qontract-reconcile 0.10.1rc1202__py3-none-any.whl → 0.10.2.dev1__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- qontract_reconcile-0.10.2.dev1.dist-info/METADATA +500 -0
- {qontract_reconcile-0.10.1rc1202.dist-info → qontract_reconcile-0.10.2.dev1.dist-info}/RECORD +12 -130
- {qontract_reconcile-0.10.1rc1202.dist-info → qontract_reconcile-0.10.2.dev1.dist-info}/WHEEL +1 -2
- {qontract_reconcile-0.10.1rc1202.dist-info → qontract_reconcile-0.10.2.dev1.dist-info}/entry_points.txt +1 -0
- reconcile/aws_account_manager/README.md +5 -0
- reconcile/change_owners/README.md +34 -0
- reconcile/glitchtip/README.md +150 -0
- reconcile/gql_definitions/introspection.json +51176 -0
- reconcile/run_integration.py +293 -0
- reconcile/utils/binary.py +2 -2
- reconcile/utils/mr/README.md +198 -0
- reconcile/utils/oc_map.py +2 -2
- tools/qontract_cli.py +0 -0
- qontract_reconcile-0.10.1rc1202.dist-info/METADATA +0 -64
- qontract_reconcile-0.10.1rc1202.dist-info/top_level.txt +0 -3
- reconcile/test/__init__.py +0 -0
- reconcile/test/conftest.py +0 -157
- reconcile/test/fixtures.py +0 -24
- reconcile/test/saas_auto_promotions_manager/__init__.py +0 -0
- reconcile/test/saas_auto_promotions_manager/conftest.py +0 -170
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/__init__.py +0 -0
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/__init__.py +0 -0
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/conftest.py +0 -115
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/data_keys.py +0 -19
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/test_desired_state.py +0 -66
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/test_merge_request_manager.py +0 -86
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/test_mr_parser.py +0 -352
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/merge_request_manager/test_reconciler.py +0 -494
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/renderer/__init__.py +0 -0
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/renderer/conftest.py +0 -25
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/renderer/test_content_multiple_namespaces.py +0 -37
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/renderer/test_content_single_namespace.py +0 -81
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/renderer/test_content_single_target.py +0 -61
- reconcile/test/saas_auto_promotions_manager/merge_request_manager/renderer/test_json_path_selector.py +0 -74
- reconcile/test/saas_auto_promotions_manager/test_integration_test.py +0 -52
- reconcile/test/saas_auto_promotions_manager/utils/__init__.py +0 -0
- reconcile/test/test_acs_notifiers.py +0 -393
- reconcile/test/test_acs_policies.py +0 -497
- reconcile/test/test_acs_rbac.py +0 -865
- reconcile/test/test_aggregated_list.py +0 -237
- reconcile/test/test_amtool.py +0 -37
- reconcile/test/test_aws_ami_cleanup.py +0 -230
- reconcile/test/test_aws_ami_share.py +0 -68
- reconcile/test/test_aws_cloudwatch_log_retention.py +0 -434
- reconcile/test/test_aws_iam_keys.py +0 -70
- reconcile/test/test_aws_iam_password_reset.py +0 -35
- reconcile/test/test_aws_support_cases_sos.py +0 -23
- reconcile/test/test_checkpoint.py +0 -178
- reconcile/test/test_cli.py +0 -41
- reconcile/test/test_closedbox_endpoint_monitoring.py +0 -207
- reconcile/test/test_dashdotdb_dora.py +0 -245
- reconcile/test/test_database_access_manager.py +0 -660
- reconcile/test/test_deadmanssnitch.py +0 -290
- reconcile/test/test_gabi_authorized_users.py +0 -72
- reconcile/test/test_gcr_mirror.py +0 -14
- reconcile/test/test_github_org.py +0 -156
- reconcile/test/test_github_repo_invites.py +0 -119
- reconcile/test/test_gitlab_housekeeping.py +0 -333
- reconcile/test/test_gitlab_labeler.py +0 -126
- reconcile/test/test_gitlab_members.py +0 -219
- reconcile/test/test_gitlab_permissions.py +0 -164
- reconcile/test/test_instrumented_wrappers.py +0 -18
- reconcile/test/test_integrations_manager.py +0 -1252
- reconcile/test/test_jenkins_worker_fleets.py +0 -57
- reconcile/test/test_jira_permissions_validator.py +0 -519
- reconcile/test/test_jump_host.py +0 -114
- reconcile/test/test_ldap_users.py +0 -125
- reconcile/test/test_make.py +0 -28
- reconcile/test/test_ocm_additional_routers.py +0 -133
- reconcile/test/test_ocm_clusters.py +0 -798
- reconcile/test/test_ocm_clusters_manifest_updates.py +0 -87
- reconcile/test/test_ocm_machine_pools.py +0 -1103
- reconcile/test/test_ocm_update_recommended_version.py +0 -145
- reconcile/test/test_ocm_upgrade_scheduler_org_updater.py +0 -125
- reconcile/test/test_openshift_base.py +0 -1269
- reconcile/test/test_openshift_cluster_bots.py +0 -240
- reconcile/test/test_openshift_namespace_labels.py +0 -344
- reconcile/test/test_openshift_namespaces.py +0 -256
- reconcile/test/test_openshift_resource.py +0 -443
- reconcile/test/test_openshift_resources_base.py +0 -478
- reconcile/test/test_openshift_saas_deploy.py +0 -188
- reconcile/test/test_openshift_saas_deploy_change_tester.py +0 -308
- reconcile/test/test_openshift_saas_deploy_trigger_cleaner.py +0 -65
- reconcile/test/test_openshift_serviceaccount_tokens.py +0 -282
- reconcile/test/test_openshift_tekton_resources.py +0 -265
- reconcile/test/test_openshift_upgrade_watcher.py +0 -223
- reconcile/test/test_prometheus_rules_tester.py +0 -151
- reconcile/test/test_quay_membership.py +0 -86
- reconcile/test/test_quay_mirror.py +0 -172
- reconcile/test/test_quay_mirror_org.py +0 -82
- reconcile/test/test_quay_repos.py +0 -59
- reconcile/test/test_queries.py +0 -53
- reconcile/test/test_repo_owners.py +0 -47
- reconcile/test/test_requests_sender.py +0 -139
- reconcile/test/test_saasherder.py +0 -1611
- reconcile/test/test_saasherder_allowed_secret_paths.py +0 -125
- reconcile/test/test_secret_reader.py +0 -153
- reconcile/test/test_slack_base.py +0 -183
- reconcile/test/test_slack_usergroups.py +0 -785
- reconcile/test/test_sql_query.py +0 -316
- reconcile/test/test_status_board.py +0 -258
- reconcile/test/test_terraform_aws_route53.py +0 -29
- reconcile/test/test_terraform_cloudflare_dns.py +0 -117
- reconcile/test/test_terraform_cloudflare_resources.py +0 -408
- reconcile/test/test_terraform_cloudflare_users.py +0 -747
- reconcile/test/test_terraform_repo.py +0 -440
- reconcile/test/test_terraform_resources.py +0 -519
- reconcile/test/test_terraform_tgw_attachments.py +0 -1295
- reconcile/test/test_terraform_users.py +0 -152
- reconcile/test/test_terraform_vpc_peerings.py +0 -576
- reconcile/test/test_terraform_vpc_peerings_build_desired_state.py +0 -1434
- reconcile/test/test_three_way_diff_strategy.py +0 -131
- reconcile/test/test_utils_jinja2.py +0 -130
- reconcile/test/test_vault_replication.py +0 -534
- reconcile/test/test_vault_utils.py +0 -47
- reconcile/test/test_version_bump.py +0 -18
- reconcile/test/test_vpc_peerings_validator.py +0 -194
- reconcile/test/test_wrong_region.py +0 -78
- release/__init__.py +0 -0
- release/test_version.py +0 -50
- release/version.py +0 -104
- tools/cli_commands/test/__init__.py +0 -0
- tools/cli_commands/test/conftest.py +0 -332
- tools/cli_commands/test/test_aws_cost_report.py +0 -258
- tools/cli_commands/test/test_cost_management_api.py +0 -326
- tools/cli_commands/test/test_gpg_encrypt.py +0 -235
- tools/cli_commands/test/test_openshift_cost_optimization_report.py +0 -255
- tools/cli_commands/test/test_openshift_cost_report.py +0 -295
- tools/cli_commands/test/test_util.py +0 -70
- tools/test/__init__.py +0 -0
- tools/test/conftest.py +0 -77
- tools/test/test_app_interface_metrics_exporter.py +0 -48
- tools/test/test_erv2.py +0 -80
- tools/test/test_get_container_images.py +0 -230
- tools/test/test_qontract_cli.py +0 -197
- tools/test/test_saas_promotion_state.py +0 -187
- tools/test/test_sd_app_sre_alert_report.py +0 -74
- tools/test/test_sre_checkpoints.py +0 -79
@@ -1,747 +0,0 @@
|
|
1
|
-
from typing import Any
|
2
|
-
from unittest.mock import (
|
3
|
-
call,
|
4
|
-
mock_open,
|
5
|
-
)
|
6
|
-
|
7
|
-
import pytest
|
8
|
-
|
9
|
-
from reconcile import terraform_cloudflare_users
|
10
|
-
from reconcile.gql_definitions.fragments.vault_secret import VaultSecret
|
11
|
-
from reconcile.gql_definitions.terraform_cloudflare_users.app_interface_setting_cloudflare_and_vault import (
|
12
|
-
AppInterfaceSettingCloudflareAndVaultQueryData,
|
13
|
-
AppInterfaceSettingsV1,
|
14
|
-
)
|
15
|
-
from reconcile.gql_definitions.terraform_cloudflare_users.terraform_cloudflare_roles import (
|
16
|
-
AWSAccountV1,
|
17
|
-
AWSTerraformStateIntegrationsV1,
|
18
|
-
CloudflareAccountRoleQueryData,
|
19
|
-
CloudflareAccountRoleV1,
|
20
|
-
CloudflareAccountV1,
|
21
|
-
RoleV1,
|
22
|
-
TerraformStateAWSV1,
|
23
|
-
UserV1,
|
24
|
-
)
|
25
|
-
from reconcile.terraform_cloudflare_users import (
|
26
|
-
QONTRACT_INTEGRATION,
|
27
|
-
QONTRACT_INTEGRATION_VERSION,
|
28
|
-
QONTRACT_TF_PREFIX,
|
29
|
-
CloudflareUser,
|
30
|
-
TerraformCloudflareUsersParams,
|
31
|
-
build_external_resource_spec_from_cloudflare_users,
|
32
|
-
get_cloudflare_users,
|
33
|
-
)
|
34
|
-
from reconcile.utils.external_resource_spec import ExternalResourceSpec
|
35
|
-
from reconcile.utils.secret_reader import SecretReaderBase
|
36
|
-
|
37
|
-
|
38
|
-
@pytest.fixture
|
39
|
-
def query_data_with_one_role_one_user():
|
40
|
-
return CloudflareAccountRoleQueryData(
|
41
|
-
cloudflare_account_roles=[
|
42
|
-
CloudflareAccountRoleV1(
|
43
|
-
name="cloudflare-account-administrator",
|
44
|
-
roles=["Administrator"],
|
45
|
-
access_roles=[
|
46
|
-
RoleV1(
|
47
|
-
users=[
|
48
|
-
UserV1(
|
49
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
50
|
-
)
|
51
|
-
]
|
52
|
-
)
|
53
|
-
],
|
54
|
-
account=CloudflareAccountV1(
|
55
|
-
name="cloudflare-account",
|
56
|
-
providerVersion="3.19",
|
57
|
-
apiCredentials=VaultSecret(
|
58
|
-
path="creds", field="some-field", version=None, format=None
|
59
|
-
),
|
60
|
-
terraformStateAccount=AWSAccountV1(
|
61
|
-
name="aws-account",
|
62
|
-
automationToken=VaultSecret(
|
63
|
-
path="some-path",
|
64
|
-
field="some-field",
|
65
|
-
version=None,
|
66
|
-
format=None,
|
67
|
-
),
|
68
|
-
terraformState=TerraformStateAWSV1(
|
69
|
-
provider="s3",
|
70
|
-
bucket="app-interface",
|
71
|
-
region="us-east-1",
|
72
|
-
integrations=[
|
73
|
-
AWSTerraformStateIntegrationsV1(
|
74
|
-
integration="terraform-cloudflare-users",
|
75
|
-
key="some-key.tfstate",
|
76
|
-
)
|
77
|
-
],
|
78
|
-
),
|
79
|
-
),
|
80
|
-
enforceTwofactor=True,
|
81
|
-
type="enterprise",
|
82
|
-
),
|
83
|
-
)
|
84
|
-
]
|
85
|
-
)
|
86
|
-
|
87
|
-
|
88
|
-
@pytest.fixture
|
89
|
-
def query_data_with_one_role_two_users():
|
90
|
-
return CloudflareAccountRoleQueryData(
|
91
|
-
cloudflare_account_roles=[
|
92
|
-
CloudflareAccountRoleV1(
|
93
|
-
name="cloudflare-account-administrator",
|
94
|
-
roles=["Administrator"],
|
95
|
-
access_roles=[
|
96
|
-
RoleV1(
|
97
|
-
users=[
|
98
|
-
UserV1(
|
99
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
100
|
-
),
|
101
|
-
UserV1(
|
102
|
-
org_username="user2", cloudflare_user="user2@redhat.com"
|
103
|
-
),
|
104
|
-
]
|
105
|
-
)
|
106
|
-
],
|
107
|
-
account=CloudflareAccountV1(
|
108
|
-
name="cloudflare-account",
|
109
|
-
providerVersion="3.19",
|
110
|
-
apiCredentials=VaultSecret(
|
111
|
-
path="creds", field="some-field", version=None, format=None
|
112
|
-
),
|
113
|
-
terraformStateAccount=AWSAccountV1(
|
114
|
-
name="aws-account",
|
115
|
-
automationToken=VaultSecret(
|
116
|
-
path="some-path",
|
117
|
-
field="some-field",
|
118
|
-
version=None,
|
119
|
-
format=None,
|
120
|
-
),
|
121
|
-
terraformState=TerraformStateAWSV1(
|
122
|
-
provider="s3",
|
123
|
-
bucket="app-interface",
|
124
|
-
region="us-east-1",
|
125
|
-
integrations=[
|
126
|
-
AWSTerraformStateIntegrationsV1(
|
127
|
-
integration="terraform-cloudflare-users",
|
128
|
-
key="some-key.tfstate",
|
129
|
-
)
|
130
|
-
],
|
131
|
-
),
|
132
|
-
),
|
133
|
-
enforceTwofactor=True,
|
134
|
-
type="enterprise",
|
135
|
-
),
|
136
|
-
)
|
137
|
-
]
|
138
|
-
)
|
139
|
-
|
140
|
-
|
141
|
-
@pytest.fixture
|
142
|
-
def query_data_with_two_roles_from_same_account_one_user():
|
143
|
-
return CloudflareAccountRoleQueryData(
|
144
|
-
cloudflare_account_roles=[
|
145
|
-
CloudflareAccountRoleV1(
|
146
|
-
name="cloudflare-account-administrator",
|
147
|
-
roles=["Administrator"],
|
148
|
-
access_roles=[
|
149
|
-
RoleV1(
|
150
|
-
users=[
|
151
|
-
UserV1(
|
152
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
153
|
-
)
|
154
|
-
]
|
155
|
-
)
|
156
|
-
],
|
157
|
-
account=CloudflareAccountV1(
|
158
|
-
name="cloudflare-account",
|
159
|
-
providerVersion="3.19",
|
160
|
-
apiCredentials=VaultSecret(
|
161
|
-
path="creds", field="some-field", version=None, format=None
|
162
|
-
),
|
163
|
-
terraformStateAccount=AWSAccountV1(
|
164
|
-
name="aws-account",
|
165
|
-
automationToken=VaultSecret(
|
166
|
-
path="some-path",
|
167
|
-
field="some-field",
|
168
|
-
version=None,
|
169
|
-
format=None,
|
170
|
-
),
|
171
|
-
terraformState=TerraformStateAWSV1(
|
172
|
-
provider="s3",
|
173
|
-
bucket="app-interface",
|
174
|
-
region="us-east-1",
|
175
|
-
integrations=[
|
176
|
-
AWSTerraformStateIntegrationsV1(
|
177
|
-
integration="terraform-cloudflare-users",
|
178
|
-
key="some-key.tfstate",
|
179
|
-
)
|
180
|
-
],
|
181
|
-
),
|
182
|
-
),
|
183
|
-
enforceTwofactor=True,
|
184
|
-
type="enterprise",
|
185
|
-
),
|
186
|
-
),
|
187
|
-
CloudflareAccountRoleV1(
|
188
|
-
name="cloudflare-account-administrator-read-only",
|
189
|
-
roles=["Administrator Read Only"],
|
190
|
-
access_roles=[
|
191
|
-
RoleV1(
|
192
|
-
users=[
|
193
|
-
UserV1(
|
194
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
195
|
-
)
|
196
|
-
]
|
197
|
-
)
|
198
|
-
],
|
199
|
-
account=CloudflareAccountV1(
|
200
|
-
name="cloudflare-account",
|
201
|
-
providerVersion="3.19",
|
202
|
-
apiCredentials=VaultSecret(
|
203
|
-
path="creds", field="some-field", version=None, format=None
|
204
|
-
),
|
205
|
-
terraformStateAccount=AWSAccountV1(
|
206
|
-
name="aws-account",
|
207
|
-
automationToken=VaultSecret(
|
208
|
-
path="some-path",
|
209
|
-
field="some-field",
|
210
|
-
version=None,
|
211
|
-
format=None,
|
212
|
-
),
|
213
|
-
terraformState=TerraformStateAWSV1(
|
214
|
-
provider="s3",
|
215
|
-
bucket="app-interface",
|
216
|
-
region="us-east-1",
|
217
|
-
integrations=[
|
218
|
-
AWSTerraformStateIntegrationsV1(
|
219
|
-
integration="terraform-cloudflare-users",
|
220
|
-
key="some-key.tfstate",
|
221
|
-
)
|
222
|
-
],
|
223
|
-
),
|
224
|
-
),
|
225
|
-
enforceTwofactor=True,
|
226
|
-
type="enterprise",
|
227
|
-
),
|
228
|
-
),
|
229
|
-
]
|
230
|
-
)
|
231
|
-
|
232
|
-
|
233
|
-
@pytest.fixture
|
234
|
-
def query_data_with_two_roles_from_different_account_one_user():
|
235
|
-
return CloudflareAccountRoleQueryData(
|
236
|
-
cloudflare_account_roles=[
|
237
|
-
CloudflareAccountRoleV1(
|
238
|
-
name="cloudflare-account-administrator",
|
239
|
-
roles=["Administrator"],
|
240
|
-
access_roles=[
|
241
|
-
RoleV1(
|
242
|
-
users=[
|
243
|
-
UserV1(
|
244
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
245
|
-
)
|
246
|
-
]
|
247
|
-
)
|
248
|
-
],
|
249
|
-
account=CloudflareAccountV1(
|
250
|
-
name="cloudflare-account-1",
|
251
|
-
providerVersion="3.19",
|
252
|
-
apiCredentials=VaultSecret(
|
253
|
-
path="creds-1", field="some-field-1", version=None, format=None
|
254
|
-
),
|
255
|
-
terraformStateAccount=AWSAccountV1(
|
256
|
-
name="aws-account-1",
|
257
|
-
automationToken=VaultSecret(
|
258
|
-
path="some-path-1",
|
259
|
-
field="some-field-1",
|
260
|
-
version=None,
|
261
|
-
format=None,
|
262
|
-
),
|
263
|
-
terraformState=TerraformStateAWSV1(
|
264
|
-
provider="s3",
|
265
|
-
bucket="app-interface",
|
266
|
-
region="us-east-1",
|
267
|
-
integrations=[
|
268
|
-
AWSTerraformStateIntegrationsV1(
|
269
|
-
integration="terraform-cloudflare-users",
|
270
|
-
key="some-key.tfstate",
|
271
|
-
)
|
272
|
-
],
|
273
|
-
),
|
274
|
-
),
|
275
|
-
enforceTwofactor=True,
|
276
|
-
type="enterprise",
|
277
|
-
),
|
278
|
-
),
|
279
|
-
CloudflareAccountRoleV1(
|
280
|
-
name="cloudflare-account-administrator-read-only",
|
281
|
-
roles=["Administrator Read Only"],
|
282
|
-
access_roles=[
|
283
|
-
RoleV1(
|
284
|
-
users=[
|
285
|
-
UserV1(
|
286
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
287
|
-
)
|
288
|
-
]
|
289
|
-
)
|
290
|
-
],
|
291
|
-
account=CloudflareAccountV1(
|
292
|
-
name="cloudflare-account-2",
|
293
|
-
providerVersion="3.19",
|
294
|
-
apiCredentials=VaultSecret(
|
295
|
-
path="creds-2", field="some-field-2", version=None, format=None
|
296
|
-
),
|
297
|
-
terraformStateAccount=AWSAccountV1(
|
298
|
-
name="aws-account-2",
|
299
|
-
automationToken=VaultSecret(
|
300
|
-
path="some-path-2",
|
301
|
-
field="some-field-2",
|
302
|
-
version=None,
|
303
|
-
format=None,
|
304
|
-
),
|
305
|
-
terraformState=TerraformStateAWSV1(
|
306
|
-
provider="s3",
|
307
|
-
bucket="app-interface",
|
308
|
-
region="us-east-1",
|
309
|
-
integrations=[
|
310
|
-
AWSTerraformStateIntegrationsV1(
|
311
|
-
integration="terraform-cloudflare-users",
|
312
|
-
key="some-key.tfstate",
|
313
|
-
)
|
314
|
-
],
|
315
|
-
),
|
316
|
-
),
|
317
|
-
enforceTwofactor=True,
|
318
|
-
type="enterprise",
|
319
|
-
),
|
320
|
-
),
|
321
|
-
]
|
322
|
-
)
|
323
|
-
|
324
|
-
|
325
|
-
@pytest.fixture
|
326
|
-
def query_data_with_two_roles_from_different_account_two_users():
|
327
|
-
return CloudflareAccountRoleQueryData(
|
328
|
-
cloudflare_account_roles=[
|
329
|
-
CloudflareAccountRoleV1(
|
330
|
-
name="cloudflare-account-administrator",
|
331
|
-
roles=["Administrator"],
|
332
|
-
access_roles=[
|
333
|
-
RoleV1(
|
334
|
-
users=[
|
335
|
-
UserV1(
|
336
|
-
org_username="user1", cloudflare_user="user1@redhat.com"
|
337
|
-
)
|
338
|
-
]
|
339
|
-
)
|
340
|
-
],
|
341
|
-
account=CloudflareAccountV1(
|
342
|
-
name="cloudflare-account-1",
|
343
|
-
providerVersion="3.19",
|
344
|
-
apiCredentials=VaultSecret(
|
345
|
-
path="creds-1", field="some-field-1", version=None, format=None
|
346
|
-
),
|
347
|
-
terraformStateAccount=AWSAccountV1(
|
348
|
-
name="aws-account-1",
|
349
|
-
automationToken=VaultSecret(
|
350
|
-
path="some-path-1",
|
351
|
-
field="some-field-1",
|
352
|
-
version=None,
|
353
|
-
format=None,
|
354
|
-
),
|
355
|
-
terraformState=TerraformStateAWSV1(
|
356
|
-
provider="s3",
|
357
|
-
bucket="app-interface",
|
358
|
-
region="us-east-1",
|
359
|
-
integrations=[
|
360
|
-
AWSTerraformStateIntegrationsV1(
|
361
|
-
integration="terraform-cloudflare-users",
|
362
|
-
key="some-key.tfstate",
|
363
|
-
)
|
364
|
-
],
|
365
|
-
),
|
366
|
-
),
|
367
|
-
enforceTwofactor=True,
|
368
|
-
type="enterprise",
|
369
|
-
),
|
370
|
-
),
|
371
|
-
CloudflareAccountRoleV1(
|
372
|
-
name="cloudflare-account-administrator-read-only",
|
373
|
-
roles=["Administrator Read Only"],
|
374
|
-
access_roles=[
|
375
|
-
RoleV1(
|
376
|
-
users=[
|
377
|
-
UserV1(
|
378
|
-
org_username="user2", cloudflare_user="user2@redhat.com"
|
379
|
-
)
|
380
|
-
]
|
381
|
-
)
|
382
|
-
],
|
383
|
-
account=CloudflareAccountV1(
|
384
|
-
name="cloudflare-account-2",
|
385
|
-
providerVersion="3.19",
|
386
|
-
apiCredentials=VaultSecret(
|
387
|
-
path="creds-2", field="some-field-2", version=None, format=None
|
388
|
-
),
|
389
|
-
terraformStateAccount=AWSAccountV1(
|
390
|
-
name="aws-account-2",
|
391
|
-
automationToken=VaultSecret(
|
392
|
-
path="some-path-2",
|
393
|
-
field="some-field-2",
|
394
|
-
version=None,
|
395
|
-
format=None,
|
396
|
-
),
|
397
|
-
terraformState=TerraformStateAWSV1(
|
398
|
-
provider="s3",
|
399
|
-
bucket="app-interface",
|
400
|
-
region="us-east-1",
|
401
|
-
integrations=[
|
402
|
-
AWSTerraformStateIntegrationsV1(
|
403
|
-
integration="terraform-cloudflare-users",
|
404
|
-
key="some-key.tfstate",
|
405
|
-
)
|
406
|
-
],
|
407
|
-
),
|
408
|
-
),
|
409
|
-
enforceTwofactor=True,
|
410
|
-
type="enterprise",
|
411
|
-
),
|
412
|
-
),
|
413
|
-
]
|
414
|
-
)
|
415
|
-
|
416
|
-
|
417
|
-
@pytest.fixture
|
418
|
-
def app_interface_settings_cloudflare_and_vault():
|
419
|
-
return AppInterfaceSettingCloudflareAndVaultQueryData(
|
420
|
-
settings=[
|
421
|
-
AppInterfaceSettingsV1(
|
422
|
-
cloudflareEmailDomainAllowList=["redhat.com"], vault=True
|
423
|
-
)
|
424
|
-
]
|
425
|
-
)
|
426
|
-
|
427
|
-
|
428
|
-
def secret_reader_side_effect(*args):
|
429
|
-
if args[0] == {
|
430
|
-
"path": "some-path",
|
431
|
-
"field": "some-field",
|
432
|
-
"version": None,
|
433
|
-
"q_format": None,
|
434
|
-
}:
|
435
|
-
aws_acct_creds = {}
|
436
|
-
aws_acct_creds["aws_access_key_id"] = "key_id"
|
437
|
-
aws_acct_creds["aws_secret_access_key"] = "access_key"
|
438
|
-
return aws_acct_creds
|
439
|
-
|
440
|
-
if args[0] == {
|
441
|
-
"path": "creds",
|
442
|
-
"field": "some-field",
|
443
|
-
"version": None,
|
444
|
-
"q_format": None,
|
445
|
-
}:
|
446
|
-
cf_acct_creds = {}
|
447
|
-
cf_acct_creds["api_token"] = "api_token"
|
448
|
-
cf_acct_creds["account_id"] = "account_id"
|
449
|
-
return cf_acct_creds
|
450
|
-
|
451
|
-
|
452
|
-
@pytest.fixture
|
453
|
-
def secret_reader(mocker):
|
454
|
-
secret_reader = mocker.Mock(spec=SecretReaderBase)
|
455
|
-
secret_reader.read_all_secret.side_effect = secret_reader_side_effect
|
456
|
-
|
457
|
-
mocked_secret_reader = mocker.patch(
|
458
|
-
"reconcile.terraform_cloudflare_users.create_secret_reader", autospec=True
|
459
|
-
)
|
460
|
-
mocked_secret_reader.return_value = secret_reader
|
461
|
-
|
462
|
-
return mocked_secret_reader
|
463
|
-
|
464
|
-
|
465
|
-
def test_terraform_cloudflare_users(
|
466
|
-
mocker,
|
467
|
-
secret_reader,
|
468
|
-
query_data_with_one_role_one_user,
|
469
|
-
app_interface_settings_cloudflare_and_vault,
|
470
|
-
):
|
471
|
-
# Used to mock out file system dependency within TerrascriptCloudflareClient
|
472
|
-
mock_builtins_open = mock_open()
|
473
|
-
mocker.patch("builtins.open", mock_builtins_open)
|
474
|
-
patch_mkdtemp = mocker.patch("tempfile.mkdtemp")
|
475
|
-
tf_directory = "/tmp/test"
|
476
|
-
patch_mkdtemp.return_value = tf_directory
|
477
|
-
|
478
|
-
mocker.patch("reconcile.terraform_cloudflare_users.gql", autospec=True)
|
479
|
-
|
480
|
-
query_data = mocker.patch(
|
481
|
-
"reconcile.terraform_cloudflare_users.terraform_cloudflare_roles", autospec=True
|
482
|
-
)
|
483
|
-
|
484
|
-
query_data.query.return_value = query_data_with_one_role_one_user
|
485
|
-
|
486
|
-
settings = mocker.patch(
|
487
|
-
"reconcile.terraform_cloudflare_users.app_interface_setting_cloudflare_and_vault",
|
488
|
-
autospec=True,
|
489
|
-
)
|
490
|
-
settings.query.return_value = app_interface_settings_cloudflare_and_vault
|
491
|
-
|
492
|
-
mocked_terraform_client = mocker.patch(
|
493
|
-
"reconcile.terraform_cloudflare_users.TerraformClient", autospec=True
|
494
|
-
)
|
495
|
-
mocked_terraform_client.return_value.plan.return_value = False, None
|
496
|
-
params = TerraformCloudflareUsersParams(
|
497
|
-
print_to_file=None,
|
498
|
-
account_name="cloudflare-account",
|
499
|
-
thread_pool_size=20,
|
500
|
-
enable_deletion=True,
|
501
|
-
)
|
502
|
-
dry_run = True
|
503
|
-
integration = terraform_cloudflare_users.TerraformCloudflareUsers(params=params)
|
504
|
-
|
505
|
-
integration.run(dry_run)
|
506
|
-
|
507
|
-
expected_call_args = call(
|
508
|
-
QONTRACT_INTEGRATION,
|
509
|
-
QONTRACT_INTEGRATION_VERSION,
|
510
|
-
QONTRACT_TF_PREFIX,
|
511
|
-
[
|
512
|
-
{
|
513
|
-
"name": "cloudflare-account",
|
514
|
-
"providerVersion": "3.19",
|
515
|
-
"apiCredentials": {
|
516
|
-
"path": "creds",
|
517
|
-
"field": "some-field",
|
518
|
-
"version": None,
|
519
|
-
"format": None,
|
520
|
-
},
|
521
|
-
"terraformStateAccount": {
|
522
|
-
"name": "aws-account",
|
523
|
-
"automationToken": {
|
524
|
-
"path": "some-path",
|
525
|
-
"field": "some-field",
|
526
|
-
"version": None,
|
527
|
-
"format": None,
|
528
|
-
},
|
529
|
-
"terraformState": {
|
530
|
-
"provider": "s3",
|
531
|
-
"bucket": "app-interface",
|
532
|
-
"region": "us-east-1",
|
533
|
-
"integrations": [
|
534
|
-
{
|
535
|
-
"integration": "terraform-cloudflare-users",
|
536
|
-
"key": "some-key.tfstate",
|
537
|
-
}
|
538
|
-
],
|
539
|
-
},
|
540
|
-
},
|
541
|
-
"enforceTwofactor": True,
|
542
|
-
"type": "enterprise",
|
543
|
-
}
|
544
|
-
],
|
545
|
-
{"cloudflare-account": tf_directory},
|
546
|
-
params.thread_pool_size,
|
547
|
-
)
|
548
|
-
assert mocked_terraform_client.called
|
549
|
-
assert mocked_terraform_client.call_args == expected_call_args
|
550
|
-
assert call().apply() not in mocked_terraform_client.method_calls
|
551
|
-
|
552
|
-
|
553
|
-
def test_get_cloudflare_users_without_email_domain_allow_list(
|
554
|
-
query_data_with_one_role_one_user,
|
555
|
-
):
|
556
|
-
actual_users = get_cloudflare_users(
|
557
|
-
query_data_with_one_role_one_user.cloudflare_account_roles, None, None
|
558
|
-
)
|
559
|
-
expected_users: dict[str, dict[str, Any]] = {}
|
560
|
-
assert actual_users == expected_users
|
561
|
-
|
562
|
-
|
563
|
-
def test_get_cloudflare_users_with_one_role_one_user(query_data_with_one_role_one_user):
|
564
|
-
actual_users = get_cloudflare_users(
|
565
|
-
query_data_with_one_role_one_user.cloudflare_account_roles,
|
566
|
-
None,
|
567
|
-
["redhat.com"],
|
568
|
-
)
|
569
|
-
expected_users = {
|
570
|
-
"cloudflare-account": {
|
571
|
-
"user1@redhat.com": CloudflareUser(
|
572
|
-
email_address="user1@redhat.com",
|
573
|
-
account_name="cloudflare-account",
|
574
|
-
org_username="user1",
|
575
|
-
roles={"Administrator"},
|
576
|
-
)
|
577
|
-
}
|
578
|
-
}
|
579
|
-
assert actual_users == expected_users
|
580
|
-
|
581
|
-
|
582
|
-
def test_get_cloudflare_users_with_one_role_two_users(
|
583
|
-
query_data_with_one_role_two_users,
|
584
|
-
):
|
585
|
-
actual_users = get_cloudflare_users(
|
586
|
-
query_data_with_one_role_two_users.cloudflare_account_roles,
|
587
|
-
None,
|
588
|
-
["redhat.com"],
|
589
|
-
)
|
590
|
-
expected_users = {
|
591
|
-
"cloudflare-account": {
|
592
|
-
"user1@redhat.com": CloudflareUser(
|
593
|
-
email_address="user1@redhat.com",
|
594
|
-
account_name="cloudflare-account",
|
595
|
-
org_username="user1",
|
596
|
-
roles={"Administrator"},
|
597
|
-
),
|
598
|
-
"user2@redhat.com": CloudflareUser(
|
599
|
-
email_address="user2@redhat.com",
|
600
|
-
account_name="cloudflare-account",
|
601
|
-
org_username="user2",
|
602
|
-
roles={"Administrator"},
|
603
|
-
),
|
604
|
-
}
|
605
|
-
}
|
606
|
-
assert actual_users == expected_users
|
607
|
-
|
608
|
-
|
609
|
-
def test_get_cloudflare_users_with_two_roles_from_same_account_one_user(
|
610
|
-
query_data_with_two_roles_from_same_account_one_user,
|
611
|
-
):
|
612
|
-
actual_users = get_cloudflare_users(
|
613
|
-
query_data_with_two_roles_from_same_account_one_user.cloudflare_account_roles,
|
614
|
-
None,
|
615
|
-
["redhat.com"],
|
616
|
-
)
|
617
|
-
|
618
|
-
expected_users = {
|
619
|
-
"cloudflare-account": {
|
620
|
-
"user1@redhat.com": CloudflareUser(
|
621
|
-
email_address="user1@redhat.com",
|
622
|
-
account_name="cloudflare-account",
|
623
|
-
org_username="user1",
|
624
|
-
roles={"Administrator", "Administrator Read Only"},
|
625
|
-
)
|
626
|
-
}
|
627
|
-
}
|
628
|
-
assert actual_users == expected_users
|
629
|
-
|
630
|
-
|
631
|
-
def test_get_cloudflare_users_with_two_roles_from_different_account_one_user(
|
632
|
-
query_data_with_two_roles_from_different_account_one_user,
|
633
|
-
):
|
634
|
-
actual_users = get_cloudflare_users(
|
635
|
-
query_data_with_two_roles_from_different_account_one_user.cloudflare_account_roles,
|
636
|
-
None,
|
637
|
-
["redhat.com"],
|
638
|
-
)
|
639
|
-
|
640
|
-
expected_users = {
|
641
|
-
"cloudflare-account-1": {
|
642
|
-
"user1@redhat.com": CloudflareUser(
|
643
|
-
email_address="user1@redhat.com",
|
644
|
-
account_name="cloudflare-account-1",
|
645
|
-
org_username="user1",
|
646
|
-
roles={"Administrator"},
|
647
|
-
)
|
648
|
-
},
|
649
|
-
"cloudflare-account-2": {
|
650
|
-
"user1@redhat.com": CloudflareUser(
|
651
|
-
email_address="user1@redhat.com",
|
652
|
-
account_name="cloudflare-account-2",
|
653
|
-
org_username="user1",
|
654
|
-
roles={"Administrator Read Only"},
|
655
|
-
)
|
656
|
-
},
|
657
|
-
}
|
658
|
-
|
659
|
-
assert actual_users == expected_users
|
660
|
-
|
661
|
-
|
662
|
-
def test_external_spec_with_two_roles_from_different_account_one_user(
|
663
|
-
query_data_with_two_roles_from_different_account_two_users,
|
664
|
-
):
|
665
|
-
actual_users = get_cloudflare_users(
|
666
|
-
query_data_with_two_roles_from_different_account_two_users.cloudflare_account_roles,
|
667
|
-
None,
|
668
|
-
["redhat.com"],
|
669
|
-
)
|
670
|
-
|
671
|
-
expected_users = {
|
672
|
-
"cloudflare-account-1": {
|
673
|
-
"user1@redhat.com": CloudflareUser(
|
674
|
-
email_address="user1@redhat.com",
|
675
|
-
account_name="cloudflare-account-1",
|
676
|
-
org_username="user1",
|
677
|
-
roles={"Administrator"},
|
678
|
-
)
|
679
|
-
},
|
680
|
-
"cloudflare-account-2": {
|
681
|
-
"user2@redhat.com": CloudflareUser(
|
682
|
-
email_address="user2@redhat.com",
|
683
|
-
account_name="cloudflare-account-2",
|
684
|
-
org_username="user2",
|
685
|
-
roles={"Administrator Read Only"},
|
686
|
-
)
|
687
|
-
},
|
688
|
-
}
|
689
|
-
|
690
|
-
assert actual_users == expected_users
|
691
|
-
|
692
|
-
|
693
|
-
def test_build_external_resource_spec_from_cloudflare_users(
|
694
|
-
query_data_with_two_roles_from_same_account_one_user,
|
695
|
-
):
|
696
|
-
users = get_cloudflare_users(
|
697
|
-
query_data_with_two_roles_from_same_account_one_user.cloudflare_account_roles,
|
698
|
-
None,
|
699
|
-
["redhat.com"],
|
700
|
-
)
|
701
|
-
|
702
|
-
actual_specs = build_external_resource_spec_from_cloudflare_users(users)
|
703
|
-
|
704
|
-
expected_spec = ExternalResourceSpec(
|
705
|
-
provision_provider="cloudflare",
|
706
|
-
provisioner={"name": "cloudflare-account"},
|
707
|
-
resource={
|
708
|
-
"provider": "account_member",
|
709
|
-
"identifier": "user1",
|
710
|
-
"email_address": "user1@redhat.com",
|
711
|
-
"status": "accepted",
|
712
|
-
"account_id": "${var.account_id}",
|
713
|
-
"role_ids": [
|
714
|
-
'%{ for role in data.cloudflare_account_roles.cloudflare-account.roles ~} %{if role.name == "Administrator" ~}${role.id}%{ endif ~} %{ endfor ~}',
|
715
|
-
'%{ for role in data.cloudflare_account_roles.cloudflare-account.roles ~} %{if role.name == "Administrator Read Only" ~}${role.id}%{ endif ~} %{ endfor ~}',
|
716
|
-
],
|
717
|
-
"cloudflare_account_roles": {
|
718
|
-
"identifier": "cloudflare-account",
|
719
|
-
"account_id": "${var.account_id}",
|
720
|
-
},
|
721
|
-
},
|
722
|
-
namespace={},
|
723
|
-
)
|
724
|
-
|
725
|
-
count = 0
|
726
|
-
for spec in actual_specs:
|
727
|
-
count += 1
|
728
|
-
actual_spec = spec
|
729
|
-
|
730
|
-
assert count == 1
|
731
|
-
|
732
|
-
# Doing comparison manual way as resource.role_ids is a set of unique values which is not taken into consideration
|
733
|
-
# while using equal(==) comparison operator with pure dictionary
|
734
|
-
assert actual_spec.provision_provider == expected_spec.provision_provider
|
735
|
-
assert actual_spec.provisioner == expected_spec.provisioner
|
736
|
-
assert actual_spec.namespace == expected_spec.namespace
|
737
|
-
assert actual_spec.secret == expected_spec.secret
|
738
|
-
|
739
|
-
actual_resource = actual_spec.resource
|
740
|
-
expected_resource = expected_spec.resource
|
741
|
-
|
742
|
-
actual_role_ids = actual_resource.pop("role_ids")
|
743
|
-
expected_role_ids = expected_resource.pop("role_ids")
|
744
|
-
|
745
|
-
assert actual_resource == expected_resource
|
746
|
-
|
747
|
-
assert set(actual_role_ids) == set(expected_role_ids)
|