qontract-reconcile 0.10.1rc456__py3-none-any.whl → 0.10.1rc458__py3-none-any.whl

{qontract_reconcile-0.10.1rc456.dist-info → qontract_reconcile-0.10.1rc458.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc456
+Version: 0.10.1rc458
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc456.dist-info → qontract_reconcile-0.10.1rc458.dist-info}/RECORD

@@ -59,7 +59,7 @@ reconcile/ocm_groups.py,sha256=_kiMUndKc6as6cbbvXxVnq8V_Lj7X5lxMJVCuRWuUFE,2888
 reconcile/ocm_machine_pools.py,sha256=eebJ6iiTdUcuKE5zBcfNxW1OGmPOvgBtmVu3xNVOoyY,16608
 reconcile/ocm_update_recommended_version.py,sha256=IYkfLXIprOW1jguZeELcGP1iBPuj-b53R-FTqKulMl8,4204
 reconcile/ocm_upgrade_scheduler_org_updater.py,sha256=ta8hMJ-su5mRcPpYrvB1COsojXV-SU3PzLPbQhy2Q0I,4190
-reconcile/openshift_base.py,sha256=wlxa3wvuySMLCBKThZeY-wwwRSqXGIEMbmETlQ1BXp8,47254
+reconcile/openshift_base.py,sha256=ZESvh2i6Y-0UbctNYgQyChnAt7MJXVePCIAJXhMGruM,49696
 reconcile/openshift_clusterrolebindings.py,sha256=9lBO2INBDCCtDpoj29NuOPbbpdJUXf-_LQIrhiLmmns,5827
 reconcile/openshift_groups.py,sha256=tcc9jJtSY_z76BKrN9GzPeClSV2wj_Ymcsmy5LkzsAE,9419
 reconcile/openshift_limitranges.py,sha256=UvCGo_OQ4XoDK55TJmn55qEhhlkhLzhU12tX8nT5kPQ,3442
@@ -395,7 +395,7 @@ reconcile/test/test_ocm_clusters_manifest_updates.py,sha256=jFRVfc5jby1kI2x_gT6w
 reconcile/test/test_ocm_machine_pools.py,sha256=3qo6t2Jfr1Wee0NUacyLTDmatp0o7CUNpkVOpHiOiGk,29737
 reconcile/test/test_ocm_update_recommended_version.py,sha256=iA4BVirTGVXlwcOyeR52IuNO81X_8NR6ZNd7ZFE7igs,4328
 reconcile/test/test_ocm_upgrade_scheduler_org_updater.py,sha256=zYRGUX7pAmxSv9oFYw2ZnPGa-YAPgDfmqXOJM4eE-8A,4353
-reconcile/test/test_openshift_base.py,sha256=owJsyyatl_7z6igUEDeJcMMV5_jIwcV2Yj7YgsmYkXs,27035
+reconcile/test/test_openshift_base.py,sha256=uVsnMghAQhHaJTreeOw4x2INTKJ6qeiZiiteWeKflW8,33874
 reconcile/test/test_openshift_namespace_labels.py,sha256=P1hqi6P88NijNrurdXG_QR2usyo3EYZSy9zpwYHvDsM,12104
 reconcile/test/test_openshift_namespaces.py,sha256=HmRnCE5EnFt3MYceVEFHmk8wWRtCrxu2AFGFkY9pdyA,9214
 reconcile/test/test_openshift_resource.py,sha256=lbTf48jX1q6rGnRiA5pPvfU0uPfY8zhNylMtryn0sLI,12995
@@ -600,7 +600,7 @@ reconcile/utils/ocm/cluster_groups.py,sha256=F8oqVqN_4QUnGL0K61zZhoYIzJeP57EcmZp
 reconcile/utils/ocm/clusters.py,sha256=Q6g5kGSNfxZUZ56LPFAYjOz8xJ2c6QG76V78GvyLxB0,7448
 reconcile/utils/ocm/identity_providers.py,sha256=dKed09N8iWmn39tI_MpwgVe47x23eLsknGbjMUxtwr4,2175
 reconcile/utils/ocm/labels.py,sha256=pRzTE506hKAgVbBNO51IBlGOuCbJmTYDMsL0pWBEwp8,5945
-reconcile/utils/ocm/ocm.py,sha256=drUa6n57YMc4JIrnJOOr3dp4YBFUw0wjVJ8u8mT2Iks,57904
+reconcile/utils/ocm/ocm.py,sha256=oTBz-apc-z51azwurPa0bGxZJY99MuXW1L7gHW3nVPE,58097
 reconcile/utils/ocm/search_filters.py,sha256=zExZpYBh7_tucG-xKoPHUxz1b_6l9qwbEMpMihQg7nA,15043
 reconcile/utils/ocm/service_log.py,sha256=XmGOP6hwhKwMEMeD0GhErTGzdgk1IHaKs-QatL1mAdY,2052
 reconcile/utils/ocm/sre_capability_labels.py,sha256=-TUmTzvK5yu7qY8SUMGj6-684wa8ZVYbjrJ6X3M7z-o,1576
@@ -646,8 +646,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=SX7qL3D1SIRKFo95FoQztvf
 tools/test/test_qontract_cli.py,sha256=awwTHEc2DWlykuqGIYM0WOBoSL0KRnOraCLk3C7izis,1401
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc456.dist-info/METADATA,sha256=ELUskVBpH-7UOHtLgJlAu7MmnMyGbNXMQLMR_zWNFxQ,2348
-qontract_reconcile-0.10.1rc456.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-qontract_reconcile-0.10.1rc456.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
-qontract_reconcile-0.10.1rc456.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc456.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc458.dist-info/METADATA,sha256=dDexn0oD1_4zQL6Fd516zTaG1hPC3S6ASKdXaIHs0qM,2348
+qontract_reconcile-0.10.1rc458.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+qontract_reconcile-0.10.1rc458.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
+qontract_reconcile-0.10.1rc458.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc458.dist-info/RECORD,,

reconcile/openshift_base.py

@@ -600,7 +600,8 @@ def should_apply(
     ):
         ri.register_error()
         logging.error(
-            f"[{cluster}/{namespace}] resource '{resource_type}/{name}' present and managed by another caller: {current.caller}"
+            f"[{cluster}/{namespace}] resource '{resource_type}/{name}' present and "
+            f"managed by another caller: {current.caller}"
         )
         return False
 
@@ -670,6 +671,74 @@ def handle_new_resources(
     return actions
 
 
+def should_take_over(
+    current: OR,
+    ri: ResourceInventory,
+    options: ApplyOptions,
+    cluster: str,
+    name: str,
+    namespace: str,
+    resource_type: str,
+) -> bool:
+    if options.caller and options.caller != current.caller:
+        # The resources are identical but the caller is different
+        if options.take_over or (
+            options.all_callers and current.caller not in options.all_callers
+        ):
+            return True
+        else:
+            ri.register_error()
+            logging.error(
+                f"[{cluster}/{namespace}] resource '{resource_type}/{name}' present "
+                f" and managed by another caller: {current.caller}"
+            )
+    return False
+
+
+def handle_identical_resources(
+    oc_map: ClusterMap,
+    ri: ResourceInventory,
+    identical_resources: Mapping[Any, Any],
+    cluster: str,
+    namespace: str,
+    resource_type: str,
+    data: Mapping[Any, Any],
+    options: ApplyOptions,
+) -> list[dict[str, Any]]:
+    actions: list[dict[str, Any]] = []
+
+    for name, dp in identical_resources.items():
+        if should_take_over(
+            current=dp.current,
+            ri=ri,
+            cluster=cluster,
+            name=name,
+            namespace=namespace,
+            resource_type=resource_type,
+            options=options,
+        ):
+            options.privileged = data["use_admin_token"].get(name, False)
+            action = {
+                "action": ACTION_APPLIED,
+                "cluster": cluster,
+                "namespace": namespace,
+                "kind": resource_type,
+                "name": name,
+                "privileged": options.privileged,
+            }
+            actions.append(action)
+            apply_action(
+                oc_map=oc_map,
+                ri=ri,
+                cluster=cluster,
+                namespace=namespace,
+                resource_type=resource_type,
+                resource=dp.desired,
+                options=options,
+            )
+    return actions
+
+
 def handle_modified_resources(
     oc_map: ClusterMap,
     ri: ResourceInventory,
@@ -875,6 +944,21 @@ def _realize_resource_data_3way_diff(
         data["current"], data["desired"], equal=three_way_diff_using_hash
     )
 
+    # identical resources need to be checked
+    # for take_overs and saas file deprecations
+    actions.extend(
+        handle_identical_resources(
+            oc_map=oc_map,
+            ri=ri,
+            identical_resources=diff_result.identical,
+            cluster=cluster,
+            namespace=namespace,
+            resource_type=resource_type,
+            data=data,
+            options=options,
+        )
+    )
+
     actions.extend(
         handle_new_resources(
             oc_map=oc_map,

reconcile/test/test_openshift_base.py

@@ -742,8 +742,8 @@ def apply_options() -> sut.ApplyOptions:
         recycle_pods=True,
         take_over=False,
         override_enable_deletion=False,
-        caller=None,
-        all_callers=None,
+        caller="saas-test",
+        all_callers=["saas-test"],
         privileged=False,
         enable_deletion=False,
     )
@@ -763,9 +763,7 @@ def build_openshift_resource(
     body = {
         "kind": kind,
         "apiVersion": api_version,
-        "metadata": {
-            "name": name,
-        },
+        "metadata": {"name": name},
     }
     if extra_body:
         body = body | extra_body
@@ -783,14 +781,22 @@ def build_openshift_resource(
 def build_openshift_resource_1() -> resource.OpenshiftResource:
     spec = {"spec": {"test-attr": "test-value-1"}}
     return build_openshift_resource(
-        kind="test-kind", api_version="v1", name="test-resource", extra_body=spec
+        kind="test-kind",
+        api_version="v1",
+        name="test-resource",
+        extra_body=spec,
+        caller_name="saas-test",
     )
 
 
 def build_openshift_resource_2() -> resource.OpenshiftResource:
-    spec = {"spec": {"test-attr": "test-value-1"}}
+    spec = {"spec": {"test-attr": "test-value-2"}}
     return build_openshift_resource(
-        kind="test-kind", api_version="v1", name="test-resource", extra_body=spec
+        kind="test-kind",
+        api_version="v1",
+        name="test-resource",
+        extra_body=spec,
+        caller_name="saas-test",
     )
 
 
@@ -802,7 +808,7 @@ def diff_result() -> DiffResult:
         add={"test-resource": r1},
         change={"test-resource": DiffPair(r1, r2)},
         delete={"test-resource": r1},
-        identical={},
+        identical={"test-resource": DiffPair(r1, r1)},
     )
 
 
@@ -845,12 +851,86 @@ def test_handle_new_resources(
     apply_mock.assert_called_with(**apply_expected_args)
 
 
+@pytest.mark.parametrize(
+    "apply_options, should_apply, should_error_ri",
+    [
+        (  # Same Caller. The resource should be updated
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=False,
+                override_enable_deletion=False,
+                caller="saas-test",
+                all_callers=["saas-test"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            True,
+            False,
+        ),
+        (  # The resource is owned by "saas-test" but is present in "different".
+            # An error must be raised
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=False,
+                override_enable_deletion=False,
+                caller="different",
+                all_callers=["saas-test", "different"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            False,
+            True,
+        ),
+        (  # The Resource is owned by "saas-test" and is being deployed by "different"
+            # Since "saas-test" is not in all_callers it means it has been
+            # deprecated. The Resource needs to be taken over by "different"
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=False,
+                override_enable_deletion=False,
+                caller="different",
+                all_callers=["different"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            True,
+            False,
+        ),
+        (  # Take over resources from another Saas-file
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=True,
+                override_enable_deletion=False,
+                caller="different",
+                all_callers=["saas-test", "different"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            True,
+            False,
+        ),
+    ],
+)
 def test_handle_modified_resources(
     mocker: MockerFixture,
     oc_map: oc.OC_Map,
     resource_inventory: resource.ResourceInventory,
     diff_result: DiffResult,
     apply_options: sut.ApplyOptions,
+    should_apply: bool,
+    should_error_ri: bool,
 ):
     apply_mock = mocker.patch.object(sut, "apply", autospec=True)
     cluster = "test-cluster"
@@ -871,19 +951,143 @@ def test_handle_modified_resources(
         options=apply_options,
     )
 
-    assert len(actions) == 1
-    apply_expected_args = {
-        "dry_run": True,
-        "oc_map": oc_map,
-        "cluster": "test-cluster",
-        "namespace": "test-namespace",
-        "resource_type": "test-Kind",
-        "resource": diff_result.change["test-resource"].desired,
-        "wait_for_namespace": True,
-        "recycle_pods": True,
-        "privileged": False,
-    }
-    apply_mock.assert_called_with(**apply_expected_args)
+    if should_apply:
+        assert len(actions) == 1
+        apply_expected_args = {
+            "dry_run": True,
+            "oc_map": oc_map,
+            "cluster": "test-cluster",
+            "namespace": "test-namespace",
+            "resource_type": "test-Kind",
+            "resource": diff_result.change["test-resource"].desired,
+            "wait_for_namespace": True,
+            "recycle_pods": True,
+            "privileged": False,
+        }
+        apply_mock.assert_called_with(**apply_expected_args)
+    else:
+        assert len(actions) == 0
+
+    if should_error_ri:
+        assert resource_inventory._error_registered
+
+
+@pytest.mark.parametrize(
+    "apply_options, should_take_over, should_error_ri",
+    [
+        (  # Same Caller and Identical Resource. Nothing should happen
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=False,
+                override_enable_deletion=False,
+                caller="saas-test",
+                all_callers=["saas-test"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            False,
+            False,
+        ),
+        (  # The resource is owned by "saas-test" but is present in "different".
+            # An error must be raised
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=False,
+                override_enable_deletion=False,
+                caller="different",
+                all_callers=["saas-test", "different"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            False,
+            True,
+        ),
+        (  # The Resource is owned by "saas-test" and is being deployed by "different"
+            # Since "saas-test" is not in all_callers it means it has been
+            # deprecated. The Resource needs to be taken over by "different"
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=False,
+                override_enable_deletion=False,
+                caller="different",
+                all_callers=["different"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            True,
+            False,
+        ),
+        (  # Take over resources from another Saas-file
+            sut.ApplyOptions(
+                dry_run=True,
+                no_dry_run_skip_compare=False,
+                wait_for_namespace=True,
+                recycle_pods=True,
+                take_over=True,
+                override_enable_deletion=False,
+                caller="different",
+                all_callers=["saas-test", "different"],
+                privileged=False,
+                enable_deletion=False,
+            ),
+            True,
+            False,
+        ),
+    ],
+)
+def test_handle_identical_resources(
+    mocker: MockerFixture,
+    oc_map: oc.OC_Map,
+    resource_inventory: resource.ResourceInventory,
+    diff_result: DiffResult,
+    apply_options: sut.ApplyOptions,
+    should_take_over: bool,
+    should_error_ri: bool,
+):
+    apply_mock = mocker.patch.object(sut, "apply", autospec=True)
+    cluster = "test-cluster"
+    namespace = "test-namespace"
+    resource_type = "test-Kind"
+    data = {"use_admin_token": {"test-resource": False}}
+
+    actions = sut.handle_identical_resources(
+        oc_map=oc_map,
+        ri=resource_inventory,
+        identical_resources=diff_result.identical,
+        cluster=cluster,
+        namespace=namespace,
+        resource_type=resource_type,
+        data=data,
+        options=apply_options,
+    )
+
+    if should_take_over:
+        assert len(actions) == 1
+        apply_expected_args = {
+            "dry_run": True,
+            "oc_map": oc_map,
+            "cluster": "test-cluster",
+            "namespace": "test-namespace",
+            "resource_type": "test-Kind",
+            "resource": diff_result.identical["test-resource"].desired,
+            "wait_for_namespace": True,
+            "recycle_pods": True,
+            "privileged": False,
+        }
+        apply_mock.assert_called_with(**apply_expected_args)
+    else:
+        assert len(actions) == 0
+    if should_error_ri:
+        assert resource_inventory._error_registered
 
 
 def test_handle_deleted_resources(

reconcile/utils/ocm/ocm.py

@@ -584,6 +584,7 @@ class OCMProductHypershift(OCMProduct):
         SPEC_ATTR_HYPERSHIFT,
         SPEC_ATTR_SUBNET_IDS,
         SPEC_ATTR_AVAILABILITY_ZONES,
+        SPEC_ATTR_OIDC_ENDPONT_URL,
     }
 
     @staticmethod
@@ -612,6 +613,7 @@ class OCMProductHypershift(OCMProduct):
             provision_shard_id = None
 
         sts = None
+        oidc_endpoint_url = None
         if cluster["aws"].get("sts", None):
             sts = ROSAOcmAwsStsAttrs(
                 installer_role_arn=cluster["aws"]["sts"]["role_arn"],
@@ -623,6 +625,7 @@ class OCMProductHypershift(OCMProduct):
                     "worker_role_arn"
                 ],
             )
+            oidc_endpoint_url = cluster["aws"]["sts"]["oidc_endpoint_url"]
         account = ROSAClusterAWSAccount(
             uid=cluster["properties"]["rosa_creator_arn"].split(":")[4],
             rosa=ROSAOcmAwsAttrs(
@@ -649,6 +652,7 @@ class OCMProductHypershift(OCMProduct):
             subnet_ids=cluster["aws"].get("subnet_ids"),
             availability_zones=cluster["nodes"].get("availability_zones"),
             hypershift=cluster["hypershift"]["enabled"],
+            oidc_endpoint_url=oidc_endpoint_url,
         )
 
         network = OCMClusterNetwork(