qontract-reconcile 0.10.1rc1202__py3-none-any.whl → 0.10.2.dev1__py3-none-any.whl

reconcile/test/test_openshift_saas_deploy_change_tester.py

@@ -1,308 +0,0 @@
-from collections.abc import Callable
-
-import pytest
-
-from reconcile.openshift_saas_deploy_change_tester import (
-    State,
-    collect_compare_diffs,
-    collect_state,
-)
-from reconcile.typed_queries.saas_files import SaasFile
-
-
-@pytest.fixture
-def saas_files(gql_class_factory: Callable[..., SaasFile]) -> list[SaasFile]:
-    return [
-        gql_class_factory(
-            SaasFile,
-            {
-                "path": "/path.yml",
-                "name": "saas-file-name",
-                "app": {"name": "ccx-data-pipeline"},
-                "pipelinesProvider": {
-                    "name": "pipeline-provider-01",
-                    "provider": "tekton",
-                    "namespace": {
-                        "name": "namespace",
-                        "cluster": {
-                            "name": "appint-ex-01",
-                            "serverUrl": "https://cluster-url",
-                            "internal": False,
-                            "automationToken": {"path": "creds", "field": "token"},
-                            "consoleUrl": "https://console-url",
-                        },
-                    },
-                    "defaults": {
-                        "pipelineTemplates": {
-                            "openshiftSaasDeploy": {"name": "saas-deploy"}
-                        }
-                    },
-                },
-                "deployResources": {
-                    "requests": {"cpu": "1500m", "memory": "700Mi"},
-                    "limits": {"cpu": "2000m", "memory": "1Gi"},
-                },
-                "managedResourceTypes": [
-                    "Deployment",
-                ],
-                "takeover": None,
-                "deprecated": None,
-                "compare": None,
-                "clusterAdmin": None,
-                "imagePatterns": [
-                    "quay.io/some-org",
-                ],
-                "allowedSecretParameterPaths": None,
-                "use_channel_in_image_tag": None,
-                "parameters": '{"SAAS_DEFAULT_1":"saas", "SAAS_DEFAULT_2":"saas"}',
-                "secretParameters": [
-                    {
-                        "name": "saas_default_1",
-                        "secret": {
-                            "field": "saas_field_1",
-                            "path": "saas_path_1",
-                            "version": 1,
-                        },
-                    },
-                    {
-                        "name": "saas_default_2",
-                        "secret": {
-                            "field": "saas_field_2",
-                            "path": "saas_path_2",
-                            "version": 1,
-                        },
-                    },
-                ],
-                "resourceTemplates": [
-                    {
-                        "name": "tmpl",
-                        "url": "https://github.com/some-org/some-repo.git",
-                        "path": "/deploy.yaml",
-                        "hash_length": 7,
-                        "parameters": '{"TMPL_DEFAULT_1":"tmpl", "TMPL_DEFAULT_2":"tmpl"}',  # used in collect_state but not saasherder
-                        "secretParameters": [  # used in collect_state but saasherder
-                            {
-                                "name": "tmpl_default_1",
-                                "secret": {
-                                    "field": "tmpl_field_1",
-                                    "path": "tmpl_path_1",
-                                    "version": 1,
-                                },
-                            },
-                            {
-                                "name": "tmpl_default_2",
-                                "secret": {
-                                    "field": "tmpl_field_2",
-                                    "path": "tmpl_path_2",
-                                    "version": 1,
-                                },
-                            },
-                        ],
-                        "targets": [
-                            {
-                                "name": "target",
-                                "namespace": {
-                                    "name": "namespace",
-                                    "environment": {
-                                        "name": "env-name",
-                                        # used in collect_state but not saas_file_owners
-                                        "parameters": '{ "ENV_DEFAULT_1": "env", "ENV_DEFAULT_2": "env" }',
-                                        "secretParameters": [
-                                            {
-                                                "name": "env_default_1",
-                                                "secret": {
-                                                    "field": "env_field_1",
-                                                    "path": "env_path_1",
-                                                    "version": 1,
-                                                },
-                                            },
-                                            {
-                                                "name": "env_default_2",
-                                                "secret": {
-                                                    "field": "env_field_2",
-                                                    "path": "env_path_2",
-                                                    "version": 1,
-                                                },
-                                            },
-                                        ],
-                                    },
-                                    "app": {"name": "app"},
-                                    "cluster": {"name": "cluster"},
-                                },
-                                "ref": "master",
-                                "promotion": None,
-                                "parameters": '{"TARGET":"target", "ENV_DEFAULT_1":"target", "SAAS_DEFAULT_1":"target", "TMPL_DEFAULT_1":"target"}',
-                                "secretParameters": [
-                                    {
-                                        "name": "target_default",
-                                        "secret": {
-                                            "field": "target_field",
-                                            "path": "target_path",
-                                            "version": 1,
-                                            "format": None,
-                                        },
-                                    },
-                                    {
-                                        "name": "saas_default_1",
-                                        "secret": {
-                                            "field": "target_field",
-                                            "path": "target_path",
-                                            "version": 1,
-                                            "format": None,
-                                        },
-                                    },
-                                    {
-                                        "name": "tmpl_default_1",
-                                        "secret": {
-                                            "field": "target_field",
-                                            "path": "target_path",
-                                            "version": 1,
-                                            "format": None,
-                                        },
-                                    },
-                                    {
-                                        "name": "env_default_1",
-                                        "secret": {
-                                            "field": "target_field",
-                                            "path": "target_path",
-                                            "version": 1,
-                                            "format": None,
-                                        },
-                                    },
-                                ],
-                                "upstream": {
-                                    "instance": {
-                                        "name": "ci",
-                                        "serverUrl": "https://ci.example.net",
-                                    },
-                                    "name": "job-name",
-                                },
-                                "image": None,
-                                "disable": None,
-                                "delete": None,
-                            },
-                        ],
-                    }
-                ],
-            },
-        )
-    ]
-
-
-def test_collect_state(saas_files: list[SaasFile]) -> None:
-    """
-    this implementation of collect_state may contain a bug when compared to the
-    saas_herder way to of collecting parameters and secrets.
-    there are 4 places where parameters and secrets can be defined with qontract-schema:
-    1) environment-1
-    2) saas-file-2
-    3) saas-file-2.resourceTemplates
-    4) saas-file-2.resourceTemplates.targets
-
-    - saas-herder collects from 1), 2), 4)
-    - collect_state collects from 2), 3), 4)
-    """
-    state = collect_state(saas_files)
-    expected = State(**{
-        "saas_file_path": "/path.yml",
-        "saas_file_name": "saas-file-name",
-        "saas_file_deploy_resources": {
-            "requests": {"cpu": "1500m", "memory": "700Mi"},
-            "limits": {"cpu": "2000m", "memory": "1Gi"},
-        },
-        "resource_template_name": "tmpl",
-        "namespace": "namespace",
-        "environment": "env-name",
-        "cluster": "cluster",
-        "url": "https://github.com/some-org/some-repo.git",
-        "ref": "master",
-        "parameters": {
-            "SAAS_DEFAULT_1": "target",
-            "SAAS_DEFAULT_2": "saas",
-            "ENV_DEFAULT_1": "target",
-            # "ENV_DEFAULT_2": "env", # todo - check if it is a bug or on purpose that environment-1 params are not loaded
-            "TMPL_DEFAULT_1": "target",
-            "TMPL_DEFAULT_2": "tmpl",
-            "TARGET": "target",
-        },
-        "secret_parameters": {
-            "target_default": {
-                "field": "target_field",
-                "path": "target_path",
-                "version": 1,
-                "format": None,
-            },
-            "saas_default_1": {
-                "field": "target_field",
-                "path": "target_path",
-                "version": 1,
-                "format": None,
-            },
-            "saas_default_2": {
-                "field": "saas_field_2",
-                "path": "saas_path_2",
-                "version": 1,
-                "format": None,
-            },
-            "env_default_1": {
-                "field": "target_field",
-                "path": "target_path",
-                "version": 1,
-                "format": None,
-            },
-            # environment-1 secrets should be present since saasherder uses them but collect_state does sadly not
-            # "env_default_2": {
-            #    "field": "env_field_2",
-            #    "path": "env_path_2",
-            #    "version": 1,
-            #    "format": None,
-            # },
-            "tmpl_default_1": {
-                "field": "target_field",
-                "path": "target_path",
-                "version": 1,
-                "format": None,
-            },
-            "tmpl_default_2": {
-                "field": "tmpl_field_2",
-                "path": "tmpl_path_2",
-                "version": 1,
-                "format": None,
-            },
-        },
-        "upstream": {
-            "instance": {"name": "ci", "serverUrl": "https://ci.example.net"},
-            "name": "job-name",
-        },
-        "saas_file_definitions": {
-            "managed_resource_types": ["Deployment"],
-            "image_patterns": ["quay.io/some-org"],
-            "use_channel_in_image_tag": False,
-        },
-        "disable": None,
-        "delete": None,
-        "target_path": None,
-    })
-    assert state == [expected]
-
-
-def test_collect_compare_diffs(saas_files: list[SaasFile]):
-    state_1 = collect_state(saas_files)
-    state_2 = [s.copy() for s in state_1]
-    state_1[0].ref = "another-branch"
-    diffs = collect_compare_diffs(
-        state_1, state_2, changed_paths=[state_1[0].saas_file_path]
-    )
-    assert diffs == {
-        "https://github.com/some-org/some-repo.git/compare/another-branch...master"
-    }
-
-
-def test_collect_compare_diffs_other_paths(saas_files: list[SaasFile]):
-    state_1 = collect_state(saas_files)
-    state_2 = [s.copy() for s in state_1]
-    state_1[0].ref = "another-branch"
-    diffs = collect_compare_diffs(
-        state_1, state_2, changed_paths=["/some/other-path.yml"]
-    )
-    assert diffs == set()

reconcile/test/test_openshift_saas_deploy_trigger_cleaner.py

@@ -1,65 +0,0 @@
-from datetime import UTC, datetime
-from typing import Any
-
-import pytest
-
-from reconcile.gql_definitions.fragments.pipeline_provider_retention import (
-    PipelineProviderRetention,
-)
-from reconcile.openshift_saas_deploy_trigger_cleaner import get_pipeline_runs_to_delete
-
-from .fixtures import Fixtures
-
-fxt = Fixtures("openshift_saas_deploy_trigger_cleaner")
-
-
-@pytest.fixture
-def now() -> datetime:
-    return datetime(2024, 4, 4, 0, 0, 0, 0, tzinfo=UTC)
-
-
-# A fixture simulating the output of getting PipelineRuns from a namespace, simplified
-# as it contains only the fields relevant for get_pipeline_runs_to_delete, reversed
-# sorted by creationTimestamp
-@pytest.fixture
-def pipeline_runs() -> list[dict[str, Any]]:
-    return fxt.get_anymarkup("pipeline_runs.yaml")
-
-
-# No min/max settings, we go with whatever "days" says
-def test_days(now: datetime, pipeline_runs: list[dict[str, Any]]) -> None:
-    retention = PipelineProviderRetention(days=1, minimum=None, maximum=None)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 4
-
-    retention = PipelineProviderRetention(days=2, minimum=None, maximum=None)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 2
-
-
-# Minimum set, it takes precedence over "days"
-def test_days_and_minimum(now: datetime, pipeline_runs: list[dict[str, Any]]) -> None:
-    retention = PipelineProviderRetention(days=1, minimum=5, maximum=None)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 1
-    # We would have removed four from the "days" setting, we can only remove one
-
-    retention = PipelineProviderRetention(days=1, minimum=3, maximum=None)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 3
-    # We would have removed four from the "days" setting, we can only remove three
-
-    retention = PipelineProviderRetention(days=1, minimum=1, maximum=None)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 4
-    # Removing 4 we still have two, we're fine.
-
-
-# Maximum set, it takes precedence over "days"
-def test_days_and_maximum(now: datetime, pipeline_runs: list[dict[str, Any]]) -> None:
-    retention = PipelineProviderRetention(days=1, minimum=None, maximum=1)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 5
-    # we have a max of 1, no matter what "days" says.
-
-    retention = PipelineProviderRetention(days=1, minimum=None, maximum=3)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 4
-    # by removing 4 we comply with the max setting of three.
-
-    retention = PipelineProviderRetention(days=2, minimum=None, maximum=3)
-    assert len(get_pipeline_runs_to_delete(pipeline_runs, retention, now)) == 3
-    # We would have remove only two following "days", but max tells us otherwise.

reconcile/test/test_openshift_serviceaccount_tokens.py

@@ -1,282 +0,0 @@
-from collections.abc import Callable, Mapping
-from typing import Any
-from unittest.mock import call
-
-import pytest
-from pytest_mock import MockerFixture
-
-from reconcile.gql_definitions.openshift_serviceaccount_tokens.tokens import NamespaceV1
-from reconcile.openshift_serviceaccount_tokens import (
-    QONTRACT_INTEGRATION,
-    canonicalize_namespaces,
-    construct_sa_token_oc_resource,
-    fetch_desired_state,
-    get_namespaces_with_serviceaccount_tokens,
-    get_tokens_for_service_account,
-    service_account_token_request,
-    write_outputs_to_vault,
-)
-from reconcile.test.fixtures import Fixtures
-from reconcile.utils.oc import OC_Map, OCCli
-from reconcile.utils.openshift_resource import ResourceInventory
-from reconcile.utils.vault import _VaultClient
-
-
-@pytest.fixture
-def fx() -> Fixtures:
-    return Fixtures("openshift_serviceaccount_tokens")
-
-
-@pytest.fixture
-def query_func(
-    data_factory: Callable[[type[NamespaceV1], Mapping[str, Any]], Mapping[str, Any]],
-    fx: Fixtures,
-) -> Callable:
-    def q(*args: Any, **kwargs: Any) -> dict:
-        return {
-            "namespaces": [
-                data_factory(NamespaceV1, item)
-                for item in fx.get_anymarkup("namespaces.yml")["namespaces"]
-            ]
-        }
-
-    return q
-
-
-@pytest.fixture
-def namespaces(query_func: Callable) -> list[NamespaceV1]:
-    return get_namespaces_with_serviceaccount_tokens(query_func)
-
-
-@pytest.fixture
-def ri(namespaces: list[NamespaceV1]) -> ResourceInventory:
-    _ri = ResourceInventory()
-    _ri.initialize_resource_type(
-        cluster="cluster",
-        namespace="namespace",
-        resource_type="Secret",
-    )
-    _ri.initialize_resource_type(
-        cluster="another-cluster",
-        namespace="platform-changelog-stage",
-        resource_type="Secret",
-    )
-    _ri.initialize_resource_type(
-        cluster="another-cluster",
-        namespace="with-openshift-serviceaccount-tokens",
-        resource_type="Secret",
-    )
-    for ns in namespaces:
-        _ri.initialize_resource_type(
-            cluster=ns.cluster.name, namespace=ns.name, resource_type="Secret"
-        )
-    return _ri
-
-
-def test_openshift_serviceaccount_tokens__construct_sa_token_oc_resource() -> None:
-    qr = construct_sa_token_oc_resource("foobar", "token")
-    assert qr.body == {
-        "apiVersion": "v1",
-        "data": {"token": "token"},
-        "kind": "Secret",
-        "metadata": {"name": "foobar"},
-        "type": "Opaque",
-    }
-
-
-def test_openshift_serviceaccount_tokens__get_tokens_for_service_account() -> None:
-    foobar_secret = {
-        "metadata": {
-            "annotations": {"kubernetes.io/service-account.name": "foobar-account"}
-        },
-        "type": "kubernetes.io/service-account-token",
-    }
-    assert get_tokens_for_service_account(
-        service_account="foobar-account",
-        tokens=[
-            foobar_secret,
-            {
-                "metadata": {
-                    "annotations": {
-                        "kubernetes.io/service-account.name": "just-another-account"
-                    }
-                },
-                "type": "kubernetes.io/service-account-token",
-            },
-            foobar_secret,
-            {
-                "metadata": {"annotations": {"whatever": "foobar-account"}},
-                "type": "not-a-service-account-token",
-            },
-        ],
-    ) == [foobar_secret, foobar_secret]
-
-
-def test_openshift_serviceaccount_tokens__write_outputs_to_vault(
-    mocker: MockerFixture, ri: ResourceInventory
-) -> None:
-    vault_client = mocker.create_autospec(_VaultClient)
-
-    ri.add_desired(
-        cluster="cluster",
-        namespace="namespace",
-        resource_type="Secret",
-        name="name",
-        value=construct_sa_token_oc_resource("name", "token"),
-    )
-    write_outputs_to_vault(vault_client, "path/to/secrets", ri)
-    assert vault_client.write.call_count == 2
-    vault_client.write.assert_has_calls([
-        call({
-            "path": "path/to/secrets/openshift-serviceaccount-tokens/cluster/namespace/name",
-            "data": {"token": "token"},
-        }),
-        call({
-            "path": "path/to/secrets/openshift-serviceaccount-tokens/shared-resources/name",
-            "data": {"token": "token"},
-        }),
-    ])
-
-
-def test_openshift_serviceaccount_tokens__get_namespaces_with_serviceaccount_tokens(
-    namespaces: list[NamespaceV1],
-) -> None:
-    assert len(namespaces) == 3
-    assert namespaces[0].name == "with-openshift-serviceaccount-tokens"
-    assert namespaces[1].name == "with-shared-resources"
-    assert (
-        namespaces[2].name
-        == "with-openshift-serviceaccount-tokens-and-shared-resources"
-    )
-
-
-def test_openshift_serviceaccount_tokens__canonicalize_namespaces(
-    namespaces: list[NamespaceV1],
-) -> None:
-    nss = canonicalize_namespaces(namespaces)
-    # sort by number of tokens and namespace name
-    nss.sort(key=lambda n: f"{len(n.openshift_service_account_tokens or [])}-{n.name}")
-    assert len(nss) == 6
-
-    # added via remote service account token
-    assert nss[0].name == "observability"
-    assert nss[0].openshift_service_account_tokens is None
-    assert nss[1].name == "platform-changelog-stage"
-    assert nss[1].openshift_service_account_tokens is None
-    assert nss[2].name == "with-openshift-serviceaccount-tokens"
-    assert nss[2].openshift_service_account_tokens is None
-
-    # namespace with tokens or shared resources defined
-    assert nss[3].name == "with-shared-resources"
-    assert nss[3].cluster.name == "cluster"
-    assert len(nss[3].openshift_service_account_tokens or []) == 1
-
-    assert nss[4].name == "with-openshift-serviceaccount-tokens"
-    assert len(nss[4].openshift_service_account_tokens or []) == 2
-
-    assert nss[5].name == "with-openshift-serviceaccount-tokens-and-shared-resources"
-    assert len(nss[5].openshift_service_account_tokens or []) == 2
-
-
-def test_openshift_serviceaccount_tokens__fetch_desired_state(
-    mocker: MockerFixture, namespaces: list[NamespaceV1], ri: ResourceInventory
-) -> None:
-    grafana_secret = {
-        "metadata": {
-            "name": "grafana-secret",
-            "annotations": {"kubernetes.io/service-account.name": "grafana"},
-        },
-        "type": "kubernetes.io/service-account-token",
-        "data": {"token": "super-secret-token"},
-    }
-
-    oc_map = mocker.create_autospec(OC_Map)
-    oc = mocker.create_autospec(OCCli)
-    oc_map.get.return_value = oc
-    oc.get_items.return_value = [
-        grafana_secret,
-        {
-            "metadata": {
-                "name": "just-another-account-secret",
-                "annotations": {
-                    "kubernetes.io/service-account.name": "just-another-account"
-                },
-            },
-            "type": "kubernetes.io/service-account-token",
-        },
-        grafana_secret,
-        {
-            "metadata": {
-                "name": "just-something-different",
-                "annotations": {"whatever": "grafana"},
-            },
-            "type": "not-a-service-account-token",
-        },
-    ]
-    fetch_desired_state(
-        namespaces=namespaces,
-        ri=ri,
-        oc_map=oc_map,
-    )
-    assert (
-        len(
-            ri._clusters["cluster"]["with-openshift-serviceaccount-tokens"]["Secret"][
-                "desired"
-            ].keys()
-        )
-        == 2
-    )
-    assert (
-        len(
-            ri._clusters["cluster"][
-                "with-openshift-serviceaccount-tokens-and-shared-resources"
-            ]["Secret"]["desired"].keys()
-        )
-        == 1
-    )
-    assert (
-        "another-cluster-with-openshift-serviceaccount-tokens-grafana"
-        in ri._clusters["cluster"]["with-openshift-serviceaccount-tokens"]["Secret"][
-            "desired"
-        ]
-    )
-
-
-def test_openshift_serviceaccount_tokens__fetch_desired_state_create_token(
-    mocker: MockerFixture, namespaces: list[NamespaceV1], ri: ResourceInventory
-) -> None:
-    oc_map = mocker.create_autospec(OC_Map)
-    oc = mocker.create_autospec(OCCli)
-    oc_map.get.return_value = oc
-    oc.get_items.return_value = []
-
-    fetch_desired_state(
-        namespaces=[namespaces[0]],
-        ri=ri,
-        oc_map=oc_map,
-    )
-
-    assert (
-        len(
-            ri._clusters["cluster"]["with-openshift-serviceaccount-tokens"]["Secret"][
-                "desired"
-            ].keys()
-        )
-        == 1
-    )
-    r = next(
-        iter(
-            ri._clusters["cluster"]["with-openshift-serviceaccount-tokens"]["Secret"][
-                "desired"
-            ].values()
-        )
-    )
-    assert r.body["type"] == "kubernetes.io/service-account-token"
-
-
-def test_openshift_serviceaccount_tokens__service_account_token_request() -> None:
-    resource = service_account_token_request("grafana")
-    assert resource.name.startswith("grafana-")
-    assert resource.body["type"] == "kubernetes.io/service-account-token"
-    assert resource.kind == "Secret"
-    assert resource.integration != QONTRACT_INTEGRATION