qontract-reconcile 0.10.0__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/cli.py

@@ -1,3 +1,4 @@
+# ruff: noqa: PLC0415 - `import` should be at the top-level of a file
 import faulthandler
 import json
 import logging
@@ -5,12 +6,13 @@ import os
 import re
 import sys
 import traceback
+from collections.abc import Iterable
 from signal import SIGUSR1
 from types import ModuleType
-from typing import Optional
 
 import click
 import sentry_sdk
+from sentry_sdk.integrations.logging import LoggingIntegration
 
 from reconcile.status import (
     ExitCodes,
@@ -18,16 +20,21 @@ from reconcile.status import (
 )
 from reconcile.utils import gql
 from reconcile.utils.aggregated_list import RunnerException
+from reconcile.utils.amtool import AMTOOL_VERSION, AMTOOL_VERSION_REGEX
 from reconcile.utils.binary import (
     binary,
     binary_version,
 )
 from reconcile.utils.exceptions import PrintToFileInGitRepositoryError
 from reconcile.utils.git import is_file_in_git_repo
+from reconcile.utils.gql import GqlApiSingleton
+from reconcile.utils.promtool import PROMTOOL_VERSION, PROMTOOL_VERSION_REGEX
 from reconcile.utils.runtime.environment import init_env
 from reconcile.utils.runtime.integration import (
     ModuleArgsKwargsRunParams,
     ModuleBasedQontractReconcileIntegration,
+    NoParams,
+    PydanticRunParams,
     QontractReconcileIntegration,
 )
 from reconcile.utils.runtime.meta import IntegrationMeta
@@ -37,12 +44,15 @@ from reconcile.utils.runtime.runner import (
 )
 from reconcile.utils.unleash import get_feature_toggle_state
 
-TERRAFORM_VERSION = "0.13.7"
+TERRAFORM_VERSION = ["1.6.6"]
 TERRAFORM_VERSION_REGEX = r"^Terraform\sv([\d]+\.[\d]+\.[\d]+)$"
 
-OC_VERSION = "4.10.15"
+OC_VERSIONS = ["4.12.46", "4.10.15"]
 OC_VERSION_REGEX = r"^Client\sVersion:\s([\d]+\.[\d]+\.[\d]+)$"
 
+HELM_VERSIONS = ["3.11.1"]
+HELM_VERSION_REGEX = r"^version.BuildInfo{Version:\"v([\d]+\.[\d]+\.[\d]+)\".*$"
+
 
 def before_breadcrumb(crumb, hint):
     # https://docs.sentry.io/platforms/python/configuration/filtering/
@@ -60,8 +70,22 @@ def before_breadcrumb(crumb, hint):
 
 # Enable Sentry
 if os.getenv("SENTRY_DSN"):
-    sentry_sdk.init(  # type: ignore[abstract] # pylint: disable=abstract-class-instantiated
-        os.environ["SENTRY_DSN"], before_breadcrumb=before_breadcrumb
+    match os.environ.get("SENTRY_EVENT_LEVEL", "CRITICAL").upper():
+        case "CRITICAL":
+            sentry_event_level = logging.CRITICAL
+        case "ERROR":
+            sentry_event_level = logging.ERROR
+        case _:
+            raise ValueError(
+                "Invalid value for SENTRY_EVENT_LEVEL. Must be CRITICAL or ERROR."
+            )
+
+    sentry_sdk.init(
+        os.environ["SENTRY_DSN"],
+        before_breadcrumb=before_breadcrumb,
+        integrations=[
+            LoggingIntegration(event_level=sentry_event_level),
+        ],
     )
 
 
@@ -292,8 +316,23 @@ def vault_throughput_path(function):
 
 
 def cluster_name(function):
+    """This option can be used when more than one cluster needs to be passed as argument"""
+    function = click.option(
+        "--cluster-name",
+        default=None,
+        multiple=True,
+        help="openshift cluster names to act on i.e.: --cluster-name cluster-1 --cluster-name cluster-2",
+    )(function)
+
+    return function
+
+
+def exclude_cluster(function):
     function = click.option(
-        "--cluster-name", help="cluster name to act on.", default=None
+        "--exclude-cluster",
+        multiple=True,
+        help="openshift cluster names to remove from execution when in dry-run",
+        default=[],
     )(function)
 
     return function
@@ -362,6 +401,29 @@ def exclude_aws_accounts(function):
     return function
 
 
+def org_id_multiple(function):
+    """This option can be used when more than one OCM organization ID needs to be passed as argument"""
+    function = click.option(
+        "--org-id",
+        default=None,
+        multiple=True,
+        help="OCM organization IDs to act on",
+    )(function)
+
+    return function
+
+
+def exclude_org_id(function):
+    function = click.option(
+        "--exclude-org-id",
+        multiple=True,
+        help="OCM organization to exclude from execution when in dry-run",
+        default=[],
+    )(function)
+
+    return function
+
+
 def workspace_name(function):
     function = click.option(
         "--workspace-name", help="slack workspace name to act on.", default=None
@@ -445,6 +507,50 @@ def include_trigger_trace(function):
     return function
 
 
+def trigger_reason(function):
+    function = click.option(
+        "--trigger-reason",
+        help="reason deployment was triggered.",
+        default=None,
+    )(function)
+
+    return function
+
+
+def trigger_integration(function):
+    function = click.option(
+        "--trigger-integration",
+        help="integration deployment was triggered.",
+        default=None,
+    )(function)
+
+    return function
+
+
+def enable_extended_early_exit(function):
+    return click.option(
+        "--enable-extended-early-exit/--no-enable-extended-early-exit",
+        default=False,
+        help="enable extended early exit.",
+    )(function)
+
+
+def extended_early_exit_cache_ttl_seconds(function):
+    return click.option(
+        "--extended-early-exit-cache-ttl-seconds",
+        default=3600,
+        help="TTL of extended early exit cache in seconds.",
+    )(function)
+
+
+def log_cached_log_output(function):
+    return click.option(
+        "--log-cached-log-output/--no-log-cached-log-output",
+        default=False,
+        help="log the cached log output.",
+    )(function)
+
+
 def register_faulthandler(fileobj=sys.__stderr__):
     if fileobj:
         if not faulthandler.is_enabled():
@@ -526,7 +632,7 @@ def run_class_integration(
     finally:
         if dump_schemas_file:
             gqlapi = gql.get_api()
-            with open(dump_schemas_file, "w") as f:
+            with open(dump_schemas_file, "w", encoding="locale") as f:
                 f.write(json.dumps(gqlapi.get_queried_schemas()))
 
 
@@ -558,6 +664,7 @@ def integration(
     init_env(
         log_level=log_level,
         config_file=configfile,
+        dry_run=dry_run,
         # don't print gql url in dry-run mode - less noisy PR check logs and
         # the actual SHA is not that important during PR checks
         print_gql_url=(not dry_run and bool(gql_url_print)),
@@ -572,6 +679,22 @@ def integration(
     ctx.obj["dump_schemas_file"] = dump_schemas_file
 
 
+@integration.result_callback()
+def exit_integration(
+    ctx,
+    configfile,
+    dry_run,
+    early_exit_compare_sha,
+    check_only_affected_shards,
+    validate_schemas,
+    dump_schemas_file,
+    log_level,
+    gql_sha_url,
+    gql_url_print,
+):
+    GqlApiSingleton.close()
+
+
 @integration.command(short_help="Manage AWS Route53 resources using Terraform.")
 @print_to_file
 @threaded()
@@ -595,6 +718,64 @@ def terraform_aws_route53(
     )
 
 
+@integration.command(short_help="Manage the SAML IDP config for all AWS accounts.")
+@print_to_file
+@threaded()
+@binary(["terraform", "git"])
+@binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
+@enable_deletion(default=True)
+@account_name
+@click.option(
+    "--saml-idp-name",
+    help="Name of the SAML IDP. Must match the name the SAML response!",
+    required=True,
+    default="RedHatInternal",
+)
+@click.option(
+    "--saml-metadata-url",
+    help="URL of the SAML metadata xml file. Must be a valid URL!",
+    required=True,
+    default="https://auth.redhat.com/auth/realms/EmployeeIDP/protocol/saml/descriptor",
+)
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
+@click.pass_context
+def aws_saml_idp(
+    ctx,
+    print_to_file,
+    enable_deletion,
+    thread_pool_size,
+    account_name,
+    saml_idp_name,
+    saml_metadata_url,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
+):
+    from reconcile.aws_saml_idp.integration import (
+        AwsSamlIdpIntegration,
+        AwsSamlIdpIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=AwsSamlIdpIntegration(
+            AwsSamlIdpIntegrationParams(
+                thread_pool_size=thread_pool_size,
+                print_to_file=print_to_file,
+                enable_deletion=enable_deletion,
+                saml_idp_name=saml_idp_name,
+                saml_metadata_url=saml_metadata_url,
+                account_name=account_name,
+                enable_extended_early_exit=enable_extended_early_exit,
+                extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+                log_cached_log_output=log_cached_log_output,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
 @integration.command(short_help="Configures the teams and members in a GitHub org.")
 @click.pass_context
 def github(ctx):
@@ -630,22 +811,6 @@ def github_users(ctx, gitlab_project_id, thread_pool_size, enable_deletion, send
     )
 
 
-@integration.command(
-    short_help="Scan GitHub repositories for leaked keys "
-    "and remove them (only submits PR)."
-)
-@gitlab_project_id
-@threaded()
-@binary(["git", "git-secrets"])
-@click.pass_context
-def github_scanner(ctx, gitlab_project_id, thread_pool_size):
-    import reconcile.github_scanner
-
-    run_integration(
-        reconcile.github_scanner, ctx.obj, gitlab_project_id, thread_pool_size
-    )
-
-
 @integration.command(short_help="Validates GitHub organization settings.")
 @click.pass_context
 def github_validator(ctx):
@@ -657,7 +822,7 @@ def github_validator(ctx):
 @integration.command(short_help="Configures ClusterRolebindings in OpenShift clusters.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -676,7 +841,7 @@ def openshift_clusterrolebindings(ctx, thread_pool_size, internal, use_jump_host
 @integration.command(short_help="Configures Rolebindings in OpenShift clusters.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -695,7 +860,7 @@ def openshift_rolebindings(ctx, thread_pool_size, internal, use_jump_host):
 @integration.command(short_help="Manages OpenShift Groups.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -710,7 +875,7 @@ def openshift_groups(ctx, thread_pool_size, internal, use_jump_host):
 @integration.command(short_help="Deletion of users from OpenShift clusters.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -727,7 +892,7 @@ def openshift_users(ctx, thread_pool_size, internal, use_jump_host):
 )
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @vault_output_path
@@ -747,20 +912,186 @@ def openshift_serviceaccount_tokens(
     )
 
 
-@integration.command(short_help="Manage Jenkins roles association via REST API.")
+@integration.command(
+    short_help="Manage the SAML IAM roles for all AWS accounts with SSO enabled."
+)
+@print_to_file
+@threaded()
+@binary(["terraform", "git"])
+@binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
+@enable_deletion(default=True)
+@account_name
+@click.option(
+    "--saml-idp-name",
+    help="Name of the SAML IDP. Must match the name the SAML response!",
+    required=True,
+    default="RedHatInternal",
+)
+@click.option(
+    "--max-session-duration-hours",
+    help="Maximum session duration (in hours) that you want to set for the specified role",
+    required=True,
+    default=6,
+)
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @click.pass_context
-def jenkins_roles(ctx):
-    import reconcile.jenkins_roles
+def aws_saml_roles(
+    ctx,
+    print_to_file,
+    enable_deletion,
+    thread_pool_size,
+    account_name,
+    saml_idp_name,
+    max_session_duration_hours,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
+):
+    from reconcile.aws_saml_roles.integration import (
+        AwsSamlRolesIntegration,
+        AwsSamlRolesIntegrationParams,
+    )
 
-    run_integration(reconcile.jenkins_roles, ctx.obj)
+    run_class_integration(
+        integration=AwsSamlRolesIntegration(
+            AwsSamlRolesIntegrationParams(
+                thread_pool_size=thread_pool_size,
+                print_to_file=print_to_file,
+                enable_deletion=enable_deletion,
+                saml_idp_name=saml_idp_name,
+                max_session_duration_hours=max_session_duration_hours,
+                account_name=account_name,
+                enable_extended_early_exit=enable_extended_early_exit,
+                extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+                log_cached_log_output=log_cached_log_output,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Create and manage AWS accounts.")
+@account_name
+@click.option(
+    "--flavor",
+    help="Flavor of the AWS account manager.",
+    required=True,
+    default="app-interface-commercial",
+)
+@click.option(
+    "--tag",
+    "-t",
+    type=(str, str),
+    multiple=True,
+    default=[("managed-by", "app-interface")],
+)
+@click.option(
+    "--initial-user-name",
+    help="The name of the initial user to be created in the account.",
+    required=True,
+    default="terraform",
+)
+@click.option(
+    "--initial-user-policy-arn",
+    help="The ARN of the policy that is attached to the initial user.",
+    required=True,
+    default="arn:aws:iam::aws:policy/AdministratorAccess",
+)
+@click.option(
+    "--initial-user-secret-vault-path",
+    help="The path in Vault to store the initial user secret. Python format string with access to 'account_name' attribute.",
+    required=True,
+    default="app-sre-v2/creds/terraform/{account_name}/config",  # noqa: RUF027
+)
+@click.option(
+    "--account-tmpl-resource",
+    help="Resource name of the account template-collection template in the app-interface.",
+    required=True,
+    default="/aws-account-manager/account-tmpl.yml",
+)
+@click.option(
+    "--template-collection-root-path",
+    help="File path to the root directory to store new account template-collections.",
+    required=True,
+    default="data/templating/collections/aws-account",
+)
+@click.pass_context
+def aws_account_manager(
+    ctx,
+    account_name,
+    flavor,
+    tag,
+    initial_user_name,
+    initial_user_policy_arn,
+    initial_user_secret_vault_path,
+    account_tmpl_resource,
+    template_collection_root_path,
+):
+    from reconcile.aws_account_manager.integration import (
+        AwsAccountMgmtIntegration,
+        AwsAccountMgmtIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=AwsAccountMgmtIntegration(
+            AwsAccountMgmtIntegrationParams(
+                account_name=account_name,
+                flavor=flavor,
+                default_tags=dict(tag),
+                initial_user_name=initial_user_name,
+                initial_user_policy_arn=initial_user_policy_arn,
+                initial_user_secret_vault_path=initial_user_secret_vault_path,
+                account_tmpl_resource=account_tmpl_resource,
+                template_collection_root_path=template_collection_root_path,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Initialize AWS accounts for Terraform usage.")
+@account_name
+@click.option(
+    "--state-tmpl-resource",
+    help="Resource name of the state template-collection template in the app-interface.",
+    required=True,
+    default="/terraform-init/terraform-state.yml",
+)
+@click.option(
+    "--template-collection-root-path",
+    help="File path to the root directory to store new state template-collections.",
+    required=True,
+    default="data/templating/collections/terraform-init",
+)
+@click.pass_context
+def terraform_init(
+    ctx, account_name, state_tmpl_resource, template_collection_root_path
+):
+    from reconcile.terraform_init.integration import (
+        TerraformInitIntegration,
+        TerraformInitIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=TerraformInitIntegration(
+            TerraformInitIntegrationParams(
+                account_name=account_name,
+                state_tmpl_resource=state_tmpl_resource,
+                template_collection_root_path=template_collection_root_path,
+            )
+        ),
+        ctx=ctx.obj,
+    )
 
 
-@integration.command(short_help="Manage Jenkins plugins installation via REST API.")
+@integration.command(short_help="Manage Jenkins roles association via REST API.")
 @click.pass_context
-def jenkins_plugins(ctx):
-    import reconcile.jenkins_plugins
+def jenkins_roles(ctx):
+    import reconcile.jenkins_roles
 
-    run_integration(reconcile.jenkins_plugins, ctx.obj)
+    run_integration(reconcile.jenkins_roles, ctx.obj)
 
 
 @integration.command(short_help="Manage Jenkins worker fleets via JCasC.")
@@ -826,29 +1157,41 @@ def jenkins_webhooks_cleaner(ctx):
     run_integration(reconcile.jenkins_webhooks_cleaner, ctx.obj)
 
 
-@integration.command(short_help="Watch for changes in Jira boards and notify on Slack.")
+@integration.command(short_help="Validate permissions in Jira.")
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @click.pass_context
-def jira_watcher(ctx):
-    import reconcile.jira_watcher
+def jira_permissions_validator(
+    ctx,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
+):
+    import reconcile.jira_permissions_validator
 
-    run_integration(reconcile.jira_watcher, ctx.obj)
+    run_integration(
+        reconcile.jira_permissions_validator,
+        ctx.obj,
+        enable_extended_early_exit=enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output=log_cached_log_output,
+    )
 
 
-@integration.command(
-    short_help="Watch for changes in Unleah feature toggles " "and notify on Slack."
-)
+@integration.command(short_help="Watch for changes in Jira boards and notify on Slack.")
 @click.pass_context
-def unleash_watcher(ctx):
-    import reconcile.unleash_watcher
+def jira_watcher(ctx):
+    import reconcile.jira_watcher
 
-    run_integration(reconcile.unleash_watcher, ctx.obj)
+    run_integration(reconcile.jira_watcher, ctx.obj)
 
 
 @integration.command(
     short_help="Watches for OpenShift upgrades and sends notifications."
 )
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @threaded()
 @internal()
 @use_jump_host()
@@ -868,8 +1211,18 @@ def openshift_upgrade_watcher(ctx, thread_pool_size, internal, use_jump_host):
 @integration.command(short_help="Manage Slack User Groups (channels and users).")
 @workspace_name
 @usergroup_name
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @click.pass_context
-def slack_usergroups(ctx, workspace_name, usergroup_name):
+def slack_usergroups(
+    ctx,
+    workspace_name,
+    usergroup_name,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
+):
     import reconcile.slack_usergroups
 
     run_integration(
@@ -877,17 +1230,12 @@ def slack_usergroups(ctx, workspace_name, usergroup_name):
         ctx.obj,
         workspace_name,
         usergroup_name,
+        enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output,
     )
 
 
-@integration.command(short_help="Manage integrations on GitLab projects.")
-@click.pass_context
-def gitlab_integrations(ctx):
-    import reconcile.gitlab_integrations
-
-    run_integration(reconcile.gitlab_integrations, ctx.obj)
-
-
 @integration.command(short_help="Manage permissions on GitLab projects.")
 @threaded()
 @click.pass_context
@@ -956,6 +1304,26 @@ def aws_ami_share(ctx):
     run_integration(reconcile.aws_ami_share, ctx.obj)
 
 
+@integration.command(short_help="Cleanup old and unused AMIs.")
+@threaded()
+@click.pass_context
+def aws_ami_cleanup(ctx, thread_pool_size):
+    import reconcile.aws_ami_cleanup.integration
+
+    run_integration(reconcile.aws_ami_cleanup.integration, ctx.obj, thread_pool_size)
+
+
+@integration.command(short_help="Set up retention period for Cloudwatch logs.")
+@threaded()
+@click.pass_context
+def aws_cloudwatch_log_retention(ctx, thread_pool_size):
+    import reconcile.aws_cloudwatch_log_retention.integration
+
+    run_integration(
+        reconcile.aws_cloudwatch_log_retention.integration, ctx.obj, thread_pool_size
+    )
+
+
 @integration.command(
     short_help="Generate AWS ECR image pull secrets and store them in Vault."
 )
@@ -983,16 +1351,24 @@ def aws_support_cases_sos(ctx, gitlab_project_id, thread_pool_size):
 
 
 @integration.command(short_help="Manages OpenShift Resources.")
-@threaded(default=20)
+@threaded()
 @binary(["oc", "ssh", "amtool"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
+@binary_version("amtool", ["--version"], AMTOOL_VERSION_REGEX, AMTOOL_VERSION)
 @internal()
 @use_jump_host()
 @cluster_name
+@exclude_cluster
 @namespace_name
 @click.pass_context
 def openshift_resources(
-    ctx, thread_pool_size, internal, use_jump_host, cluster_name, namespace_name
+    ctx,
+    thread_pool_size,
+    internal,
+    use_jump_host,
+    cluster_name,
+    exclude_cluster,
+    namespace_name,
 ):
     import reconcile.openshift_resources
 
@@ -1003,19 +1379,22 @@ def openshift_resources(
         internal,
         use_jump_host,
         cluster_name=cluster_name,
+        exclude_cluster=exclude_cluster,
         namespace_name=namespace_name,
     )
 
 
 @integration.command(short_help="Manage OpenShift resources defined in Saas files.")
-@gitlab_project_id
 @threaded()
 @throughput
 @use_jump_host()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
+@binary_version("helm", ["version"], HELM_VERSION_REGEX, HELM_VERSIONS)
 @click.option("--saas-file-name", default=None, help="saas-file to act on.")
 @click.option("--env-name", default=None, help="environment to deploy to.")
+@trigger_integration
+@trigger_reason
 @click.pass_context
 def openshift_saas_deploy(
     ctx,
@@ -1024,7 +1403,8 @@ def openshift_saas_deploy(
     use_jump_host,
     saas_file_name,
     env_name,
-    gitlab_project_id,
+    trigger_integration,
+    trigger_reason,
 ):
     import reconcile.openshift_saas_deploy
 
@@ -1036,7 +1416,8 @@ def openshift_saas_deploy(
         use_jump_host=use_jump_host,
         saas_file_name=saas_file_name,
         env_name=env_name,
-        gitlab_project_id=gitlab_project_id,
+        trigger_integration=trigger_integration,
+        trigger_reason=trigger_reason,
     )
 
 
@@ -1051,7 +1432,7 @@ def openshift_saas_deploy(
     help="bundle sha to compare to to find changes",
 )
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @use_jump_host()
 @click.pass_context
 def openshift_saas_deploy_change_tester(
@@ -1086,7 +1467,7 @@ def saas_file_validator(ctx):
 @integration.command(short_help="Trigger deployments when a commit changed for a ref.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @include_trigger_trace
@@ -1109,7 +1490,7 @@ def openshift_saas_deploy_trigger_moving_commits(
 @integration.command(short_help="Trigger deployments when upstream job runs.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @include_trigger_trace
@@ -1132,7 +1513,7 @@ def openshift_saas_deploy_trigger_upstream_jobs(
 @integration.command(short_help="Trigger deployments when images are pushed.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @include_trigger_trace
@@ -1155,7 +1536,7 @@ def openshift_saas_deploy_trigger_images(
 @integration.command(short_help="Trigger deployments when configuration changes.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @include_trigger_trace
@@ -1178,7 +1559,7 @@ def openshift_saas_deploy_trigger_configs(
 @integration.command(short_help="Clean up deployment related resources.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -1237,7 +1618,7 @@ def gitlab_labeler(ctx, gitlab_project_id, gitlab_merge_request_id):
 @integration.command(short_help="Manages labels on OpenShift namespaces.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -1256,7 +1637,7 @@ def openshift_namespace_labels(ctx, thread_pool_size, internal, use_jump_host):
 @integration.command(short_help="Manages OpenShift Namespaces.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @cluster_name
@@ -1281,7 +1662,7 @@ def openshift_namespaces(
 @integration.command(short_help="Manages OpenShift NetworkPolicies.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -1301,7 +1682,7 @@ def openshift_network_policies(ctx, thread_pool_size, internal, use_jump_host):
 @threaded()
 @take_over()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -1322,7 +1703,7 @@ def openshift_limitranges(ctx, thread_pool_size, internal, use_jump_host, take_o
 @threaded()
 @take_over()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -1342,7 +1723,7 @@ def openshift_resourcequotas(ctx, thread_pool_size, internal, use_jump_host, tak
 @integration.command(short_help="Manages OpenShift Secrets from Vault.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @cluster_name
@@ -1367,7 +1748,7 @@ def openshift_vault_secrets(
 @integration.command(short_help="Manages OpenShift Routes.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @cluster_name
@@ -1389,19 +1770,96 @@ def openshift_routes(
     )
 
 
-@integration.command(short_help="Configures the teams and members in Quay.")
+@integration.command(short_help="Manages OpenShift Prometheus Rules.")
+@threaded()
+@binary(["oc", "ssh"])
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
+@internal()
+@use_jump_host()
+@cluster_name
+@namespace_name
 @click.pass_context
-def quay_membership(ctx):
-    import reconcile.quay_membership
+def openshift_prometheus_rules(
+    ctx, thread_pool_size, internal, use_jump_host, cluster_name, namespace_name
+):
+    import reconcile.openshift_prometheus_rules
 
-    run_integration(reconcile.quay_membership, ctx.obj)
+    run_integration(
+        reconcile.openshift_prometheus_rules,
+        ctx.obj,
+        thread_pool_size,
+        internal,
+        use_jump_host,
+        cluster_name=cluster_name,
+        namespace_name=namespace_name,
+    )
 
 
-@integration.command(
-    short_help="Mirrors external images into Google Container Registry."
-)
-@click.pass_context
-@binary(["skopeo"])
+@integration.command(short_help="Discover routes and update endpoints")
+@threaded()
+@binary(["oc"])
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
+@internal()
+@use_jump_host()
+@cluster_name
+@namespace_name
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
+@click.option(
+    "--endpoint-tmpl-resource",
+    help="Resource name of the endpoint template in the app-interface.",
+    required=False,
+)
+@click.pass_context
+def endpoints_discovery(
+    ctx,
+    thread_pool_size,
+    internal,
+    use_jump_host,
+    cluster_name,
+    namespace_name,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
+    endpoint_tmpl_resource,
+):
+    from reconcile.endpoints_discovery.integration import (
+        EndpointsDiscoveryIntegration,
+        EndpointsDiscoveryIntegrationParams,
+    )
+
+    params = EndpointsDiscoveryIntegrationParams(
+        thread_pool_size=thread_pool_size,
+        internal=internal,
+        use_jump_host=use_jump_host,
+        cluster_name=cluster_name,
+        namespace_name=namespace_name,
+        enable_extended_early_exit=enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output=log_cached_log_output,
+    )
+    if endpoint_tmpl_resource:
+        params.endpoint_tmpl_resource = endpoint_tmpl_resource
+    run_class_integration(
+        integration=EndpointsDiscoveryIntegration(params),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Configures the teams and members in Quay.")
+@click.pass_context
+def quay_membership(ctx):
+    import reconcile.quay_membership
+
+    run_integration(reconcile.quay_membership, ctx.obj)
+
+
+@integration.command(
+    short_help="Mirrors external images into Google Container Registry."
+)
+@click.pass_context
+@binary(["skopeo"])
 def gcr_mirror(ctx):
     import reconcile.gcr_mirror
 
@@ -1431,14 +1889,27 @@ def gcr_mirror(ctx):
     default=86400,
 )
 @click.option(
-    "-i",
-    "--image",
-    help="Only considers this image to mirror. It can be specified multiple times.",
+    "-r",
+    "--repository-url",
+    help="Only considers this repository to mirror. It can be specified multiple times.",
+    multiple=True,
+)
+@click.option(
+    "-e",
+    "--exclude-repository-url",
+    help="excludes this repository  to mirror. It can be specified multiple times.",
     multiple=True,
 )
 @click.pass_context
 @binary(["skopeo"])
-def quay_mirror(ctx, control_file_dir, compare_tags, compare_tags_interval, image):
+def quay_mirror(
+    ctx,
+    control_file_dir,
+    compare_tags,
+    compare_tags_interval,
+    repository_url,
+    exclude_repository_url,
+):
     import reconcile.quay_mirror
 
     run_integration(
@@ -1447,7 +1918,8 @@ def quay_mirror(ctx, control_file_dir, compare_tags, compare_tags_interval, imag
         control_file_dir,
         compare_tags,
         compare_tags_interval,
-        image,
+        repository_url,
+        exclude_repository_url,
     )
 
 
@@ -1533,18 +2005,175 @@ def ldap_users(ctx, infra_project_id, app_interface_project_id):
     )
 
 
+@integration.command(short_help="Manages LDAP groups based on App-Interface roles.")
+@click.option(
+    "--aws-sso-namespace",
+    help="Namespace used to store AWS SSO groups.",
+    required=True,
+    default="it-cloud-aws",
+)
+@click.pass_context
+def ldap_groups(ctx, aws_sso_namespace):
+    from reconcile.ldap_groups.integration import (
+        LdapGroupsIntegration,
+        LdapGroupsIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=LdapGroupsIntegration(
+            LdapGroupsIntegrationParams(aws_sso_namespace=aws_sso_namespace)
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Sync AWS asset version numbers to App-Interface")
+@click.option(
+    "--aws-resource-exporter-clusters",
+    help="A comma seperated list of cluster names where aws-resource-exporter is deployed.",
+    required=True,
+    envvar="AVS_AWS_RESOURCE_EXPORTER_CLUSTERS",
+)
+@click.option(
+    "--clusters",
+    help="A comma seperated list of cluster names to operator on. If none is specified, all clusters are considered.",
+    required=False,
+    envvar="AVS_CLUSTERS",
+)
+@click.option(
+    "--supported-providers",
+    help="A comma seperated list of supported external resource providers to operator on. Default: rds, elasticache",
+    required=False,
+    envvar="AVS_SUPPORTED_PROVIDERS",
+)
+@click.option(
+    "--prometheus-timeout",
+    help="Prometheus timeout in seconds. Default: 10",
+    required=False,
+    envvar="AVS_PROMETHEUS_TIMEOUT",
+)
+@click.pass_context
+def aws_version_sync(
+    ctx,
+    aws_resource_exporter_clusters,
+    clusters,
+    supported_providers,
+    prometheus_timeout,
+):
+    from reconcile.aws_version_sync.integration import (
+        AVSIntegration,
+        AVSIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=AVSIntegration(
+            AVSIntegrationParams(
+                aws_resource_exporter_clusters=aws_resource_exporter_clusters.split(
+                    ","
+                ),
+                supported_providers=supported_providers.split(",")
+                if supported_providers
+                else ["rds", "elasticache"],
+                clusters=clusters.split(",") if clusters else [],
+                prometheus_timeout=int(prometheus_timeout)
+                if prometheus_timeout
+                else 10,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manages raw HCL Terraform from a separate repository.")
+@click.option(
+    "-o",
+    "--output-file",
+    help="Specify where to place the output of the integration",
+)
+@click.argument("gitlab-project-id", required=False)
+@click.argument("gitlab-merge-request-id", required=False)
+@click.pass_context
+def terraform_repo(ctx, output_file, gitlab_project_id, gitlab_merge_request_id):
+    from reconcile import terraform_repo
+
+    run_class_integration(
+        integration=terraform_repo.TerraformRepoIntegration(
+            terraform_repo.TerraformRepoIntegrationParams(
+                output_file=output_file,
+                validate_git=True,
+                gitlab_project_id=gitlab_project_id,
+                gitlab_merge_request_id=gitlab_merge_request_id,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Test app-interface templates.")
+@click.pass_context
+def template_validator(ctx):
+    from reconcile.templating import validator
+
+    run_class_integration(
+        integration=validator.TemplateValidatorIntegration(PydanticRunParams()),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Render datafile templates in app-interface.")
+@click.option(
+    "--app-interface-data-path",
+    help="Path to data dir in app-interface repo. Use this for local rendering or in MR checks.",
+    required=False,
+    envvar="APP_INTERFACE_DATA_PATH",
+)
+@click.option(
+    "--clone-repo",
+    is_flag=True,
+    help="Flag to enable cloning of the app-interface repo. Use this for regular integration run.",
+    default=False,
+)
+@click.option(
+    "--template-collection-name",
+    help="specific template collection name to render",
+    required=False,
+)
+@click.pass_context
+def template_renderer(
+    ctx, app_interface_data_path, clone_repo, template_collection_name
+):
+    from reconcile.templating.renderer import (
+        TemplateRendererIntegration,
+        TemplateRendererIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=TemplateRendererIntegration(
+            TemplateRendererIntegrationParams(
+                app_interface_data_path=app_interface_data_path,
+                clone_repo=clone_repo,
+                template_collection_name=template_collection_name,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
 @integration.command(short_help="Manage AWS Resources using Terraform.")
 @print_to_file
 @vault_output_path
-@threaded(default=20)
+@threaded()
 @binary(["terraform", "oc", "git"])
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @enable_deletion(default=False)
 @account_name_multiple
 @exclude_aws_accounts
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @click.option(
     "--light/--full",
     default=False,
@@ -1562,6 +2191,9 @@ def terraform_resources(
     vault_output_path,
     account_name,
     exclude_accounts,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
 ):
     import reconcile.terraform_resources
 
@@ -1579,13 +2211,16 @@ def terraform_resources(
         vault_output_path,
         account_name=account_name,
         exclude_accounts=exclude_accounts,
+        enable_extended_early_exit=enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output=log_cached_log_output,
     )
 
 
 @integration.command(short_help="Manage Cloudflare Resources using Terraform.")
 @print_to_file
 @enable_deletion(default=False)
-@threaded(default=20)
+@threaded()
 @binary(["terraform"])
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
 @account_name
@@ -1621,7 +2256,7 @@ def terraform_cloudflare_resources(
 @integration.command(short_help="Manage Cloudflare DNS using Terraform.")
 @print_to_file
 @enable_deletion(default=False)
-@threaded(default=10)
+@threaded()
 @binary(["terraform"])
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
 @account_name
@@ -1649,7 +2284,7 @@ def terraform_cloudflare_dns(
 @integration.command(short_help="Manage Cloudflare Users using Terraform.")
 @print_to_file
 @binary(["terraform"])
-@threaded(default=20)
+@threaded()
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
 @account_name
 @enable_deletion(default=True)
@@ -1679,7 +2314,7 @@ def terraform_cloudflare_users(
     short_help="Manage Cloud Resources using Cloud Native Assets (CNA)."
 )
 @enable_deletion(default=False)
-@threaded(default=20)
+@threaded()
 @click.pass_context
 def cna_resources(
     ctx,
@@ -1697,11 +2332,15 @@ def cna_resources(
 
 
 @integration.command(short_help="Manage auto-promotions defined in SaaS files")
-@threaded(default=10)
+@threaded()
+@click.option("--env-name", default=None, help="environment to filter saas files by")
+@click.option("--app-name", default=None, help="app to filter saas files by.")
 @click.pass_context
 def saas_auto_promotions_manager(
     ctx,
     thread_pool_size,
+    env_name,
+    app_name,
 ):
     import reconcile.saas_auto_promotions_manager.integration
 
@@ -1709,12 +2348,14 @@ def saas_auto_promotions_manager(
         reconcile.saas_auto_promotions_manager.integration,
         ctx.obj,
         thread_pool_size,
+        env_name=env_name,
+        app_name=app_name,
     )
 
 
 @integration.command(short_help="Manage AWS users using Terraform.")
 @print_to_file
-@threaded(default=20)
+@threaded()
 @binary(["terraform", "gpg", "git"])
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
 @enable_deletion(default=True)
@@ -1744,6 +2385,35 @@ def terraform_users(
     )
 
 
+@integration.command(short_help="Manage VPC creation")
+@binary(["terraform"])
+@binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
+@account_name
+@print_to_file
+@threaded()
+@enable_deletion(default=False)
+@click.pass_context
+def terraform_vpc_resources(
+    ctx, account_name, print_to_file, thread_pool_size, enable_deletion
+):
+    from reconcile.terraform_vpc_resources.integration import (
+        TerraformVpcResources,
+        TerraformVpcResourcesParams,
+    )
+
+    run_class_integration(
+        TerraformVpcResources(
+            TerraformVpcResourcesParams(
+                account_name=account_name,
+                print_to_file=print_to_file,
+                thread_pool_size=thread_pool_size,
+                enable_deletion=enable_deletion,
+            )
+        ),
+        ctx.obj,
+    )
+
+
 @integration.command(
     short_help="Manage VPC peerings between OSD clusters and AWS accounts or other OSD clusters."
 )
@@ -1753,9 +2423,19 @@ def terraform_users(
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
 @enable_deletion(default=False)
 @account_name
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @click.pass_context
 def terraform_vpc_peerings(
-    ctx, print_to_file, enable_deletion, thread_pool_size, account_name
+    ctx,
+    print_to_file,
+    enable_deletion,
+    thread_pool_size,
+    account_name,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
 ):
     import reconcile.terraform_vpc_peerings
 
@@ -1768,6 +2448,9 @@ def terraform_vpc_peerings(
         enable_deletion,
         thread_pool_size,
         account_name,
+        enable_extended_early_exit=enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output=log_cached_log_output,
     )
 
 
@@ -1789,9 +2472,22 @@ def vpc_peerings_validator(ctx):
 @threaded()
 @binary(["terraform", "git"])
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @enable_deletion(default=False)
+@account_name
 @click.pass_context
-def terraform_tgw_attachments(ctx, print_to_file, enable_deletion, thread_pool_size):
+def terraform_tgw_attachments(
+    ctx,
+    print_to_file,
+    enable_deletion,
+    thread_pool_size,
+    account_name,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
+):
     import reconcile.terraform_tgw_attachments
 
     if print_to_file and is_file_in_git_repo(print_to_file):
@@ -1802,6 +2498,10 @@ def terraform_tgw_attachments(ctx, print_to_file, enable_deletion, thread_pool_s
         print_to_file,
         enable_deletion,
         thread_pool_size,
+        account_name=account_name,
+        enable_extended_early_exit=enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output=log_cached_log_output,
     )
 
 
@@ -1852,12 +2552,142 @@ def ocm_groups(ctx, thread_pool_size):
 @integration.command(short_help="Manages clusters via OCM.")
 @gitlab_project_id
 @threaded()
+@click.option(
+    "--job-controller-cluster",
+    help="The cluster holding the job-controller namepsace",
+    required=False,
+    envvar="JOB_CONTROLLER_CLUSTER",
+)
+@click.option(
+    "--job-controller-namespace",
+    help="The namespace used for ROSA jobs",
+    required=False,
+    envvar="JOB_CONTROLLER_NAMESPACE",
+)
+@click.option(
+    "--rosa-job-service-account",
+    help="The service-account used for ROSA jobs",
+    required=False,
+    envvar="ROSA_JOB_SERVICE_ACCOUNT",
+)
+@click.option(
+    "--rosa-job-image",
+    help="The container image to use to run ROSA cli command jobs",
+    required=False,
+    envvar="ROSA_JOB_IMAGE",
+)
+@click.option(
+    "--rosa-role",
+    help="The role to assume in the ROSA cluster account",
+    required=False,
+    envvar="ROSA_ROLE",
+)
+@click.pass_context
+def ocm_clusters(
+    ctx,
+    gitlab_project_id: str | None,
+    thread_pool_size: int,
+    job_controller_cluster: str | None,
+    job_controller_namespace: str | None,
+    rosa_job_service_account: str | None,
+    rosa_role: str | None,
+    rosa_job_image: str | None,
+):
+    from reconcile.ocm_clusters import (
+        OcmClusters,
+        OcmClustersParams,
+    )
+
+    run_class_integration(
+        integration=OcmClusters(
+            OcmClustersParams(
+                gitlab_project_id=gitlab_project_id,
+                thread_pool_size=thread_pool_size,
+                job_controller_cluster=job_controller_cluster,
+                job_controller_namespace=job_controller_namespace,
+                rosa_job_service_account=rosa_job_service_account,
+                rosa_job_image=rosa_job_image,
+                rosa_role=rosa_role,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+def vault_creds_path(function):
+    function = click.option(
+        "--vault-creds-path",
+        help="path in Vault to store creds.",
+        default="app-sre/creds/kube-configs",
+    )(function)
+
+    return function
+
+
+def dedicated_admin_namespace(function):
+    function = click.option(
+        "--dedicated-admin-namespace",
+        default="dedicated-admin",
+        help="namespace for the dedicated-admin bot",
+    )(function)
+    return function
+
+
+def dedicated_admin_service_account(function):
+    function = click.option(
+        "--dedicated-admin-service-account",
+        default="app-sre",
+        help="service account name for the dedicated-admin bot",
+    )(function)
+    return function
+
+
+def cluster_admin_namespace(function):
+    function = click.option(
+        "--cluster-admin-namespace",
+        default="app-sre",
+        help="namespace for the cluster-admin bot",
+    )(function)
+    return function
+
+
+def cluster_admin_service_account(function):
+    function = click.option(
+        "--cluster-admin-service-account",
+        default="app-sre-cluster-admin-bot",
+        help="service account name for the cluster-admin bot",
+    )(function)
+    return function
+
+
+@integration.command(short_help="Manages dedicated-admin and cluster-admin creds.")
+@gitlab_project_id
+@vault_creds_path
+@dedicated_admin_namespace
+@dedicated_admin_service_account
+@cluster_admin_namespace
+@cluster_admin_service_account
 @click.pass_context
-def ocm_clusters(ctx, gitlab_project_id, thread_pool_size):
-    import reconcile.ocm_clusters
+def openshift_cluster_bots(
+    ctx,
+    gitlab_project_id,
+    vault_creds_path,
+    dedicated_admin_namespace,
+    dedicated_admin_service_account,
+    cluster_admin_namespace,
+    cluster_admin_service_account,
+):
+    import reconcile.openshift_cluster_bots
 
     run_integration(
-        reconcile.ocm_clusters, ctx.obj, gitlab_project_id, thread_pool_size
+        reconcile.openshift_cluster_bots,
+        ctx.obj,
+        gitlab_project_id,
+        vault_creds_path,
+        dedicated_admin_ns=dedicated_admin_namespace,
+        dedicated_admin_sa=dedicated_admin_service_account,
+        cluster_admin_ns=cluster_admin_namespace,
+        cluster_admin_sa=cluster_admin_service_account,
     )
 
 
@@ -1872,14 +2702,6 @@ def ocm_external_configuration_labels(ctx, thread_pool_size):
     )
 
 
-@integration.command(short_help="Manage Cluster Admin in OCM.")
-@click.pass_context
-def ocm_cluster_admin(ctx):
-    import reconcile.ocm_cluster_admin
-
-    run_integration(reconcile.ocm_cluster_admin, ctx.obj)
-
-
 @integration.command(short_help="Trigger jenkins jobs following Addon upgrades.")
 @click.pass_context
 def ocm_addons_upgrade_tests_trigger(ctx):
@@ -1889,33 +2711,20 @@ def ocm_addons_upgrade_tests_trigger(ctx):
 
 
 @integration.command(short_help="Manage Machine Pools in OCM.")
-@threaded()
 @click.pass_context
-def ocm_machine_pools(ctx, thread_pool_size):
+def ocm_machine_pools(ctx):
     import reconcile.ocm_machine_pools
 
-    run_integration(reconcile.ocm_machine_pools, ctx.obj, thread_pool_size)
-
-
-@integration.command(short_help="Manage Upgrade Policy schedules in OCM.")
-@click.pass_context
-def ocm_upgrade_scheduler(ctx):
-    from reconcile.aus.base import AdvancedUpgradeSchedulerBaseIntegrationParams
-    from reconcile.aus.ocm_upgrade_scheduler import (
-        OCMClusterUpgradeSchedulerIntegration,
-    )
-
-    run_class_integration(
-        integration=OCMClusterUpgradeSchedulerIntegration(
-            AdvancedUpgradeSchedulerBaseIntegrationParams()
-        ),
-        ctx=ctx.obj,
-    )
+    run_integration(reconcile.ocm_machine_pools, ctx.obj)
 
 
 @integration.command(short_help="Manage Upgrade Policy schedules in OCM organizations.")
+@org_id_multiple
+@exclude_org_id
 @click.pass_context
-def ocm_upgrade_scheduler_org(ctx):
+def ocm_upgrade_scheduler_org(
+    ctx, org_id: Iterable[str], exclude_org_id: Iterable[str]
+) -> None:
     from reconcile.aus.base import AdvancedUpgradeSchedulerBaseIntegrationParams
     from reconcile.aus.ocm_upgrade_scheduler_org import (
         OCMClusterUpgradeSchedulerOrgIntegration,
@@ -1924,7 +2733,8 @@ def ocm_upgrade_scheduler_org(ctx):
     run_class_integration(
         integration=OCMClusterUpgradeSchedulerOrgIntegration(
             AdvancedUpgradeSchedulerBaseIntegrationParams(
-                # pass in env or org here for sharding
+                ocm_organization_ids=set(org_id),
+                excluded_ocm_organization_ids=set(exclude_org_id),
             )
         ),
         ctx=ctx.obj,
@@ -1945,9 +2755,21 @@ def ocm_upgrade_scheduler_org_updater(ctx, gitlab_project_id):
 @integration.command(
     short_help="Manage Addons Upgrade Policy schedules in OCM organizations."
 )
+@click.option(
+    "--ocm-env",
+    help="The OCM environment the integration should operator on. If none is specified, all environments will be operated on.",
+    required=False,
+    envvar="OCM_ENV",
+)
+@org_id_multiple
+@exclude_org_id
 @click.pass_context
-def ocm_addons_upgrade_scheduler_org(ctx):
-
+def ocm_addons_upgrade_scheduler_org(
+    ctx,
+    ocm_env: str,
+    org_id: Iterable[str],
+    exclude_org_id: Iterable[str],
+) -> None:
     from reconcile.aus.base import AdvancedUpgradeSchedulerBaseIntegrationParams
     from reconcile.aus.ocm_addons_upgrade_scheduler_org import (
         OCMAddonsUpgradeSchedulerOrgIntegration,
@@ -1955,7 +2777,11 @@ def ocm_addons_upgrade_scheduler_org(ctx):
 
     run_class_integration(
         integration=OCMAddonsUpgradeSchedulerOrgIntegration(
-            AdvancedUpgradeSchedulerBaseIntegrationParams()
+            AdvancedUpgradeSchedulerBaseIntegrationParams(
+                ocm_environment=ocm_env,
+                ocm_organization_ids=set(org_id),
+                excluded_ocm_organization_ids=set(exclude_org_id),
+            )
         ),
         ctx=ctx.obj,
     )
@@ -1964,31 +2790,144 @@ def ocm_addons_upgrade_scheduler_org(ctx):
 @integration.command(
     short_help="Manage Cluster Upgrade Policy schedules in OCM organizations based on OCM labels."
 )
+@click.option(
+    "--ocm-env",
+    help="The OCM environment AUS should operator on. If none is specified, all environments will be operated on.",
+    required=False,
+    envvar="AUS_OCM_ENV",
+)
+@org_id_multiple
+@exclude_org_id
+@click.option(
+    "--ignore-sts-clusters",
+    is_flag=True,
+    default=os.environ.get("IGNORE_STS_CLUSTERS", False),
+    help="Ignore STS clusters",
+)
 @click.pass_context
-def aus_upgrade_scheduler_org(ctx):
-
+def advanced_upgrade_scheduler(
+    ctx,
+    ocm_env: str,
+    org_id: Iterable[str],
+    exclude_org_id: Iterable[str],
+    ignore_sts_clusters: bool,
+) -> None:
     from reconcile.aus.advanced_upgrade_service import AdvancedUpgradeServiceIntegration
     from reconcile.aus.base import AdvancedUpgradeSchedulerBaseIntegrationParams
 
     run_class_integration(
         integration=AdvancedUpgradeServiceIntegration(
-            AdvancedUpgradeSchedulerBaseIntegrationParams()
+            AdvancedUpgradeSchedulerBaseIntegrationParams(
+                ocm_environment=ocm_env,
+                ocm_organization_ids=set(org_id),
+                excluded_ocm_organization_ids=set(exclude_org_id),
+                ignore_sts_clusters=ignore_sts_clusters,
+            )
         ),
         ctx=ctx.obj,
     )
 
 
-@integration.command(short_help="Update recommended version for OCM orgs")
-@gitlab_project_id
-@click.pass_context
-def ocm_update_recommended_version(ctx, gitlab_project_id):
-    import reconcile.ocm_update_recommended_version
-
-    run_integration(
-        reconcile.ocm_update_recommended_version, ctx.obj, gitlab_project_id
-    )
-
-
+@integration.command(short_help="Approves OCM cluster upgrade version gates.")
+@click.option(
+    "--job-controller-cluster",
+    help="The cluster holding the job-controller namepsace",
+    required=True,
+    envvar="JOB_CONTROLLER_CLUSTER",
+)
+@click.option(
+    "--job-controller-namespace",
+    help="The namespace used for ROSA jobs",
+    required=True,
+    envvar="JOB_CONTROLLER_NAMESPACE",
+)
+@click.option(
+    "--rosa-job-service-account",
+    help="The service-account used for ROSA jobs",
+    required=True,
+    envvar="ROSA_JOB_SERVICE_ACCOUNT",
+)
+@click.option(
+    "--rosa-job-image",
+    help="The container image to use to run ROSA cli command jobs",
+    required=False,
+    envvar="ROSA_JOB_IMAGE",
+)
+@click.option(
+    "--rosa-role",
+    help="The role to assume in the ROSA cluster account",
+    required=True,
+    envvar="ROSA_ROLE",
+)
+@click.pass_context
+def version_gate_approver(
+    ctx,
+    job_controller_cluster: str,
+    job_controller_namespace: str,
+    rosa_job_service_account: str,
+    rosa_role: str,
+    rosa_job_image: str | None,
+) -> None:
+    from reconcile.aus.version_gate_approver import (
+        VersionGateApprover,
+        VersionGateApproverParams,
+    )
+
+    run_class_integration(
+        integration=VersionGateApprover(
+            VersionGateApproverParams(
+                job_controller_cluster=job_controller_cluster,
+                job_controller_namespace=job_controller_namespace,
+                rosa_job_service_account=rosa_job_service_account,
+                rosa_job_image=rosa_job_image,
+                rosa_role=rosa_role,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manage Databases and Database Users.")
+@vault_output_path
+@click.pass_context
+def database_access_manager(ctx, vault_output_path: str):
+    from reconcile.database_access_manager import (
+        DatabaseAccessManagerIntegration,
+        DBAMIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=DatabaseAccessManagerIntegration(
+            DBAMIntegrationParams(vault_output_path=vault_output_path)
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(
+    short_help="Export Product and Application informnation to Status Board."
+)
+@click.pass_context
+def status_board_exporter(ctx):
+    from reconcile.status_board import StatusBoardExporterIntegration
+
+    run_class_integration(
+        integration=StatusBoardExporterIntegration(PydanticRunParams()),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Update recommended version for OCM orgs")
+@gitlab_project_id
+@click.pass_context
+def ocm_update_recommended_version(ctx, gitlab_project_id):
+    import reconcile.ocm_update_recommended_version
+
+    run_integration(
+        reconcile.ocm_update_recommended_version, ctx.obj, gitlab_project_id
+    )
+
+
 @integration.command(short_help="Manages cluster Addons in OCM.")
 @threaded()
 @click.pass_context
@@ -2017,13 +2956,160 @@ def ocm_github_idp(ctx, vault_input_path):
     run_integration(reconcile.ocm_github_idp, ctx.obj, vault_input_path)
 
 
-@integration.command(short_help="Manage OIDC Identity Providers in OCM.")
-@vault_input_path
+@integration.command(
+    short_help="Manage OIDC cluster configuration in OCM organizations based on OCM labels. Part of RHIDP."
+)
+@click.option(
+    "--ocm-env",
+    help="The OCM environment RHIDP should operator on. If none is specified, all environments will be operated on.",
+    required=False,
+    envvar="RHIDP_OCM_ENV",
+)
+@click.option(
+    "--default-auth-name",
+    default="redhat-sso",
+    help="The authentication name must match that one used in the redirect URL.",
+    required=True,
+    envvar="RHIDP_DEFAULT_AUTH_NAME",
+)
+@click.option(
+    "--default-auth-issuer-url",
+    default="https://auth.redhat.com/auth/realms/EmployeeIDP",
+    help="Use this Issuer (SSO server) URL if nothing else is specified for a cluster in the OCM cluster labels.",
+    required=True,
+    envvar="RHIDP_DEFAULT_AUTH_ISSUER_URL",
+)
+@click.option(
+    "--vault-input-path",
+    help="path in Vault to find input resources.",
+    required=True,
+)
+@click.pass_context
+def ocm_oidc_idp(
+    ctx,
+    ocm_env,
+    default_auth_name,
+    default_auth_issuer_url,
+    vault_input_path,
+):
+    from reconcile.rhidp.ocm_oidc_idp.integration import (
+        OCMOidcIdp,
+        OCMOidcIdpParams,
+    )
+
+    run_class_integration(
+        integration=OCMOidcIdp(
+            OCMOidcIdpParams(
+                vault_input_path=vault_input_path,
+                ocm_environment=ocm_env,
+                default_auth_name=default_auth_name,
+                default_auth_issuer_url=default_auth_issuer_url,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(
+    short_help="Manage Keycloak SSO clients for OCM clusters. Part of RHIDP."
+)
+@click.option(
+    "--keycloak-instance-vault-paths",
+    help="A comma seperated list of vault paths to keycloak instance secrets.",
+    required=True,
+)
+@click.option(
+    "--contact-emails",
+    default="sd-app-sre+auth@redhat.com",
+    help="A comma seperated list of contact email addresses.",
+    required=True,
+)
+@click.option(
+    "--vault-input-path",
+    help="path in Vault to find input resources.",
+    required=True,
+)
+@click.option(
+    "--ocm-env",
+    help="The OCM environment RHIDP should operator on. If none is specified, all environments will be operated on.",
+    required=False,
+    envvar="RHIDP_OCM_ENV",
+)
+@click.option(
+    "--default-auth-name",
+    default="redhat-sso",
+    help="The authentication name must match that one used in the redirect URL.",
+    required=True,
+    envvar="RHIDP_DEFAULT_AUTH_NAME",
+)
+@click.option(
+    "--default-auth-issuer-url",
+    default="https://auth.redhat.com/auth/realms/EmployeeIDP",
+    help="Use this Issuer (SSO server) URL if nothing else is specified for a cluster in the OCM cluster labels.",
+    required=True,
+    envvar="RHIDP_DEFAULT_AUTH_ISSUER_URL",
+)
 @click.pass_context
-def ocm_oidc_idp(ctx, vault_input_path):
-    import reconcile.ocm_oidc_idp
+def rhidp_sso_client(
+    ctx,
+    keycloak_instance_vault_paths,
+    contact_emails,
+    vault_input_path,
+    ocm_env,
+    default_auth_name,
+    default_auth_issuer_url,
+):
+    from reconcile.rhidp.sso_client.integration import (
+        SSOClient,
+        SSOClientParams,
+    )
+
+    run_class_integration(
+        integration=SSOClient(
+            SSOClientParams(
+                keycloak_vault_paths=list(
+                    set(keycloak_instance_vault_paths.split(","))
+                ),
+                vault_input_path=vault_input_path,
+                ocm_environment=ocm_env,
+                default_auth_name=default_auth_name,
+                default_auth_issuer_url=default_auth_issuer_url,
+                contacts=list(set(contact_emails.split(","))),
+            )
+        ),
+        ctx=ctx.obj,
+    )
 
-    run_integration(reconcile.ocm_oidc_idp, ctx.obj, vault_input_path)
+
+@integration.command(
+    short_help="Manages the OCM subscription labels for clusters with RHIDP authentication. Part of RHIDP."
+)
+@click.pass_context
+def cluster_auth_rhidp(ctx):
+    from reconcile.cluster_auth_rhidp.integration import (
+        ClusterAuthRhidpIntegration,
+        ClusterAuthRhidpIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=ClusterAuthRhidpIntegration(ClusterAuthRhidpIntegrationParams()),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(
+    short_help="Automatically provide dedicated Dynatrace tokens to management clusters"
+)
+@click.pass_context
+def dynatrace_token_provider(ctx):
+    from reconcile.dynatrace_token_provider.integration import (
+        DynatraceTokenProviderIntegration,
+    )
+
+    run_class_integration(
+        integration=DynatraceTokenProviderIntegration(),
+        ctx=ctx.obj,
+    )
 
 
 @integration.command(short_help="Manage additional routers in OCM.")
@@ -2042,14 +3128,6 @@ def email_sender(ctx):
     run_integration(reconcile.email_sender, ctx.obj)
 
 
-@integration.command(short_help="Watch for Sentry access requests and notify on Slack.")
-@click.pass_context
-def sentry_helper(ctx):
-    import reconcile.sentry_helper
-
-    run_integration(reconcile.sentry_helper, ctx.obj)
-
-
 @integration.command(
     short_help="Send emails to users based on " "requests submitted to app-interface."
 )
@@ -2068,14 +3146,6 @@ def service_dependencies(ctx):
     run_integration(reconcile.service_dependencies, ctx.obj)
 
 
-@integration.command(short_help="Configure and enforce sentry instance configuration.")
-@click.pass_context
-def sentry_config(ctx):
-    import reconcile.sentry_config
-
-    run_integration(reconcile.sentry_config, ctx.obj)
-
-
 @integration.command(short_help="Runs SQL Queries against app-interface RDS resources.")
 @enable_deletion(default=False)
 @click.pass_context
@@ -2153,76 +3223,22 @@ def dashdotdb_slo(ctx, thread_pool_size):
     run_integration(reconcile.dashdotdb_slo, ctx.obj, thread_pool_size)
 
 
-@integration.command(short_help="Mirrors OCP release images.")
-@click.pass_context
-def ocp_release_mirror(ctx):
-    import reconcile.ocp_release_mirror
-
-    run_integration(reconcile.ocp_release_mirror, ctx.obj)
-
-
-@integration.command(short_help="Mirrors external images into AWS ECR.")
-@threaded()
-@click.pass_context
-def ecr_mirror(ctx, thread_pool_size):
-    import reconcile.ecr_mirror
-
-    run_integration(reconcile.ecr_mirror, ctx.obj, thread_pool_size)
-
-
-@integration.command(short_help="Manages Kafka clusters via OCM.")
-@threaded()
-@binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
-@internal()
-@use_jump_host()
-@vault_throughput_path
-@click.pass_context
-def kafka_clusters(
-    ctx, thread_pool_size, internal, use_jump_host, vault_throughput_path
-):
-    import reconcile.kafka_clusters
-
-    run_integration(
-        reconcile.kafka_clusters,
-        ctx.obj,
-        thread_pool_size,
-        internal,
-        use_jump_host,
-        vault_throughput_path,
-    )
-
-
-@integration.command(
-    short_help="Ensures all integrations are defined in App-Interface."
-)
-@click.pass_context
-def integrations_validator(ctx):
-    import reconcile.integrations_validator
-
-    run_integration(
-        reconcile.integrations_validator,
-        ctx.obj,
-        reconcile.cli.integration.commands.keys(),
-    )
-
-
-@integration.command(short_help="Tests prometheus rules using promtool.")
-@threaded()
-@binary(["promtool"])
-@cluster_name
+@integration.command(short_help="Collects dora metrics.")
+@gitlab_project_id
+@threaded(default=5)
 @click.pass_context
-def prometheus_rules_tester_old(ctx, thread_pool_size, cluster_name):
-    import reconcile.prometheus_rules_tester_old
+def dashdotdb_dora(ctx, gitlab_project_id, thread_pool_size):
+    import reconcile.dashdotdb_dora
 
     run_integration(
-        reconcile.prometheus_rules_tester_old, ctx.obj, thread_pool_size, cluster_name
+        reconcile.dashdotdb_dora, ctx.obj, gitlab_project_id, thread_pool_size
     )
 
 
 @integration.command(short_help="Tests prometheus rules using promtool.")
 @threaded(default=5)
 @binary(["promtool"])
+@binary_version("promtool", ["--version"], PROMTOOL_VERSION_REGEX, PROMTOOL_VERSION)
 @cluster_name
 @click.pass_context
 def prometheus_rules_tester(ctx, thread_pool_size, cluster_name):
@@ -2232,16 +3248,16 @@ def prometheus_rules_tester(ctx, thread_pool_size, cluster_name):
         reconcile.prometheus_rules_tester.integration,
         ctx.obj,
         thread_pool_size,
-        cluster_name=cluster_name,
+        cluster_names=cluster_name,
     )
 
 
 @integration.command(short_help="Tests templating of resources.")
 @click.pass_context
-def template_tester(ctx):
-    import reconcile.template_tester
+def resource_template_tester(ctx):
+    import reconcile.resource_template_tester
 
-    run_integration(reconcile.template_tester, ctx.obj)
+    run_integration(reconcile.resource_template_tester, ctx.obj)
 
 
 @integration.command(
@@ -2291,7 +3307,7 @@ def resource_scraper(ctx, namespace_name, resource_kind, vault_output_path):
 @integration.command(short_help="Manages user access for GABI instances.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -2312,11 +3328,64 @@ def gabi_authorized_users(ctx, thread_pool_size, internal, use_jump_host):
 )
 @click.pass_context
 def status_page_components(ctx):
-    from reconcile.statuspage.integration import StatusPageComponentsIntegration
+    from reconcile.statuspage.integrations.components import (
+        StatusPageComponentsIntegration,
+    )
 
     run_class_integration(StatusPageComponentsIntegration(), ctx.obj)
 
 
+@integration.command(
+    short_help="Manages maintenances on statuspage.io hosted status pages."
+)
+@click.pass_context
+def status_page_maintenances(ctx):
+    from reconcile.statuspage.integrations.maintenances import (
+        StatusPageMaintenancesIntegration,
+    )
+
+    run_class_integration(StatusPageMaintenancesIntegration(NoParams()), ctx.obj)
+
+
+@integration.command(
+    short_help="Manages OCM cluster usergroups and notifications via OCM labels."
+)
+@click.option(
+    "--ocm-env",
+    help="The OCM environment the integration should operator on. If none is specified, all environments will be operated on.",
+    required=False,
+    envvar="OCM_ENV",
+)
+@click.option(
+    "--ocm-org-ids",
+    help="A comma seperated list of OCM organization IDs the integration should operator on. If none is specified, all organizations are considered.",
+    required=False,
+    envvar="OCM_ORG_IDS",
+)
+@click.option(
+    "--group-provider",
+    help="A group provider spec is the form of <provider-name>:<provider-type>:<provider-args>.",
+    required=False,
+    multiple=True,
+)
+@click.pass_context
+def ocm_standalone_user_management(ctx, ocm_env, ocm_org_ids, group_provider):
+    from reconcile.oum.base import OCMUserManagementIntegrationParams
+    from reconcile.oum.standalone import OCMStandaloneUserManagementIntegration
+
+    ocm_organization_ids = set(ocm_org_ids.split(",")) if ocm_org_ids else None
+    run_class_integration(
+        OCMStandaloneUserManagementIntegration(
+            OCMUserManagementIntegrationParams(
+                ocm_environment=ocm_env,
+                ocm_organization_ids=ocm_organization_ids,
+                group_provider_specs=group_provider,
+            ),
+        ),
+        ctx.obj,
+    )
+
+
 @integration.command(
     short_help="Manages Prometheus Probe resources for blackbox-exporter"
 )
@@ -2359,7 +3428,7 @@ def signalfx_prometheus_endpoint_monitoring(
     )
 
 
-def parse_image_tag_from_ref(ctx, param, value) -> Optional[dict[str, str]]:
+def parse_image_tag_from_ref(ctx, param, value) -> dict[str, str] | None:
     if value:
         result = {}
         for v in value:
@@ -2386,7 +3455,7 @@ def vault_replication(ctx):
 @environment_name
 @threaded()
 @binary(["oc", "ssh", "helm"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.option(
@@ -2481,6 +3550,33 @@ def change_owners(
     )
 
 
+@integration.command(short_help="Analyze bundle diffs by change types.")
+@gitlab_project_id
+@click.option(
+    "--process-existing/--no-process-existing",
+    default=False,
+    help="wait for pending/running pipelines before acting.",
+)
+@click.option("--commit", help="Reconcile just this commit.", default=None)
+@click.pass_context
+def change_log_tracking(ctx, gitlab_project_id, process_existing, commit):
+    from reconcile.change_owners.change_log_tracking import (
+        ChangeLogIntegration,
+        ChangeLogIntegrationParams,
+    )
+
+    run_class_integration(
+        ChangeLogIntegration(
+            ChangeLogIntegrationParams(
+                gitlab_project_id=gitlab_project_id,
+                process_existing=process_existing,
+                commit=commit,
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
 @integration.command(
     short_help="Configure and enforce glitchtip instance configuration."
 )
@@ -2492,10 +3588,27 @@ def glitchtip(ctx, instance):
     run_integration(reconcile.glitchtip.integration, ctx.obj, instance)
 
 
+@integration.command(short_help="Configure Glitchtip project alerts.")
+@click.option("--instance", help="Reconcile just this instance.", default=None)
+@click.pass_context
+def glitchtip_project_alerts(ctx, instance):
+    from reconcile.glitchtip_project_alerts.integration import (
+        GlitchtipProjectAlertsIntegration,
+        GlitchtipProjectAlertsIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=GlitchtipProjectAlertsIntegration(
+            GlitchtipProjectAlertsIntegrationParams(instance=instance)
+        ),
+        ctx=ctx.obj,
+    )
+
+
 @integration.command(short_help="Glitchtip project dsn as openshift secret.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.option("--instance", help="Reconcile just this instance.", default=None)
@@ -2516,7 +3629,7 @@ def glitchtip_project_dsn(ctx, thread_pool_size, internal, use_jump_host, instan
 @integration.command(short_help="Manages Skupper Networks.")
 @threaded()
 @binary(["oc", "ssh"])
-@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSION)
+@binary_version("oc", ["version", "--client"], OC_VERSION_REGEX, OC_VERSIONS)
 @internal()
 @use_jump_host()
 @click.pass_context
@@ -2532,6 +3645,170 @@ def skupper_network(ctx, thread_pool_size, internal, use_jump_host):
     )
 
 
+@integration.command(short_help="Manage cluster OCM labels.")
+@click.option(
+    "--managed-label-prefixes",
+    help="A comma list of label prefixes that are managed.",
+    required=True,
+    envvar="OL_MANAGED_LABEL_PREFIXES",
+    default="sre-capabilities",
+)
+@click.option(
+    "--ignored-label-prefixes",
+    help="A comma list of label prefixes that must be ignored.",
+    required=True,
+    envvar="OL_IGNORED_LABEL_PREFIXES",
+    default="sre-capabilities.rhidp",
+)
+@click.pass_context
+def ocm_labels(ctx, managed_label_prefixes, ignored_label_prefixes):
+    from reconcile.ocm_labels.integration import (
+        OcmLabelsIntegration,
+        OcmLabelsIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=OcmLabelsIntegration(
+            OcmLabelsIntegrationParams(
+                managed_label_prefixes=list(set(managed_label_prefixes.split(","))),
+                ignored_label_prefixes=list(set(ignored_label_prefixes.split(","))),
+            )
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(
+    short_help="Notifications to internal Red Hat users based on conditions in OCM."
+)
+@click.pass_context
+def ocm_internal_notifications(ctx):
+    from reconcile.ocm_internal_notifications.integration import (
+        OcmInternalNotifications,
+    )
+
+    run_class_integration(
+        integration=OcmInternalNotifications(),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manages RHACS rbac configuration")
+@click.pass_context
+def acs_rbac(ctx):
+    from reconcile import acs_rbac
+
+    run_class_integration(
+        integration=acs_rbac.AcsRbacIntegration(),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manages RHACS security policy configurations")
+@click.pass_context
+def acs_policies(ctx):
+    from reconcile import acs_policies
+
+    run_class_integration(
+        integration=acs_policies.AcsPoliciesIntegration(),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manages RHACS notifier configurations")
+@click.pass_context
+def acs_notifiers(ctx):
+    from reconcile import acs_notifiers
+
+    run_class_integration(
+        integration=acs_notifiers.AcsNotifiersIntegration(),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manage Unleash feature toggles.")
+@click.option("--instance", help="Reconcile just this Unlash instance.", default=None)
+@click.pass_context
+def unleash_feature_toggles(ctx, instance):
+    from reconcile.unleash_feature_toggles.integration import (
+        UnleashTogglesIntegration,
+        UnleashTogglesIntegrationParams,
+    )
+
+    run_class_integration(
+        integration=UnleashTogglesIntegration(
+            UnleashTogglesIntegrationParams(instance=instance)
+        ),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Automate Deadmanssnitch Creation/Deletion")
+@click.pass_context
+def deadmanssnitch(ctx):
+    from reconcile import deadmanssnitch
+
+    run_class_integration(
+        integration=deadmanssnitch.DeadMansSnitchIntegration(),
+        ctx=ctx.obj,
+    )
+
+
+@integration.command(short_help="Manages External Resources")
+@click.pass_context
+@threaded(default=5)
+@click.option(
+    "--workers_cluster",
+    help="Cluster name where the Jobs will be created",
+    default=None,
+)
+@click.option(
+    "--workers_namespace",
+    help="Namespace name where the Jobs will be created",
+    default=None,
+)
+@click.option(
+    "--dry-run-job-suffix",
+    help="Suffix jons run in pr_checks. e.g: gitlab merge request id",
+    default="",
+)
+def external_resources(
+    ctx,
+    dry_run_job_suffix: str,
+    thread_pool_size: int,
+    workers_cluster: str,
+    workers_namespace: str,
+):
+    import reconcile.external_resources.integration
+
+    run_integration(
+        reconcile.external_resources.integration,
+        ctx.obj,
+        dry_run_job_suffix=dry_run_job_suffix,
+        thread_pool_size=thread_pool_size,
+        workers_cluster=workers_cluster,
+        workers_namespace=workers_namespace,
+    )
+
+
+@integration.command(
+    short_help="Syncs External Resources Secrets from Vault to Clusters"
+)
+@click.pass_context
+@threaded(default=5)
+def external_resources_secrets_sync(
+    ctx,
+    thread_pool_size: int,
+):
+    import reconcile.external_resources.integration_secrets_sync
+
+    run_integration(
+        reconcile.external_resources.integration_secrets_sync,
+        ctx.obj,
+        thread_pool_size,
+    )
+
+
 def get_integration_cli_meta() -> dict[str, IntegrationMeta]:
     """
     returns all integrations known to cli.py via click introspection
@@ -2545,7 +3822,11 @@ def get_integration_cli_meta() -> dict[str, IntegrationMeta]:
         integration_cmd = integration.get_command(None, integration_name)  # type: ignore
         integration_meta[integration_name] = IntegrationMeta(
             name=integration_name,
-            args=[p.opts[0] for p in integration_cmd.params if p.opts and len(p.opts) > 0],  # type: ignore
+            args=[
+                p.opts[0]
+                for p in integration_cmd.params  # type: ignore
+                if p.opts and len(p.opts) > 0
+            ],
             short_help=integration_cmd.short_help,  # type: ignore
         )
     return integration_meta