qontract-reconcile 0.10.1rc417__py3-none-any.whl → 0.10.1rc418__py3-none-any.whl

{qontract_reconcile-0.10.1rc417.dist-info → qontract_reconcile-0.10.1rc418.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc417
+Version: 0.10.1rc418
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc417.dist-info → qontract_reconcile-0.10.1rc418.dist-info}/RECORD

@@ -1,5 +1,5 @@
 reconcile/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/acs_rbac.py,sha256=OggKBiNGOGQJBsE3jJXwt0NT7zsTebdgDNKllE8cQMs,23537
+reconcile/acs_rbac.py,sha256=Jr9qIR1VjH16xpADZqjkigqsDW7iDnMD9nn7GxU4z0Y,23828
 reconcile/aws_ami_share.py,sha256=yLNSjtepxk4UL5f4Ix9oRp17jy9OXza0MIr71mhuqEA,3665
 reconcile/aws_ecr_image_pull_secrets.py,sha256=TGEc_0nv8oxV2HqA8VdcM4HHP-B1YqmNOOU6FPwVFTY,2328
 reconcile/aws_garbage_collector.py,sha256=ddwU8IKTueAJc0TzymcREr7hcoVui9kOGvdH1B2EcuM,450
@@ -636,8 +636,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=dmEcNwZltP1rd_4DbxIYakO
 tools/test/test_qontract_cli.py,sha256=awwTHEc2DWlykuqGIYM0WOBoSL0KRnOraCLk3C7izis,1401
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc417.dist-info/METADATA,sha256=qVCp5XoYQncnPYXv4depIwHI3RastqoUxTf1pDAkvro,2347
-qontract_reconcile-0.10.1rc417.dist-info/WHEEL,sha256=Xo9-1PvkuimrydujYJAjF7pCkriuXBpUPEjma1nZyJ0,92
-qontract_reconcile-0.10.1rc417.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
-qontract_reconcile-0.10.1rc417.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc417.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc418.dist-info/METADATA,sha256=bYR73yjW15cE_wXs6HuU9pT1haQ-xRZBBOnXU4whpII,2347
+qontract_reconcile-0.10.1rc418.dist-info/WHEEL,sha256=Xo9-1PvkuimrydujYJAjF7pCkriuXBpUPEjma1nZyJ0,92
+qontract_reconcile-0.10.1rc418.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
+qontract_reconcile-0.10.1rc418.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc418.dist-info/RECORD,,

reconcile/acs_rbac.py

@@ -353,6 +353,7 @@ class AcsRbacIntegration(QontractReconcileIntegration[NoParams]):
         role: AcsRole,
         acs: AcsApi,
         access_scope_id: str,
+        admin_access_scope_id: str,
         groups: list[Group],
         dry_run: bool,
     ) -> None:
@@ -383,9 +384,11 @@ class AcsRbacIntegration(QontractReconcileIntegration[NoParams]):
             acs.delete_role(role.name)
         logging.info("Deleted role: %s", role.name)
 
-        if not dry_run:
-            acs.delete_access_scope(access_scope_id)
-        logging.info("Deleted access scope: %s", role.access_scope.name)
+        # do not attempt deletion of system default 'Unrestricted' scope referenced by a custom role
+        if access_scope_id != admin_access_scope_id:
+            if not dry_run:
+                acs.delete_access_scope(access_scope_id)
+            logging.info("Deleted access scope: %s", role.access_scope.name)
 
     def delete_rbac(
         self,
@@ -416,6 +419,7 @@ class AcsRbacIntegration(QontractReconcileIntegration[NoParams]):
                     role=role,
                     acs=acs,
                     access_scope_id=access_scope_id_map[role.access_scope.name],
+                    admin_access_scope_id=access_scope_id_map[DEFAULT_ADMIN_SCOPE_NAME],
                     groups=role_group_mappings[role.name],
                     dry_run=dry_run,
                 )