount(
+                                    name="workdir",
+                                    mount_path="/.aws",
+                                ),
+                                V1VolumeMount(
+                                    name="bound-sa-token",
+                                    mount_path="/var/run/secrets/openshift/serviceaccount",
+                                    read_only=True,
+                                ),
+                                self.scripts_volume_mount(SCRIPTS_MOUNT_PATH),
+                            ],
+                        )
+                    ],
+                    restart_policy="Never",
+                    service_account_name=self.service_account,
+                    volumes=[
+                        V1Volume(
+                            name="aws-credentials",
+                            secret=V1SecretVolumeSource(
+                                secret_name="rosa-automation-sts-iam",
+                            ),
+                        ),
+                        V1Volume(
+                            name="bound-sa-token",
+                            projected=V1ProjectedVolumeSource(
+                                sources=[
+                                    V1VolumeProjection(
+                                        service_account_token=V1ServiceAccountTokenProjection(
+                                            audience="openshift",
+                                            expiration_seconds=3600,
+                                            path="token",
+                                        )
+                                    )
+                                ]
+                            ),
+                        ),
+                        V1Volume(
+                            name="workdir",
+                            empty_dir=V1EmptyDirVolumeSource(
+                                size_limit="10Mi",
+                            ),
+                        ),
+                        self.scripts_volume(),
+                    ],
+                ),
+            ),
+        )

reconcile/utils/rosa/session.py

@@ -0,0 +1,201 @@
+import logging
+import tempfile
+
+from jinja2 import Environment, FileSystemLoader
+from pydantic import BaseModel
+
+from reconcile.ocm.types import OCMSpec
+from reconcile.utils.constants import PROJ_ROOT
+from reconcile.utils.jobcontroller.controller import K8sJobController
+from reconcile.utils.jobcontroller.models import JobConcurrencyPolicy, JobStatus
+from reconcile.utils.ocm_base_client import OCMBaseClient
+from reconcile.utils.rosa.rosa_cli import (
+    LogHandle,
+    RosaCliException,
+    RosaCliResult,
+    RosaJob,
+)
+
+
+class RosaSessionBuilder(BaseModel, arbitrary_types_allowed=True):
+    aws_iam_role: str
+    job_controller: K8sJobController
+    image: str
+    service_account: str
+
+    def build(
+        self, ocm_api: OCMBaseClient, aws_account_id: str, region: str, ocm_org_id: str
+    ) -> "RosaSession":
+        return RosaSession(
+            aws_account_id=aws_account_id,
+            aws_region=region,
+            aws_iam_role=self.aws_iam_role,
+            ocm_org_id=ocm_org_id,
+            ocm_api=ocm_api,
+            job_controller=self.job_controller,
+            image=self.image,
+            service_account=self.service_account,
+        )
+
+
+class RosaSession:
+    """
+    A ROSA session contains the required context to interact with OCM and AWS
+    for a specific cluster.
+    """
+
+    def __init__(
+        self,
+        aws_account_id: str,
+        aws_region: str,
+        aws_iam_role: str,
+        ocm_org_id: str,
+        ocm_api: OCMBaseClient,
+        job_controller: K8sJobController,
+        image: str | None = None,
+        service_account: str | None = None,
+    ):
+        self.aws_account_id = aws_account_id
+        self.aws_region = aws_region
+        self.aws_iam_role = aws_iam_role
+        self.ocm_org_id = ocm_org_id
+        self.ocm_api = ocm_api
+        self.job_controller = job_controller
+        self.image = image or "registry.ci.openshift.org/ci/rosa-aws-cli:latest"
+        self.service_account = service_account or "default"
+
+    def assemble_job(
+        self,
+        cmd: str,
+        annotations: dict[str, str] | None = None,
+        image: str | None = None,
+    ) -> RosaJob:
+        return RosaJob(
+            aws_account_id=self.aws_account_id,
+            aws_iam_role=self.aws_iam_role,
+            aws_region=self.aws_region,
+            ocm_org_id=self.ocm_org_id,
+            ocm_token=self.ocm_api._access_token,
+            cmd=cmd,
+            image=image or self.image,
+            extra_annotations=annotations or {},
+            service_account=self.service_account,
+        )
+
+    def cli_execute(
+        self,
+        cmd: str,
+        annotations: dict[str, str] | None = None,
+        image: str | None = None,
+        check_interval_seconds: int = 5,
+        timeout_seconds: int = 60,
+    ) -> RosaCliResult:
+        """
+        Execute CLI commands in the context of a valid ROSA session (rosa login not required).
+        The provided cmd needs to be a single command. If multiple commands are required, they
+        need to be combined delimited with a ;
+        """
+        job = self.assemble_job(cmd, annotations, image)
+
+        status = self.job_controller.enqueue_job_and_wait_for_completion(
+            job,
+            check_interval_seconds=check_interval_seconds,
+            timeout_seconds=timeout_seconds,
+            concurrency_policy=JobConcurrencyPolicy.REPLACE_FAILED,
+        )
+        log_dir = tempfile.mkdtemp()
+        log_file_name = self.job_controller.store_job_logs(job.name(), log_dir)
+        if status != JobStatus.SUCCESS:
+            raise RosaCliException(status, cmd, LogHandle(log_file_name))
+        return RosaCliResult(status, cmd, LogHandle(log_file_name))
+
+    def create_hcp_cluster(
+        self,
+        cluster_name: str,
+        spec: OCMSpec,
+        dry_run: bool,
+        check_interval_seconds: int = 10,
+        timeout_seconds: int = 300,
+    ) -> RosaCliResult:
+        """
+        Create a ROSA HCP cluster in the OCM org and AWS account of this session.
+        If dry-run is provided, cluster creation is simulated and invalid configuration
+        data is highlighted as errors.
+        """
+        return self.cli_execute(
+            cmd=generate_rosa_creation_script(cluster_name, spec, dry_run),
+            check_interval_seconds=check_interval_seconds,
+            timeout_seconds=timeout_seconds,
+        )
+
+    def create_rosa_cluster(
+        self,
+        cluster_name: str,
+        spec: OCMSpec,
+        dry_run: bool,
+        check_interval_seconds: int = 10,
+        timeout_seconds: int = 300,
+    ) -> RosaCliResult:
+        """
+        Create a ROSA cluster in the OCM org and AWS account of this session.
+        If dry-run is provided, cluster creation is simulated and invalid configuration
+        data is highlighted as errors.
+        """
+        return self.cli_execute(
+            cmd=generate_rosa_creation_script(cluster_name, spec, dry_run),
+            check_interval_seconds=check_interval_seconds,
+            timeout_seconds=timeout_seconds,
+        )
+
+    def upgrade_account_roles(
+        self, role_prefix: str, minor_version: str, channel_group: str, dry_run: bool
+    ) -> None:
+        logging.info(
+            f"Upgrade account roles in AWS account {self.aws_account_id} to {minor_version} ({channel_group})"
+        )
+        if not dry_run:
+            result = self.cli_execute(
+                f"rosa upgrade account-roles --prefix {role_prefix} --version {minor_version} --channel-group {channel_group} -y -m=auto"
+            )
+            result.write_logs_to_logger(logging.info)
+
+    def upgrade_operator_roles(
+        self,
+        cluster_id: str,
+        dry_run: bool,
+    ) -> None:
+        """
+        Upgrades the operator roles of a cluster to match the latest
+        policy versions available for the cluster.
+        """
+        logging.info(
+            f"Upgrade operator roles in AWS account {self.aws_account_id} for cluster {cluster_id}"
+        )
+        if not dry_run:
+            result = self.cli_execute(
+                cmd=f"rosa upgrade operator-roles --cluster {cluster_id} -y -m=auto",
+                annotations={"qontract.rosa.cluster_id": cluster_id},
+            )
+            result.write_logs_to_logger(logging.info)
+
+
+def generate_rosa_creation_script(
+    cluster_name: str, cluster: OCMSpec, dry_run: bool
+) -> str:
+    """
+    Builds a bash script to install a ROSA clusters.
+    """
+
+    env = Environment(loader=FileSystemLoader(PROJ_ROOT / "templates"))
+    env.filters["split"] = lambda value, sep: value.split(sep)
+
+    if cluster.spec.hypershift:
+        template = env.get_template("rosa-hcp-cluster-creation.sh.j2")
+    else:
+        template = env.get_template("rosa-classic-cluster-creation.sh.j2")
+
+    return template.render(
+        cluster_name=cluster_name,
+        cluster=cluster,
+        dry_run=dry_run,
+    )

reconcile/utils/ruamel.py

@@ -0,0 +1,16 @@
+from ruamel import yaml
+
+
+def create_ruamel_instance(
+    preserve_quotes: bool = True,
+    explicit_start: bool = False,
+    width: int = 4096,
+    pure: bool = False,
+) -> yaml.YAML:
+    ruamel_instance = yaml.YAML(pure=pure)
+
+    ruamel_instance.preserve_quotes = preserve_quotes
+    ruamel_instance.explicit_start = explicit_start
+    ruamel_instance.width = width
+
+    return ruamel_instance

reconcile/utils/runtime/__init__.py

@@ -3,6 +3,5 @@ from dataclasses import dataclass
 
 @dataclass
 class IntegrationMeta:
-
     name: str
     options: list[str]

reconcile/utils/runtime/desired_state_diff.py

@@ -1,13 +1,8 @@
 import logging
 import multiprocessing
+from collections.abc import Callable, Iterable, Mapping
 from dataclasses import dataclass
-from typing import (
-    Any,
-    Callable,
-    Iterable,
-    Mapping,
-    Optional,
-)
+from typing import Any
 
 from deepdiff import DeepHash
 from jsonpath_ng.ext.parser import parse
@@ -69,19 +64,13 @@ def find_changed_shards(
             shard_path = apply_constraint_to_path(parse(shard_path_spec), d.path)
             if shard_path:
                 if d.diff_type in {DiffType.CHANGED, d.diff_type.REMOVED}:
-                    affected_shards.update(
-                        {
-                            shard.value
-                            for shard in shard_path.find(previous_desired_state)
-                        }
-                    )
+                    affected_shards.update({
+                        shard.value for shard in shard_path.find(previous_desired_state)
+                    })
                 if d.diff_type in {DiffType.CHANGED, d.diff_type.ADDED}:
-                    affected_shards.update(
-                        {
-                            shard.value
-                            for shard in shard_path.find(current_desired_state)
-                        }
-                    )
+                    affected_shards.update({
+                        shard.value for shard in shard_path.find(current_desired_state)
+                    })
     return affected_shards
 
 
@@ -183,7 +172,7 @@ def extract_diffs_with_timeout(
 
 
 def build_desired_state_diff(
-    sharding_config: Optional[DesiredStateShardConfig],
+    sharding_config: DesiredStateShardConfig | None,
     previous_desired_state: Mapping[str, Any],
     current_desired_state: Mapping[str, Any],
 ) -> DesiredStateDiff:

reconcile/utils/runtime/environment.py

@@ -1,7 +1,6 @@
 import logging
 import os
 import sys
-from typing import Optional
 
 from reconcile.utils import (
     config,
@@ -11,16 +10,42 @@ from reconcile.utils import (
 QONTRACT_CONFIG = "QONTRACT_CONFIG"
 QONTRACT_LOG_LEVEL = "QONTRACT_LOG_LEVEL"
 
-LOG_FMT = (
-    "[%(asctime)s] [%(levelname)s] "
-    "[%(filename)s:%(funcName)s:%(lineno)d] - %(message)s"
-)
 LOG_DATEFMT = "%Y-%m-%d %H:%M:%S"
 
+DRY_RUN_MAP = {
+    "--dry-run": True,
+    "--no-dry-run": False,
+}
+
+
+def log_fmt(dry_run: bool | None = None, dry_run_option: str | None = None) -> str:
+    if dry_run and dry_run_option:
+        raise ValueError("Please set either dry_run or dry_run_option.")
+
+    if dry_run_option:
+        if dry_run_option not in DRY_RUN_MAP:
+            raise ValueError(
+                f'Invalid dry_run_option "{dry_run_option}". '
+                f"Only the following options are allowed: {list(DRY_RUN_MAP.keys())}."
+            )
+
+        dry_run = DRY_RUN_MAP[dry_run_option]
+
+    log_fmt = (
+        "[%(asctime)s] [%(levelname)s] [DRY-RUN] "
+        if dry_run
+        else "[%(asctime)s] [%(levelname)s] "
+    )
+
+    log_fmt += "[%(filename)s:%(funcName)s:%(lineno)d] - %(message)s"
+
+    return log_fmt
+
 
 def init_env(
-    log_level: Optional[str] = None,
-    config_file: Optional[str] = None,
+    log_level: str | None = None,
+    config_file: str | None = None,
+    dry_run: bool | None = None,
     print_gql_url: bool = True,
 ) -> None:
     # store env configs in environment variables. this way child processes
@@ -33,7 +58,7 @@ def init_env(
 
     # init loglevel
     logging.basicConfig(
-        format=LOG_FMT,
+        format=log_fmt(dry_run=dry_run),
         datefmt=LOG_DATEFMT,
         level=getattr(logging, os.environ.get(QONTRACT_LOG_LEVEL, "INFO")),
     )