qontract-reconcile 0.10.1rc763__py3-none-any.whl → 0.10.1rc764__py3-none-any.whl

reconcile/external_resources/reconciler.py

@@ -0,0 +1,249 @@
+import sys
+from abc import ABC, abstractmethod
+from collections.abc import Iterable
+from typing import Any
+
+from kubernetes.client import (
+    V1Container,
+    V1EmptyDirVolumeSource,
+    V1EnvVar,
+    V1EnvVarSource,
+    V1JobSpec,
+    V1LocalObjectReference,
+    V1ObjectFieldSelector,
+    V1ObjectMeta,
+    V1PodSpec,
+    V1PodTemplateSpec,
+    V1SecretVolumeSource,
+    V1Volume,
+    V1VolumeMount,
+)
+from pydantic import BaseModel
+
+from reconcile.external_resources.model import (
+    Reconciliation,
+)
+from reconcile.external_resources.state import ReconcileStatus
+from reconcile.utils.jobcontroller.controller import (
+    JobConcurrencyPolicy,
+    K8sJobController,
+)
+from reconcile.utils.jobcontroller.models import K8sJob
+
+
+class ExternalResourcesReconciler(ABC):
+    @abstractmethod
+    def get_resource_reconcile_status(
+        self,
+        reconciliation: Reconciliation,
+    ) -> ReconcileStatus: ...
+
+    @abstractmethod
+    def reconcile_resource(self, reconciliation: Reconciliation) -> None: ...
+
+    @abstractmethod
+    def get_resource_reconcile_logs(self, reconciliation: Reconciliation) -> None: ...
+
+    @abstractmethod
+    def wait_for_reconcile_list_completion(
+        self,
+        reconcile_list: Iterable[Reconciliation],
+        check_interval_seconds: int,
+        timeout_seconds: int,
+    ) -> dict[str, ReconcileStatus]: ...
+
+
+class ReconciliationK8sJob(K8sJob, BaseModel, frozen=True):
+    """
+    Wraps a reconciliation request into a Kubernetes Job
+    """
+
+    reconciliation: Reconciliation
+    is_dry_run: bool = False
+    dry_run_suffix: str = ""
+
+    def name_prefix(self) -> str:
+        if self.is_dry_run:
+            return f"er-dry-run-mr-{self.dry_run_suffix}"
+        else:
+            return "er"
+
+    def unit_of_work_identity(self) -> Any:
+        return self.reconciliation.key
+
+    def description(self) -> str:
+        return f"Action: {self.reconciliation.action}, Key: {self.reconciliation.key} "
+
+    def annotations(self) -> dict[str, Any]:
+        return {
+            "provision_provider": self.reconciliation.key.provision_provider,
+            "provisioner": self.reconciliation.key.provisioner_name,
+            "provider": self.reconciliation.key.provision_provider,
+            "identifier": self.reconciliation.key.identifier,
+        }
+
+    def job_spec(self) -> V1JobSpec:
+        return V1JobSpec(
+            backoff_limit=0,
+            active_deadline_seconds=self.reconciliation.module_configuration.reconcile_timeout_minutes
+            * 60,
+            ttl_seconds_after_finished=3600,
+            template=V1PodTemplateSpec(
+                metadata=V1ObjectMeta(
+                    annotations=self.annotations(), labels=self.labels()
+                ),
+                spec=V1PodSpec(
+                    init_containers=[
+                        V1Container(
+                            name="job",
+                            image=self.reconciliation.module_configuration.image_version,
+                            image_pull_policy="Always",
+                            env=[
+                                V1EnvVar(
+                                    name="DRY_RUN",
+                                    value=str(self.is_dry_run),
+                                ),
+                                V1EnvVar(
+                                    name="ACTION",
+                                    value=self.reconciliation.action.value,
+                                ),
+                            ],
+                            volume_mounts=[
+                                V1VolumeMount(
+                                    name="credentials",
+                                    mount_path="/credentials",
+                                    sub_path="credentials",
+                                ),
+                                V1VolumeMount(
+                                    name="workdir",
+                                    mount_path="/work",
+                                ),
+                                self.scripts_volume_mount("/inputs"),
+                            ],
+                        )
+                    ],
+                    containers=[
+                        V1Container(
+                            name="outputs",
+                            image="quay.io/app-sre/er-outputs-secrets:0.0.1",
+                            command=["/bin/bash", "/app/entrypoint.sh"],
+                            image_pull_policy="Always",
+                            env=[
+                                V1EnvVar(
+                                    name="NAMESPACE",
+                                    value_from=V1EnvVarSource(
+                                        field_ref=V1ObjectFieldSelector(
+                                            field_path="metadata.namespace"
+                                        )
+                                    ),
+                                ),
+                                V1EnvVar(
+                                    name="ACTION",
+                                    value=self.reconciliation.action,
+                                ),
+                                V1EnvVar(
+                                    name="DRY_RUN",
+                                    value=str(self.is_dry_run),
+                                ),
+                            ],
+                            volume_mounts=[
+                                V1VolumeMount(
+                                    name="credentials",
+                                    mount_path="/.aws/credentials",
+                                    sub_path="credentials",
+                                ),
+                                V1VolumeMount(
+                                    name="workdir",
+                                    mount_path="/work",
+                                ),
+                                self.scripts_volume_mount("/inputs"),
+                            ],
+                        )
+                    ],
+                    image_pull_secrets=[V1LocalObjectReference(name="quay.io")],
+                    volumes=[
+                        V1Volume(
+                            name="credentials",
+                            secret=V1SecretVolumeSource(
+                                secret_name=f"credentials-{self.reconciliation.key.provisioner_name}",
+                            ),
+                        ),
+                        V1Volume(
+                            name="workdir",
+                            empty_dir=V1EmptyDirVolumeSource(size_limit="10Mi"),
+                        ),
+                        self.scripts_volume(),
+                    ],
+                    restart_policy="Never",
+                    service_account_name="external-resources-sa",
+                ),
+            ),
+        )
+
+    def scripts(self) -> dict[str, str]:
+        return {"input.json": self.reconciliation.input}
+
+
+class K8sExternalResourcesReconciler(ExternalResourcesReconciler):
+    def __init__(
+        self, controller: K8sJobController, dry_run: bool, dry_run_job_suffix: str = ""
+    ) -> None:
+        self.controller = controller
+        self.dry_run = dry_run
+        self.dry_run_job_suffix = dry_run_job_suffix
+
+    def get_resource_reconcile_status(
+        self,
+        reconciliation: Reconciliation,
+    ) -> ReconcileStatus:
+        job_name = ReconciliationK8sJob(reconciliation=reconciliation).name()
+        return ReconcileStatus(self.controller.get_job_status(job_name))
+
+    def reconcile_resource(self, reconciliation: Reconciliation) -> None:
+        concurrency_policy = (
+            JobConcurrencyPolicy.REPLACE_FAILED | JobConcurrencyPolicy.REPLACE_FINISHED
+        )
+        if self.dry_run:
+            concurrency_policy = (
+                JobConcurrencyPolicy.REPLACE_FAILED
+                | JobConcurrencyPolicy.REPLACE_FINISHED
+                | JobConcurrencyPolicy.REPLACE_IN_PROGRESS
+            )
+
+        self.controller.enqueue_job(
+            ReconciliationK8sJob(
+                reconciliation=reconciliation,
+                is_dry_run=self.dry_run,
+                dry_run_suffix=self.dry_run_job_suffix,
+            ),
+            concurrency_policy=concurrency_policy,
+        )
+
+    def wait_for_reconcile_list_completion(
+        self,
+        reconcile_list: Iterable[Reconciliation],
+        check_interval_seconds: int,
+        timeout_seconds: int,
+    ) -> dict[str, ReconcileStatus]:
+        job_names = {
+            ReconciliationK8sJob(
+                reconciliation=r,
+                is_dry_run=self.dry_run,
+                dry_run_suffix=self.dry_run_job_suffix,
+            ).name()
+            for r in reconcile_list
+        }
+        job_status = self.controller.wait_for_job_list_completion(
+            job_names=job_names,
+            check_interval_seconds=check_interval_seconds,
+            timeout_seconds=timeout_seconds,
+        )
+        return {job: ReconcileStatus(status) for job, status in job_status.items()}
+
+    def get_resource_reconcile_logs(self, reconciliation: Reconciliation) -> None:
+        job = ReconciliationK8sJob(
+            reconciliation=reconciliation,
+            is_dry_run=True,
+            dry_run_suffix=self.dry_run_job_suffix,
+        )
+        self.controller.get_job_logs(job_name=job.name(), output=sys.stdout)

reconcile/external_resources/secrets_sync.py

@@ -0,0 +1,229 @@
+import base64
+import json
+from abc import abstractmethod
+from collections.abc import Iterable, Mapping
+from hashlib import shake_128
+from typing import Any, Optional, cast
+
+from pydantic import BaseModel
+from sretoolbox.utils import retry
+
+from reconcile.external_resources.meta import (
+    QONTRACT_INTEGRATION,
+    QONTRACT_INTEGRATION_VERSION,
+)
+from reconcile.typed_queries.clusters_minimal import get_clusters_minimal
+from reconcile.utils.differ import diff_mappings
+from reconcile.utils.external_resource_spec import (
+    ExternalResourceSpec,
+)
+from reconcile.utils.oc import (
+    OCCli,
+)
+from reconcile.utils.oc_map import OCMap, init_oc_map_from_clusters
+from reconcile.utils.openshift_resource import OpenshiftResource, ResourceInventory
+from reconcile.utils.secret_reader import SecretReaderBase
+from reconcile.utils.three_way_diff_strategy import three_way_diff_using_hash
+from reconcile.utils.vault import (
+    VaultClient,
+    _VaultClient,  # noqa
+)
+
+
+class VaultSecret(BaseModel):
+    """Generic class to use the Protocol with Dicts"""
+
+    path: str
+    field: str
+    version: Optional[int]
+    q_format: Optional[str]
+
+
+class SecretsReconciler:
+    def __init__(
+        self,
+        ri: ResourceInventory,
+        secrets_reader: SecretReaderBase,
+        vault_path: str,
+        vault_client: VaultClient,
+    ) -> None:
+        self.secrets_reader = secrets_reader
+        self.ri = ri
+        self.vault_path = vault_path
+        self.vault_client = cast(_VaultClient, vault_client)
+
+    @abstractmethod
+    def _populate_secret_data(self, specs: Iterable[ExternalResourceSpec]) -> None:
+        raise NotImplementedError()
+
+    def _populate_annotations(self, spec: ExternalResourceSpec) -> None:
+        try:
+            annotations = json.loads(spec.resource["annotations"])
+        except Exception:
+            annotations = {}
+
+        annotations["provision_provider"] = spec.provision_provider
+        annotations["provisioner"] = spec.provisioner_name
+        annotations["provider"] = spec.provider
+        annotations["identifier"] = spec.identifier
+
+        spec.resource["annotations"] = json.dumps(annotations)
+
+    def _initialize_ri(
+        self,
+        ri: ResourceInventory,
+        specs: Iterable[ExternalResourceSpec],
+    ) -> None:
+        for spec in specs:
+            ri.initialize_resource_type(
+                spec.cluster_name, spec.namespace_name, "Secret"
+            )
+            ri.add_desired(
+                spec.cluster_name,
+                spec.namespace_name,
+                "Secret",
+                name=spec.output_resource_name,
+                value=spec.build_oc_secret(
+                    QONTRACT_INTEGRATION, QONTRACT_INTEGRATION_VERSION
+                ),
+            )
+
+    def _init_ocmap(self, specs: Iterable[ExternalResourceSpec]) -> OCMap:
+        return init_oc_map_from_clusters(
+            clusters=[
+                c
+                for c in get_clusters_minimal()
+                if c.name in [o.cluster_name for o in specs]
+            ],
+            secret_reader=self.secrets_reader,
+            integration=QONTRACT_INTEGRATION,
+        )
+
+    @retry()
+    def _write_secrets_to_vault(self, spec: ExternalResourceSpec) -> None:
+        if spec.secret:
+            secret_path = f"{self.vault_path}/{QONTRACT_INTEGRATION}/{spec.cluster_name}/{spec.namespace_name}/{spec.output_resource_name}"
+            stringified_secret = {k: str(v) for k, v in spec.secret.items()}
+            desired_secret = {"path": secret_path, "data": stringified_secret}
+            self.vault_client.write(desired_secret, decode_base64=False)
+
+    def sync_secrets(self, specs: Iterable[ExternalResourceSpec]) -> None:
+        self._populate_secret_data(specs)
+        ri = ResourceInventory()
+        self._initialize_ri(ri, specs)
+        ocmap = self._init_ocmap(specs)
+        for item in ri:
+            self.reconcile_data(item, ri, ocmap)
+
+    def reconcile_data(
+        self,
+        ri_item: tuple[str, str, str, Mapping[str, Any]],
+        ri: ResourceInventory,
+        ocmap: OCMap,
+    ) -> None:
+        cluster, namespace, kind, data = ri_item
+        oc = ocmap.get_cluster(cluster)
+        names = list(data["desired"].keys())
+
+        items = oc.get_items("Secret", namespace=namespace, resource_names=names)
+        for item in items:
+            obj = OpenshiftResource(
+                body=item,
+                integration=QONTRACT_INTEGRATION,
+                integration_version=QONTRACT_INTEGRATION_VERSION,
+            )
+            ri.add_current(cluster, namespace, kind, name=obj.name, value=obj)
+
+        diff = diff_mappings(
+            data["current"], data["desired"], equal=three_way_diff_using_hash
+        )
+        items_to_update = [i.desired for i in diff.change.values()] + list(
+            diff.add.values()
+        )
+        self.apply_action(oc, namespace, items_to_update)
+
+    def apply_action(
+        self, oc: OCCli, namespace: str, items: Iterable[OpenshiftResource]
+    ) -> None:
+        for i in items:
+            oc.apply(namespace, resource=i)
+
+
+class InClusterSecretsReconciler(SecretsReconciler):
+    def __init__(
+        self,
+        ri: ResourceInventory,
+        secrets_reader: SecretReaderBase,
+        vault_path: str,
+        vault_client: VaultClient,
+        cluster: str,
+        namespace: str,
+        oc: OCCli,
+    ):
+        super().__init__(ri, secrets_reader, vault_path, vault_client)
+
+        self.cluster = cluster
+        self.namespace = namespace
+        self.oc = oc
+        self.source_secrets: list[str] = []
+
+    def _get_spec_hash(self, spec: ExternalResourceSpec) -> str:
+        secret_key = f"{spec.provision_provider}-{spec.provisioner_name}-{spec.provider}-{spec.identifier}"
+        return shake_128(secret_key.encode("utf-8")).hexdigest(16)
+
+    def _populate_secret_data(self, specs: Iterable[ExternalResourceSpec]) -> None:
+        if not specs:
+            return
+        secrets_map = {
+            "external-resources-output-" + self._get_spec_hash(spec): spec
+            for spec in specs
+        }
+        secrets = self.oc.get_items(
+            "Secret", namespace=self.namespace, resource_names=list(secrets_map.keys())
+        )
+        for secret in secrets:
+            secret_name = secret["metadata"]["name"]
+            spec = secrets_map[secret_name]
+            data = dict[str, str]()
+            for k, v in secret["data"].items():
+                decoded = base64.b64decode(v).decode("utf-8")
+                if decoded.startswith("__vault__:"):
+                    _secret_ref = json.loads(decoded.replace("__vault__:", ""))
+                    secret_ref = VaultSecret(**_secret_ref)
+                    data[k] = self.secrets_reader.read_secret(secret_ref)
+                else:
+                    data[k] = decoded
+            spec.secret = data
+
+        self.source_secrets = list(secrets_map.keys())
+
+    def _delete_source_secrets(self) -> None:
+        for secret_name in self.source_secrets:
+            print("Deleting secret " + secret_name)
+            self.oc.delete(namespace=self.namespace, kind="Secret", name=secret_name)
+
+    def sync_secrets(self, specs: Iterable[ExternalResourceSpec]) -> None:
+        super().sync_secrets(specs)
+        self._delete_source_secrets()
+
+
+def build_incluster_secrets_reconciler(
+    cluster: str, namespace: str, secrets_reader: SecretReaderBase, vault_path: str
+) -> InClusterSecretsReconciler:
+    ri = ResourceInventory()
+    ocmap = init_oc_map_from_clusters(
+        clusters=[c for c in get_clusters_minimal() if c.name == cluster],
+        secret_reader=secrets_reader,
+        integration=QONTRACT_INTEGRATION,
+    )
+    oc = ocmap.get_cluster(cluster)
+    vault_client = VaultClient()
+    return InClusterSecretsReconciler(
+        cluster=cluster,
+        namespace=namespace,
+        ri=ri,
+        oc=oc,
+        vault_path=vault_path,
+        vault_client=vault_client,
+        secrets_reader=secrets_reader,
+    )