qontract-reconcile 0.10.1rc830__py3-none-any.whl → 0.10.1rc832__py3-none-any.whl

{qontract_reconcile-0.10.1rc830.dist-info → qontract_reconcile-0.10.1rc832.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc830
+Version: 0.10.1rc832
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc830.dist-info → qontract_reconcile-0.10.1rc832.dist-info}/RECORD

@@ -10,7 +10,7 @@ reconcile/aws_iam_password_reset.py,sha256=NwErtrqgBiXr7eGCAHdtGGOx0S7-4JnSc29Ie
 reconcile/aws_support_cases_sos.py,sha256=Jk6_XjDeJSYxgRGqcEAOcynt9qJF2r5HPIPcSKmoBv8,2974
 reconcile/blackbox_exporter_endpoint_monitoring.py,sha256=W_VJagnsJR1v5oqjlI3RJJE0_nhtJ0m81RS8zWA5u5c,3538
 reconcile/checkpoint.py,sha256=R2WFXUXLTB4sWMi4GeA4eegsuf_1-Q4vH8M0Toh3Ij4,5036
-reconcile/cli.py,sha256=UnVVYcG6lqGAhUcXXCUsxw-eVlU4AyHjI5fAE4E_4DQ,101994
+reconcile/cli.py,sha256=bRYr5vnUstP3dkRmt3NOyCaA4n-1xIxQU6vooISgFTk,102404
 reconcile/closedbox_endpoint_monitoring_base.py,sha256=SMhkcQqprWvThrIJa3U_3uh5w1h-alleW1QnCJFY4Qw,4909
 reconcile/cluster_deployment_mapper.py,sha256=2Ah-nu-Mdig0pjuiZl_XLrmVAjYzFjORR3dMlCgkmw0,2352
 reconcile/dashdotdb_base.py,sha256=R2JuwiXAEYAFiCtnztM_IIr1rtVzPpaWAmgxuDa2FgY,4813
@@ -115,7 +115,7 @@ reconcile/terraform_repo.py,sha256=xkp5EiRQ7cz-IquXiBq5plvBQLf910tqywKK0B_QlPM,1
 reconcile/terraform_resources.py,sha256=BN8XuJwjOt1ztruEAHydkd0YiBlb3fHZ7n0snZtRhck,19356
 reconcile/terraform_tgw_attachments.py,sha256=S5IP7RmnVuVSOIPXFlUX2srGBrBBeH2uM4J6ewHCvOQ,18797
 reconcile/terraform_users.py,sha256=9rgbM572LfmOSnV3uCP20G_Cw6T7due94g8rhhiz904,10225
-reconcile/terraform_vpc_peerings.py,sha256=rnDH1u93OyzrBM8Hib0HwSnlxZtx4ScRQaZAcn3mx-k,25402
+reconcile/terraform_vpc_peerings.py,sha256=WhGvDHwllM36yTJPE5EzQ1Z0Oc-tT9ksXbBn5cpFBBg,27676
 reconcile/vault_replication.py,sha256=79GZ_kCimPoQcxkdhkWTQxPOAa46E0mNhf05s_Mk5so,17385
 reconcile/vpc_peerings_validator.py,sha256=Kv22HJVlTW9l9GB2eXwjPWqdDbr_VuvQBNPttox6s5o,7177
 reconcile/aus/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -537,8 +537,8 @@ reconcile/test/test_terraform_repo.py,sha256=j9mLfwiK707U2KRxYpvzAbOYywk__pL9SXA
 reconcile/test/test_terraform_resources.py,sha256=EFCqPI5_G8hPRh1zmnU91o8wMeT2qK1CabDUa_X1rSk,15283
 reconcile/test/test_terraform_tgw_attachments.py,sha256=rHZHUtDxewpKsRj3nfm2bZ2JoQ4CWiN2nQM-SWkMopg,41047
 reconcile/test/test_terraform_users.py,sha256=XOAfGvITCJPI1LTlISmHbA4ONMQMkxYUMTsny7pQCFw,4319
-reconcile/test/test_terraform_vpc_peerings.py,sha256=ubcsKh0TrUIwuI1-W3ETIgzsFvzAyeoFmEJFC-IK6JY,20538
-reconcile/test/test_terraform_vpc_peerings_build_desired_state.py,sha256=DAfpb12I0PlqnuVUHK2vh4LH4d1OylT3H2GE_3TGZZI,47852
+reconcile/test/test_terraform_vpc_peerings.py,sha256=Btl0ym7NmO2QFST9Xviz4OO1RjJuhCp1Xhix5A3e_HQ,20822
+reconcile/test/test_terraform_vpc_peerings_build_desired_state.py,sha256=7VAFVbjlnnUJoOkZ4ApDc1lHFj38Zj4yrbDKvWkqWXE,49545
 reconcile/test/test_three_way_diff_strategy.py,sha256=0QY2hzOrTVnQxDFbdOJBOIIHEKKOA5RmGftT0QXABeY,3697
 reconcile/test/test_utils_jinja2.py,sha256=TpzQlpFnLGzNEZp5WOh0o7AuBiGEktqO4MuwiiJW2YY,3895
 reconcile/test/test_vault_replication.py,sha256=wlc4jm9f8P641UvvxIFFFc5_unJysNkOVrKJscjhQr0,16867
@@ -812,8 +812,8 @@ tools/test/test_app_interface_metrics_exporter.py,sha256=SX7qL3D1SIRKFo95FoQztvf
 tools/test/test_qontract_cli.py,sha256=_D61RFGAN5x44CY1tYbouhlGXXABwYfxKSWSQx3Jrss,4941
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc830.dist-info/METADATA,sha256=dFJyqmQPBYPDrL163PxcGXf0YY_SvLi75h_E5O5d5nQ,2314
-qontract_reconcile-0.10.1rc830.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-qontract_reconcile-0.10.1rc830.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
-qontract_reconcile-0.10.1rc830.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc830.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc832.dist-info/METADATA,sha256=7yMOQ62RfKBicCBhKjtcwL8CN6tJUQvFOH6K5lBcDP0,2314
+qontract_reconcile-0.10.1rc832.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+qontract_reconcile-0.10.1rc832.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
+qontract_reconcile-0.10.1rc832.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc832.dist-info/RECORD,,

reconcile/cli.py

@@ -2296,9 +2296,19 @@ def terraform_users(
 @binary_version("terraform", ["version"], TERRAFORM_VERSION_REGEX, TERRAFORM_VERSION)
 @enable_deletion(default=False)
 @account_name
+@enable_extended_early_exit
+@extended_early_exit_cache_ttl_seconds
+@log_cached_log_output
 @click.pass_context
 def terraform_vpc_peerings(
-    ctx, print_to_file, enable_deletion, thread_pool_size, account_name
+    ctx,
+    print_to_file,
+    enable_deletion,
+    thread_pool_size,
+    account_name,
+    enable_extended_early_exit,
+    extended_early_exit_cache_ttl_seconds,
+    log_cached_log_output,
 ):
     import reconcile.terraform_vpc_peerings
 
@@ -2311,6 +2321,9 @@ def terraform_vpc_peerings(
         enable_deletion,
         thread_pool_size,
         account_name,
+        enable_extended_early_exit=enable_extended_early_exit,
+        extended_early_exit_cache_ttl_seconds=extended_early_exit_cache_ttl_seconds,
+        log_cached_log_output=log_cached_log_output,
     )
 
 

reconcile/terraform_vpc_peerings.py

@@ -1,10 +1,8 @@
 import json
 import logging
 import sys
-from typing import (
-    Any,
-    Optional,
-)
+from collections.abc import Callable, Iterable, Mapping
+from typing import Any, TypedDict
 
 import reconcile.utils.terraform_client as terraform
 import reconcile.utils.terrascript_aws_client as terrascript
@@ -15,11 +13,16 @@ from reconcile.utils import (
 )
 from reconcile.utils.aws_api import AWSApi
 from reconcile.utils.defer import defer
+from reconcile.utils.extended_early_exit import (
+    ExtendedEarlyExitRunnerResult,
+    extended_early_exit_run,
+)
 from reconcile.utils.ocm import (
     OCM,
     OCMMap,
 )
 from reconcile.utils.semver_helper import make_semver
+from reconcile.utils.unleash.client import get_feature_toggle_state
 
 QONTRACT_INTEGRATION = "terraform_vpc_peerings"
 QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
@@ -29,7 +32,11 @@ class BadTerraformPeeringState(Exception):
     pass
 
 
-def find_matching_peering(from_cluster, to_cluster, desired_provider):
+def find_matching_peering(
+    from_cluster: Mapping[str, Any],
+    to_cluster: Mapping[str, Any],
+    desired_provider: str,
+) -> Mapping[str, Any] | None:
     """
     Ensures there is a matching peering with the desired provider type
     going from the destination (to) cluster back to this one (from)
@@ -47,8 +54,8 @@ def find_matching_peering(from_cluster, to_cluster, desired_provider):
 
 
 def _get_default_management_account(
-    cluster: dict[str, Any],
-) -> Optional[dict[str, Any]]:
+    cluster: Mapping[str, Any],
+) -> Mapping[str, Any] | None:
     cluster_infra_accounts = cluster["awsInfrastructureManagementAccounts"]
     for infra_account_def in cluster_infra_accounts or []:
         if (
@@ -60,11 +67,11 @@ def _get_default_management_account(
 
 
 def _build_infrastructure_assume_role(
-    account: dict[str, Any],
-    cluster: dict[str, Any],
-    ocm: Optional[OCM],
-    provided_assume_role: Optional[str],
-) -> Optional[dict[str, Any]]:
+    account: Mapping[str, Any],
+    cluster: Mapping[str, Any],
+    ocm: OCM | None,
+    provided_assume_role: str | None,
+) -> dict[str, Any] | None:
     if provided_assume_role:
         assume_role = provided_assume_role
     elif cluster["spec"].get("account"):
@@ -97,11 +104,11 @@ def _build_infrastructure_assume_role(
 
 
 def aws_assume_roles_for_cluster_vpc_peering(
-    requester_connection: dict[str, Any],
-    requester_cluster: dict[str, Any],
-    accepter_connection: dict[str, Any],
-    accepter_cluster: dict[str, Any],
-    ocm: Optional[OCM],
+    requester_connection: Mapping[str, Any],
+    requester_cluster: Mapping[str, Any],
+    accepter_connection: Mapping[str, Any],
+    accepter_cluster: Mapping[str, Any],
+    ocm: OCM | None,
 ) -> tuple[str, dict[str, Any], dict[str, Any]]:
     # check if dedicated infra accounts have been declared on the
     # accepters peering connection or on the accepters cluster
@@ -159,8 +166,11 @@ def aws_assume_roles_for_cluster_vpc_peering(
 
 
 def build_desired_state_single_cluster(
-    cluster_info, ocm: Optional[OCM], awsapi: AWSApi, account_filter: Optional[str]
-):
+    cluster_info: Mapping[str, Any],
+    ocm: OCM | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> list[dict[str, Any]]:
     cluster_name = cluster_info["name"]
 
     peerings = []
@@ -268,8 +278,11 @@ def build_desired_state_single_cluster(
 
 
 def build_desired_state_all_clusters(
-    clusters, ocm_map: Optional[OCMMap], awsapi: AWSApi, account_filter: Optional[str]
-):
+    clusters: Iterable[Mapping[str, Any]],
+    ocm_map: OCMMap | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> tuple[list[dict[str, Any]], bool]:
     """
     Fetch state for VPC peerings between two OCM clusters
     """
@@ -292,8 +305,11 @@ def build_desired_state_all_clusters(
 
 
 def build_desired_state_vpc_mesh_single_cluster(
-    cluster_info, ocm: Optional[OCM], awsapi: AWSApi, account_filter: Optional[str]
-):
+    cluster_info: Mapping[str, Any],
+    ocm: OCM | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> list[dict[str, Any]]:
     desired_state = []
 
     cluster = cluster_info["name"]
@@ -386,8 +402,11 @@ def build_desired_state_vpc_mesh_single_cluster(
 
 
 def build_desired_state_vpc_mesh(
-    clusters, ocm_map: Optional[OCMMap], awsapi: AWSApi, account_filter: Optional[str]
-):
+    clusters: Iterable[Mapping[str, Any]],
+    ocm_map: OCMMap | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> tuple[list[dict[str, Any]], bool]:
     """
     Fetch state for VPC peerings between a cluster and all VPCs in an account
     """
@@ -410,8 +429,11 @@ def build_desired_state_vpc_mesh(
 
 
 def build_desired_state_vpc_single_cluster(
-    cluster_info, ocm: Optional[OCM], awsapi: AWSApi, account_filter: Optional[str]
-):
+    cluster_info: Mapping[str, Any],
+    ocm: OCM | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> list[dict[str, Any]]:
     desired_state = []
 
     peering_info = cluster_info["peering"]
@@ -506,15 +528,18 @@ def build_desired_state_vpc_single_cluster(
     return desired_state
 
 
-def _private_hosted_control_plane(cluster_info: dict[str, Any]) -> bool:
+def _private_hosted_control_plane(cluster_info: Mapping[str, Any]) -> bool:
     return bool(
         cluster_info["spec"].get("hypershift") and cluster_info["spec"].get("private")
     )
 
 
 def build_desired_state_vpc(
-    clusters, ocm_map: Optional[OCMMap], awsapi: AWSApi, account_filter: Optional[str]
-):
+    clusters: Iterable[Mapping[str, Any]],
+    ocm_map: OCMMap | None,
+    awsapi: AWSApi,
+    account_filter: str | None,
+) -> tuple[list[dict[str, Any]], bool]:
     """
     Fetch state for VPC peerings between a cluster and a VPC (account)
     """
@@ -538,13 +563,16 @@ def build_desired_state_vpc(
 
 @defer
 def run(
-    dry_run,
-    print_to_file=None,
-    enable_deletion=False,
-    thread_pool_size=10,
-    account_name: Optional[str] = None,
-    defer=None,
-):
+    dry_run: bool,
+    print_to_file: bool | None = None,
+    enable_deletion: bool = False,
+    thread_pool_size: int = 10,
+    account_name: str | None = None,
+    enable_extended_early_exit: bool = False,
+    extended_early_exit_cache_ttl_seconds: int = 3600,
+    log_cached_log_output: bool = False,
+    defer: Callable | None = None,
+) -> None:
     settings = queries.get_secret_reader_settings()
     clusters = queries.get_clusters_with_peering_settings()
     with_ocm = any(c.get("ocm") for c in clusters)
@@ -638,10 +666,14 @@ def run(
             ts.populate_additional_providers(infra_account_name, items)
         ts.populate_vpc_peerings(desired_state)
         working_dirs = ts.dump(print_to_file=print_to_file)
+        terraform_configurations = ts.terraform_configurations()
 
     if print_to_file:
         sys.exit(0 if dry_run else int(any(errors)))
 
+    if any(errors):
+        sys.exit(1)
+
     tf = terraform.TerraformClient(
         QONTRACT_INTEGRATION,
         QONTRACT_INTEGRATION_VERSION,
@@ -651,34 +683,68 @@ def run(
         thread_pool_size,
         awsapi,
     )
+    if defer:
+        defer(tf.cleanup)
 
-    if any(errors):
-        sys.exit(1)
+    runner_params: RunnerParams = dict(
+        tf=tf,
+        dry_run=dry_run,
+        enable_deletion=enable_deletion,
+    )
+
+    if enable_extended_early_exit and get_feature_toggle_state(
+        "terraform-vpc-peerings-extended-early-exit",
+        default=True,
+    ):
+        cache_source = CacheSource(terraform_configurations=terraform_configurations)
+        extended_early_exit_run(
+            integration=QONTRACT_INTEGRATION,
+            integration_version=QONTRACT_INTEGRATION_VERSION,
+            dry_run=dry_run,
+            cache_source=cache_source,
+            shard=account_name if account_name else "",
+            ttl_seconds=extended_early_exit_cache_ttl_seconds,
+            logger=logging.getLogger(),
+            runner=runner,
+            runner_params=runner_params,
+            log_cached_log_output=log_cached_log_output,
+        )
+    else:
+        runner(**runner_params)
+
+
+class CacheSource(TypedDict):
+    terraform_configurations: dict[str, str]
+
+
+class RunnerParams(TypedDict):
+    tf: terraform.TerraformClient
+    dry_run: bool
+    enable_deletion: bool
 
-    defer(tf.cleanup)
 
+def runner(
+    dry_run: bool,
+    tf: terraform.TerraformClient,
+    enable_deletion: bool = False,
+) -> ExtendedEarlyExitRunnerResult:
     disabled_deletions_detected, err = tf.plan(enable_deletion)
-    errors.append(err)
     if disabled_deletions_detected:
-        logging.error("Deletions detected when they are disabled")
-        sys.exit(1)
+        raise RuntimeError("Terraform plan has disabled deletions detected")
+    if err:
+        raise RuntimeError("Terraform plan has errors")
 
     if dry_run:
-        sys.exit(int(any(errors)))
-    if any(errors):
-        sys.exit(1)
+        return ExtendedEarlyExitRunnerResult(payload={}, applied_count=0)
+
+    if err := tf.apply():
+        raise RuntimeError("Terraform apply has errors")
 
-    errors.append(tf.apply())
-    sys.exit(int(any(errors)))
+    return ExtendedEarlyExitRunnerResult(payload={}, applied_count=tf.apply_count)
 
 
-def early_exit_desired_state(
-    print_to_file=None,
-    enable_deletion=False,
-    thread_pool_size=10,
-    account_name: Optional[str] = None,
-) -> dict[str, Any]:
-    if account_name:
+def early_exit_desired_state(*args: Any, **kwargs: Any) -> dict[str, Any]:
+    if kwargs.get("account_name"):
         raise ValueError(
             "terraform-vpc-peerings early-exit check does not support sharding yet"
         )

reconcile/test/test_terraform_vpc_peerings.py

@@ -1,11 +1,9 @@
 import sys
-from typing import (
-    Any,
-    Optional,
-)
+from typing import Any, Self
 
 import pytest
 import testslide
+from pytest_mock import MockerFixture
 
 import reconcile.terraform_vpc_peerings as integ
 import reconcile.utils.terraform_client as terraform
@@ -23,8 +21,8 @@ class MockOCM:
         self.assumes: dict[str, str] = {}
 
     def register(
-        self, cluster: str, tf_account_id: str, tf_user: str, assume_role: Optional[str]
-    ) -> "MockOCM":
+        self, cluster: str, tf_account_id: str, tf_user: str, assume_role: str | None
+    ) -> Self:
         if not assume_role:
             assume_role = f"arn::::{cluster}"
         if not assume_role.startswith("arn:"):
@@ -33,11 +31,11 @@ class MockOCM:
         return self
 
     def get_aws_infrastructure_access_terraform_assume_role(
-        self, cluster, tf_account_id, tf_user
-    ):
+        self, cluster: str, tf_account_id: str, tf_user: str
+    ) -> str | None:
         return self.assumes.get(f"{cluster}/{tf_account_id}/{tf_user}")
 
-    def auto_speced_mock(self, mocker) -> ocm.OCM:
+    def auto_speced_mock(self, mocker: MockerFixture) -> ocm.OCM:
         ocm_mock = mocker.patch("reconcile.utils.ocm.OCM", autospec=True).return_value
         ocm_mock.get_aws_infrastructure_access_terraform_assume_role.mock_add_spec(
             ocm.OCM.get_aws_infrastructure_access_terraform_assume_role
@@ -50,15 +48,15 @@ class MockOCM:
 
 class MockAWSAPI:
     def __init__(self) -> None:
-        self.vpc_details: dict[str, tuple[str, list[str], Optional[str]]] = {}
+        self.vpc_details: dict[str, tuple[str, list[str], str | None]] = {}
 
     def register(
         self,
         vpc: str,
         vpc_id: str,
         route_tables: list[str],
-        vpce_sg: Optional[str] = None,
-    ) -> "MockAWSAPI":
+        vpce_sg: str | None = None,
+    ) -> Self:
         self.vpc_details[vpc] = (
             vpc_id,
             route_tables,
@@ -69,9 +67,9 @@ class MockAWSAPI:
     def get_cluster_vpc_details(
         self,
         account: dict[str, Any],
-        route_tables=False,
-        subnets=False,
-        hcp_vpc_endpoint_sg=False,
+        route_tables: bool = False,
+        subnets: bool = False,
+        hcp_vpc_endpoint_sg: bool = False,
     ) -> tuple:
         if account["assume_cidr"] in self.vpc_details:
             vpc_id, rt, sg_id = self.vpc_details[account["assume_cidr"]]
@@ -80,7 +78,7 @@ class MockAWSAPI:
             return vpc_id, rt, None, sg_id if hcp_vpc_endpoint_sg else None
         return None, None, None, None
 
-    def auto_speced_mock(self, mocker) -> aws_api.AWSApi:
+    def auto_speced_mock(self, mocker: MockerFixture) -> aws_api.AWSApi:
         aws_api_mock = mocker.patch(
             "reconcile.utils.aws_api.AWSApi", autospec=True
         ).return_value
@@ -93,14 +91,14 @@ class MockAWSAPI:
 
 def build_cluster(
     name: str,
-    vpc: Optional[str] = None,
-    read_only_accounts: Optional[list[str]] = None,
-    network_mgmt_accounts: Optional[list[str]] = None,
-    peering_connections: Optional[list[dict[str, Any]]] = None,
+    vpc: str | None = None,
+    read_only_accounts: list[str] | None = None,
+    network_mgmt_accounts: list[str] | None = None,
+    peering_connections: list[dict[str, Any]] | None = None,
     hcp: bool = False,
     private: bool = False,
-    sg: Optional[str] = None,
-):
+    sg: str | None = None,
+) -> dict[str, Any]:
     if not vpc:
         vpc = name
     cluster = {
@@ -150,7 +148,7 @@ def build_cluster(
 
 def build_requester_connection(
     name: str, peer_cluster: dict[str, Any], manage_routes: bool = True
-):
+) -> dict[str, Any]:
     return {
         "name": name,
         "provider": "cluster-vpc-requester",
@@ -162,9 +160,9 @@ def build_requester_connection(
 def build_accepter_connection(
     name: str,
     cluster: str,
-    aws_infra_acc: Optional[str] = None,
+    aws_infra_acc: str | None = None,
     manage_routes: bool = True,
-):
+) -> dict[str, Any]:
     connection = {
         "name": name,
         "provider": "cluster-vpc-accepter",
@@ -182,7 +180,7 @@ def build_accepter_connection(
     return connection
 
 
-def test_c2c_vpc_peering_assume_role_accepter_connection_acc_overwrite(mocker):
+def test_c2c_vpc_peering_assume_role_accepter_connection_acc_overwrite() -> None:
     """
     makes sure the peer connection account overwrite on the accepter is used
     when available. in this test, the overwrite is also allowed
@@ -210,7 +208,7 @@ def test_c2c_vpc_peering_assume_role_accepter_connection_acc_overwrite(mocker):
         requester_cluster,
         accepter_connection,
         accepter_cluster,
-        ocm,
+        ocm,  # type: ignore
     )
 
     assert infra_acc_name == "acc_overwrite"
@@ -238,7 +236,7 @@ def test_c2c_vpc_peering_assume_role_accepter_connection_acc_overwrite(mocker):
     assert acc_aws == expected_acc_aws
 
 
-def test_c2c_vpc_peering_assume_role_acc_overwrite_fail(mocker):
+def test_c2c_vpc_peering_assume_role_acc_overwrite_fail() -> None:
     """
     try overwrite the account to be used on the accepter connection with an
     account not listed on the accepter cluster
@@ -263,12 +261,12 @@ def test_c2c_vpc_peering_assume_role_acc_overwrite_fail(mocker):
             requester_cluster,
             accepter_connection,
             accepter_cluster,
-            ocm,
+            ocm,  # type: ignore
         )
     assert str(ex.value).startswith("[account_not_allowed]")
 
 
-def test_c2c_vpc_peering_assume_role_accepter_cluster_account(mocker):
+def test_c2c_vpc_peering_assume_role_accepter_cluster_account() -> None:
     """
     makes sure the clusters default infra account is used when no peer
     connection overwrite exists
@@ -292,7 +290,7 @@ def test_c2c_vpc_peering_assume_role_accepter_cluster_account(mocker):
         requester_cluster,
         accepter_connection,
         accepter_cluster,
-        ocm,
+        ocm,  # type: ignore
     )
 
     assert infra_acc_name == "default_acc"
@@ -320,7 +318,7 @@ def test_c2c_vpc_peering_assume_role_accepter_cluster_account(mocker):
     assert acc_aws == expected_acc_aws
 
 
-def test_c2c_vpc_peering_missing_ocm_assume_role(mocker):
+def test_c2c_vpc_peering_missing_ocm_assume_role() -> None:
     """
     makes sure the clusters infra account is used when no peer connection
     overwrite exists
@@ -338,12 +336,12 @@ def test_c2c_vpc_peering_missing_ocm_assume_role(mocker):
             requester_cluster,
             accepter_connection,
             accepter_cluster,
-            ocm,
+            ocm,  # type: ignore
         )
     assert str(ex.value).startswith("[assume_role_not_found]")
 
 
-def test_c2c_vpc_peering_missing_account(mocker):
+def test_c2c_vpc_peering_missing_account() -> None:
     """
     test the fallback logic, looking for network-mgmt groups accounts
     """
@@ -360,12 +358,12 @@ def test_c2c_vpc_peering_missing_account(mocker):
             requester_cluster,
             accepter_connection,
             accepter_cluster,
-            ocm,
+            ocm,  # type: ignore
         )
     assert str(ex.value).startswith("[no_account_available]")
 
 
-def test_empty_run(mocker):
+def test_empty_run(mocker: MockerFixture) -> None:
     mocked_queries = mocker.patch("reconcile.terraform_vpc_peerings.queries")
     mocked_queries.get_secret_reader_settings.return_value = {}
     mocked_queries.get_clusters_with_peering_settings.return_value = []
@@ -390,7 +388,7 @@ def test_empty_run(mocker):
 
 
 class TestRun(testslide.TestCase):
-    def setUp(self):
+    def setUp(self) -> None:
         super().setUp()
 
         self.awsapi = testslide.StrictMock(aws_api.AWSApi)
@@ -412,6 +410,7 @@ class TestRun(testslide.TestCase):
         self.mock_constructor(terraform, "TerraformClient").to_return_value(
             self.terraform
         )
+        self.terraform.apply_count = 1
         self.mock_constructor(terrascript, "TerrascriptClient").to_return_value(
             self.terrascript
         )
@@ -442,11 +441,14 @@ class TestRun(testslide.TestCase):
         self.mock_callable(self.terrascript, "dump").to_return_value({
             "some_account": "/some/dir"
         }).and_assert_called_once()
+        self.mock_callable(
+            self.terrascript, "terraform_configurations"
+        ).to_return_value({"foo": "bar"}).and_assert_called_once()
         # Sigh...
         self.exit = self.mock_callable(sys, "exit").to_raise(OSError("Exit called!"))
         self.addCleanup(testslide.mock_callable.unpatch_all_callable_mocks)
 
-    def initialize_desired_states(self, error_code):
+    def initialize_desired_states(self, error_code: bool) -> None:
         self.build_desired_state_vpc.to_return_value((
             [
                 {
@@ -499,7 +501,7 @@ class TestRun(testslide.TestCase):
             ],
         ).to_return_value(None).and_assert_called_once()
 
-    def test_all_fine(self):
+    def test_all_fine(self) -> None:
         self.initialize_desired_states(False)
         self.mock_callable(self.terraform, "plan").to_return_value((
             False,
@@ -511,11 +513,9 @@ class TestRun(testslide.TestCase):
         self.mock_callable(self.terraform, "apply").to_return_value(
             None
         ).and_assert_called_once()
-        self.exit.for_call(0).and_assert_called_once()
-        with self.assertRaises(OSError):
-            integ.run(False, print_to_file=None, enable_deletion=False)
+        integ.run(False, print_to_file=None, enable_deletion=False)
 
-    def test_fail_state(self):
+    def test_fail_state(self) -> None:
         """Ensure we don't change the world if there are failures"""
         self.initialize_desired_states(True)
         self.mock_callable(self.terraform, "plan").to_return_value((
@@ -532,7 +532,7 @@ class TestRun(testslide.TestCase):
         with self.assertRaises(OSError):
             integ.run(False, print_to_file=None, enable_deletion=True)
 
-    def test_dry_run(self):
+    def test_dry_run(self) -> None:
         self.initialize_desired_states(False)
 
         self.mock_callable(self.terraform, "plan").to_return_value((
@@ -545,11 +545,9 @@ class TestRun(testslide.TestCase):
         self.mock_callable(self.terraform, "apply").to_return_value(
             None
         ).and_assert_not_called()
-        self.exit.for_call(0).and_assert_called_once()
-        with self.assertRaises(OSError):
-            integ.run(True, print_to_file=None, enable_deletion=False)
+        integ.run(True, print_to_file=None, enable_deletion=False)
 
-    def test_dry_run_with_failures(self):
+    def test_dry_run_with_failures(self) -> None:
         """This is what we do during PR checks and new clusters!"""
         self.initialize_desired_states(True)
         self.mock_callable(self.terraform, "plan").to_return_value((
@@ -563,7 +561,7 @@ class TestRun(testslide.TestCase):
         with self.assertRaises(OSError):
             integ.run(True, print_to_file=None, enable_deletion=False)
 
-    def test_dry_run_print_only_with_failures(self):
+    def test_dry_run_print_only_with_failures(self) -> None:
         """This is what we do during PR checks and new clusters!"""
         self.initialize_desired_states(True)
         self.mock_callable(self.terraform, "plan").to_return_value((

reconcile/test/test_terraform_vpc_peerings_build_desired_state.py

@@ -1,5 +1,6 @@
 import pytest
 import testslide
+from pytest_mock import MockerFixture
 
 import reconcile.terraform_vpc_peerings as sut
 from reconcile.test.test_terraform_vpc_peerings import (
@@ -15,7 +16,7 @@ from reconcile.utils import (
 )
 
 
-def test_c2c_all_clusters(mocker):
+def test_c2c_all_clusters() -> None:
     """
     happy path
     """
@@ -101,27 +102,36 @@ def test_c2c_all_clusters(mocker):
 
     # no account filter
     result, error = sut.build_desired_state_all_clusters(
-        [requester_cluster], ocm_map, awsapi, account_filter=None
+        [requester_cluster],
+        ocm_map,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter=None,
     )
     assert result == expected
     assert not error
 
     # correct account filter
     result, error = sut.build_desired_state_all_clusters(
-        [requester_cluster], ocm_map, awsapi, account_filter="acc"
+        [requester_cluster],
+        ocm_map,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter="acc",
     )
     assert result == expected
     assert not error
 
     # wrong account filter
     result, error = sut.build_desired_state_all_clusters(
-        [requester_cluster], ocm_map, awsapi, account_filter="another_account"
+        [requester_cluster],
+        ocm_map,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter="another_account",
     )
     assert not result
     assert not error
 
 
-def test_c2c_one_cluster_failing_recoverable(mocker):
+def test_c2c_one_cluster_failing_recoverable(mocker: MockerFixture) -> None:
     """
     in this scenario, the handling of a single cluster fails with known
     exceptions
@@ -134,14 +144,17 @@ def test_c2c_one_cluster_failing_recoverable(mocker):
     )
 
     result, error = sut.build_desired_state_all_clusters(
-        [{"name": "cluster"}], {}, {}, account_filter=None
+        [{"name": "cluster"}],
+        None,
+        None,  # type: ignore
+        account_filter=None,
     )
 
     assert not result
     assert error
 
 
-def test_c2c_one_cluster_failing_weird(mocker):
+def test_c2c_one_cluster_failing_weird(mocker: MockerFixture) -> None:
     """
     in this scenario, the handling of a single cluster fails with unexpected
     exceptions
@@ -154,7 +167,10 @@ def test_c2c_one_cluster_failing_weird(mocker):
 
     with pytest.raises(ValueError) as ex:
         sut.build_desired_state_all_clusters(
-            [{"name": "cluster"}], {}, {}, account_filter=None
+            [{"name": "cluster"}],
+            None,
+            None,  # type: ignore
+            account_filter=None,
         )
 
     assert str(ex.value) == SOMETHING_UNEXPECTED
@@ -173,14 +189,13 @@ def test_c2c_one_cluster_failing_weird(mocker):
     ],
 )
 def test_c2c_hcp(
-    accepter_hcp,
-    accepter_private,
-    requester_hcp,
-    requester_private,
-    expected_accepter_security_group,
-    expected_requester_security_group,
-    mocker,
-):
+    accepter_hcp: bool,
+    accepter_private: bool,
+    requester_hcp: bool,
+    requester_private: bool,
+    expected_accepter_security_group: str | None,
+    expected_requester_security_group: str | None,
+) -> None:
     accepter_cluster = build_cluster(
         name="accepter_cluster",
         vpc="accepter_vpc",
@@ -267,24 +282,33 @@ def test_c2c_hcp(
 
     # no account filtering
     result = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter=None
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter=None,
     )
     assert result == expected
 
     # correct account filtering
     result = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter="acc"
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter="acc",
     )
     assert result == expected
 
     # correct account filtering
     result = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter="another_account"
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter="another_account",
     )
     assert not result
 
 
-def test_c2c_base(mocker):
+def test_c2c_base() -> None:
     """
     happy path
     """
@@ -368,24 +392,33 @@ def test_c2c_base(mocker):
 
     # no account filtering
     result = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter=None
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter=None,
     )
     assert result == expected
 
     # correct account filtering
     result = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter="acc"
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter="acc",
     )
     assert result == expected
 
     # correct account filtering
     result = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter="another_account"
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter="another_account",
     )
     assert not result
 
 
-def test_c2c_no_peerings(mocker):
+def test_c2c_no_peerings() -> None:
     """
     in this scenario, the requester cluster has no peerings defines,
     which results in an empty desired state
@@ -398,14 +431,14 @@ def test_c2c_no_peerings(mocker):
     )
     result = sut.build_desired_state_single_cluster(
         requester_cluster,
-        MockOCM(),
-        MockAWSAPI(),
+        MockOCM(),  # type: ignore
+        MockAWSAPI(),  # type: ignore
         account_filter=None,
     )
     assert not result
 
 
-def test_c2c_no_matches(mocker):
+def test_c2c_no_matches() -> None:
     """
     in this scenario, the accepter cluster has no cluster-vpc-accepter
     connection that references back to the requester cluster
@@ -430,14 +463,14 @@ def test_c2c_no_matches(mocker):
     with pytest.raises(sut.BadTerraformPeeringState) as ex:
         sut.build_desired_state_single_cluster(
             requester_cluster,
-            MockOCM(),
-            MockAWSAPI(),
+            MockOCM(),  # type: ignore
+            MockAWSAPI(),  # type: ignore
             account_filter=None,
         )
     assert str(ex.value).startswith("[no_matching_peering]")
 
 
-def test_c2c_no_vpc_in_aws(mocker):
+def test_c2c_no_vpc_in_aws() -> None:
     """
     in this scenario, there are no VPCs found in AWS
     """
@@ -467,12 +500,15 @@ def test_c2c_no_vpc_in_aws(mocker):
     awsapi = MockAWSAPI()
 
     desired_state = sut.build_desired_state_single_cluster(
-        requester_cluster, ocm, awsapi, account_filter=None
+        requester_cluster,
+        ocm,  # type: ignore
+        awsapi,  # type: ignore
+        account_filter=None,
     )
     assert desired_state == []
 
 
-def test_c2c_no_peer_account(mocker):
+def test_c2c_no_peer_account() -> None:
     """
     in this scenario, the accepters connection and the accepters cluster
     have no aws infrastructura account available to set up the peering″
@@ -503,13 +539,16 @@ def test_c2c_no_peer_account(mocker):
 
     with pytest.raises(sut.BadTerraformPeeringState) as ex:
         sut.build_desired_state_single_cluster(
-            requester_cluster, ocm, awsapi, account_filter=None
+            requester_cluster,
+            ocm,  # type: ignore
+            awsapi,  # type: ignore
+            account_filter=None,
         )
     assert str(ex.value).startswith("[no_account_available]")
 
 
 class TestBuildDesiredStateVpcMesh(testslide.TestCase):
-    def setUp(self):
+    def setUp(self) -> None:
         super().setUp()
         self.clusters = [
             {
@@ -577,8 +616,8 @@ class TestBuildDesiredStateVpcMesh(testslide.TestCase):
             "assume_region": "mars-hellas-1",
             "assume_cidr": "172.25.0.0/12",
         }
-        self.clusters[0]["peering"]["connections"][0]["cluster"] = self.peer_cluster
-        self.clusters[0]["peering"]["connections"][0]["account"] = self.peer_account
+        self.clusters[0]["peering"]["connections"][0]["cluster"] = self.peer_cluster  # type: ignore
+        self.clusters[0]["peering"]["connections"][0]["account"] = self.peer_account  # type: ignore
         self.peer_vpc = {
             "cidr_block": "172.30.0.0/12",
             "vpc_id": "peervpcid",
@@ -589,11 +628,11 @@ class TestBuildDesiredStateVpcMesh(testslide.TestCase):
         )
         self.maxDiff = None
         self.ocm = testslide.StrictMock(ocm.OCM)
-        self.ocm_map = {"clustername": self.ocm}
+        self.ocm_map: ocm.OCMMap = {"clustername": self.ocm}  # type: ignore
         self.ocm.get_aws_infrastructure_access_terraform_assume_role = (
             lambda cluster, uid, tfuser: self.peer_account["assume_role"]
         )
-        self.awsapi = testslide.StrictMock(aws_api.AWSApi)
+        self.awsapi: aws_api.AWSApi = testslide.StrictMock(aws_api.AWSApi)
         self.account_vpcs = [
             {
                 "vpc_id": "vpc1",
@@ -610,7 +649,7 @@ class TestBuildDesiredStateVpcMesh(testslide.TestCase):
         ]
         self.addCleanup(testslide.mock_callable.unpatch_all_callable_mocks)
 
-    def test_all_fine(self):
+    def test_all_fine(self) -> None:
         expected = [
             {
                 "connection_provider": "account-vpc-mesh",
@@ -652,7 +691,10 @@ class TestBuildDesiredStateVpcMesh(testslide.TestCase):
             },
         ]
         self.vpc_mesh_single_cluster.for_call(
-            self.clusters[0], self.ocm, self.awsapi, None
+            self.clusters[0],
+            self.ocm,
+            self.awsapi,
+            None,
         ).to_return_value(expected)
 
         rs = sut.build_desired_state_vpc_mesh(
@@ -663,25 +705,31 @@ class TestBuildDesiredStateVpcMesh(testslide.TestCase):
         )
         self.assertEqual(rs, (expected, False))
 
-    def test_cluster_raises(self):
+    def test_cluster_raises(self) -> None:
         self.vpc_mesh_single_cluster.to_raise(
             sut.BadTerraformPeeringState("This is wrong")
         )
         rs = sut.build_desired_state_vpc_mesh(
-            self.clusters, self.ocm_map, self.awsapi, None
+            self.clusters,
+            self.ocm_map,
+            self.awsapi,
+            None,
         )
         self.assertEqual(rs, ([], True))
 
-    def test_cluster_raises_unexpected(self):
+    def test_cluster_raises_unexpected(self) -> None:
         self.vpc_mesh_single_cluster.to_raise(ValueError("Nope"))
         with self.assertRaises(ValueError):
             sut.build_desired_state_vpc_mesh(
-                self.clusters, self.ocm_map, self.awsapi, None
+                self.clusters,
+                self.ocm_map,
+                self.awsapi,
+                None,
             )
 
 
 class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
-    def setUp(self):
+    def setUp(self) -> None:
         super().setUp()
         self.cluster = {
             "name": "clustername",
@@ -728,7 +776,7 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
                 ]
             },
         }
-        self.awsapi = testslide.StrictMock(aws_api.AWSApi)
+        self.awsapi: aws_api.AWSApi = testslide.StrictMock(aws_api.AWSApi)
         self.mock_constructor(aws_api, "AWSApi").to_return_value(self.awsapi)
         self.find_matching_peering = self.mock_callable(sut, "find_matching_peering")
         self.aws_account = {
@@ -749,8 +797,8 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
             "assume_region": "mars-hellas-1",
             "assume_cidr": "172.25.0.0/12",
         }
-        self.cluster["peering"]["connections"][0]["cluster"] = self.peer_cluster
-        self.cluster["peering"]["connections"][0]["account"] = self.peer_account
+        self.cluster["peering"]["connections"][0]["cluster"] = self.peer_cluster  # type: ignore
+        self.cluster["peering"]["connections"][0]["account"] = self.peer_account  # type: ignore
         self.peer_vpc = {
             "cidr_block": "172.30.0.0/12",
             "vpc_id": "peervpcid",
@@ -758,8 +806,8 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
         }
         self.maxDiff = None
         self.addCleanup(testslide.mock_callable.unpatch_all_callable_mocks)
-        self.ocm = testslide.StrictMock(template=ocm.OCM)
-        self.ocm.get_aws_infrastructure_access_terraform_assume_role = (
+        self.ocm: ocm.OCM = testslide.StrictMock(template=ocm.OCM)
+        self.ocm.get_aws_infrastructure_access_terraform_assume_role = (  # type: ignore
             lambda cluster, uid, tfuser: self.peer_account["assume_role"]
         )
         self.account_vpcs = [
@@ -777,7 +825,7 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
             },
         ]
 
-    def test_one_cluster(self):
+    def test_one_cluster(self) -> None:
         req_account = {
             **self.peer_account,
             "assume_region": "mars-plain-1",
@@ -842,11 +890,14 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
         ]
 
         rs = sut.build_desired_state_vpc_mesh_single_cluster(
-            self.cluster, self.ocm, self.awsapi, None
+            self.cluster,
+            self.ocm,
+            self.awsapi,
+            None,
         )
         self.assertEqual(rs, expected)
 
-    def test_one_cluster_private_hcp(self):
+    def test_one_cluster_private_hcp(self) -> None:
         self.cluster["spec"] = {
             "region": "mars-plain-1",
             "hypershift": True,
@@ -920,14 +971,14 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
         )
         self.assertEqual(rs, expected)
 
-    def test_no_peering_connections(self):
-        self.cluster["peering"]["connections"] = []
+    def test_no_peering_connections(self) -> None:
+        self.cluster["peering"]["connections"] = []  # type: ignore
         rs = sut.build_desired_state_vpc_mesh_single_cluster(
             self.cluster, self.ocm, self.awsapi, None
         )
         self.assertEqual(rs, [])
 
-    def test_no_peer_vpc_id(self):
+    def test_no_peer_vpc_id(self) -> None:
         self.mock_callable(self.awsapi, "get_cluster_vpc_details").to_return_value((
             None,
             [None],
@@ -942,7 +993,7 @@ class TestBuildDesiredStateVpcMeshSingleCluster(testslide.TestCase):
 
 
 class TestBuildDesiredStateVpc(testslide.TestCase):
-    def setUp(self):
+    def setUp(self) -> None:
         super().setUp()
         self.peer = {
             "vpc": "172.17.0.0/12",
@@ -1007,13 +1058,13 @@ class TestBuildDesiredStateVpc(testslide.TestCase):
                 ]
             },
         }
-        self.clusters[0]["peering"]["connections"][0]["cluster"] = self.peer_cluster
+        self.clusters[0]["peering"]["connections"][0]["cluster"] = self.peer_cluster  # type: ignore
         self.build_single_cluster = self.mock_callable(
             sut, "build_desired_state_single_cluster"
         )
         self.ocm = testslide.StrictMock(template=ocm.OCM)
-        self.ocm_map = {"clustername": self.ocm}
-        self.awsapi = testslide.StrictMock(aws_api.AWSApi)
+        self.ocm_map: ocm.OCMMap = {"clustername": self.ocm}  # type: ignore
+        self.awsapi: aws_api.AWSApi = testslide.StrictMock(aws_api.AWSApi)
 
         self.build_single_cluster = self.mock_callable(
             sut, "build_desired_state_vpc_single_cluster"
@@ -1021,7 +1072,7 @@ class TestBuildDesiredStateVpc(testslide.TestCase):
         self.addCleanup(testslide.mock_callable.unpatch_all_callable_mocks)
         self.maxDiff = None
 
-    def test_all_fine(self):
+    def test_all_fine(self) -> None:
         expected = [
             {
                 "accepter": {
@@ -1067,7 +1118,7 @@ class TestBuildDesiredStateVpc(testslide.TestCase):
         )
         self.assertEqual(rs, (expected, False))
 
-    def test_cluster_fails(self):
+    def test_cluster_fails(self) -> None:
         self.build_single_cluster.to_raise(
             sut.BadTerraformPeeringState("I have failed")
         )
@@ -1079,10 +1130,10 @@ class TestBuildDesiredStateVpc(testslide.TestCase):
             ([], True),
         )
 
-    def test_error_persists(self):
+    def test_error_persists(self) -> None:
         self.clusters.append(self.clusters[0].copy())
         self.clusters[1]["name"] = "afailingcluster"
-        self.ocm_map["afailingcluster"] = self.ocm
+        self.ocm_map["afailingcluster"] = self.ocm  # type: ignore
         self.build_single_cluster.for_call(
             self.clusters[0], self.ocm, self.awsapi, None
         ).to_return_value([{"a dict": "a value"}]).and_assert_called_once()
@@ -1100,10 +1151,10 @@ class TestBuildDesiredStateVpc(testslide.TestCase):
             ([{"a dict": "a value"}], True),
         )
 
-    def test_other_exceptions_raise(self):
+    def test_other_exceptions_raise(self) -> None:
         self.clusters.append(self.clusters[0].copy())
         self.clusters[1]["name"] = "afailingcluster"
-        self.ocm_map["afailingcluster"] = self.ocm
+        self.ocm_map["afailingcluster"] = self.ocm  # type: ignore
         self.build_single_cluster.for_call(
             self.clusters[0], self.ocm, self.awsapi, None
         ).to_raise(ValueError("I am not planned!")).and_assert_called_once()
@@ -1114,7 +1165,7 @@ class TestBuildDesiredStateVpc(testslide.TestCase):
 
 
 class TestBuildDesiredStateVpcSingleCluster(testslide.TestCase):
-    def setUp(self):
+    def setUp(self) -> None:
         super().setUp()
         self.peer = {
             "vpc": "172.17.0.0/12",
@@ -1177,20 +1228,20 @@ class TestBuildDesiredStateVpcSingleCluster(testslide.TestCase):
                 ]
             },
         }
-        self.cluster["peering"]["connections"][0]["cluster"] = self.peer_cluster
+        self.cluster["peering"]["connections"][0]["cluster"] = self.peer_cluster  # type: ignore
         self.build_single_cluster = self.mock_callable(
             sut, "build_desired_state_single_cluster"
         )
-        self.ocm = testslide.StrictMock(template=ocm.OCM)
-        self.awsapi = testslide.StrictMock(aws_api.AWSApi)
+        self.ocm: ocm.OCM = testslide.StrictMock(template=ocm.OCM)
+        self.awsapi: aws_api.AWSApi = testslide.StrictMock(aws_api.AWSApi)
         self.mock_constructor(aws_api, "AWSApi").to_return_value(self.awsapi)
-        self.ocm.get_aws_infrastructure_access_terraform_assume_role = (
+        self.ocm.get_aws_infrastructure_access_terraform_assume_role = (  # type: ignore
             lambda cluster, uid, tfuser: self.aws_account["assume_role"]
         )
         self.addCleanup(testslide.mock_callable.unpatch_all_callable_mocks)
         self.maxDiff = None
 
-    def test_all_fine(self):
+    def test_all_fine(self) -> None:
         expected = [
             {
                 "accepter": {
@@ -1252,7 +1303,7 @@ class TestBuildDesiredStateVpcSingleCluster(testslide.TestCase):
         )
         self.assertEqual(rs, expected)
 
-    def test_private_hcp(self):
+    def test_private_hcp(self) -> None:
         self.cluster["spec"] = {
             "region": "mars-plain-1",
             "hypershift": True,
@@ -1319,16 +1370,19 @@ class TestBuildDesiredStateVpcSingleCluster(testslide.TestCase):
         )
         self.assertEqual(rs, expected)
 
-    def test_different_provider(self):
-        self.cluster["peering"]["connections"][0]["provider"] = "something-else"
+    def test_different_provider(self) -> None:
+        self.cluster["peering"]["connections"][0]["provider"] = "something-else"  # type: ignore
         self.assertEqual(
             sut.build_desired_state_vpc_single_cluster(
-                self.cluster, self.ocm, self.awsapi, None
+                self.cluster,
+                self.ocm,
+                self.awsapi,
+                None,
             ),
             [],
         )
 
-    def test_no_vpc_id(self):
+    def test_no_vpc_id(self) -> None:
         self.mock_callable(self.awsapi, "get_cluster_vpc_details").to_return_value((
             None,
             None,
@@ -1345,7 +1399,7 @@ class TestBuildDesiredStateVpcSingleCluster(testslide.TestCase):
         )
         assert desired_state == []
 
-    def test_aws_exception(self):
+    def test_aws_exception(self) -> None:
         exc_txt = "AWS Problem!"
         self.mock_callable(self.awsapi, "get_cluster_vpc_details").to_raise(
             Exception(exc_txt)
@@ -1357,5 +1411,8 @@ class TestBuildDesiredStateVpcSingleCluster(testslide.TestCase):
 
         with pytest.raises(Exception, match=exc_txt):
             sut.build_desired_state_vpc_single_cluster(
-                self.cluster, self.ocm, self.awsapi, None
+                self.cluster,
+                self.ocm,
+                self.awsapi,
+                None,
             )