qontract-reconcile 0.10.1rc972__py3-none-any.whl → 0.10.1rc973__py3-none-any.whl

{qontract_reconcile-0.10.1rc972.dist-info → qontract_reconcile-0.10.1rc973.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc972
+Version: 0.10.1rc973
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc972.dist-info → qontract_reconcile-0.10.1rc973.dist-info}/RECORD

@@ -83,7 +83,7 @@ reconcile/openshift_saas_deploy_trigger_configs.py,sha256=eUejMGWuaQabZTLuvPLLvR
 reconcile/openshift_saas_deploy_trigger_images.py,sha256=iUsiBGJf-CyFw7tSLWo59rXmSvsVnN6TTaAObbsVpNg,936
 reconcile/openshift_saas_deploy_trigger_moving_commits.py,sha256=fpanSH-EGH15C9me--0VSpcpaw9BY4RTb8_mPtsSZGc,942
 reconcile/openshift_saas_deploy_trigger_upstream_jobs.py,sha256=0CjfeVQE0QrRrOVuTxkXvBUdKNtYLYuX4mZRB48PQ9g,940
-reconcile/openshift_serviceaccount_tokens.py,sha256=9zNSMEHwcaGWy4H-OLkk0zLw80CYTBnLVEZKB_xq6Ew,7331
+reconcile/openshift_serviceaccount_tokens.py,sha256=ha3I7gk5C0Y-gD5_h-jvSheM2JamCx4KuihHpsaipUU,8840
 reconcile/openshift_tekton_resources.py,sha256=jKH5nw84aeYkgikxjQnjSOSF3m2kk3lp2BaPd3FfTew,16220
 reconcile/openshift_upgrade_watcher.py,sha256=9IB321hlRZZhzdaR9G3zoWAhVv0-KzNiEqx73p3-wmk,6539
 reconcile/openshift_users.py,sha256=63mar-swgidz8f10TCPJcofbMN9FETq-HuVFpi8dUL4,5293
@@ -530,7 +530,7 @@ reconcile/test/test_openshift_resources_base.py,sha256=LtlR9x3o7KkSEw0JN0fZhinFe
 reconcile/test/test_openshift_saas_deploy.py,sha256=3QXMrN9dXIiR0JktVDNQ7yJSexMTjZLb1tbRrB3-7uU,5991
 reconcile/test/test_openshift_saas_deploy_change_tester.py,sha256=1yVe54Hx9YdVjn6qdnKge5Sa_s732c-8uZqCnuT1gGI,12871
 reconcile/test/test_openshift_saas_deploy_trigger_cleaner.py,sha256=UQx1iJ21rsMa2whG-rtUIuTXbUzc0Ngr7jRLKXZCCCI,2838
-reconcile/test/test_openshift_serviceaccount_tokens.py,sha256=btaI8Au5XdZXXHtQfFPA8bGSTrXReC8ywJKUjaIQc-A,7341
+reconcile/test/test_openshift_serviceaccount_tokens.py,sha256=tpCJMJw2nkaJQjTPCajd_0CZ1yivdV2qWJFCytPuyDo,8923
 reconcile/test/test_openshift_tekton_resources.py,sha256=RtRWsdm51S13OSkENC9nY_rOH0QELSCaO5tjF0XqIDI,11222
 reconcile/test/test_openshift_upgrade_watcher.py,sha256=0GDQ_YFHIX8DbkbDYSuLv9uZeeg4NwP1vlOqvSaZvN4,7183
 reconcile/test/test_prometheus_rules_tester.py,sha256=cgVkPM3KcAw69bOkJ6iR2Lfog_WgblyoqVRtXv4ly7o,5685
@@ -851,8 +851,8 @@ tools/test/test_qontract_cli.py,sha256=_D61RFGAN5x44CY1tYbouhlGXXABwYfxKSWSQx3Jr
 tools/test/test_saas_promotion_state.py,sha256=dy4kkSSAQ7bC0Xp2CociETGN-2aABEfL6FU5D9Jl00Y,6056
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc972.dist-info/METADATA,sha256=xWOaHmFbbnZOTavYlu2Vm9acmJ3tUubkXEJ37diSsT8,2262
-qontract_reconcile-0.10.1rc972.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-qontract_reconcile-0.10.1rc972.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
-qontract_reconcile-0.10.1rc972.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc972.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc973.dist-info/METADATA,sha256=jMbfD4v2wrIGbDyj0IGF1KOlLZUXYLxJBKmIbmhwAPw,2262
+qontract_reconcile-0.10.1rc973.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+qontract_reconcile-0.10.1rc973.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
+qontract_reconcile-0.10.1rc973.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc973.dist-info/RECORD,,

reconcile/openshift_serviceaccount_tokens.py

@@ -1,4 +1,5 @@
 import logging
+import random
 import sys
 from collections.abc import Callable, Iterable
 
@@ -35,6 +36,31 @@ def construct_sa_token_oc_resource(name: str, sa_token: str) -> OR:
     )
 
 
+def service_account_token_request(name: str) -> OR:
+    """Create a service account token secret for a given service account."""
+    body = {
+        "apiVersion": "v1",
+        "kind": "Secret",
+        "type": "kubernetes.io/service-account-token",
+        "metadata": {
+            # service-account-name-<random-number>
+            "name": f"{name}-token-{random.randrange(99999):05d}",
+            "annotations": {
+                "kubernetes.io/service-account.name": name,
+            },
+        },
+    }
+    return OR(
+        body,
+        # We are marking this token secret as "unmanaged" because we just want to create it
+        # and not manage it in the future.
+        # Openshift will delete this token secret automatically if the service account is deleted.
+        f"{QONTRACT_INTEGRATION}-unmanaged",
+        QONTRACT_INTEGRATION_VERSION,
+        error_details=name,
+    )
+
+
 def get_tokens_for_service_account(
     service_account: str, tokens: list[dict]
 ) -> list[dict]:
@@ -79,6 +105,21 @@ def fetch_desired_state(
                 sa_tokens = get_tokens_for_service_account(
                     sat.service_account_name, namespace_secrets
                 )
+                if not sa_tokens:
+                    # OpenShfit 4.16+ does not automatically create service account tokens anymore so we need to create them manually.
+                    logging.info(
+                        f"[{sat.namespace.cluster.name}/{sat.namespace.name}] Creating token for service account: {sat.service_account_name}"
+                    )
+                    # Be aware: The secret won't be created by OpenShift as long as the service account doesn't exist.
+                    ri.add_desired_resource(
+                        cluster=sat.namespace.cluster.name,
+                        namespace=sat.namespace.name,
+                        resource=service_account_token_request(
+                            sat.service_account_name
+                        ),
+                    )
+                    continue
+
                 sa_tokens.sort(key=lambda t: t["metadata"]["name"])
                 # take the first token found
                 sa_token = sa_tokens[0]["data"]["token"]
@@ -87,11 +128,6 @@ def fetch_desired_state(
                     f"[{sat.namespace.cluster.name}/{sat.namespace.name}] Token not found for service account: {sat.service_account_name}"
                 )
                 raise
-            except IndexError:
-                logging.error(
-                    f"[{sat.namespace.cluster.name}/{sat.namespace.name}] 0 Secret found for service account: {sat.service_account_name}"
-                )
-                raise
 
             oc_resource = construct_sa_token_oc_resource(
                 name=(

reconcile/test/test_openshift_serviceaccount_tokens.py

@@ -7,11 +7,13 @@ from pytest_mock import MockerFixture
 
 from reconcile.gql_definitions.openshift_serviceaccount_tokens.tokens import NamespaceV1
 from reconcile.openshift_serviceaccount_tokens import (
+    QONTRACT_INTEGRATION,
     canonicalize_namespaces,
     construct_sa_token_oc_resource,
     fetch_desired_state,
     get_namespaces_with_serviceaccount_tokens,
     get_tokens_for_service_account,
+    service_account_token_request,
     write_outputs_to_vault,
 )
 from reconcile.test.fixtures import Fixtures
@@ -50,7 +52,19 @@ def namespaces(query_func: Callable) -> list[NamespaceV1]:
 def ri(namespaces: list[NamespaceV1]) -> ResourceInventory:
     _ri = ResourceInventory()
     _ri.initialize_resource_type(
-        cluster="cluster", namespace="namespace", resource_type="Secret"
+        cluster="cluster",
+        namespace="namespace",
+        resource_type="Secret",
+    )
+    _ri.initialize_resource_type(
+        cluster="another-cluster",
+        namespace="platform-changelog-stage",
+        resource_type="Secret",
+    )
+    _ri.initialize_resource_type(
+        cluster="another-cluster",
+        namespace="with-openshift-serviceaccount-tokens",
+        resource_type="Secret",
     )
     for ns in namespaces:
         _ri.initialize_resource_type(
@@ -226,3 +240,41 @@ def test_openshift_serviceaccount_tokens__fetch_desired_state(
             "desired"
         ]
     )
+
+
+def test_openshift_serviceaccount_tokens__fetch_desired_state_create_token(
+    mocker: MockerFixture, namespaces: list[NamespaceV1], ri: ResourceInventory
+) -> None:
+    oc_map = mocker.create_autospec(OC_Map)
+    oc = mocker.create_autospec(OCCli)
+    oc_map.get.return_value = oc
+    oc.get_items.return_value = []
+
+    fetch_desired_state(
+        namespaces=[namespaces[0]],
+        ri=ri,
+        oc_map=oc_map,
+    )
+
+    assert (
+        len(
+            ri._clusters["cluster"]["with-openshift-serviceaccount-tokens"]["Secret"][
+                "desired"
+            ].keys()
+        )
+        == 1
+    )
+    r = list(
+        ri._clusters["cluster"]["with-openshift-serviceaccount-tokens"]["Secret"][
+            "desired"
+        ].values()
+    )[0]
+    assert r.body["type"] == "kubernetes.io/service-account-token"
+
+
+def test_openshift_serviceaccount_tokens__service_account_token_request() -> None:
+    resource = service_account_token_request("grafana")
+    assert resource.name.startswith("grafana-")
+    assert resource.body["type"] == "kubernetes.io/service-account-token"
+    assert resource.kind == "Secret"
+    assert resource.integration != QONTRACT_INTEGRATION