qontract-reconcile 0.10.1rc528__py3-none-any.whl → 0.10.1rc530__py3-none-any.whl

{qontract_reconcile-0.10.1rc528.dist-info → qontract_reconcile-0.10.1rc530.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc528
+Version: 0.10.1rc530
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc528.dist-info → qontract_reconcile-0.10.1rc530.dist-info}/RECORD

@@ -303,7 +303,7 @@ reconcile/gql_definitions/terraform_repo/__init__.py,sha256=47DEQpj8HBSa-_TImW-5
 reconcile/gql_definitions/terraform_repo/terraform_repo.py,sha256=pefTRhb0ZcWm_j6dYz6m6qNqZFteqgrQ25SgUqRAVaI,3173
 reconcile/gql_definitions/terraform_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_resources/database_access_manager.py,sha256=yv0_YC-LmhaKD_gyGG3le1w5BtypBjlsO894-Zgdg4U,4813
-reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py,sha256=czniF5fsJLsJuILI5FYr38yqnr90J3VLRe4tB4hSqio,40573
+reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py,sha256=GMV0sch1Mdznjd3Vwgj_gMS1fb56d5xa2dFtOM57yUA,41126
 reconcile/gql_definitions/terraform_tgw_attachments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_tgw_attachments/aws_accounts.py,sha256=GjCuLHOgm3eHbkpK7Q2i7l6tori5Y62uFlz3M89BYtA,2602
 reconcile/gql_definitions/vault_instances/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -535,7 +535,7 @@ reconcile/utils/filtering.py,sha256=zZnHH0u0SaTDyzuFXZ_mREURGLvjEqQIQy4z-7QBVlc,
 reconcile/utils/git.py,sha256=Qad7mfPuS9s7eKODeWSewehwSGgJPCbQuLda1qg_6GA,1522
 reconcile/utils/git_secrets.py,sha256=0wGNL5mvDtVPRuu3vEQgld1Am64gIDJHtmu1_ZKxMAI,1973
 reconcile/utils/github_api.py,sha256=_bttNxYKeam_tLVe27L7O4gKqSn6CeyuFnJn8tSaUVY,2488
-reconcile/utils/gitlab_api.py,sha256=4AYzYQYJtAYY_9uAU4lHnyKl9Xkreu5CDaqRkWMoOSQ,26121
+reconcile/utils/gitlab_api.py,sha256=7gImzen-LzEcdyTbRNcvuLOczzm03sEI78NmKBSMAl4,27228
 reconcile/utils/gpg.py,sha256=EKG7_fdMv8BMlV5yUdPiqoTx-KrzmVSEAl2sLkaKwWI,1123
 reconcile/utils/gql.py,sha256=bzIYYYYGIO_4Db4sA-mnZUOPVNBELZD5EcIUSTbYG1o,13604
 reconcile/utils/grouping.py,sha256=kWKivD14eAkiDneH_VIl_XyUdcVVQgiaKA9sLsuD2dw,441
@@ -581,7 +581,7 @@ reconcile/utils/state.py,sha256=SAa6QLHu9lr0yqLCBy2AypNx1IPCJWlrRBrvlzAKsOU,1450
 reconcile/utils/structs.py,sha256=LcbLEg8WxfRqM6nW7NhcWN0YeqF7SQzxOgntmLs1SgY,352
 reconcile/utils/template.py,sha256=wTvRU4AnAV_o042tD4Mwls2dwWMuk7MKnde3MaCjaYg,331
 reconcile/utils/terraform_client.py,sha256=V7AMQOEU4tvUOT-LQN2cXLqcphD5L93PMGMfurQQyPY,31753
-reconcile/utils/terrascript_aws_client.py,sha256=XNhTfvPtaxWE0MpWDJxUW5_PtPaBaijcTNr7lD86L88,264470
+reconcile/utils/terrascript_aws_client.py,sha256=wA6AcAqbS2tIuqh8soMfpdpuf0IbAJWjONMmffJ-0vA,265467
 reconcile/utils/three_way_diff_strategy.py,sha256=nyqeQsLCoPI6e16k2CF3b9KNgQLU-rPf5RtfdUfVMwE,4468
 reconcile/utils/throughput.py,sha256=iP4UWAe2LVhDo69mPPmgo9nQ7RxHD6_GS8MZe-aSiuM,344
 reconcile/utils/unleash.py,sha256=1D56CsZfE3ShDtN3IErE1T2eeIwNmxhK-yYbCotJ99E,3601
@@ -668,8 +668,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=SX7qL3D1SIRKFo95FoQztvf
 tools/test/test_qontract_cli.py,sha256=d18KrdhtUGqoC7_kWZU128U0-VJEj-0rjFkLVufcI6I,2755
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc528.dist-info/METADATA,sha256=wbE04VOAGLnR3YKFZ9BmP08N32wMPLDE5nG2e6KEINo,2349
-qontract_reconcile-0.10.1rc528.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-qontract_reconcile-0.10.1rc528.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
-qontract_reconcile-0.10.1rc528.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc528.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc530.dist-info/METADATA,sha256=vBKtmSp2hYuK2N6ks8hGTMvpT7L7s6ZFD3yMu1NpS8w,2349
+qontract_reconcile-0.10.1rc530.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+qontract_reconcile-0.10.1rc530.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
+qontract_reconcile-0.10.1rc530.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc530.dist-info/RECORD,,

reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py

@@ -168,6 +168,11 @@ query TerraformResourcesNamespaces {
                 role_policy
                 output_resource_name
                 annotations
+                lifecycle {
+                  create_before_destroy
+                  prevent_destroy
+                  ignore_changes
+                }
             }
             ... on NamespaceTerraformResourceSQS_v1 {
                 region
@@ -614,6 +619,12 @@ class AssumeRoleV1(ConfiguredBaseModel):
     federated: Optional[str] = Field(..., alias="Federated")
 
 
+class NamespaceTerraformResourceLifecycleV1(ConfiguredBaseModel):
+    create_before_destroy: Optional[bool] = Field(..., alias="create_before_destroy")
+    prevent_destroy: Optional[bool] = Field(..., alias="prevent_destroy")
+    ignore_changes: Optional[list[str]] = Field(..., alias="ignore_changes")
+
+
 class NamespaceTerraformResourceRoleV1(NamespaceTerraformResourceAWSV1):
     identifier: str = Field(..., alias="identifier")
     assume_role: AssumeRoleV1 = Field(..., alias="assume_role")
@@ -623,6 +634,7 @@ class NamespaceTerraformResourceRoleV1(NamespaceTerraformResourceAWSV1):
     role_policy: Optional[str] = Field(..., alias="role_policy")
     output_resource_name: Optional[str] = Field(..., alias="output_resource_name")
     annotations: Optional[str] = Field(..., alias="annotations")
+    lifecycle: Optional[NamespaceTerraformResourceLifecycleV1] = Field(..., alias="lifecycle")
 
 
 class KeyValueV1(ConfiguredBaseModel):

reconcile/utils/gitlab_api.py

@@ -1,5 +1,6 @@
 import logging
 import os
+import re
 from collections.abc import (
     Iterable,
     Set,
@@ -12,6 +13,7 @@ from operator import (
 from typing import (
     Any,
     Optional,
+    TypedDict,
 )
 from urllib.parse import urlparse
 
@@ -19,6 +21,8 @@ import gitlab
 import urllib3
 from gitlab.v4.objects import (
     CurrentUser,
+    Group,
+    Project,
     ProjectIssue,
     ProjectMergeRequest,
     ProjectMergeRequestNote,
@@ -66,12 +70,19 @@ class MRStatus:
     CANNOT_BE_MERGED_RECHECK = "cannot_be_merged_recheck"
 
 
+GROUP_BOT_NAME_REGEX = re.compile(r"group_.+_bot_.+")
+
+
+class GLGroupMember(TypedDict):
+    user: str
+    access_level: str
+
+
 class GitLabApi:  # pylint: disable=too-many-public-methods
     def __init__(
         self,
         instance,
         project_id=None,
-        ssl_verify=True,
         settings=None,
         secret_reader=None,
         project_url=None,
@@ -205,14 +216,14 @@ class GitLabApi:  # pylint: disable=too-many-public-methods
         gitlab_request.labels(integration=INTEGRATION_NAME).inc()
         return self.project.mergerequests.create(data)
 
-    def mr_exists(self, title):
+    def mr_exists(self, title: str) -> bool:
         mrs = self.get_merge_requests(state=MRState.OPENED)
         # since we are using a naming convention for these MRs
         # we can determine if a pending MR exists based on the title
         return any(mr.title == title for mr in mrs)
 
     @retry()
-    def get_project_maintainers(self, repo_url=None):
+    def get_project_maintainers(self, repo_url: str | None = None) -> list[str] | None:
         if repo_url is None:
             project = self.project
         else:
@@ -227,25 +238,42 @@ class GitLabApi:  # pylint: disable=too-many-public-methods
         app_sre_group = self.gl.groups.get("app-sre")
         return self.get_items(app_sre_group.members.list)
 
-    def get_group_if_exists(self, group_name):
+    def get_group_if_exists(self, group_name: str) -> Group | None:
         gitlab_request.labels(integration=INTEGRATION_NAME).inc()
         try:
             return self.gl.groups.get(group_name)
         except gitlab.exceptions.GitlabGetError:
             return None
 
-    def get_group_members(self, group_name):
+    @staticmethod
+    def _is_bot_username(username: str) -> bool:
+        """crudely checking for the username
+
+        as gitlab-python require a major upgrade to use the billable members apis
+        https://python-gitlab.readthedocs.io/en/stable/gl_objects/groups.html#id11 lists the api
+        billable_membersis the attribute that provides billable members of groups
+
+        the second api is https://python-gitlab.readthedocs.io/en/stable/gl_objects/group_access_tokens.html
+        which provides a list of access tokens as well as their assigned users
+
+        those apis are not avaliable in python-gitlab v1.x
+        """
+        return GROUP_BOT_NAME_REGEX.match(username) is not None
+
+    def get_group_members(self, group_name: str) -> list[GLGroupMember]:
         group = self.get_group_if_exists(group_name)
-        if not group:
+        if group is None:
             logging.error(group_name + " group not found")
             return []
-        return [
-            {
-                "user": m.username,
-                "access_level": self.get_access_level_string(m.access_level),
-            }
-            for m in self.get_items(group.members.list)
-        ]
+        else:
+            return [
+                {
+                    "user": m.username,
+                    "access_level": self.get_access_level_string(m.access_level),
+                }
+                for m in self.get_items(group.members.list)
+                if not self._is_bot_username(m.username)
+            ]
 
     def add_project_member(self, repo_url, user, access="maintainer"):
         project = self.get_project(repo_url)
@@ -323,7 +351,7 @@ class GitLabApi:  # pylint: disable=too-many-public-methods
         if access == "guest":
             return gitlab.GUEST_ACCESS
 
-    def get_group_id_and_projects(self, group_name):
+    def get_group_id_and_projects(self, group_name: str) -> tuple[str, list[str]]:
         gitlab_request.labels(integration=INTEGRATION_NAME).inc()
         group = self.gl.groups.get(group_name)
         return group.id, [p.name for p in self.get_items(group.projects.list)]
@@ -336,7 +364,7 @@ class GitLabApi:  # pylint: disable=too-many-public-methods
         return f"{self.server}/{group}/{project}"
 
     @retry()
-    def get_project(self, repo_url):
+    def get_project(self, repo_url: str) -> Project | None:
         repo = repo_url.replace(self.server + "/", "")
         gitlab_request.labels(integration=INTEGRATION_NAME).inc()
         try:
@@ -748,5 +776,5 @@ class GitLabApi:  # pylint: disable=too-many-public-methods
         self, repo_url: str, ref_from: str, ref_to: str
     ) -> list[dict[str, Any]]:
         project = self.get_project(repo_url)
-        response = project.repository_compare(ref_from, ref_to)
+        response: Any = project.repository_compare(ref_from, ref_to)
         return response.get("commits", [])

reconcile/utils/terrascript_aws_client.py

@@ -143,6 +143,9 @@ import reconcile.openshift_resources_base as orb
 import reconcile.utils.aws_helper as awsh
 from reconcile import queries
 from reconcile.github_org import get_default_config
+from reconcile.gql_definitions.terraform_resources.terraform_resources_namespaces import (
+    NamespaceTerraformResourceLifecycleV1,
+)
 from reconcile.utils import gql
 from reconcile.utils.aws_api import (
     AmiTag,
@@ -238,6 +241,7 @@ VARIABLE_KEYS = [
     "subscriptions",
     "records",
     "extra_tags",
+    "lifecycle",
 ]
 
 EMAIL_REGEX = re.compile(r"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$")
@@ -870,6 +874,23 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
         role_name = awsh.get_id_from_arn(account["assume_role"])
         return f"account-{uid}-{role_name}"
 
+    @staticmethod
+    def get_resource_lifecycle(
+        common_values: dict[str, Any],
+    ) -> Optional[dict[str, Any]]:
+        if lifecycle := common_values.get("lifecycle"):
+            lifecycle = NamespaceTerraformResourceLifecycleV1(**lifecycle)
+            if lifecycle.create_before_destroy is None:
+                lifecycle.create_before_destroy = False
+            if lifecycle.prevent_destroy is None:
+                lifecycle.prevent_destroy = False
+            if lifecycle.ignore_changes is None:
+                lifecycle.ignore_changes = []
+            if "all" in lifecycle.ignore_changes:
+                lifecycle.ignore_changes = "all"
+            return lifecycle.dict(by_alias=True)
+        return None
+
     def populate_additional_providers(self, infra_account_name: str, accounts):
         for account in accounts:
             account_name = account["name"]
@@ -2459,6 +2480,9 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
         if inline_policy:
             values["inline_policy"] = {"name": identifier, "policy": inline_policy}
 
+        if lifecycle := self.get_resource_lifecycle(common_values):
+            values["lifecycle"] = lifecycle
+
         role_tf_resource = aws_iam_role(identifier, **values)
         tf_resources.append(role_tf_resource)