qontract-reconcile 0.10.1rc536__py3-none-any.whl → 0.10.1rc537__py3-none-any.whl

{qontract_reconcile-0.10.1rc536.dist-info → qontract_reconcile-0.10.1rc537.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc536
+Version: 0.10.1rc537
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc536.dist-info → qontract_reconcile-0.10.1rc537.dist-info}/RECORD

@@ -1,5 +1,5 @@
 reconcile/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/acs_policies.py,sha256=Mop44Z5T0DxXghme13ZVvy1hr5KphZKzc_ZevxAJBQ0,8784
+reconcile/acs_policies.py,sha256=e_kVyP4rGm3fJzq10Anr8scZoPenlmTcoS5REK0d2T0,9144
 reconcile/acs_rbac.py,sha256=YoKu5wTRTtb3EGT0PV3r279LDgvw2ECb-0_0j4suScg,23032
 reconcile/aws_ami_share.py,sha256=eeu0TI3M5yyUaozyAq_aW3tir-9be4YFguOXvIvKHSo,3757
 reconcile/aws_ecr_image_pull_secrets.py,sha256=TGEc_0nv8oxV2HqA8VdcM4HHP-B1YqmNOOU6FPwVFTY,2328
@@ -375,7 +375,7 @@ reconcile/templates/jira-checkpoint-missinginfo.j2,sha256=c_Vvg-lEENsB3tgxm9B6Y9
 reconcile/test/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/test/conftest.py,sha256=rQousYrxUz-EwAIbsYO6bIwR1B4CrOz9y_zaUVo2lfI,4466
 reconcile/test/fixtures.py,sha256=9SDWAUlSd1rCx7z3GhULHcpr-I6FyCsXxaFAZIqYQsQ,591
-reconcile/test/test_acs_policies.py,sha256=2hioxQ1AlbtW-jerw9YiQ8aIb0YjFpzDFs1j6pvn-Nc,15133
+reconcile/test/test_acs_policies.py,sha256=hMnCX9KdLRKb53gYXK4JUR5yJwhczJRyyUPywDeLeLg,15716
 reconcile/test/test_acs_rbac.py,sha256=lvNd8GY0-GHzcOdOn13QWdrqbBXXKzNT7EEDHNH7cjM,28272
 reconcile/test/test_aggregated_list.py,sha256=iiWitQuNYC58aimWaiBoE4NROHjr1NCgQ91MnHEG_Ro,6412
 reconcile/test/test_amtool.py,sha256=vxRhGieeydMBOb9UI2ziMHjJa8puMeGNsUhGhy-yMnk,1032
@@ -590,7 +590,7 @@ reconcile/utils/vaultsecretref.py,sha256=3Ed2uBy36TzSvL0B-l4FoWQqB2SbBKDKEuUPIO6
 reconcile/utils/vcs.py,sha256=o1r0n_IrU2El75CED_6sjR2GZGM-exuWsj5F7jONaMU,6779
 reconcile/utils/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/utils/acs/base.py,sha256=Qih-xZ3RBJZEE291iHHlv7lUY6ShcAvSj1PA3_aTTnM,2276
-reconcile/utils/acs/policies.py,sha256=utDmFKb6pbBN3W6JFxRrlr9yFwL3aQurGDywaFGM6w0,5196
+reconcile/utils/acs/policies.py,sha256=_jAz6cv8KRYtDsXjGoJgNbD8_9PUa5LSwwVlpK4A_cQ,5505
 reconcile/utils/acs/rbac.py,sha256=ugsLM9Pb7FbUbdq85E3VzXGMaB9ZovXob7tdWCxwqZ8,8808
 reconcile/utils/cloud_resource_best_practice/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/utils/cloud_resource_best_practice/aws_rds.py,sha256=EvE6XKLsrZ531MJptKqPht2lOETrOjySTHXk6CzMgo0,2279
@@ -668,8 +668,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=SX7qL3D1SIRKFo95FoQztvf
 tools/test/test_qontract_cli.py,sha256=d18KrdhtUGqoC7_kWZU128U0-VJEj-0rjFkLVufcI6I,2755
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc536.dist-info/METADATA,sha256=BZPcvTsEmz0tR4NJmj-JZM7l_J2qAMSglos5FuteOCo,2349
-qontract_reconcile-0.10.1rc536.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-qontract_reconcile-0.10.1rc536.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
-qontract_reconcile-0.10.1rc536.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc536.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc537.dist-info/METADATA,sha256=dGXxQQQzpUMW_Kyo_ktrTXrUVvKSJ9GMS7SG5jKdMoo,2349
+qontract_reconcile-0.10.1rc537.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+qontract_reconcile-0.10.1rc537.dist-info/entry_points.txt,sha256=rTjAv28I_CHLM8ID3OPqMI_suoQ9s7tFbim4aYjn9kk,376
+qontract_reconcile-0.10.1rc537.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc537.dist-info/RECORD,,

reconcile/acs_policies.py

@@ -58,7 +58,10 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
         return self.qontract_integration.replace("_", "-")
 
     def _build_policy(
-        self, gql_policy: AcsPolicyV1, notifier_name_to_id: dict[str, str]
+        self,
+        gql_policy: AcsPolicyV1,
+        notifier_name_to_id: dict[str, str],
+        cluster_name_to_id: dict[str, str],
     ) -> Policy:
         conditions = [
             pc for c in gql_policy.conditions if (pc := self._build_policy_condition(c))
@@ -72,7 +75,7 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
             severity=f"{gql_policy.severity.upper()}_SEVERITY",  # align with acs api severity value format
             scope=sorted(
                 [
-                    Scope(cluster=cs.name, namespace="")
+                    Scope(cluster=cluster_name_to_id[cs.name], namespace="")
                     for cs in cast(
                         gql_acs_policies.AcsPolicyScopeClusterV1,
                         gql_policy.scope,
@@ -83,7 +86,9 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
             if gql_policy.scope.level == "cluster"
             else sorted(
                 [
-                    Scope(cluster=ns.cluster.name, namespace=ns.name)
+                    Scope(
+                        cluster=cluster_name_to_id[ns.cluster.name], namespace=ns.name
+                    )
                     for ns in cast(
                         gql_acs_policies.AcsPolicyScopeNamespaceV1,
                         gql_policy.scope,
@@ -158,7 +163,10 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
                 return None
 
     def get_desired_state(
-        self, query_func: Callable, notifiers: list[AcsPolicyApi.NotifierIdentifiers]
+        self,
+        query_func: Callable,
+        notifiers: list[AcsPolicyApi.NotifierIdentifiers],
+        clusters: list[AcsPolicyApi.ClusterIdentifiers],
     ) -> list[Policy]:
         """
         Get desired ACS security policies and convert to acs api policy object format
@@ -167,8 +175,9 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
         :return: list of utils.acs.policies.Policy derived from acs-policy-1 definitions
         """
         notifier_name_to_id = {n.name: n.id for n in notifiers}
+        cluster_name_to_id = {c.name: c.id for c in clusters}
         return [
-            self._build_policy(gql_policy, notifier_name_to_id)
+            self._build_policy(gql_policy, notifier_name_to_id, cluster_name_to_id)
             for gql_policy in gql_acs_policies.query(query_func=query_func).acs_policies
             or []
         ]
@@ -225,7 +234,8 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
             instance={"url": instance.url, "token": token[instance.credentials.field]}
         ) as acs_api:
             notifiers = acs_api.list_notifiers()
-            desired = self.get_desired_state(gqlapi.query, notifiers)
+            clusters = acs_api.list_clusters()
+            desired = self.get_desired_state(gqlapi.query, notifiers, clusters)
             current = acs_api.get_custom_policies()
             self.reconcile(
                 desired=desired, current=current, acs=acs_api, dry_run=dry_run

reconcile/test/test_acs_policies.py

@@ -20,6 +20,10 @@ from reconcile.gql_definitions.acs.acs_policies import (
 )
 from reconcile.utils.acs.policies import AcsPolicyApi, Policy, PolicyCondition, Scope
 
+CLUSTER_NAME_ONE = "app-sre-stage"
+CLUSTER_ID_ONE = "5211d395-5cf7-4185-a1fb-d88f41bc7542"
+CLUSTER_NAME_TWO = "app-sre-prod"
+CLUSTER_ID_TWO = "a217cca7-d85a-4be1-9703-f58866fdbe2d"
 CUSTOM_POLICY_ONE_NAME = "app-sre-clusters-fixable-cve-7-fixable"
 CUSTOM_POLICY_ONE_ID = "365d4e71-3241-4448-9f3d-eb0eed1c1820"
 CUSTOM_POLICY_TWO_NAME = "app-sre-namespaces-severity-critical"
@@ -41,8 +45,8 @@ def query_data_desired_state() -> AcsPolicyQueryData:
                 scope=AcsPolicyScopeClusterV1(
                     level="cluster",
                     clusters=[
-                        ClusterV1(name="app-sre-stage"),
-                        ClusterV1(name="app-sre-prod"),
+                        ClusterV1(name=CLUSTER_NAME_ONE),
+                        ClusterV1(name=CLUSTER_NAME_TWO),
                     ],
                 ),
                 conditions=[
@@ -91,8 +95,8 @@ def modeled_acs_policies() -> list[Policy]:
             notifiers=[JIRA_NOTIFIER_ID],
             categories=["Vulnerability Management"],
             scope=[
-                Scope(cluster="app-sre-prod", namespace=""),
-                Scope(cluster="app-sre-stage", namespace=""),
+                Scope(cluster=CLUSTER_ID_ONE, namespace=""),
+                Scope(cluster=CLUSTER_ID_TWO, namespace=""),
             ],
             conditions=[
                 PolicyCondition(field_name="CVSS", values=[">=7"], negate=False),
@@ -106,8 +110,8 @@ def modeled_acs_policies() -> list[Policy]:
             notifiers=[],
             categories=["DevOps Best Practices", "Vulnerability Management"],
             scope=[
-                Scope(cluster="app-sre-prod", namespace="app-interface-production"),
-                Scope(cluster="app-sre-stage", namespace="app-interface-stage"),
+                Scope(cluster=CLUSTER_ID_ONE, namespace="app-interface-stage"),
+                Scope(cluster=CLUSTER_ID_TWO, namespace="app-interface-production"),
             ],
             conditions=[
                 PolicyCondition(
@@ -175,8 +179,8 @@ def api_response_policies_specific() -> list[Any]:
             "eventSource": "NOT_APPLICABLE",
             "exclusions": [],
             "scope": [
-                {"cluster": "app-sre-stage", "namespace": "", "label": None},
-                {"cluster": "app-sre-prod", "namespace": "", "label": None},
+                {"cluster": CLUSTER_ID_ONE, "namespace": "", "label": None},
+                {"cluster": CLUSTER_ID_TWO, "namespace": "", "label": None},
             ],
             "severity": "HIGH_SEVERITY",
             "enforcementActions": [],
@@ -216,12 +220,12 @@ def api_response_policies_specific() -> list[Any]:
             "exclusions": [],
             "scope": [
                 {
-                    "cluster": "app-sre-stage",
+                    "cluster": CLUSTER_ID_ONE,
                     "namespace": "app-interface-stage",
                     "label": None,
                 },
                 {
-                    "cluster": "app-sre-prod",
+                    "cluster": CLUSTER_ID_TWO,
                     "namespace": "app-interface-production",
                     "label": None,
                 },
@@ -257,11 +261,20 @@ def api_response_list_notifiers() -> list[AcsPolicyApi.NotifierIdentifiers]:
     ]
 
 
+@pytest.fixture
+def api_response_list_clusters() -> list[AcsPolicyApi.ClusterIdentifiers]:
+    return [
+        AcsPolicyApi.ClusterIdentifiers(id=CLUSTER_ID_ONE, name=CLUSTER_NAME_ONE),
+        AcsPolicyApi.ClusterIdentifiers(id=CLUSTER_ID_TWO, name=CLUSTER_NAME_TWO),
+    ]
+
+
 def test_get_desired_state(
     mocker: MockerFixture,
     query_data_desired_state: AcsPolicyQueryData,
     modeled_acs_policies: list[Policy],
     api_response_list_notifiers: list[AcsPolicyApi.NotifierIdentifiers],
+    api_response_list_clusters: list[AcsPolicyApi.ClusterIdentifiers],
 ) -> None:
     query_func = mocker.patch(
         "reconcile.gql_definitions.acs.acs_policies.query", autospec=True
@@ -270,7 +283,9 @@ def test_get_desired_state(
 
     integration = AcsPoliciesIntegration()
     result = integration.get_desired_state(
-        query_func=query_func, notifiers=api_response_list_notifiers
+        query_func=query_func,
+        notifiers=api_response_list_notifiers,
+        clusters=api_response_list_clusters,
     )
     assert result == modeled_acs_policies
 

reconcile/utils/acs/policies.py

@@ -151,3 +151,13 @@ class AcsPolicyApi(AcsBaseApi):
             self.NotifierIdentifiers(id=c["id"], name=c["name"])
             for c in self.generic_request("/v1/notifiers", "GET").json()["notifiers"]
         ]
+
+    class ClusterIdentifiers(BaseModel):
+        id: str
+        name: str
+
+    def list_clusters(self) -> list[ClusterIdentifiers]:
+        return [
+            self.ClusterIdentifiers(id=c["id"], name=c["name"])
+            for c in self.generic_request("/v1/clusters", "GET").json()["clusters"]
+        ]