qontract-reconcile 0.10.1rc518__py3-none-any.whl → 0.10.1rc519__py3-none-any.whl

{qontract_reconcile-0.10.1rc518.dist-info → qontract_reconcile-0.10.1rc519.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc518
+Version: 0.10.1rc519
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc518.dist-info → qontract_reconcile-0.10.1rc519.dist-info}/RECORD

@@ -61,7 +61,7 @@ reconcile/ocm_machine_pools.py,sha256=eebJ6iiTdUcuKE5zBcfNxW1OGmPOvgBtmVu3xNVOoy
 reconcile/ocm_update_recommended_version.py,sha256=IYkfLXIprOW1jguZeELcGP1iBPuj-b53R-FTqKulMl8,4204
 reconcile/ocm_upgrade_scheduler_org_updater.py,sha256=ta8hMJ-su5mRcPpYrvB1COsojXV-SU3PzLPbQhy2Q0I,4190
 reconcile/openshift_base.py,sha256=7aifvl-ay5wpY6encbUX9pGbKdjiwJmevZ3XWGRzpCM,49696
-reconcile/openshift_cluster_bots.py,sha256=6L4eQuT76AmZGr-tN8hymqqCyCBgOj07nod-35PJtHw,10165
+reconcile/openshift_cluster_bots.py,sha256=8cb-1j9ksIUxhfn_9oD--5YN9OznTCZky83MX8KgffM,10873
 reconcile/openshift_clusterrolebindings.py,sha256=QfSy1Ik8eEY5XObc1Q4xyhqyErZenJmbPv_u9wcDNNo,5864
 reconcile/openshift_groups.py,sha256=d-qGI1aUEpZZLZq7PuSnjVDgsy5EB063CQr2tNvYPCE,9419
 reconcile/openshift_limitranges.py,sha256=UvCGo_OQ4XoDK55TJmn55qEhhlkhLzhU12tX8nT5kPQ,3442
@@ -411,7 +411,7 @@ reconcile/test/test_ocm_machine_pools.py,sha256=3qo6t2Jfr1Wee0NUacyLTDmatp0o7CUN
 reconcile/test/test_ocm_update_recommended_version.py,sha256=iA4BVirTGVXlwcOyeR52IuNO81X_8NR6ZNd7ZFE7igs,4328
 reconcile/test/test_ocm_upgrade_scheduler_org_updater.py,sha256=zYRGUX7pAmxSv9oFYw2ZnPGa-YAPgDfmqXOJM4eE-8A,4353
 reconcile/test/test_openshift_base.py,sha256=uVsnMghAQhHaJTreeOw4x2INTKJ6qeiZiiteWeKflW8,33874
-reconcile/test/test_openshift_cluster_bots.py,sha256=GzwG73V-psL3qZ2R1ekiSWr9L6935eLduw7tls5KaUI,7928
+reconcile/test/test_openshift_cluster_bots.py,sha256=-h1wDki9wh_WsNvNdPGuf-EjXP1MKWGRIIF9GcSuGjw,7928
 reconcile/test/test_openshift_namespace_labels.py,sha256=P1hqi6P88NijNrurdXG_QR2usyo3EYZSy9zpwYHvDsM,12104
 reconcile/test/test_openshift_namespaces.py,sha256=HmRnCE5EnFt3MYceVEFHmk8wWRtCrxu2AFGFkY9pdyA,9214
 reconcile/test/test_openshift_resource.py,sha256=lbTf48jX1q6rGnRiA5pPvfU0uPfY8zhNylMtryn0sLI,12995
@@ -668,8 +668,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=SX7qL3D1SIRKFo95FoQztvf
 tools/test/test_qontract_cli.py,sha256=d18KrdhtUGqoC7_kWZU128U0-VJEj-0rjFkLVufcI6I,2755
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc518.dist-info/METADATA,sha256=ZHIKdYpB_uP2Zw1T7VGzb55Zemh_NrefQFPc8opTj4Q,2349
-qontract_reconcile-0.10.1rc518.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-qontract_reconcile-0.10.1rc518.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
-qontract_reconcile-0.10.1rc518.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc518.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc519.dist-info/METADATA,sha256=PkWYKrPAojcwXRY7Pu263rk2RvG9DyNwH8Tsqzg_JqA,2349
+qontract_reconcile-0.10.1rc519.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+qontract_reconcile-0.10.1rc519.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
+qontract_reconcile-0.10.1rc519.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc519.dist-info/RECORD,,

reconcile/openshift_cluster_bots.py

@@ -124,7 +124,11 @@ def retrieve_token(kubeconfig: str, namespace: str, sa: str) -> str:
 
 
 def create_sa(
-    kubeconfig: str, namespace: str, sa: str, create_namespace: bool = False
+    kubeconfig: str,
+    namespace: str,
+    sa: str,
+    create_namespace: bool = False,
+    cluster_admin: bool = False,
 ) -> str:
     items: list[dict] = []
     if create_namespace:
@@ -159,6 +163,26 @@ def create_sa(
             "type": "kubernetes.io/service-account-token",
         },
     ])
+    if cluster_admin:
+        items.append({
+            "apiVersion": "rbac.authorization.k8s.io/v1",
+            "kind": "ClusterRoleBinding",
+            "metadata": {
+                "name": f"{namespace}-{sa}",
+            },
+            "roleRef": {
+                "apiGroup": "rbac.authorization.k8s.io",
+                "kind": "ClusterRole",
+                "name": "cluster-admin",
+            },
+            "subjects": [
+                {
+                    "kind": "ServiceAccount",
+                    "name": sa,
+                    "namespace": namespace,
+                }
+            ],
+        })
 
     oc_apply(kubeconfig, namespace, items)
     token = retrieve_token(kubeconfig, namespace, sa)
@@ -200,6 +224,7 @@ def create_cluster_bots(
                         config.cluster_admin_ns,
                         config.cluster_admin_sa,
                         create_namespace=True,
+                        cluster_admin=True,
                     )
     except subprocess.CalledProcessError as e:
         logging.error(e.stderr)

reconcile/test/test_openshift_cluster_bots.py

@@ -234,6 +234,6 @@ def test_run_cluster_admin(
     )
     mocks.oc.return_value = {"data": {"token": "mytoken"}}
     ocb.run(**integ_params)
-    assert mocks.oc.call_count == 7
+    assert mocks.oc.call_count == 8
     mocks.vault.assert_called_once()
     mocks.submit_mr.assert_called_once()