qontract-reconcile 0.10.1rc996__py3-none-any.whl → 0.10.1rc997__py3-none-any.whl

{qontract_reconcile-0.10.1rc996.dist-info → qontract_reconcile-0.10.1rc997.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: qontract-reconcile
-Version: 0.10.1rc996
+Version: 0.10.1rc997
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Home-page: https://github.com/app-sre/qontract-reconcile
 Author: Red Hat App-SRE Team

{qontract_reconcile-0.10.1rc996.dist-info → qontract_reconcile-0.10.1rc997.dist-info}/RECORD

@@ -194,7 +194,7 @@ reconcile/external_resources/meta.py,sha256=cMT9OsKcUY26qwEjlQ02EkorvOBNqWj0JVMw
 reconcile/external_resources/metrics.py,sha256=m2TIOao2N7pD6k45driFbBGVCC_N7ai44m-lLPfa5qk,454
 reconcile/external_resources/model.py,sha256=oXxJkjhV53lwwAuxUCBrjJ8aCJmQdgcKWv68ugJPK4k,7229
 reconcile/external_resources/reconciler.py,sha256=E50X_lnOD0OWYXMzyZld1P6dCFJFYjHGyICWff9bxlc,9323
-reconcile/external_resources/secrets_sync.py,sha256=WeoUANltYOjzr_Pn_pZ1ormGof9yRy2DiSB7LoPAQqM,15076
+reconcile/external_resources/secrets_sync.py,sha256=6n0oDPLjd9Ql0lf6zsr1AZw8A6EEe3yCzl20XodtgkE,16229
 reconcile/external_resources/state.py,sha256=bWq51xPK4-BHVXWsRu6Y-vn69yg9Dse4x1RNNF7qw84,9614
 reconcile/glitchtip/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/glitchtip/integration.py,sha256=XtewM9nfTPLnPSpYebP50GrveYOnhTvKNq3seSvL6u8,8343
@@ -854,8 +854,8 @@ tools/test/test_qontract_cli.py,sha256=_D61RFGAN5x44CY1tYbouhlGXXABwYfxKSWSQx3Jr
 tools/test/test_saas_promotion_state.py,sha256=dy4kkSSAQ7bC0Xp2CociETGN-2aABEfL6FU5D9Jl00Y,6056
 tools/test/test_sd_app_sre_alert_report.py,sha256=v363r9zM7__0kR5K6mvJoGFcM9BvE33fWAayrqkpojA,2116
 tools/test/test_sre_checkpoints.py,sha256=SKqPPTl9ua0RFdSSofnoQX-JZE6dFLO3LRhfQzqtfh8,2607
-qontract_reconcile-0.10.1rc996.dist-info/METADATA,sha256=1yk8ORxJ5XgceH637jz-GGaURn1NIRcEEF228Yd0_UM,2262
-qontract_reconcile-0.10.1rc996.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-qontract_reconcile-0.10.1rc996.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
-qontract_reconcile-0.10.1rc996.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
-qontract_reconcile-0.10.1rc996.dist-info/RECORD,,
+qontract_reconcile-0.10.1rc997.dist-info/METADATA,sha256=zxGaYZt6G_4RJZBpfsYs23oXou1bP0MNIEkxLY83WxA,2262
+qontract_reconcile-0.10.1rc997.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+qontract_reconcile-0.10.1rc997.dist-info/entry_points.txt,sha256=GKQqCl2j2X1BJQ69een6rHcR26PmnxnONLNOQB-nRjY,491
+qontract_reconcile-0.10.1rc997.dist-info/top_level.txt,sha256=l5ISPoXzt0SdR4jVdkfa7RPSKNc8zAHYWAnR-Dw8Ey8,24
+qontract_reconcile-0.10.1rc997.dist-info/RECORD,,

reconcile/external_resources/secrets_sync.py

@@ -95,6 +95,43 @@ class SecretHelper:
         return three_way_diff_using_hash(cmp_current, cmp_desired)
 
 
+class OutputSecretsFormatter:
+    """Class to format Module output keys/values into suitable values for K8s Secrets. It currently implements the same
+    behavior as Terraform-Resources."""
+
+    def __init__(self, secret_reader: SecretReaderBase) -> None:
+        self.secret_reader = secret_reader
+
+    def _key_must_be_populated(self, key: str) -> bool:
+        "Only keys containing '__' must be populated to Secrets"
+        return "__" in key
+
+    def _format_key(self, key: str) -> str:
+        if "__" not in key:
+            return key
+        k_split = key.split("__")
+        output_key = k_split[1]
+        if output_key.startswith("db"):
+            output_key = output_key.replace("db_", "db.")
+        return output_key
+
+    def _format_value(self, value: str) -> str:
+        decoded_value = base64.b64decode(value).decode("utf-8")
+        if decoded_value.startswith("__vault__:"):
+            _secret_ref = json.loads(decoded_value.replace("__vault__:", ""))
+            secret_ref = VaultSecret(**_secret_ref)
+            return self.secret_reader.read_secret(secret_ref)
+        else:
+            return decoded_value
+
+    def format(self, data: Mapping[str, str]) -> dict[str, str]:
+        return {
+            self._format_key(key): self._format_value(value)
+            for key, value in data.items()
+            if self._key_must_be_populated(key)
+        }
+
+
 class SecretsReconciler:
     def __init__(
         self,
@@ -281,6 +318,7 @@ class InClusterSecretsReconciler(SecretsReconciler):
         cluster: str,
         namespace: str,
         oc: OCCli,
+        output_secrets_formatter: OutputSecretsFormatter,
         thread_pool_size: int,
         dry_run: bool,
     ):
@@ -292,6 +330,7 @@ class InClusterSecretsReconciler(SecretsReconciler):
         self.source_secrets: list[str] = []
         self.vault_client = vault_client
         self.vault_path = vault_path
+        self.output_secrets_formatter = output_secrets_formatter
 
     def _get_spec_hash(self, spec: ExternalResourceSpec) -> str:
         secret_key = f"{spec.provision_provider}-{spec.provisioner_name}-{spec.provider}-{spec.identifier}"
@@ -313,21 +352,10 @@ class InClusterSecretsReconciler(SecretsReconciler):
         for secret in secrets:
             secret_name = secret["metadata"]["name"]
             spec = secrets_map[secret_name]
-            data = dict[str, str]()
-            for k, v in secret["data"].items():
-                decoded = base64.b64decode(v).decode("utf-8")
-
-                if decoded.startswith("__vault__:"):
-                    _secret_ref = json.loads(decoded.replace("__vault__:", ""))
-                    secret_ref = VaultSecret(**_secret_ref)
-                    data[k] = self.secrets_reader.read_secret(secret_ref)
-                else:
-                    data[k] = decoded
-
+            spec.secret = self.output_secrets_formatter.format(secret["data"])
             spec.metadata[SECRET_UPDATED_AT] = datetime.now(UTC).strftime(
                 SECRET_UPDATED_AT_TIMEFORMAT
             )
-            spec.secret = data
 
     def _delete_source_secret(self, spec: ExternalResourceSpec) -> None:
         secret_name = self._get_spec_outputs_secret_name(spec)
@@ -396,6 +424,7 @@ def build_incluster_secrets_reconciler(
         vault_path=vault_path,
         vault_client=VaultClient(),
         secrets_reader=secrets_reader,
+        output_secrets_formatter=OutputSecretsFormatter(secrets_reader),
         thread_pool_size=thread_pool_size,
         dry_run=dry_run,
     )