qontract-reconcile 0.10.1rc402__py3-none-any.whl → 0.10.1rc403__py3-none-any.whl

{qontract_reconcile-0.10.1rc402.dist-info → qontract_reconcile-0.10.1rc403.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc402
+Version: 0.10.1rc403
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc402.dist-info → qontract_reconcile-0.10.1rc403.dist-info}/RECORD

@@ -7,7 +7,7 @@ reconcile/aws_iam_password_reset.py,sha256=NwErtrqgBiXr7eGCAHdtGGOx0S7-4JnSc29Ie
 reconcile/aws_support_cases_sos.py,sha256=i6bSWnlH9fh14P14PjVhFLwNl-q3fD733_rXKM_O51c,2992
 reconcile/blackbox_exporter_endpoint_monitoring.py,sha256=W_VJagnsJR1v5oqjlI3RJJE0_nhtJ0m81RS8zWA5u5c,3538
 reconcile/checkpoint.py,sha256=figtZRuWUvdpdSnkhAqeGvO5dI02TT6J3heyeFhlwqM,5016
-reconcile/cli.py,sha256=AYkCf2D4jENSkiJmpNzc6cVv_mlcIUc7k7Mli3vgtZA,79614
+reconcile/cli.py,sha256=QEKbka04dATCDawHz2_Xs5tkGWHQ7Hs-YZ-E-JzOQ84,79955
 reconcile/closedbox_endpoint_monitoring_base.py,sha256=GmEdDSp9yBnwpzzrla6VJfhOZd_qxYh-xtIN5bXjOBo,4909
 reconcile/cluster_deployment_mapper.py,sha256=2Ah-nu-Mdig0pjuiZl_XLrmVAjYzFjORR3dMlCgkmw0,2352
 reconcile/dashdotdb_base.py,sha256=13s9B8iIqSwu-rS-95QbIMPue_Gli3YMNBct5QjmrVo,4525
@@ -15,6 +15,7 @@ reconcile/dashdotdb_cso.py,sha256=FoXrWGpOwXG5jf0eklN84tjJVUAYzKat7rtq_28JMlQ,36
 reconcile/dashdotdb_dora.py,sha256=FINH-8dU3_r8EgUOMiF_fbxD9fKs6LFDxe6rufQ9XcM,17214
 reconcile/dashdotdb_dvo.py,sha256=YXqpI6fBQAql-ybGI0grj9gWMzmKiAvPE__pNju6obk,8996
 reconcile/dashdotdb_slo.py,sha256=oiWMehzU5wTk2AkYmOzD34vCvIFKCzuy0WDLrA3Kjzc,5823
+reconcile/database_access_manager.py,sha256=2I__xR2VzvbF5VdRXCDlFtKZZK7f_-Zmm2BHXaRxc4E,20706
 reconcile/dynatrace_token_provider.py,sha256=HWItJ_LavPcUJlpYz5fmfnfOpP2-0Qjkar0EAzBJ5Cw,16602
 reconcile/email_sender.py,sha256=-5L-Ag_jaEYSzYRoMr52KQBRXz1E8yx9GqLbg2X4XFU,3533
 reconcile/gabi_authorized_users.py,sha256=rCosZv8Iu9jhWG88YiwK-gftX475aJ1R-PYIJYp_svY,4342
@@ -277,6 +278,7 @@ reconcile/gql_definitions/terraform_cloudflare_users/terraform_cloudflare_roles.
 reconcile/gql_definitions/terraform_repo/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_repo/terraform_repo.py,sha256=H2jQhte5Db3orab8RsTUBV-Zi9KgESxGOB835CocqSY,3108
 reconcile/gql_definitions/terraform_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+reconcile/gql_definitions/terraform_resources/database_access_manager.py,sha256=rw-6tQ05lzeE30hnLEuvLJR6sdTWZJapgmMZKixVgzE,4881
 reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py,sha256=edR1d8taPIlQH-4OSc9uaGyluDi-3KTsLXpO28REoDU,41349
 reconcile/gql_definitions/terraform_tgw_attachments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_tgw_attachments/aws_accounts.py,sha256=bxW6Wg0uE1lL9KWz1Kw9BR5QV658Tq_zbhHLDDumlgU,2606
@@ -357,6 +359,7 @@ reconcile/test/test_checkpoint.py,sha256=sbDtqTbfw5yMZ_mCltMXxkyyGueVLGUjTDtcWhP
 reconcile/test/test_cli.py,sha256=qx_iBwh4Z-YkK3sbjK1wEziPTgn060EN-baf9DNvR3k,1096
 reconcile/test/test_closedbox_endpoint_monitoring.py,sha256=isMHYwRWMFARU2nbJgbl69kD6H0eA86noCM4MPVI1fo,7151
 reconcile/test/test_dashdotdb_dora.py,sha256=XDMdnLDvup8sSqQEynxdPhXQZAafYbd2IUo9flSRJ8I,7917
+reconcile/test/test_database_access_manager.py,sha256=9P-IKPlqirpHu_vyRedZ69zR63AvJZdLDuM30qtg4F4,11384
 reconcile/test/test_gabi_authorized_users.py,sha256=6XnV5Q9inxP81ktGMVKyWucjBTUj8Imy2L0HG3YHyUE,2496
 reconcile/test/test_github_org.py,sha256=j3KeB4OnSln1gm2hidce49xdMru-j75NS3cM-AEgzZc,4511
 reconcile/test/test_github_repo_invites.py,sha256=QJ0VFk5B59rx4XtHoT6XOGWw9xRIZMen_cgtviN_Vi8,3419
@@ -619,8 +622,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=dmEcNwZltP1rd_4DbxIYakO
 tools/test/test_qontract_cli.py,sha256=awwTHEc2DWlykuqGIYM0WOBoSL0KRnOraCLk3C7izis,1401
 tools/test/test_sd_app_sre_alert_report.py,sha256=JeLhgzpKCPgLvptwg_4ZvJHLVWKNG1T5845HXTkMBxA,1826
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc402.dist-info/METADATA,sha256=DU5UiE_qV8lPDI4Eir53vzO8F3AH0kFhHZ-U0cN7akQ,2347
-qontract_reconcile-0.10.1rc402.dist-info/WHEEL,sha256=yQN5g4mg4AybRjkgi-9yy4iQEFibGQmlz78Pik5Or-A,92
-qontract_reconcile-0.10.1rc402.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
-qontract_reconcile-0.10.1rc402.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc402.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc403.dist-info/METADATA,sha256=cIo20x-baQGEabysu8S0LhYBh9G8h8NeNGF0KOyJhlU,2347
+qontract_reconcile-0.10.1rc403.dist-info/WHEEL,sha256=yQN5g4mg4AybRjkgi-9yy4iQEFibGQmlz78Pik5Or-A,92
+qontract_reconcile-0.10.1rc403.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
+qontract_reconcile-0.10.1rc403.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc403.dist-info/RECORD,,

reconcile/cli.py

@@ -2128,6 +2128,17 @@ def advanced_upgrade_scheduler(
     )
 
 
+@integration.command(short_help="Manage Databases and Database Users.")
+@click.pass_context
+def database_access_manager(ctx):
+    from reconcile.database_access_manager import DatabaseAccessManagerIntegration
+
+    run_class_integration(
+        integration=DatabaseAccessManagerIntegration(PydanticRunParams()),
+        ctx=ctx.obj,
+    )
+
+
 @integration.command(
     short_help="Export Product and Application informnation to Status Board."
 )

reconcile/database_access_manager.py

@@ -0,0 +1,621 @@
+import base64
+import logging
+from random import choices
+from string import (
+    ascii_letters,
+    digits,
+)
+from typing import (
+    Any,
+    Callable,
+    Optional,
+)
+
+from pydantic import BaseModel
+
+from reconcile import openshift_base
+from reconcile import openshift_resources_base as orb
+from reconcile import queries
+from reconcile.gql_definitions.terraform_resources.database_access_manager import (
+    DatabaseAccessV1,
+    NamespaceTerraformProviderResourceAWSV1,
+    NamespaceTerraformResourceRDSV1,
+    NamespaceV1,
+    query,
+)
+from reconcile.utils import gql
+from reconcile.utils.oc import (
+    OC_Map,
+    OCClient,
+)
+from reconcile.utils.openshift_resource import OpenshiftResource
+from reconcile.utils.runtime.integration import QontractReconcileIntegration
+from reconcile.utils.semver_helper import make_semver
+from reconcile.utils.state import (
+    State,
+    init_state,
+)
+
+QONTRACT_INTEGRATION = "database-access-manager"
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+
+SUPPORTED_ENGINES = ["postgres"]
+
+
+def get_database_access_namespaces(
+    query_func: Optional[Callable] = None,
+) -> list[NamespaceV1]:
+    if not query_func:
+        query_func = gql.get_api().query
+    return query(query_func).namespaces_v1 or []
+
+
+class DatabaseConnectionParameters(BaseModel):
+    host: str
+    port: str
+    user: str
+    password: str
+    database: str
+
+
+class PSQLScriptGenerator(BaseModel):
+    db_access: DatabaseAccessV1
+    connection_parameter: DatabaseConnectionParameters
+    engine: str
+
+    def _get_db(self) -> str:
+        return self.db_access.database
+
+    def _get_user(self) -> str:
+        return self.db_access.username
+
+    def _generate_create_user(self) -> str:
+        return f"""
+\\set ON_ERROR_STOP on
+
+SELECT 'CREATE DATABASE "{self._get_db()}"'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '{self._get_db()}');\\gexec
+/* revoke only required for databases lower version 15
+   this makes the behaviour compliant with postgres 15, writes are only allowed
+   in the schema created for the role/user */
+REVOKE ALL ON DATABASE "{self._get_db()}" FROM public;
+
+\\c "{self._get_db()}"
+
+select 'CREATE ROLE "{self._get_user()}"  WITH LOGIN PASSWORD ''{self.connection_parameter.password}'' VALID UNTIL ''infinity'''
+WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '{self._get_db()}');\\gexec
+
+-- rds specific, grant role to admin or create schema fails
+grant "{self._get_user()}" to postgres;
+CREATE SCHEMA IF NOT EXISTS "{self._get_user()}" AUTHORIZATION "{self._get_user()}";"""
+
+    def _generate_db_access(self) -> str:
+        statements: list[str] = ["\n"]
+        for access in self.db_access.access or []:
+            statement = f"GRANT {','.join(access.grants)} ON ALL TABLES IN SCHEMA \"{access.target.dbschema}\" TO \"{self._get_user()}\";\n"
+            statements.append(statement)
+        return "".join(statements)
+
+    def generate_script(self) -> str:
+        x = self._generate_create_user() + "\n" + self._generate_db_access()
+        return x
+
+
+def secret_head(name: str) -> dict[str, Any]:
+    return {
+        "apiVersion": "v1",
+        "kind": "Secret",
+        "type": "Opaque",
+        "metadata": {
+            "name": name,
+        },
+    }
+
+
+def generate_user_secret_spec(
+    name: str, db_connection: DatabaseConnectionParameters
+) -> OpenshiftResource:
+    secret = secret_head(name)
+    secret["data"] = {
+        "db.host": base64.b64encode(db_connection.host.encode("utf-8")).decode("utf-8"),
+        "db.name": base64.b64encode(db_connection.database.encode("utf-8")).decode(
+            "utf-8"
+        ),
+        "db.password": base64.b64encode(db_connection.password.encode("utf-8")).decode(
+            "utf-8"
+        ),
+        "db.port": base64.b64encode(db_connection.port.encode("utf-8")).decode("utf-8"),
+        "db.user": base64.b64encode(db_connection.user.encode("utf-8")).decode("utf-8"),
+    }
+    return OpenshiftResource(
+        body=secret,
+        integration=QONTRACT_INTEGRATION,
+        integration_version=QONTRACT_INTEGRATION_VERSION,
+    )
+
+
+def generate_script_secret_spec(name: str, script: str) -> OpenshiftResource:
+    secret = secret_head(name)
+    secret["data"] = {
+        "script.sql": base64.b64encode(script.encode("utf-8")).decode("utf-8"),
+    }
+    return OpenshiftResource(
+        body=secret,
+        integration=QONTRACT_INTEGRATION,
+        integration_version=QONTRACT_INTEGRATION_VERSION,
+    )
+
+
+def get_db_engine(resource: NamespaceTerraformResourceRDSV1) -> str:
+    defaults = gql.get_resource(resource.defaults)
+    engine = "postgres"
+    for line in defaults["content"].split("\n"):
+        if line and line.startswith("engine:"):
+            engine = line.split(":")[1].strip()
+    if engine not in SUPPORTED_ENGINES:
+        raise Exception(f"Unsupported engine: {engine}")
+    return engine
+
+
+class JobData(BaseModel):
+    engine: str
+    engine_version: str
+    name_suffix: str
+    image_repository: str
+    service_account_name: str
+    rds_admin_secret_name: str
+    script_secret_name: str
+    pull_secret: str
+
+
+def get_job_spec(job_data: JobData) -> OpenshiftResource:
+    job_name = f"dbam-{job_data.name_suffix}"
+
+    if job_data.engine == "postgres":
+        command = "/usr/local/bin/psql"
+
+    job = {
+        "apiVersion": "batch/v1",
+        "kind": "Job",
+        "metadata": {
+            "name": job_name,
+            "labels": {
+                "app": "qontract-reconcile",
+                "integration": QONTRACT_INTEGRATION,
+            },
+        },
+        "spec": {
+            "backoffLimit": 1,
+            "template": {
+                "metadata": {
+                    "name": job_name,
+                },
+                "spec": {
+                    "imagePullSecrets": [{"name": job_data.pull_secret}],
+                    "restartPolicy": "Never",
+                    "serviceAccountName": job_data.service_account_name,
+                    "containers": [
+                        {
+                            "name": job_name,
+                            "image": f"{job_data.image_repository}/{job_data.engine}:{job_data.engine_version}",
+                            "command": [
+                                command,
+                            ],
+                            "args": [
+                                "-ae",
+                                "--host=$(db.host)",
+                                "--port=$(db.port)",
+                                "--username=$(db.user)",
+                                "--dbname=$(db.name)",
+                                "--file=/tmp/scripts/script.sql",
+                            ],
+                            "env": [
+                                {
+                                    "name": "db.host",
+                                    "valueFrom": {
+                                        "secretKeyRef": {
+                                            "name": job_data.rds_admin_secret_name,
+                                            "key": "db.host",
+                                        },
+                                    },
+                                },
+                                {
+                                    "name": "db.name",
+                                    "valueFrom": {
+                                        "secretKeyRef": {
+                                            "name": job_data.rds_admin_secret_name,
+                                            "key": "db.name",
+                                        },
+                                    },
+                                },
+                                {
+                                    "name": "PGPASSWORD",
+                                    "valueFrom": {
+                                        "secretKeyRef": {
+                                            "name": job_data.rds_admin_secret_name,
+                                            "key": "db.password",
+                                        },
+                                    },
+                                },
+                                {
+                                    "name": "db.port",
+                                    "valueFrom": {
+                                        "secretKeyRef": {
+                                            "name": job_data.rds_admin_secret_name,
+                                            "key": "db.port",
+                                        },
+                                    },
+                                },
+                                {
+                                    "name": "db.user",
+                                    "valueFrom": {
+                                        "secretKeyRef": {
+                                            "name": job_data.rds_admin_secret_name,
+                                            "key": "db.user",
+                                        },
+                                    },
+                                },
+                            ],
+                            "resources": {
+                                "requests": {
+                                    "cpu": "100m",
+                                    "memory": "128Mi",
+                                },
+                            },
+                            "volumeMounts": [
+                                {
+                                    "name": "configs",
+                                    "mountPath": "/tmp/scripts/",
+                                    "readOnly": True,
+                                },
+                            ],
+                        },
+                    ],
+                    "volumes": [
+                        {
+                            "name": "configs",
+                            "projected": {
+                                "sources": [
+                                    {
+                                        "secret": {
+                                            "name": job_data.script_secret_name,
+                                        },
+                                    },
+                                ],
+                            },
+                        },
+                    ],
+                },
+            },
+        },
+    }
+    return OpenshiftResource(
+        body=job,
+        integration=QONTRACT_INTEGRATION,
+        integration_version=QONTRACT_INTEGRATION_VERSION,
+    )
+
+
+def get_service_account_spec(name: str) -> OpenshiftResource:
+    return OpenshiftResource(
+        body={
+            "apiVersion": "v1",
+            "kind": "ServiceAccount",
+            "metadata": {
+                "name": name,
+                "labels": {
+                    "app": "qontract-reconcile",
+                    "integration": QONTRACT_INTEGRATION,
+                },
+            },
+            "automountServiceAccountToken": False,
+        },
+        integration=QONTRACT_INTEGRATION,
+        integration_version=QONTRACT_INTEGRATION_VERSION,
+    )
+
+
+class DBAMResource(BaseModel):
+    resource: OpenshiftResource
+    clean_up: bool
+
+    class Config:
+        arbitrary_types_allowed = True
+
+
+class JobStatusCondition(BaseModel):
+    type: str
+
+
+class JobStatus(BaseModel):
+    conditions: list[JobStatusCondition]
+
+    def is_complete(self) -> bool:
+        return True if self.conditions else False
+
+    def has_errors(self) -> bool:
+        for condition in self.conditions:
+            if condition.type == "Failed":
+                return True
+        return False
+
+
+def _populate_resources(
+    db_access: DatabaseAccessV1,
+    engine: str,
+    image_repository: str,
+    pull_secret: dict[Any, Any],
+    admin_secret_name: str,
+    resource_prefix: str,
+    settings: dict[Any, Any],
+    database_connection: DatabaseConnectionParameters,
+) -> list[DBAMResource]:
+    managed_resources: list[DBAMResource] = []
+    # create service account
+    managed_resources.append(
+        DBAMResource(
+            resource=get_service_account_spec(resource_prefix),
+            clean_up=True,
+        )
+    )
+
+    # create script secret
+    generator = PSQLScriptGenerator(
+        db_access=db_access,
+        connection_parameter=database_connection,
+        engine=engine,
+    )
+    script_secret_name = f"{resource_prefix}-script"
+    managed_resources.append(
+        DBAMResource(
+            resource=generate_script_secret_spec(
+                script_secret_name,
+                generator.generate_script(),
+            ),
+            clean_up=True,
+        )
+    )
+    # create user secret
+    managed_resources.append(
+        DBAMResource(
+            resource=generate_user_secret_spec(resource_prefix, database_connection),
+            clean_up=False,
+        )
+    )
+    # create pull secret
+    labels = pull_secret["labels"] or {}
+    pull_secret_resources = orb.fetch_provider_vault_secret(
+        path=pull_secret["path"],
+        version=pull_secret["version"],
+        name=f"{resource_prefix}-pull-secret",
+        labels=labels,
+        annotations=pull_secret["annotations"] or {},
+        type=pull_secret["type"],
+        integration=QONTRACT_INTEGRATION,
+        integration_version=QONTRACT_INTEGRATION_VERSION,
+        settings=settings,
+    )
+    managed_resources.append(
+        DBAMResource(resource=pull_secret_resources, clean_up=True)
+    )
+    # create job
+    managed_resources.append(
+        DBAMResource(
+            resource=get_job_spec(
+                JobData(
+                    engine=engine,
+                    engine_version="15.4-alpine",
+                    name_suffix=db_access.name,
+                    image_repository=image_repository,
+                    service_account_name=resource_prefix,
+                    rds_admin_secret_name=admin_secret_name,
+                    script_secret_name=script_secret_name,
+                    pull_secret=f"{resource_prefix}-pull-secret",
+                )
+            ),
+            clean_up=True,
+        )
+    )
+
+    return managed_resources
+
+
+def _generate_password() -> str:
+    return "".join(choices(ascii_letters + digits, k=32))
+
+
+def _create_database_connection_parameter(
+    db_access: DatabaseAccessV1,
+    namespace_name: str,
+    oc: OCClient,
+    admin_secret_name: str,
+    user_secret_name: str,
+) -> DatabaseConnectionParameters:
+    def _decode_secret_value(value: str) -> str:
+        return base64.b64decode(value).decode("utf-8")
+
+    user_secret = oc.get(
+        namespace_name,
+        "Secret",
+        user_secret_name,
+        allow_not_found=True,
+    )
+    if user_secret:
+        password = _decode_secret_value(user_secret["data"]["db.password"])
+        host = _decode_secret_value(user_secret["data"]["db.host"])
+        user = _decode_secret_value(user_secret["data"]["db.user"])
+        port = _decode_secret_value(user_secret["data"]["db.port"])
+        database = _decode_secret_value(user_secret["data"]["db.name"])
+    else:
+        admin_secret = oc.get(
+            namespace_name,
+            "Secret",
+            admin_secret_name,
+            allow_not_found=False,
+        )
+        host = _decode_secret_value(admin_secret["data"]["db.host"])
+        port = _decode_secret_value(admin_secret["data"]["db.port"])
+        user = db_access.username
+        password = _generate_password()
+        database = db_access.database
+    database_connection = DatabaseConnectionParameters(
+        host=host,
+        port=port,
+        user=user,
+        password=password,
+        database=database,
+    )
+    return database_connection
+
+
+class JobFailedError(Exception):
+    pass
+
+
+def _process_db_access(
+    dry_run: bool,
+    state: State,
+    db_access: DatabaseAccessV1,
+    oc_map: OC_Map,
+    cluster_name: str,
+    namespace_name: str,
+    admin_secret_name: str,
+    engine: str,
+    settings: dict[Any, Any],
+) -> None:
+    if state.exists(db_access.name):
+        current_state = state.get(db_access.name)
+        if current_state == db_access.dict(by_alias=True):
+            return
+
+    resource_prefix = f"dbam-{db_access.name}"
+    oc = oc_map.get_cluster(cluster_name, False)
+
+    database_connection = _create_database_connection_parameter(
+        db_access,
+        namespace_name,
+        oc,
+        admin_secret_name,
+        resource_prefix,
+    )
+
+    managed_resources = _populate_resources(
+        db_access,
+        engine,
+        settings["imageRepository"],
+        settings["pullSecret"],
+        admin_secret_name,
+        resource_prefix,
+        settings,
+        database_connection,
+    )
+
+    # create job, delete old, failed job first
+    job = oc.get(
+        namespace_name,
+        "Job",
+        f"dbam-{db_access.name}",
+        allow_not_found=True,
+    )
+    if not job:
+        for r in managed_resources:
+            openshift_base.apply(
+                dry_run=dry_run,
+                oc_map=oc_map,
+                cluster=cluster_name,
+                namespace=namespace_name,
+                resource_type=r.resource.kind,
+                resource=r.resource,
+                wait_for_namespace=False,
+            )
+        return
+    job_status = JobStatus(
+        conditions=[
+            JobStatusCondition(type=c["type"])
+            for c in job["status"].get("conditions", [])
+        ]
+    )
+    if job_status.is_complete():
+        if job_status.has_errors():
+            raise JobFailedError(f"Job dbam-{db_access.name} failed, please check logs")
+        state.add(
+            db_access.name,
+            value=db_access.dict(by_alias=True),
+            force=True,
+        )
+        logging.debug("job completed, cleaning up")
+        for r in managed_resources:
+            if r.clean_up:
+                openshift_base.delete(
+                    dry_run=dry_run,
+                    oc_map=oc_map,
+                    cluster=cluster_name,
+                    namespace=namespace_name,
+                    resource_type=r.resource.kind,
+                    name=r.resource.name,
+                    enable_deletion=True,
+                )
+    else:
+        logging.info(f"Job dbam-{db_access.name} appears to be still running")
+
+
+class DatabaseAccessManagerIntegration(QontractReconcileIntegration):
+    @property
+    def name(self) -> str:
+        return QONTRACT_INTEGRATION
+
+    def run(self, dry_run: bool) -> None:
+        settings = queries.get_app_interface_settings()
+
+        sql_query_settings = settings.get("sqlQuery")
+        if not sql_query_settings:
+            raise KeyError("sqlQuery settings are required")
+
+        state = init_state(
+            integration=QONTRACT_INTEGRATION, secret_reader=self.secret_reader
+        )
+
+        encounteredErrors = False
+
+        namespaces = get_database_access_namespaces()
+        with OC_Map(
+            namespaces=[n.dict(by_alias=True) for n in namespaces],
+            integration=QONTRACT_INTEGRATION,
+            settings=settings,
+        ) as oc_map:
+            for namespace in namespaces:
+                for external_resource in [
+                    er
+                    for er in namespace.external_resources or []
+                    if isinstance(er, NamespaceTerraformProviderResourceAWSV1)
+                ]:
+                    for resource in [
+                        r
+                        for r in external_resource.resources or []
+                        if isinstance(r, NamespaceTerraformResourceRDSV1)
+                    ]:
+                        admin_secret_name = resource.output_resource_name
+                        if admin_secret_name is None:
+                            logging.error(
+                                f"{resource.identifier}-{resource.provider} is missing output_resource_name"
+                            )
+                            encounteredErrors = True
+                        else:
+                            for db_access in resource.database_access or []:
+                                try:
+                                    _process_db_access(
+                                        dry_run,
+                                        state,
+                                        db_access,
+                                        oc_map,
+                                        namespace.cluster.name,
+                                        namespace.name,
+                                        admin_secret_name,
+                                        get_db_engine(resource),
+                                        sql_query_settings,
+                                    )
+                                except JobFailedError:
+                                    encounteredErrors = True
+
+            if encounteredErrors:
+                raise JobFailedError("One or more jobs failed to complete")

reconcile/gql_definitions/terraform_resources/database_access_manager.py

@@ -0,0 +1,166 @@
+"""
+Generated by qenerate plugin=pydantic_v1. DO NOT MODIFY MANUALLY!
+"""
+from collections.abc import Callable  # noqa: F401 # pylint: disable=W0611
+from datetime import datetime  # noqa: F401 # pylint: disable=W0611
+from enum import Enum  # noqa: F401 # pylint: disable=W0611
+from typing import (  # noqa: F401 # pylint: disable=W0611
+    Any,
+    Optional,
+    Union,
+)
+
+from pydantic import (  # noqa: F401 # pylint: disable=W0611
+    BaseModel,
+    Extra,
+    Field,
+    Json,
+)
+
+
+DEFINITION = """
+query DatabaseAccessManager {
+  namespaces_v1 {
+    name
+    cluster {
+      name
+      serverUrl
+      automationToken {
+        path
+        field
+        version
+        format
+      }
+      internal
+    }
+    externalResources {
+      provider
+      provisioner {
+        name
+      }
+      ... on NamespaceTerraformProviderResourceAWS_v1 {
+        resources {
+          provider
+          ... on NamespaceTerraformResourceRDS_v1 {
+            region
+            identifier
+            defaults
+            output_resource_name
+            database_access {
+              username
+              name
+              database
+              delete
+              access {
+                grants
+                target {
+                  dbschema
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+"""
+
+
+class ConfiguredBaseModel(BaseModel):
+    class Config:
+        smart_union = True
+        extra = Extra.forbid
+
+
+class VaultSecretV1(ConfiguredBaseModel):
+    path: str = Field(..., alias="path")
+    field: str = Field(..., alias="field")
+    version: Optional[int] = Field(..., alias="version")
+    q_format: Optional[str] = Field(..., alias="format")
+
+
+class ClusterV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    server_url: str = Field(..., alias="serverUrl")
+    automation_token: Optional[VaultSecretV1] = Field(..., alias="automationToken")
+    internal: Optional[bool] = Field(..., alias="internal")
+
+
+class ExternalResourcesProvisionerV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+
+
+class NamespaceExternalResourceV1(ConfiguredBaseModel):
+    provider: str = Field(..., alias="provider")
+    provisioner: ExternalResourcesProvisionerV1 = Field(..., alias="provisioner")
+
+
+class NamespaceTerraformResourceAWSV1(ConfiguredBaseModel):
+    provider: str = Field(..., alias="provider")
+
+
+class DatabaseAccessAccessGranteeV1(ConfiguredBaseModel):
+    dbschema: str = Field(..., alias="dbschema")
+
+
+class DatabaseAccessAccessV1(ConfiguredBaseModel):
+    grants: list[str] = Field(..., alias="grants")
+    target: DatabaseAccessAccessGranteeV1 = Field(..., alias="target")
+
+
+class DatabaseAccessV1(ConfiguredBaseModel):
+    username: str = Field(..., alias="username")
+    name: str = Field(..., alias="name")
+    database: str = Field(..., alias="database")
+    delete: Optional[bool] = Field(..., alias="delete")
+    access: Optional[list[DatabaseAccessAccessV1]] = Field(..., alias="access")
+
+
+class NamespaceTerraformResourceRDSV1(NamespaceTerraformResourceAWSV1):
+    region: Optional[str] = Field(..., alias="region")
+    identifier: str = Field(..., alias="identifier")
+    defaults: str = Field(..., alias="defaults")
+    output_resource_name: Optional[str] = Field(..., alias="output_resource_name")
+    database_access: Optional[list[DatabaseAccessV1]] = Field(
+        ..., alias="database_access"
+    )
+
+
+class NamespaceTerraformProviderResourceAWSV1(NamespaceExternalResourceV1):
+    resources: list[
+        Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceAWSV1]
+    ] = Field(..., alias="resources")
+
+
+class NamespaceV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    cluster: ClusterV1 = Field(..., alias="cluster")
+    external_resources: Optional[
+        list[
+            Union[NamespaceTerraformProviderResourceAWSV1, NamespaceExternalResourceV1]
+        ]
+    ] = Field(..., alias="externalResources")
+
+
+class DatabaseAccessManagerQueryData(ConfiguredBaseModel):
+    namespaces_v1: Optional[list[NamespaceV1]] = Field(..., alias="namespaces_v1")
+
+
+def query(query_func: Callable, **kwargs: Any) -> DatabaseAccessManagerQueryData:
+    """
+    This is a convenience function which queries and parses the data into
+    concrete types. It should be compatible with most GQL clients.
+    You do not have to use it to consume the generated data classes.
+    Alternatively, you can also mime and alternate the behavior
+    of this function in the caller.
+
+    Parameters:
+        query_func (Callable): Function which queries your GQL Server
+        kwargs: optional arguments that will be passed to the query function
+
+    Returns:
+        DatabaseAccessManagerQueryData: queried data parsed into generated classes
+    """
+    raw_data: dict[Any, Any] = query_func(DEFINITION, **kwargs)
+    return DatabaseAccessManagerQueryData(**raw_data)

reconcile/test/test_database_access_manager.py

@@ -0,0 +1,405 @@
+from collections import defaultdict
+from typing import Callable
+from unittest.mock import MagicMock
+
+import pytest
+from pytest_mock import MockerFixture
+
+from reconcile.database_access_manager import (
+    DatabaseConnectionParameters,
+    DBAMResource,
+    JobFailedError,
+    JobStatus,
+    JobStatusCondition,
+    PSQLScriptGenerator,
+    _create_database_connection_parameter,
+    _generate_password,
+    _populate_resources,
+    _process_db_access,
+)
+from reconcile.gql_definitions.terraform_resources.database_access_manager import (
+    DatabaseAccessAccessV1,
+    DatabaseAccessV1,
+)
+from reconcile.utils.oc import OC_Map
+from reconcile.utils.openshift_resource import OpenshiftResource
+
+
+@pytest.fixture
+def db_access(gql_class_factory: Callable[..., DatabaseAccessV1]) -> DatabaseAccessV1:
+    return gql_class_factory(
+        DatabaseAccessV1,
+        {
+            "username": "test",
+            "name": "test",
+            "database": "test",
+        },
+    )
+
+
+@pytest.fixture
+def db_access_access(
+    gql_class_factory: Callable[..., DatabaseAccessAccessV1]
+) -> DatabaseAccessAccessV1:
+    return gql_class_factory(
+        DatabaseAccessAccessV1,
+        {
+            "grants": ["insert", "select"],
+            "target": {
+                "dbschema": "foo",
+            },
+        },
+    )
+
+
+@pytest.fixture
+def db_access_complete(
+    db_access: DatabaseAccessV1, db_access_access: DatabaseAccessAccessV1
+) -> DatabaseAccessV1:
+    db_access.access = [db_access_access]
+    return db_access
+
+
+@pytest.fixture
+def db_connection_parameter():
+    return DatabaseConnectionParameters(
+        host="localhost",
+        port="5432",
+        user="test",
+        password="postgres",  # notsecret
+        database="test",
+    )
+
+
+@pytest.fixture
+def db_secret_dict() -> dict[str, dict[str, str]]:
+    return {
+        "data": {
+            "db.password": "aGR1aHNkZnVoc2Rm",  # notsecret
+            "db.host": "bG9jYWxob3N0",
+            "db.port": "NTQzMg==",
+            "db.user": "dGVzdA==",
+            "db.name": "dGVzdA==",
+        }
+    }
+
+
+@pytest.fixture
+def openshift_resource_secet() -> OpenshiftResource:
+    return OpenshiftResource(
+        body={
+            "metadata": {"name": "test"},
+            "kind": "secret",
+            "data": {"password": "postgres"},
+        },
+        integration="TEST",
+        integration_version="0.0.1",
+    )
+
+
+def _assert_create_script(script: str) -> None:
+    assert 'CREATE DATABASE "test"' in script
+    assert "REVOKE ALL ON DATABASE" in script
+    assert 'CREATE ROLE "test"  WITH LOGIN PASSWORD' in script
+    assert "CREATE SCHEMA IF NOT EXISTS" in script
+
+
+def _assert_grant_access(script: str) -> None:
+    assert 'GRANT insert,select ON ALL TABLES IN SCHEMA "foo" TO "test"' in script
+
+
+def test_generate_create_user(
+    db_access: DatabaseAccessV1, db_connection_parameter: DatabaseConnectionParameters
+) -> None:
+    s = PSQLScriptGenerator(
+        db_access=db_access,
+        connection_parameter=db_connection_parameter,
+        engine="postgres",
+    )
+    script = s._generate_create_user()
+    _assert_create_script(script)
+
+
+def test_generate_access(
+    db_access: DatabaseAccessV1,
+    db_access_access: DatabaseAccessAccessV1,
+    db_connection_parameter: DatabaseConnectionParameters,
+):
+    db_access.access = [db_access_access]
+
+    s = PSQLScriptGenerator(
+        db_access=db_access,
+        connection_parameter=db_connection_parameter,
+        engine="postgres",
+    )
+    script = s._generate_db_access()
+    _assert_grant_access(script)
+
+
+def test_generate_complete(
+    db_access_complete: DatabaseAccessV1,
+    db_connection_parameter: DatabaseConnectionParameters,
+):
+    s = PSQLScriptGenerator(
+        db_access=db_access_complete,
+        connection_parameter=db_connection_parameter,
+        engine="postgres",
+    )
+    script = s.generate_script()
+    _assert_create_script(script)
+    _assert_grant_access(script)
+
+
+def test_job_completion():
+    s = JobStatus(conditions=[])
+    assert s.is_complete() is False
+
+    s = JobStatus(conditions=[JobStatusCondition(type="Complete")])
+    assert s.is_complete()
+    assert s.has_errors() is False
+
+
+def test_has_errors():
+    s = JobStatus(conditions=[JobStatusCondition(type="Failed")])
+    assert s.is_complete()
+    assert s.has_errors()
+
+
+def test_populate_resources(
+    mocker: MockerFixture,
+    db_access: DatabaseAccessV1,
+    db_connection_parameter: DatabaseConnectionParameters,
+    openshift_resource_secet: OpenshiftResource,
+):
+    mocker.patch(
+        "reconcile.database_access_manager.orb.fetch_provider_vault_secret",
+        return_value=openshift_resource_secet,
+    )
+    reources = _populate_resources(
+        db_access=db_access,
+        engine="postgres",
+        image_repository="foo",
+        pull_secret={
+            "version": 1,
+            "annotations": [],
+            "type": "a",
+            "labels": [],
+            "path": "/foo/bar",
+        },
+        admin_secret_name="db-secret",
+        resource_prefix="dbam-foo",
+        settings={"foo": "bar"},
+        database_connection=db_connection_parameter,
+    )
+
+    r_kinds = [r.resource.kind for r in reources]
+    assert sorted(r_kinds) == ["Job", "Secret", "Secret", "ServiceAccount", "secret"]
+
+
+def test__create_database_connection_parameter_user_exists(
+    db_access: DatabaseAccessV1,
+    db_secret_dict: dict[str, dict[str, str]],
+    mocker: MockerFixture,
+):
+    oc = mocker.patch("reconcile.utils.oc.OCNative", autospec=True)
+    oc.get.return_value = db_secret_dict
+    p = _create_database_connection_parameter(
+        db_access=db_access,
+        namespace_name="foo",
+        oc=oc,
+        admin_secret_name="db-secret",
+        user_secret_name="db-user-secret",
+    )
+    assert p == DatabaseConnectionParameters(
+        host="localhost",
+        port="5432",
+        user="test",
+        password="hduhsdfuhsdf",
+        database="test",
+    )
+
+
+def test__create_database_connection_parameter_user_missing(
+    db_access: DatabaseAccessV1,
+    db_secret_dict: dict[str, dict[str, str]],
+    mocker: MockerFixture,
+):
+    pw_generated = "1N5j7oksB45l8w0RJD8qR0ENJP1yOAOs"  # notsecret
+    oc = mocker.patch("reconcile.utils.oc.OCNative", autospec=True)
+    oc.get.side_effect = [None, db_secret_dict]
+    mocker.patch(
+        "reconcile.database_access_manager._generate_password",
+        return_value=pw_generated,
+    )
+    p = _create_database_connection_parameter(
+        db_access=db_access,
+        namespace_name="foo",
+        oc=oc,
+        admin_secret_name="db-secret",
+        user_secret_name="db-user-secret",
+    )
+    assert p == DatabaseConnectionParameters(
+        host="localhost",
+        port="5432",
+        user="test",
+        password=pw_generated,
+        database="test",
+    )
+
+
+def test_generate_password():
+    assert len(_generate_password()) == 32
+    assert _generate_password() != _generate_password()
+
+
+@pytest.fixture
+def dbam_state(mocker: MockerFixture) -> MockerFixture:
+    return mocker.patch("reconcile.database_access_manager.State", autospec=True)
+
+
+@pytest.fixture
+def dbam_oc_map(mocker: MockerFixture) -> MockerFixture:
+    return mocker.patch("reconcile.database_access_manager.OC_Map", autospec=True)
+
+
+@pytest.fixture
+def dbam_process_mocks(
+    openshift_resource_secet: OpenshiftResource, mocker: MockerFixture
+) -> DBAMResource:
+    expected_resource = DBAMResource(resource=openshift_resource_secet, clean_up=True)
+    mocker.patch(
+        "reconcile.database_access_manager._create_database_connection_parameter",
+        return_value=db_connection_parameter,
+    )
+    mocker.patch(
+        "reconcile.database_access_manager._populate_resources",
+        return_value=[expected_resource],
+    )
+    return expected_resource
+
+
+def test__process_db_access_job_pass(
+    db_access: DatabaseAccessV1,
+    dbam_state: MagicMock,
+    dbam_oc_map: MagicMock,
+    dbam_process_mocks: DBAMResource,
+    mocker: MockerFixture,
+):
+    dbam_state.exists.return_value = False
+    oc = mocker.patch("reconcile.utils.oc.OCNative", autospec=True)
+    oc.get.return_value = {"status": {"conditions": [{"type": "Complete"}]}}
+    dbam_oc_map.get_cluster.return_value = oc
+
+    ob_delete = mocker.patch(
+        "reconcile.database_access_manager.openshift_base.delete", autospec=True
+    )
+
+    _process_db_access(
+        False,
+        dbam_state,
+        db_access,
+        dbam_oc_map,
+        "test-cluster",
+        namespace_name="test-namepsace",
+        admin_secret_name="db-secret",
+        engine="postgres",
+        settings=defaultdict(str),
+    )
+
+    assert ob_delete.call_count == 1
+    ob_delete.assert_called_once_with(
+        dry_run=False,
+        oc_map=dbam_oc_map,
+        cluster="test-cluster",
+        namespace="test-namepsace",
+        resource_type="secret",
+        name=dbam_process_mocks.resource.name,
+        enable_deletion=True,
+    )
+
+
+def test__process_db_access_job_error(
+    db_access: DatabaseAccessV1,
+    dbam_state: MagicMock,
+    dbam_oc_map: MagicMock,
+    dbam_process_mocks: DBAMResource,
+    mocker: MockerFixture,
+):
+    dbam_state.exists.return_value = False
+    oc = mocker.patch("reconcile.utils.oc.OCNative", autospec=True)
+    oc.get.return_value = {"status": {"conditions": [{"type": "Failed"}]}}
+    dbam_oc_map.get_cluster.return_value = oc
+
+    with pytest.raises(JobFailedError):
+        _process_db_access(
+            False,
+            dbam_state,
+            db_access,
+            dbam_oc_map,
+            "test-cluster",
+            namespace_name="test-namepsace",
+            admin_secret_name="db-secret",
+            engine="postgres",
+            settings=defaultdict(str),
+        )
+
+
+def test__process_db_access_state_diff(
+    db_access: DatabaseAccessV1,
+    dbam_state: MagicMock,
+    dbam_oc_map: MagicMock,
+    dbam_process_mocks: DBAMResource,
+    mocker: MockerFixture,
+):
+    dbam_state.exists.return_value = True
+    dbam_state.get.return_value = {}
+    oc = mocker.patch("reconcile.utils.oc.OCNative", autospec=True)
+    oc.get.return_value = False
+    dbam_oc_map.get_cluster.return_value = oc
+
+    ob_apply = mocker.patch(
+        "reconcile.database_access_manager.openshift_base.apply", autospec=True
+    )
+    _process_db_access(
+        False,
+        dbam_state,
+        db_access,
+        dbam_oc_map,
+        "test-cluster",
+        namespace_name="test-namepsace",
+        admin_secret_name="db-secret",
+        engine="postgres",
+        settings=defaultdict(str),
+    )
+
+    assert ob_apply.call_count == 1
+    ob_apply.assert_called_once_with(
+        dry_run=False,
+        oc_map=dbam_oc_map,
+        cluster="test-cluster",
+        namespace="test-namepsace",
+        resource_type="secret",
+        resource=dbam_process_mocks.resource,
+        wait_for_namespace=False,
+    )
+
+
+def test__process_db_access_state_exists_matched(
+    db_access: DatabaseAccessV1,
+    dbam_state: MagicMock,
+    dbam_oc_map: OC_Map,
+):
+    dbam_state.exists.return_value = True
+    dbam_state.get.return_value = db_access.dict(by_alias=True)
+    # missing mocks would cause this to fail if not exit early
+    _process_db_access(
+        False,
+        dbam_state,
+        db_access,
+        dbam_oc_map,
+        "test-cluster",
+        namespace_name="test-namepsace",
+        admin_secret_name="db-secret",
+        engine="postgres",
+        settings=defaultdict(str),
+    )