qontract-reconcile 0.10.1rc765__py3-none-any.whl → 0.10.1rc766__py3-none-any.whl

{qontract_reconcile-0.10.1rc765.dist-info → qontract_reconcile-0.10.1rc766.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc765
+Version: 0.10.1rc766
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc765.dist-info → qontract_reconcile-0.10.1rc766.dist-info}/RECORD

@@ -308,7 +308,7 @@ reconcile/gql_definitions/jira_permissions_validator/jira_boards_for_permissions
 reconcile/gql_definitions/jumphosts/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/jumphosts/jumphosts.py,sha256=gN595lx7K1XsB2AfxDQ911TBVBbCoxibVeujnsGue_Q,2371
 reconcile/gql_definitions/ldap_groups/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/ldap_groups/roles.py,sha256=RVTDgMExKb2BGq4dVeBYm5p7HMJlbjme-YkUWh8ikkA,2612
+reconcile/gql_definitions/ldap_groups/roles.py,sha256=goGDnkBBFy0mdLsXqL9qlSLPCFd9rwiD1rrsIH-6nZQ,2888
 reconcile/gql_definitions/ldap_groups/settings.py,sha256=KR6eKqXQWVYZAUEdatL1RCARaTOWl9X-QmxEMVjVNDE,2227
 reconcile/gql_definitions/membershipsources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/membershipsources/roles.py,sha256=d3nv3GLsj_eKgwB1glsiK6smpC4i16WO3dU5rIdRg94,3678
@@ -377,7 +377,7 @@ reconcile/gql_definitions/vpc_peerings_validator/vpc_peerings_validator_peered_c
 reconcile/jenkins/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/jenkins/types.py,sha256=0UlyJxv3KY1WXHkfI_ghUI6FAwRJTL4EwvLg-62tNcg,3001
 reconcile/ldap_groups/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/ldap_groups/integration.py,sha256=iVfR7bRz8up_bf5Q4aVZHuVoUT6U_aHHkcgY4S9RwqA,10113
+reconcile/ldap_groups/integration.py,sha256=Jj4jWp1aypkoweVNQj7QzMtFKQIWeaunLtXZ8KyKOHE,10670
 reconcile/ocm/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/ocm/types.py,sha256=ibJYvzfAZyyMFkcF1bP8u3rkXciYJRplt_7Z1pKHFh0,2484
 reconcile/ocm_internal_notifications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -692,7 +692,7 @@ reconcile/utils/glitchtip/client.py,sha256=KHUNjN8r2J67RxROIpjzs5cKsqbwjzsM_I1TA
 reconcile/utils/glitchtip/models.py,sha256=_oqZXNkyRTsAnx6tF4WUURSBj0cc9UNS4okOQYfAfB4,6435
 reconcile/utils/internal_groups/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/utils/internal_groups/client.py,sha256=abREA8RwXKybXFjCK8CAcCr-iUp2r0tAbIEJ-c-PXws,4538
-reconcile/utils/internal_groups/models.py,sha256=jlkH_hyyyuwS0J1IpuS7W1AyQSKQ2QpHelXoH36edbE,2316
+reconcile/utils/internal_groups/models.py,sha256=GSkF6fVcdbl774q51ZFUmNfSJPta03OcV67MgsuBR2E,2326
 reconcile/utils/jinja2/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/utils/jinja2/extensions.py,sha256=zV_x8MhSHAynKhFnG3fULXrwsm5fUG_88IygZHSnN0o,1284
 reconcile/utils/jinja2/filters.py,sha256=_kJjdMsY3lGS5PUn4NnpXUQDNrL1IwiKsB-0MhTMGYM,4521
@@ -782,8 +782,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=SX7qL3D1SIRKFo95FoQztvf
 tools/test/test_qontract_cli.py,sha256=w2l4BHB09k1d-BGJ1jBUNCqDv7zkqYrMHojQXg-21kQ,4155
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc765.dist-info/METADATA,sha256=jvfPojPDE35EHICj36iXRI8v0jcPR9pHsqy5dacJiVE,2382
-qontract_reconcile-0.10.1rc765.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-qontract_reconcile-0.10.1rc765.dist-info/entry_points.txt,sha256=rIxI5zWtHNlfpDeq1a7pZXAPoqf7HG32KMTN3MeWK_8,429
-qontract_reconcile-0.10.1rc765.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc765.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc766.dist-info/METADATA,sha256=tFpqi2YNRp9SyjmZicHUP7W6onmCER5zHM7Y-fD6qa0,2382
+qontract_reconcile-0.10.1rc766.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+qontract_reconcile-0.10.1rc766.dist-info/entry_points.txt,sha256=rIxI5zWtHNlfpDeq1a7pZXAPoqf7HG32KMTN3MeWK_8,429
+qontract_reconcile-0.10.1rc766.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc766.dist-info/RECORD,,

reconcile/gql_definitions/ldap_groups/roles.py

@@ -33,7 +33,11 @@ fragment AWSAccountSSO on AWSAccount_v1 {
 query LdapGroupsRolesQuery {
   roles: roles_v1 {
     name
-    ldapGroup
+    ldapGroup {
+      name
+      notes
+      membersAreOwners
+    }
     users {
       org_username
     }
@@ -58,6 +62,12 @@ class ConfiguredBaseModel(BaseModel):
         extra=Extra.forbid
 
 
+class LdapGroupV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    notes: Optional[str] = Field(..., alias="notes")
+    members_are_owners: Optional[bool] = Field(..., alias="membersAreOwners")
+
+
 class UserV1(ConfiguredBaseModel):
     org_username: str = Field(..., alias="org_username")
 
@@ -72,7 +82,7 @@ class AWSGroupV1(ConfiguredBaseModel):
 
 class RoleV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
-    ldap_group: Optional[str] = Field(..., alias="ldapGroup")
+    ldap_group: Optional[LdapGroupV1] = Field(..., alias="ldapGroup")
     users: list[UserV1] = Field(..., alias="users")
     user_policies: Optional[list[AWSUserPolicyV1]] = Field(..., alias="user_policies")
     aws_groups: Optional[list[AWSGroupV1]] = Field(..., alias="aws_groups")

reconcile/ldap_groups/integration.py

@@ -93,12 +93,12 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
         desired_groups_for_roles = self.get_desired_groups_for_roles(
             roles,
             contact_list=self.settings.contact_list,
-            owners=[owner],
+            default_owners=[owner],
         )
         desired_groups_for_aws_roles = self.get_desired_groups_for_aws_roles(
             roles,
             contact_list=self.settings.contact_list,
-            owners=[owner],
+            default_owners=[owner],
         )
         desired_groups = desired_groups_for_roles + desired_groups_for_aws_roles
 
@@ -147,7 +147,7 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
         data = roles_query(query_func, variables={})
         roles = [role for role in data.roles or []]
         if duplicates := find_duplicates(
-            role.ldap_group for role in roles if role.ldap_group
+            role.ldap_group.name for role in roles if role.ldap_group
         ):
             for dup in duplicates:
                 logging.error(f"{dup} is already in use by another role.")
@@ -155,30 +155,39 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
         return roles
 
     def get_desired_groups_for_roles(
-        self, roles: Iterable[RoleV1], owners: Iterable[Entity], contact_list: str
+        self,
+        roles: Iterable[RoleV1],
+        default_owners: list[Entity],
+        contact_list: str,
     ) -> list[Group]:
         """Return the desired rover groups for the given roles."""
-        return [
-            Group(
-                name=role.ldap_group,
-                description="Persisted App-Interface role. Managed by qontract-reconcile",
-                display_name=f"{role.ldap_group} (App-Interface))",
-                members=[
-                    Entity(type=EntityType.USER, id=user.org_username)
-                    for user in role.users
-                ],
-                # only owners can modify the group (e.g. add/remove members)
-                owners=owners,
-                contact_list=contact_list,
+        groups = []
+        for role in roles:
+            if not role.ldap_group:
+                continue
+            members = [
+                Entity(type=EntityType.USER, id=user.org_username)
+                for user in role.users
+            ]
+            groups.append(
+                Group(
+                    name=role.ldap_group.name,
+                    description="Persisted App-Interface role. Managed by qontract-reconcile",
+                    notes=role.ldap_group.notes,
+                    display_name=f"{role.ldap_group.name} (App-Interface))",
+                    members=members,
+                    owners=default_owners
+                    if not role.ldap_group.members_are_owners
+                    else default_owners + members,
+                    contact_list=contact_list,
+                )
             )
-            for role in roles
-            if role.ldap_group
-        ]
+        return groups
 
     def get_desired_groups_for_aws_roles(
         self,
         roles: Iterable[RoleV1],
-        owners: list[Entity],
+        default_owners: Iterable[Entity],
         contact_list: str,
     ) -> list[Group]:
         """Return the desired rover groups for all AWS roles."""
@@ -205,7 +214,7 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
                             for user in role.users
                         ],
                         # only owners can modify the group (e.g. add/remove members)
-                        owners=owners,
+                        owners=default_owners,
                         contact_list=contact_list,
                     )
                 )
@@ -246,7 +255,9 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
             logging.info([
                 "create_ldap_group",
                 group_to_add.name,
-                f"users={', '.join(u.id for u in group_to_add.members)}",
+                f"members={', '.join(u.id for u in group_to_add.members)}",
+                f"owners={', '.join(u.id for u in group_to_add.owners)}",
+                f"notes={group_to_add.notes}",
             ])
             if not dry_run:
                 internal_groups_client.create_group(group_to_add)
@@ -266,7 +277,9 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
             logging.info([
                 "update_ldap_group",
                 group_to_update.name,
-                f"users={', '.join(u.id for u in group_to_update.members)}",
+                f"members={', '.join(u.id for u in group_to_update.members)}",
+                f"owners={', '.join(u.id for u in group_to_update.owners)}",
+                f"notes={group_to_update.notes}",
             ])
             if not dry_run:
                 internal_groups_client.update_group(group_to_update)

reconcile/utils/internal_groups/models.py

@@ -54,7 +54,7 @@ class Group(BaseModel):
             self.description == other.description
             and self.member_approval_type == other.member_approval_type
             and self.contact_list == other.contact_list
-            and self.owners == other.owners
+            and set(self.owners) == set(other.owners)
             and self.display_name == other.display_name
             and self.notes == other.notes
             and set(self.members) == set(other.members)