qontract-reconcile 0.10.1rc1146__py3-none-any.whl → 0.10.1rc1148__py3-none-any.whl

{qontract_reconcile-0.10.1rc1146.dist-info → qontract_reconcile-0.10.1rc1148.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc1146
+Version: 0.10.1rc1148
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc1146.dist-info → qontract_reconcile-0.10.1rc1148.dist-info}/RECORD

@@ -17,7 +17,7 @@ reconcile/dashdotdb_base.py,sha256=l34QDu1G96_Ctnh7ZXdxXgSeCE93GQMdLAkWxmN6vDA,4
 reconcile/dashdotdb_cso.py,sha256=IkI_KSZuH_kPn0cIQKXitJXiPPFSyHykrOuFy9h9ZpU,3643
 reconcile/dashdotdb_dora.py,sha256=YmfxD02tKUAQQzku2aj2DXv1oKkAr4V_2lrPVtTFGyI,17674
 reconcile/dashdotdb_dvo.py,sha256=lCkZ0iby6HrNQb-3kYb6xrt8wCjVUZYxKzz9SiStfHU,8946
-reconcile/dashdotdb_slo.py,sha256=QKKqLzA2f6zUjQvQ_6U4DObpSOB80C7h-NWXJhzQwME,7812
+reconcile/dashdotdb_slo.py,sha256=LWn0xmMLxpLXls6U4W2R40MqLH6VpBySolapdoK8T8E,8338
 reconcile/database_access_manager.py,sha256=FfyXnYcUdX54BYR_6B9PWFmhT8xdNrPCfoz3Q7q39tg,25646
 reconcile/deadmanssnitch.py,sha256=n-5W-djUgwzpmdDM4eQIZpkkDmHY0vndt-42LJXI4Y8,7491
 reconcile/email_sender.py,sha256=-5L-Ag_jaEYSzYRoMr52KQBRXz1E8yx9GqLbg2X4XFU,3533
@@ -117,7 +117,7 @@ reconcile/terraform_resources.py,sha256=-sgMMHDtNvnQyNR05-MKebI_pSiyxSWAg8LmeA2_
 reconcile/terraform_tgw_attachments.py,sha256=09svJG9pAiwWp4aY0xRoQRV90T4ZNwHG3r8flI-ZS_s,18810
 reconcile/terraform_users.py,sha256=HqSm3ev3b8dZ9J6F_phDZB-FQsnlsdeKp9RPoY1cU94,10188
 reconcile/terraform_vpc_peerings.py,sha256=VLSfuO7FvHN5McopRiKoKJDHCmIhYtlJEHv_hxV5kcM,27669
-reconcile/vault_replication.py,sha256=isfmNaqxl4AC90n8sVJffUt685sPBfhNSvjks6DoQXg,17339
+reconcile/vault_replication.py,sha256=1MFau4dyMYXYxWQB3DIYjrQKMK5OMnKAhgiL8YC6tYg,17642
 reconcile/vpc_peerings_validator.py,sha256=-upvNg3ggKCxcJ4kqZcqJVsiltlhQ8MyyLZiWX8eYmE,7068
 reconcile/aus/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/aus/advanced_upgrade_service.py,sha256=NF3UQ02MdUpVPup50EqnTbTn3dRHGoXoSfFLZxOjr8Q,23744
@@ -574,7 +574,7 @@ reconcile/test/test_terraform_vpc_peerings.py,sha256=bpjCjhmic07cw3XKSHf-2JvmLuW
 reconcile/test/test_terraform_vpc_peerings_build_desired_state.py,sha256=cHmr1_yhRgfdqlFX6TMw-aiKXebaRv0szl16M9YRJic,49988
 reconcile/test/test_three_way_diff_strategy.py,sha256=v3rNkQFNy5e1uyfeNSlNBA07fvrPGD0aXD91Lgv8oxc,4062
 reconcile/test/test_utils_jinja2.py,sha256=rKugJEPl0qFC9joenJBXyk2qe-9md31-4EdxvQ2h5cs,4058
-reconcile/test/test_vault_replication.py,sha256=rMx-opCpC8GobL2vDj_yYYuSgX0crQuncyvrKul1xoM,16998
+reconcile/test/test_vault_replication.py,sha256=auadux0xrZb82xh7gKXThCQMct5nhbvujR-6m8um0yE,17522
 reconcile/test/test_vault_utils.py,sha256=vbJnc89XAuE07qbTuWxHM5o9F6R9SO5aHXA38fwxT7A,1122
 reconcile/test/test_version_bump.py,sha256=q6-3Y1roriI6YWpFwaHOMN7emEP3yL33sh_0VdbmG7E,511
 reconcile/test/test_vpc_peerings_validator.py,sha256=dFSmjc_dMN2GqMbntCFpa7PUZmyYuQ9DKffh-T5wmxM,6639
@@ -871,8 +871,8 @@ tools/test/test_qontract_cli.py,sha256=_D61RFGAN5x44CY1tYbouhlGXXABwYfxKSWSQx3Jr
 tools/test/test_saas_promotion_state.py,sha256=dy4kkSSAQ7bC0Xp2CociETGN-2aABEfL6FU5D9Jl00Y,6056
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc1146.dist-info/METADATA,sha256=LRnpop_Uixs9kQ5whiHWPNORzAgYT4rMKIgvJat2_M8,2213
-qontract_reconcile-0.10.1rc1146.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
-qontract_reconcile-0.10.1rc1146.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
-qontract_reconcile-0.10.1rc1146.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc1146.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc1148.dist-info/METADATA,sha256=D-ZIpS5GYoipyMcDl5QuXJTq3n-DsESc0GbyvYDrNjM,2213
+qontract_reconcile-0.10.1rc1148.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
+qontract_reconcile-0.10.1rc1148.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
+qontract_reconcile-0.10.1rc1148.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc1148.dist-info/RECORD,,

reconcile/dashdotdb_slo.py

@@ -136,6 +136,7 @@ class DashdotdbSLO(DashdotdbBase):
                 template = jinja2.Template(expr)
                 window = slo.slo_parameters.window
                 promquery = template.render({"window": window})
+
                 try:
                     prom_response = self._promget(
                         url=promurl,
@@ -149,9 +150,19 @@ class DashdotdbSLO(DashdotdbBase):
                     # and some prometheus URL are openshift service names. The trick is to run
                     # with `oc port-forward` and update the local hosts file if we need to query those.
                     LOG.error(
-                        f"{self.logmarker} Could not reach prometheus at {promurl}: {error}. Skipping {slo.name}"
+                        f"{self.logmarker} Could not reach prometheus at {promurl}: {error}."
+                        f"Skipping SLOs from SLO doc {slo_document.name}"
                     )
+                    # cannot connect to this prometheus, skip all
                     raise
+                except requests.exceptions.HTTPError as error:
+                    LOG.error(
+                        f"{self.logmarker} Error wile querying {promurl}: {error}."
+                        f"Skipping SLO '{slo.name} from SLO doc {slo_document.name}"
+                    )
+                    # it could be a query issue, keep processing other SLOs from this doc
+                    continue
+
                 prom_result = prom_response["data"]["result"]
                 if not prom_result:
                     continue

reconcile/test/test_vault_replication.py

@@ -504,13 +504,32 @@ def test_get_policy_secret_list(mocker):
     vault_client.list_all.side_effect = [
         ["policy/path/1/secret1", "policy/path/1/secret2"],
         ["policy/path/2/secret1", "policy/path/2/secret2"],
+        ["my-policy/path_to_it/3/secret1"],
     ]
 
-    assert integ.get_policy_secret_list(
-        vault_client, ["policy/path/1/*", "policy/path/2/*"]
-    ) == [
+    assert set(
+        integ.get_policy_secret_list(
+            vault_client,
+            ["policy/path/1/*", "policy/path/2/*", "policy/path/3/secret1"],
+        )
+    ) == {
         "policy/path/1/secret1",
         "policy/path/1/secret2",
         "policy/path/2/secret1",
         "policy/path/2/secret2",
-    ]
+        "policy/path/3/secret1",
+    }
+
+
+@pytest.mark.parametrize(
+    "paths",
+    [
+        ["policy/path*"],
+        ["policy/p*th"],
+        ["policy/+/p*th"],
+    ],
+)
+def test_get_policy_secret_list_failure(paths, mocker):
+    vault_client = mocker.patch("reconcile.utils.vault._VaultClient", autospec=True)
+    with pytest.raises(integ.VaultInvalidPaths):
+        integ.get_policy_secret_list(vault_client, paths)

reconcile/vault_replication.py

@@ -34,6 +34,7 @@ from reconcile.utils.vault import (
 )
 
 QONTRACT_INTEGRATION = "vault-replication"
+SECRET_PATH_PATTERN = re.compile(r"^[\w/-]+?(?P<folder>/\*?)?$")
 
 
 class VaultInvalidPaths(Exception):
@@ -232,14 +233,21 @@ def get_policy_secret_list(
     vault_instance: _VaultClient, policy_paths: Iterable[str]
 ) -> list[str]:
     """Returns a list of secrets to be copied from the given policy"""
-    secret_list = []
+    secrets = set()
     for path in policy_paths:
-        # Remove the * at the end of the path because list method expects
-        # a folder path without any secret or wilcard
-        path = path[:-1] if path.endswith("*") else path
-        secret_list.extend(vault_instance.list_all(path))
+        match = SECRET_PATH_PATTERN.match(path)
+        if not match:
+            logging.error(["get_policy_secret_list", "Invalid path to replicate", path])
+            raise VaultInvalidPaths
 
-    return secret_list
+        if match.group("folder"):
+            # Remove the * at the end of the path because list method expects
+            # a folder path without any secret or wilcard
+            secrets.update(vault_instance.list_all(path.rstrip("*")))
+        else:
+            secrets.add(path)
+
+    return list(secrets)
 
 
 def get_jenkins_secret_list(