qontract-reconcile 0.10.1rc1164__py3-none-any.whl → 0.10.1rc1166__py3-none-any.whl

{qontract_reconcile-0.10.1rc1164.dist-info → qontract_reconcile-0.10.1rc1166.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc1164
+Version: 0.10.1rc1166
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc1164.dist-info → qontract_reconcile-0.10.1rc1166.dist-info}/RECORD

@@ -29,7 +29,7 @@ reconcile/github_repo_invites.py,sha256=3GOBGZq1DKMIuyYsDxHqXDnMTWlJfeu248-m3ajf
 reconcile/github_repo_permissions_validator.py,sha256=dcbXdUx6imjNchjp3pg9-z1i7lFEGOr_28GvsiwO5Xw,1734
 reconcile/github_users.py,sha256=nfTq78QRONIfDVj-5O3bD6psllJjzWFnog-EJ1WqFPU,3672
 reconcile/github_validator.py,sha256=cVTVxJIGR4a1Jz8wrdXEAb_CMpXUzvykVmUURX4cook,917
-reconcile/gitlab_fork_compliance.py,sha256=5joAIGOOLhHme1ipa7ZQeQkUOVe3dKbRO1wJtTwyNR4,4178
+reconcile/gitlab_fork_compliance.py,sha256=c7UfqSAsW04c1bWJmXXaQDwtUcG4Kb6nCJAyRU2uAuw,4449
 reconcile/gitlab_housekeeping.py,sha256=D0DOqC-xuMBMct04_MI8Lq32OAi_QMvvGLOz_E-77Dw,22482
 reconcile/gitlab_labeler.py,sha256=4xJHmVX155fclrHqkR926sL1GH6RTN5XfZ8PnqNXbRA,4534
 reconcile/gitlab_members.py,sha256=PrJE9OhDRdGG_gHM_77nQojLb4B18jtUu8DxgLsRS88,8417
@@ -94,7 +94,7 @@ reconcile/quay_mirror.py,sha256=mFp4Z5Nwl-DcFbbsJBOB8f9ldohFT-V67o868d5ux1s,1536
 reconcile/quay_mirror_org.py,sha256=utrJpJaKCs7U6WX6DODdfCeB0EmX-lUC8Y5fkmpgFSs,10764
 reconcile/quay_permissions.py,sha256=9KOutS1w4RFQqkvMSy54VtsKNx56-phzP6yI_rEW-B8,4244
 reconcile/quay_repos.py,sha256=cuEYG0HUe0ut5yvLdEwOF5-CmccpXQHRb_wDazvDrvQ,6895
-reconcile/queries.py,sha256=Iss6BEcK6ptz1JUfyw-sewaUX_vJmcvAqvvYa4D6p-U,51455
+reconcile/queries.py,sha256=04Xkm1wVg803ukZ_28Ud6AeiLJGVihl4f_UVoERv9uU,51509
 reconcile/query_validator.py,sha256=MSh5pKLBksws4AqfuvT8nrIGucIbqX-IOzYyPYTLO7k,1491
 reconcile/requests_sender.py,sha256=914iluuF4UVgG3VyxxtnHOu4yf6YKS2fIy6PViSsFTQ,3875
 reconcile/resource_scraper.py,sha256=znXCHrU7YwPfKuxGBiUrV7T1tYtn4vlz9qmZlfy6Flg,2307
@@ -113,7 +113,7 @@ reconcile/terraform_cloudflare_dns.py,sha256=-aLEe2QnH5cJPu7HWqs-R9NmQ1NlFbcVUm0
 reconcile/terraform_cloudflare_resources.py,sha256=pq8Ieo5NmB-dYQ9X2F0s6iEoINMzhiqGw2yQK4ovok4,14980
 reconcile/terraform_cloudflare_users.py,sha256=iyTG5sj20Jg4J4qWJ144KVptfIHGOSfH8wQKxu0imq0,13942
 reconcile/terraform_repo.py,sha256=TKqlodhQGoAtQ6nDm04TNlpx4wpgJ_n4atoUK5Rfd7o,16444
-reconcile/terraform_resources.py,sha256=iufjMJs_aSEvmh7Cg11beCxKmV8nrOLOpEtiTryPNx0,19470
+reconcile/terraform_resources.py,sha256=jpBtp6vezq79jQ7rWdk49_mW-PIUFVzFK54ilVSEZFM,19564
 reconcile/terraform_tgw_attachments.py,sha256=09svJG9pAiwWp4aY0xRoQRV90T4ZNwHG3r8flI-ZS_s,18810
 reconcile/terraform_users.py,sha256=HqSm3ev3b8dZ9J6F_phDZB-FQsnlsdeKp9RPoY1cU94,10188
 reconcile/terraform_vpc_peerings.py,sha256=VLSfuO7FvHN5McopRiKoKJDHCmIhYtlJEHv_hxV5kcM,27669
@@ -727,7 +727,7 @@ reconcile/utils/state.py,sha256=W0_awkLAPX18hNOF_60o73tkPxDUylqbzYNHfl_sDsk,1638
 reconcile/utils/structs.py,sha256=LcbLEg8WxfRqM6nW7NhcWN0YeqF7SQzxOgntmLs1SgY,352
 reconcile/utils/template.py,sha256=wTvRU4AnAV_o042tD4Mwls2dwWMuk7MKnde3MaCjaYg,331
 reconcile/utils/terraform_client.py,sha256=LjX2U2E0Dglt2S_KA5jWQ_dVC8sPn4FEAh0xW_d6JTk,35953
-reconcile/utils/terrascript_aws_client.py,sha256=svDSrtrSzQAX9QTgR_i5FBipZd82AdyFhiaxwXpXHMU,283768
+reconcile/utils/terrascript_aws_client.py,sha256=9-3mmZtiIrpu_uZrPPtSWgf-elbAG6jeureCUzkWQO4,283459
 reconcile/utils/three_way_diff_strategy.py,sha256=oQcHXd9LVhirJfoaOBoHUYuZVGfyL2voKr6KVI34zZE,4833
 reconcile/utils/throughput.py,sha256=iP4UWAe2LVhDo69mPPmgo9nQ7RxHD6_GS8MZe-aSiuM,344
 reconcile/utils/vault.py,sha256=pi0PuyopvCq1gW0cldvy1-Ff6bqLUlCKC2MW0sifvSE,15043
@@ -880,8 +880,8 @@ tools/test/test_qontract_cli.py,sha256=iuzKbQ6ahinvjoQmQLBrG4shey0z-1rB6qCgS8T6d
 tools/test/test_saas_promotion_state.py,sha256=dy4kkSSAQ7bC0Xp2CociETGN-2aABEfL6FU5D9Jl00Y,6056
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc1164.dist-info/METADATA,sha256=QDl-QPDZNU3uD3wnepnv90eJa6yhBOmV0dKgt_t5RAU,2213
-qontract_reconcile-0.10.1rc1164.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
-qontract_reconcile-0.10.1rc1164.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
-qontract_reconcile-0.10.1rc1164.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc1164.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc1166.dist-info/METADATA,sha256=ru93sln6IVHsJ8rmuUw2C1jLSzNMey-obelfXbhXBvU,2213
+qontract_reconcile-0.10.1rc1166.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
+qontract_reconcile-0.10.1rc1166.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
+qontract_reconcile-0.10.1rc1166.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc1166.dist-info/RECORD,,

reconcile/gitlab_fork_compliance.py

@@ -5,8 +5,12 @@ from gitlab import GitlabGetError
 from gitlab.const import MAINTAINER_ACCESS
 
 from reconcile import queries
+from reconcile.typed_queries.app_interface_vault_settings import (
+    get_app_interface_vault_settings,
+)
 from reconcile.utils.gitlab_api import GitLabApi
 from reconcile.utils.mr.labels import BLOCKED_BOT_ACCESS
+from reconcile.utils.secret_reader import create_secret_reader
 
 LOG = logging.getLogger(__name__)
 
@@ -38,10 +42,11 @@ class GitlabForkCompliance:
         self.maintainers_group = maintainers_group
 
         self.instance = queries.get_gitlab_instance()
-        self.settings = queries.get_app_interface_settings()
+        vault_settings = get_app_interface_vault_settings()
+        self.secret_reader = create_secret_reader(use_vault=vault_settings.vault)
 
         self.gl_cli = GitLabApi(
-            self.instance, project_id=project_id, settings=self.settings
+            self.instance, project_id=project_id, secret_reader=self.secret_reader
         )
         self.mr = self.gl_cli.get_merge_request(mr_id)
 
@@ -94,7 +99,7 @@ class GitlabForkCompliance:
             self.src = GitLabApi(
                 self.instance,
                 project_id=self.mr.source_project_id,
-                settings=self.settings,
+                secret_reader=self.secret_reader,
             )
         except GitlabGetError:
             self.handle_error("access denied for user {bot}", MSG_ACCESS)

reconcile/queries.py

@@ -102,12 +102,11 @@ APP_INTERFACE_SETTINGS_QUERY = """
       readTimeout
       connectTimeout
     }
-    terraformResourcesProviderExclusions {
-      provider
-      excludeProvisioners {
-        name
+    terraformResourcesProviderExclusionsByProvisioner {
+      provisioner {
+          name
       }
-      excludeAllProvisioners
+      excludedProviders
     }
   }
 }
@@ -2765,13 +2764,12 @@ def get_jenkins_configs():
 
 TF_RESOURCES_PROVIDER_EXCLUSIONS_BY_PROVISIONER = """
 {
-  tf_provider_exclusions: app_interface_settings_v1 {
-    terraformResourcesProviderExclusions {
-      provider
-      excludeProvisioners {
-        name
+  tf_provider_exclusions_by_provisioner: app_interface_settings_v1 {
+    terraformResourcesProviderExclusionsByProvisioner {
+      provisioner {
+          name
       }
-      excludeAllProvisioners
+      excludedProviders
     }
   }
 }
@@ -2783,10 +2781,13 @@ def get_tf_resources_provider_exclusions_by_provisioner() -> (
 ):
     gqlapi = gql.get_api()
     settings = gqlapi.query(TF_RESOURCES_PROVIDER_EXCLUSIONS_BY_PROVISIONER)[
-        "tf_provider_exclusions"
+        "tf_provider_exclusions_by_provisioner"
     ]
-    if len(settings) == 1 and "terraformResourcesProviderExclusions" in settings[0]:
-        return settings[0]["terraformResourcesProviderExclusions"]
+    if (
+        len(settings) == 1
+        and "terraformResourcesProviderExclusionsByProvisioner" in settings[0]
+    ):
+        return settings[0]["terraformResourcesProviderExclusionsByProvisioner"]
     return None
 
 

reconcile/terraform_resources.py

@@ -266,11 +266,13 @@ def setup(
         ocm_map = None
     tf_namespaces_dicts = [ns.dict(by_alias=True) for ns in tf_namespaces]
 
-    provider_exclusions = settings.get("terraformResourcesProviderExclusions") or []
+    provider_exclusions_by_provisioner = (
+        settings.get("terraformResourcesProviderExclusionsByProvisioner") or []
+    )
     ts.init_populate_specs(
         tf_namespaces_dicts,
         account_names,
-        provider_exclusions,
+        provider_exclusions_by_provisioner=provider_exclusions_by_provisioner,
     )
     tf.populate_terraform_output_secrets(
         resource_specs=ts.resource_spec_inventory, init_rds_replica_source=True

reconcile/utils/terrascript_aws_client.py

@@ -9,7 +9,7 @@ import string
 import tempfile
 from collections import Counter
 from collections.abc import Iterable, Mapping, MutableMapping
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from ipaddress import (
     ip_address,
     ip_network,
@@ -379,12 +379,6 @@ class ElasticSearchLogGroupInfo:
     log_group_identifier: str
 
 
-@dataclass
-class Exclusion:
-    all: bool = False
-    provisioners: set[str] = field(default_factory=set)
-
-
 class ProviderExcludedError(Exception):
     def __init__(self, spec: ExternalResourceSpec) -> None:
         super().__init__(
@@ -1549,49 +1543,38 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
             for spec in specs:
                 self.populate_tf_resources(spec, ocm_map=ocm_map)
 
-    def _is_provisioner_excluded(
+    def _get_provisioner_provider_exclusions(
         self,
         spec: ExternalResourceSpec,
-        provider_exclusions: Mapping[str, Exclusion],
-    ) -> bool:
-        e = provider_exclusions.get(spec.provider)
-        if not e:
-            return False
-        return e.all or spec.provisioner_name in e.provisioners
+        provider_exclusions_by_provisioner_name: Mapping[str, Iterable[str]],
+    ) -> list[str]:
+        return list(
+            provider_exclusions_by_provisioner_name.get(spec.provisioner["name"], [])
+        )
 
     def _filter_specs_managed_by_erv2(
         self,
         specs: Iterable[ExternalResourceSpec],
-        provider_exclusions: Mapping[str, Exclusion],
+        provider_exclusions_by_provisioner_name: Mapping[str, Iterable[str]],
     ) -> list[ExternalResourceSpec]:
-        filtered_specs = [
-            spec for spec in specs if not spec.resource.get("managed_by_erv2")
-        ]
+        filtered_specs: list[ExternalResourceSpec] = []
+        for spec in specs:
+            if spec.resource.get("managed_by_erv2"):
+                continue
 
-        for spec in filtered_specs:
-            if self._is_provisioner_excluded(spec, provider_exclusions):
+            if spec.provider in self._get_provisioner_provider_exclusions(
+                spec, provider_exclusions_by_provisioner_name
+            ):
                 raise ProviderExcludedError(spec)
 
+            filtered_specs.append(spec)
         return filtered_specs
 
-    def _get_provider_exclusions_query_dict(
-        self, provider_exclusions: Iterable[Mapping[str, Any]]
-    ) -> dict[str, Exclusion]:
-        return {
-            item["provider"]: Exclusion(
-                all=item.get("excludeAllProvisioners") or False,
-                provisioners={
-                    p["name"] for p in (item.get("excludeProvisioners") or [])
-                },
-            )
-            for item in provider_exclusions
-        }
-
     def init_populate_specs(
         self,
         namespaces: Iterable[Mapping[str, Any]],
         account_names: Iterable[str] | None,
-        provider_exclusions: Iterable[Mapping[str, Any]] | None = None,
+        provider_exclusions_by_provisioner: Iterable[Mapping[str, Any]] | None = None,
     ) -> None:
         """
         Initiates resource specs from the definitions in app-interface
@@ -1603,14 +1586,15 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
         self.resource_spec_inventory: ExternalResourceSpecInventory = {}
 
         # Ensure provider exclusions are fetched
-        if provider_exclusions is None:
-            provider_exclusions = (
+        if provider_exclusions_by_provisioner is None:
+            provider_exclusions_by_provisioner = (
                 queries.get_tf_resources_provider_exclusions_by_provisioner() or []
             )
 
-        provider_exclusions_query_dict = self._get_provider_exclusions_query_dict(
-            provider_exclusions
-        )
+        provider_exclusions_by_provisioner_name = {
+            p["provisioner"]["name"]: p["excludedProviders"]
+            for p in provider_exclusions_by_provisioner or []
+        }
 
         for namespace_info in namespaces:
             all_specs = get_external_resource_specs(
@@ -1618,7 +1602,7 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
                 provision_provider=PROVIDER_AWS,
             )
             specs = self._filter_specs_managed_by_erv2(
-                all_specs, provider_exclusions_query_dict
+                all_specs, provider_exclusions_by_provisioner_name
             )
             name_counter = Counter(spec.output_resource_name for spec in specs)
             duplicates = [name for name, count in name_counter.items() if count > 1]