qontract-reconcile 0.10.0__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/terraform_vpc_peerings.py

@@ -1,10 +1,8 @@
 import json
 import logging
 import sys
-from typing import (
-    Any,
-    Optional,
-)
+from collections.abc import Callable, Iterable, Mapping
+from typing import Any, TypedDict
 
 import reconcile.utils.terraform_client as terraform
 import reconcile.utils.terrascript_aws_client as terrascript
@@ -15,11 +13,16 @@ from reconcile.utils import (
 )
 from reconcile.utils.aws_api import AWSApi
 from reconcile.utils.defer import defer
+from reconcile.utils.extended_early_exit import (
+    ExtendedEarlyExitRunnerResult,
+    extended_early_exit_run,
+)
 from reconcile.utils.ocm import (
     OCM,
     OCMMap,
 )
 from reconcile.utils.semver_helper import make_semver
+from reconcile.utils.unleash.client import get_feature_toggle_state
 
 QONTRACT_INTEGRATION = "terraform_vpc_peerings"
 QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
@@ -29,7 +32,11 @@ class BadTerraformPeeringState(Exception):
     pass
 
 
-def find_matching_peering(from_cluster, to_cluster, desired_provider):
+def find_matching_peering(
+    from_cluster: Mapping[str, Any],
+    to_cluster: Mapping[str, Any],
+    desired_provider: str,
+) -> Mapping[str, Any] | None:
     """
     Ensures there is a matching peering with the desired provider type
     going from the destination (to) cluster back to this one (from)
@@ -37,7 +44,7 @@ def find_matching_peering(from_cluster, to_cluster, desired_provider):
     peering_info = to_cluster["peering"]
     peer_connections = peering_info["connections"]
     for peer_connection in peer_connections:
-        if not peer_connection["provider"] == desired_provider:
+        if peer_connection["provider"] != desired_provider:
             continue
         if not peer_connection["cluster"]:
             continue
@@ -47,8 +54,8 @@ def find_matching_peering(from_cluster, to_cluster, desired_provider):
 
 
 def _get_default_management_account(
-    cluster: dict[str, Any]
-) -> Optional[dict[str, Any]]:
+    cluster: Mapping[str, Any],
+) -> Mapping[str, Any] | None:
     cluster_infra_accounts = cluster["awsInfrastructureManagementAccounts"]
     for infra_account_def in cluster_infra_accounts or []:
         if (
@@ -60,13 +67,29 @@ def _get_default_management_account(
 
 
 def _build_infrastructure_assume_role(
-    account: dict[str, Any], cluster: dict[str, Any], ocm: OCM
-) -> Optional[dict[str, Any]]:
-    assume_role = ocm.get_aws_infrastructure_access_terraform_assume_role(
-        cluster["name"],
-        account["uid"],
-        account["terraformUsername"],
-    )
+    account: Mapping[str, Any],
+    cluster: Mapping[str, Any],
+    ocm: OCM | None,
+    provided_assume_role: str | None,
+) -> dict[str, Any] | None:
+    if provided_assume_role:
+        assume_role = provided_assume_role
+    elif cluster["spec"].get("account"):
+        cluster_account = cluster["spec"].get("account")
+        return {
+            "name": cluster_account["name"],
+            "uid": cluster_account["uid"],
+            "terraformUsername": cluster_account["terraformUsername"],
+            "automationToken": cluster_account["automationToken"],
+            "assume_region": cluster["spec"]["region"],
+            "assume_cidr": cluster["network"]["vpc"],
+        }
+    elif ocm is not None:
+        assume_role = ocm.get_aws_infrastructure_access_terraform_assume_role(
+            cluster["name"],
+            account["uid"],
+            account["terraformUsername"],
+        )
     if assume_role:
         return {
             "name": account["name"],
@@ -81,11 +104,12 @@ def _build_infrastructure_assume_role(
 
 
 def aws_assume_roles_for_cluster_vpc_peering(
-    requester_cluster: dict[str, Any],
-    accepter_connection: dict[str, Any],
-    accepter_cluster: dict[str, Any],
-    ocm: OCM,
-) -> tuple[dict[str, Any], dict[str, Any]]:
+    requester_connection: Mapping[str, Any],
+    requester_cluster: Mapping[str, Any],
+    accepter_connection: Mapping[str, Any],
+    accepter_cluster: Mapping[str, Any],
+    ocm: OCM | None,
+) -> tuple[str, dict[str, Any], dict[str, Any]]:
     # check if dedicated infra accounts have been declared on the
     # accepters peering connection or on the accepters cluster
     allowed_accounts = {
@@ -96,21 +120,21 @@ def aws_assume_roles_for_cluster_vpc_peering(
 
     # check if a dedicated infra accounts have been declared on the
     # accepters peering connection
-    account = accepter_connection["awsInfrastructureManagementAccount"]
-    if account and account["name"] not in allowed_accounts:
+    infra_account = accepter_connection["awsInfrastructureManagementAccount"]
+    if infra_account and infra_account["name"] not in allowed_accounts:
         raise BadTerraformPeeringState(
             "[account_not_allowed] "
-            f"account {account['name']} used on the peering accepter of "
+            f"account {infra_account['name']} used on the peering accepter of "
             f"cluster {accepter_cluster['name']} is not listed as a "
             "network-mgmt in awsInfrastructureManagementAccounts"
         )
 
-    if not account:
+    if not infra_account:
         # look for a network-mgmt account marked as default on the accepters
         # clusters awsInfrastructureManagementAccounts
-        account = _get_default_management_account(accepter_cluster)
+        infra_account = _get_default_management_account(accepter_cluster)
 
-    if not account:
+    if not infra_account:
         raise BadTerraformPeeringState(
             f"[no_account_available] unable to find infra account "
             f"for {accepter_cluster['name']} to manage the VPC peering "
@@ -119,27 +143,34 @@ def aws_assume_roles_for_cluster_vpc_peering(
 
     # a dedicated infra account was found on the accepter side
     # let's use it for both legs
-    req_aws = _build_infrastructure_assume_role(account, requester_cluster, ocm)
+    req_aws = _build_infrastructure_assume_role(
+        infra_account, requester_cluster, ocm, requester_connection.get("assumeRole")
+    )
     if req_aws is None:
         raise BadTerraformPeeringState(
             f"[assume_role_not_found] unable to find assume role "
-            f"on cluster-vpc-requester for account {account['name']} and "
+            f"on cluster-vpc-requester for account {infra_account['name']} and "
             f"cluster {requester_cluster['name']} "
         )
-    acc_aws = _build_infrastructure_assume_role(account, accepter_cluster, ocm)
+    acc_aws = _build_infrastructure_assume_role(
+        infra_account, accepter_cluster, ocm, accepter_connection.get("assumeRole")
+    )
     if acc_aws is None:
         raise BadTerraformPeeringState(
             f"[assume_role_not_found] unable to find assume role "
-            f"on cluster-vpc-accepter for account {account['name']} and "
+            f"on cluster-vpc-accepter for account {infra_account['name']} and "
             f"cluster {accepter_cluster['name']} "
         )
 
-    return req_aws, acc_aws
+    return infra_account["name"], req_aws, acc_aws
 
 
 def build_desired_state_single_cluster(
-    cluster_info, ocm: OCM, awsapi: AWSApi, account_filter: Optional[str]
-):
+    cluster_info: Mapping[str, Any],
+    ocm: OCM | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> list[dict[str, Any]]:
     cluster_name = cluster_info["name"]
 
     peerings = []
@@ -169,32 +200,31 @@ def build_desired_state_single_cluster(
 
         accepter_manage_routes = peer_info.get("manageRoutes")
 
-        req_aws, acc_aws = aws_assume_roles_for_cluster_vpc_peering(
-            cluster_info, peer_info, peer_cluster, ocm
+        infra_account_name, req_aws, acc_aws = aws_assume_roles_for_cluster_vpc_peering(
+            peer_connection, cluster_info, peer_info, peer_cluster, ocm
         )
 
         # filter on account
-        if account_filter and acc_aws["name"] != account_filter:
+        if (
+            account_filter
+            and acc_aws["name"] != account_filter
+            and infra_account_name != account_filter
+        ):
             continue
 
-        # verify that the infra mgmt account for both sides of a peering is the same
-        # this is a restriction we might lift in the future but it
-        # requires work in `populate_vpc_peerings` where the tf resources are hooked up
-        if req_aws["name"] != acc_aws["name"]:
-            raise BadTerraformPeeringState(
-                f"different infra mgmt accounts for peering "
-                f"requester ({cluster_name} - {req_aws['name']}) and "
-                f"accepter ({peer_connection_name} - {acc_aws['name']}) "
-                "are not suppored"
+        requester_vpc_id, requester_route_table_ids, _, api_security_group_id = (
+            awsapi.get_cluster_vpc_details(
+                req_aws,
+                route_tables=requester_manage_routes,
+                hcp_vpc_endpoint_sg=_private_hosted_control_plane(cluster_info),
             )
-
-        requester_vpc_id, requester_route_table_ids, _ = awsapi.get_cluster_vpc_details(
-            req_aws, route_tables=requester_manage_routes
         )
         if requester_vpc_id is None:
-            raise BadTerraformPeeringState(
-                f"[{cluster_name}] could not find VPC ID for cluster"
+            logging.warning(
+                f"[{cluster_name}] could not find VPC ID for cluster. "
+                f"Skipping {peer_connection_provider} connection {peer_connection['name']}"
             )
+            continue
 
         requester = {
             "cidr_block": cluster_info["network"]["vpc"],
@@ -202,28 +232,42 @@ def build_desired_state_single_cluster(
             "vpc_id": requester_vpc_id,
             "route_table_ids": requester_route_table_ids,
             "account": req_aws,
+            "api_security_group_id": api_security_group_id,
         }
 
-        accepter_vpc_id, accepter_route_table_ids, _ = awsapi.get_cluster_vpc_details(
-            acc_aws, route_tables=accepter_manage_routes
+        (
+            accepter_vpc_id,
+            accepter_route_table_ids,
+            _,
+            api_security_group_id,
+        ) = awsapi.get_cluster_vpc_details(
+            acc_aws,
+            route_tables=accepter_manage_routes,
+            hcp_vpc_endpoint_sg=_private_hosted_control_plane(peer_cluster),
         )
         if accepter_vpc_id is None:
-            raise BadTerraformPeeringState(
-                f"[{peer_cluster_name}] could not find VPC ID for cluster"
+            logging.warning(
+                f"[{peer_cluster_name}] could not find VPC ID for cluster. "
+                f"Skipping {peer_info['provider']} connection {peer_info['name']}"
             )
+            continue
 
-        requester["peer_owner_id"] = acc_aws["assume_role"].split(":")[4]
+        requester["peer_owner_id"] = acc_aws["uid"]
+        if acc_aws.get("assume_role"):
+            requester["peer_owner_id"] = acc_aws["assume_role"].split(":")[4]
         accepter = {
             "cidr_block": peer_cluster["network"]["vpc"],
             "region": peer_cluster["spec"]["region"],
             "vpc_id": accepter_vpc_id,
             "route_table_ids": accepter_route_table_ids,
             "account": acc_aws,
+            "api_security_group_id": api_security_group_id,
         }
 
         item = {
             "connection_provider": peer_connection_provider,
             "connection_name": peer_connection_name,
+            "infra_account_name": infra_account_name,
             "requester": requester,
             "accepter": accepter,
             "deleted": peer_connection.get("delete", False),
@@ -234,8 +278,11 @@ def build_desired_state_single_cluster(
 
 
 def build_desired_state_all_clusters(
-    clusters, ocm_map: OCMMap, awsapi: AWSApi, account_filter: Optional[str]
-):
+    clusters: Iterable[Mapping[str, Any]],
+    ocm_map: OCMMap | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> tuple[list[dict[str, Any]], bool]:
     """
     Fetch state for VPC peerings between two OCM clusters
     """
@@ -245,7 +292,7 @@ def build_desired_state_all_clusters(
     for cluster_info in clusters:
         try:
             cluster = cluster_info["name"]
-            ocm = ocm_map.get(cluster)
+            ocm = None if ocm_map is None else ocm_map.get(cluster)
             items = build_desired_state_single_cluster(
                 cluster_info, ocm, awsapi, account_filter
             )
@@ -258,8 +305,11 @@ def build_desired_state_all_clusters(
 
 
 def build_desired_state_vpc_mesh_single_cluster(
-    cluster_info, ocm: OCM, awsapi: AWSApi, account_filter: Optional[str]
-):
+    cluster_info: Mapping[str, Any],
+    ocm: OCM | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> list[dict[str, Any]]:
     desired_state = []
 
     cluster = cluster_info["name"]
@@ -268,7 +318,7 @@ def build_desired_state_vpc_mesh_single_cluster(
     for peer_connection in peer_connections:
         # We only care about account-vpc-mesh peering providers
         peer_connection_provider = peer_connection["provider"]
-        if not peer_connection_provider == "account-vpc-mesh":
+        if peer_connection_provider != "account-vpc-mesh":
             continue
         # filter on account
         account = peer_connection["account"]
@@ -281,28 +331,45 @@ def build_desired_state_vpc_mesh_single_cluster(
             "region": cluster_info["spec"]["region"],
         }
 
+        cluster_account = account
         # assume_role is the role to assume to provision the peering
         # connection request, through the accepter AWS account.
-        account[
-            "assume_role"
-        ] = ocm.get_aws_infrastructure_access_terraform_assume_role(
-            cluster, account["uid"], account["terraformUsername"]
-        )
+        provided_assume_role = peer_connection.get("assumeRole")
+        if provided_assume_role:
+            cluster_account["assume_role"] = provided_assume_role
+        elif cluster_info["spec"].get("account"):
+            cluster_account = cluster_info["spec"].get("account")
+        elif ocm is not None:
+            cluster_account["assume_role"] = (
+                ocm.get_aws_infrastructure_access_terraform_assume_role(
+                    cluster, account["uid"], account["terraformUsername"]
+                )
+            )
         account["assume_region"] = requester["region"]
-        account["assume_cidr"] = requester["cidr_block"]
-        requester_vpc_id, requester_route_table_ids, _ = awsapi.get_cluster_vpc_details(
-            account, route_tables=peer_connection.get("manageRoutes")
+        cluster_account["assume_region"] = requester["region"]
+        cluster_account["assume_cidr"] = requester["cidr_block"]
+        (
+            requester_vpc_id,
+            requester_route_table_ids,
+            _,
+            api_security_group_id,
+        ) = awsapi.get_cluster_vpc_details(
+            cluster_account,
+            route_tables=peer_connection.get("manageRoutes"),
+            hcp_vpc_endpoint_sg=_private_hosted_control_plane(cluster_info),
         )
 
         if requester_vpc_id is None:
-            raise BadTerraformPeeringState(
-                f"{cluster} could not find VPC ID for cluster and "
-                f"peer account {account}"
+            logging.warning(
+                f"[{cluster}] could not find VPC ID for cluster and peer account {account}. "
+                f"Skipping {peer_connection_provider} connection {peer_connection['name']}"
             )
+            continue
 
         requester["vpc_id"] = requester_vpc_id
         requester["route_table_ids"] = requester_route_table_ids
-        requester["account"] = account
+        requester["account"] = cluster_account
+        requester["api_security_group_id"] = api_security_group_id
 
         account_vpcs = awsapi.get_vpcs_details(
             account,
@@ -324,6 +391,7 @@ def build_desired_state_vpc_mesh_single_cluster(
             item = {
                 "connection_provider": peer_connection_provider,
                 "connection_name": connection_name,
+                "infra_account_name": account["name"],
                 "requester": requester,
                 "accepter": accepter,
                 "deleted": peer_connection.get("delete", False),
@@ -334,8 +402,11 @@ def build_desired_state_vpc_mesh_single_cluster(
 
 
 def build_desired_state_vpc_mesh(
-    clusters, ocm_map: OCMMap, awsapi: AWSApi, account_filter: Optional[str]
-):
+    clusters: Iterable[Mapping[str, Any]],
+    ocm_map: OCMMap | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> tuple[list[dict[str, Any]], bool]:
     """
     Fetch state for VPC peerings between a cluster and all VPCs in an account
     """
@@ -345,7 +416,7 @@ def build_desired_state_vpc_mesh(
     for cluster_info in clusters:
         try:
             cluster = cluster_info["name"]
-            ocm = ocm_map.get(cluster)
+            ocm = None if ocm_map is None else ocm_map.get(cluster)
             items = build_desired_state_vpc_mesh_single_cluster(
                 cluster_info, ocm, awsapi, account_filter
             )
@@ -358,8 +429,11 @@ def build_desired_state_vpc_mesh(
 
 
 def build_desired_state_vpc_single_cluster(
-    cluster_info, ocm: Optional[OCM], awsapi: AWSApi, account_filter: Optional[str]
-):
+    cluster_info: Mapping[str, Any],
+    ocm: OCM | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> list[dict[str, Any]]:
     desired_state = []
 
     peering_info = cluster_info["peering"]
@@ -369,7 +443,7 @@ def build_desired_state_vpc_single_cluster(
     for peer_connection in peer_connections:
         # We only care about account-vpc peering providers
         peer_connection_provider = peer_connection["provider"]
-        if not peer_connection_provider == "account-vpc":
+        if peer_connection_provider != "account-vpc":
             continue
         # requester is the cluster's AWS account
         requester = {
@@ -394,6 +468,7 @@ def build_desired_state_vpc_single_cluster(
                 account, peer_vpc["vpc_id"], peer_vpc["region"]
             )
 
+        cluster_account = account
         # assume_role is the role to assume to provision the peering
         # connection request, through the accepter AWS account.
         provided_assume_role = peer_connection.get("assumeRole")
@@ -401,14 +476,16 @@ def build_desired_state_vpc_single_cluster(
         # to get the information from OCM. it likely means that
         # there is no OCM at all.
         if provided_assume_role:
-            account["assume_role"] = provided_assume_role
+            cluster_account["assume_role"] = provided_assume_role
+        elif cluster_info["spec"].get("account"):
+            cluster_account = cluster_info["spec"].get("account")
         elif ocm is not None:
-            account[
-                "assume_role"
-            ] = ocm.get_aws_infrastructure_access_terraform_assume_role(
-                cluster,
-                peer_vpc["account"]["uid"],
-                peer_vpc["account"]["terraformUsername"],
+            cluster_account["assume_role"] = (
+                ocm.get_aws_infrastructure_access_terraform_assume_role(
+                    cluster,
+                    peer_vpc["account"]["uid"],
+                    peer_vpc["account"]["terraformUsername"],
+                )
             )
         else:
             raise KeyError(
@@ -417,22 +494,32 @@ def build_desired_state_vpc_single_cluster(
                 "or ocm should be defined to obtain role to assume"
             )
         account["assume_region"] = requester["region"]
-        account["assume_cidr"] = requester["cidr_block"]
-        requester_vpc_id, requester_route_table_ids, _ = awsapi.get_cluster_vpc_details(
-            account, route_tables=peer_connection.get("manageRoutes")
+        cluster_account["assume_region"] = requester["region"]
+        cluster_account["assume_cidr"] = requester["cidr_block"]
+        requester_vpc_id, requester_route_table_ids, _, api_security_group_id = (
+            awsapi.get_cluster_vpc_details(
+                cluster_account,
+                route_tables=peer_connection.get("manageRoutes"),
+                hcp_vpc_endpoint_sg=_private_hosted_control_plane(cluster_info),
+            )
         )
 
         if requester_vpc_id is None:
-            raise BadTerraformPeeringState(
-                f"[{cluster}] could not find VPC ID for cluster"
+            logging.warning(
+                f"[{cluster}] could not find VPC ID for cluster. "
+                f"Skipping {peer_connection_provider} connection {peer_connection['name']}"
             )
+            continue
+
         requester["vpc_id"] = requester_vpc_id
         requester["route_table_ids"] = requester_route_table_ids
-        requester["account"] = account
+        requester["account"] = cluster_account
+        requester["api_security_group_id"] = api_security_group_id
         accepter["account"] = account
         item = {
             "connection_provider": peer_connection_provider,
             "connection_name": connection_name,
+            "infra_account_name": account["name"],
             "requester": requester,
             "accepter": accepter,
             "deleted": peer_connection.get("delete", False),
@@ -441,9 +528,18 @@ def build_desired_state_vpc_single_cluster(
     return desired_state
 
 
+def _private_hosted_control_plane(cluster_info: Mapping[str, Any]) -> bool:
+    return bool(
+        cluster_info["spec"].get("hypershift") and cluster_info["spec"].get("private")
+    )
+
+
 def build_desired_state_vpc(
-    clusters, ocm_map: Optional[OCMMap], awsapi: AWSApi, account_filter: Optional[str]
-):
+    clusters: Iterable[Mapping[str, Any]],
+    ocm_map: OCMMap | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> tuple[list[dict[str, Any]], bool]:
     """
     Fetch state for VPC peerings between a cluster and a VPC (account)
     """
@@ -467,13 +563,16 @@ def build_desired_state_vpc(
 
 @defer
 def run(
-    dry_run,
-    print_to_file=None,
-    enable_deletion=False,
-    thread_pool_size=10,
-    account_name: Optional[str] = None,
-    defer=None,
-):
+    dry_run: bool,
+    print_to_file: bool | None = None,
+    enable_deletion: bool = False,
+    thread_pool_size: int = 10,
+    account_name: str | None = None,
+    enable_extended_early_exit: bool = False,
+    extended_early_exit_cache_ttl_seconds: int = 3600,
+    log_cached_log_output: bool = False,
+    defer: Callable | None = None,
+) -> None:
     settings = queries.get_secret_reader_settings()
     clusters = queries.get_clusters_with_peering_settings()
     with_ocm = any(c.get("ocm") for c in clusters)
@@ -500,24 +599,18 @@ def run(
     errors.append(err)
 
     # Fetch desired state for cluster-to-account (vpc mesh) VPCs
-    if ocm_map is not None:
-        desired_state_vpc_mesh, err = build_desired_state_vpc_mesh(
-            clusters, ocm_map, awsapi, account_name
-        )
-        desired_state.extend(desired_state_vpc_mesh)
-        errors.append(err)
-    else:
-        logging.debug("account-vpc-mesh is not yet supported without OCM")
+    desired_state_vpc_mesh, err = build_desired_state_vpc_mesh(
+        clusters, ocm_map, awsapi, account_name
+    )
+    desired_state.extend(desired_state_vpc_mesh)
+    errors.append(err)
 
     # Fetch desired state for cluster-to-cluster VPCs
-    if ocm_map is not None:
-        desired_state_cluster, err = build_desired_state_all_clusters(
-            clusters, ocm_map, awsapi, account_name
-        )
-        desired_state.extend(desired_state_cluster)
-        errors.append(err)
-    else:
-        logging.debug("cluster-vpc is not yet supported without OCM")
+    desired_state_cluster, err = build_desired_state_all_clusters(
+        clusters, ocm_map, awsapi, account_name
+    )
+    desired_state.extend(desired_state_cluster)
+    errors.append(err)
 
     # check there are no repeated vpc connection names
     connection_names = [c["connection_name"] for c in desired_state]
@@ -525,58 +618,133 @@ def run(
         logging.error("duplicate vpc connection names found")
         sys.exit(1)
 
-    participating_accounts = [item["requester"]["account"] for item in desired_state]
-    participating_accounts += [item["accepter"]["account"] for item in desired_state]
-    participating_account_names = [a["name"] for a in participating_accounts]
-    accounts = [a for a in accounts if a["name"] in participating_account_names]
+    # infra accounts are the accounts hosting the terraform state
+    # - for cluster to vpc or vpc-mesh peering, the infra account is the accepter (non-cluster) account
+    # - for cluster-to-cluster peerings, the infra account is the default awsInfrastructureManagementAccount from the accepter cluster
+    infra_account_names = {d["infra_account_name"] for d in desired_state}
+    infra_accounts = [a for a in accounts if a["name"] in infra_account_names]
+    if not infra_accounts:
+        logging.warning(
+            f"No participating AWS accounts found, consider disabling this integration, account name: {account_name}"
+        )
+        return
+
+    participating_accounts: dict[str, list[Any]] = {}
+    for infra_account_name in infra_account_names:
+        participating_accounts[infra_account_name] = []
+        participating_accounts[infra_account_name].extend([
+            item["requester"]["account"]
+            for item in desired_state
+            if item["infra_account_name"] == infra_account_name
+            and (
+                item["requester"]["account"]["name"] != infra_account_name
+                or item["requester"]["account"].get("assume_role")
+            )
+        ])
+        participating_accounts[infra_account_name].extend([
+            item["accepter"]["account"]
+            for item in desired_state
+            if item["infra_account_name"] == infra_account_name
+            and (
+                item["accepter"]["account"]["name"] != infra_account_name
+                or item["accepter"]["account"].get("assume_role")
+            )
+        ])
 
+    account_by_name = {a["name"]: a for a in accounts}
     with terrascript.TerrascriptClient(
-        QONTRACT_INTEGRATION, "", thread_pool_size, accounts, settings=settings
+        QONTRACT_INTEGRATION, "", thread_pool_size, infra_accounts, settings=settings
     ) as ts:
-        ts.populate_additional_providers(participating_accounts)
+        rosa_cluster_accounts = [
+            account_by_name[c["spec"]["account"]["name"]]
+            for c in clusters
+            if c.get("spec") and c["spec"].get("account")
+        ]
+        ts.populate_configs(rosa_cluster_accounts)
+
+        for infra_account_name, items in participating_accounts.items():
+            ts.populate_additional_providers(infra_account_name, items)
         ts.populate_vpc_peerings(desired_state)
         working_dirs = ts.dump(print_to_file=print_to_file)
+        terraform_configurations = ts.terraform_configurations()
 
     if print_to_file:
         sys.exit(0 if dry_run else int(any(errors)))
 
+    if any(errors):
+        sys.exit(1)
+
     tf = terraform.TerraformClient(
         QONTRACT_INTEGRATION,
         QONTRACT_INTEGRATION_VERSION,
         "",
-        accounts,
+        infra_accounts,
         working_dirs,
         thread_pool_size,
         awsapi,
     )
+    if defer:
+        defer(tf.cleanup)
+
+    runner_params: RunnerParams = {
+        "tf": tf,
+        "dry_run": dry_run,
+        "enable_deletion": enable_deletion,
+    }
+
+    if enable_extended_early_exit and get_feature_toggle_state(
+        "terraform-vpc-peerings-extended-early-exit",
+        default=True,
+    ):
+        cache_source = CacheSource(terraform_configurations=terraform_configurations)
+        extended_early_exit_run(
+            integration=QONTRACT_INTEGRATION,
+            integration_version=QONTRACT_INTEGRATION_VERSION,
+            dry_run=dry_run,
+            cache_source=cache_source,
+            shard=account_name if account_name else "",
+            ttl_seconds=extended_early_exit_cache_ttl_seconds,
+            logger=logging.getLogger(),
+            runner=runner,
+            runner_params=runner_params,
+            log_cached_log_output=log_cached_log_output,
+        )
+    else:
+        runner(**runner_params)
 
-    if any(errors):
-        sys.exit(1)
 
-    defer(tf.cleanup)
+class CacheSource(TypedDict):
+    terraform_configurations: dict[str, str]
 
+
+class RunnerParams(TypedDict):
+    tf: terraform.TerraformClient
+    dry_run: bool
+    enable_deletion: bool
+
+
+def runner(
+    dry_run: bool,
+    tf: terraform.TerraformClient,
+    enable_deletion: bool = False,
+) -> ExtendedEarlyExitRunnerResult:
     disabled_deletions_detected, err = tf.plan(enable_deletion)
-    errors.append(err)
     if disabled_deletions_detected:
-        logging.error("Deletions detected when they are disabled")
-        sys.exit(1)
+        raise RuntimeError("Terraform plan has disabled deletions detected")
+    if err:
+        raise RuntimeError("Terraform plan has errors")
 
     if dry_run:
-        sys.exit(int(any(errors)))
-    if any(errors):
-        sys.exit(1)
+        return ExtendedEarlyExitRunnerResult(payload={}, applied_count=0)
+
+    if err := tf.apply():
+        raise RuntimeError("Terraform apply has errors")
 
-    errors.append(tf.apply())
-    sys.exit(int(any(errors)))
+    return ExtendedEarlyExitRunnerResult(payload={}, applied_count=tf.apply_count)
 
 
-def early_exit_desired_state(
-    print_to_file=None,
-    enable_deletion=False,
-    thread_pool_size=10,
-    account_name: Optional[str] = None,
-) -> dict[str, Any]:
-    if account_name:
+def early_exit_desired_state(*args: Any, **kwargs: Any) -> dict[str, Any]:
+    if kwargs.get("account_name"):
         raise ValueError(
             "terraform-vpc-peerings early-exit check does not support sharding yet"
         )