qontract-reconcile 0.10.2.dev155__py3-none-any.whl → 0.10.2.dev157__py3-none-any.whl

{qontract_reconcile-0.10.2.dev155.dist-info → qontract_reconcile-0.10.2.dev157.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev155
+Version: 0.10.2.dev157
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev155.dist-info → qontract_reconcile-0.10.2.dev157.dist-info}/RECORD

@@ -89,7 +89,7 @@ reconcile/openshift_upgrade_watcher.py,sha256=9IB321hlRZZhzdaR9G3zoWAhVv0-KzNiEq
 reconcile/openshift_users.py,sha256=JUWLb13USlQ4KvXZVsi3JES4csZnXlH0plhxskg_p6A,5300
 reconcile/openshift_vault_secrets.py,sha256=9rTqV6wzCQx2Oh712E_Xj8wMG7u8Oh-pY8DWjlv4mZw,1660
 reconcile/quay_base.py,sha256=h5xNjb7EZm8L2JgpO42r6w0UA4im5dabZXJSIW69zKU,1987
-reconcile/quay_membership.py,sha256=YDLY7ayDsatEpYCe_iMdf3pkvrbmN8mAwrDKUJUa4Lg,6260
+reconcile/quay_membership.py,sha256=cmeoRdr3-wVlymNHVhzhW0W-Tq6qt1hd2OOIhGXsmrY,6398
 reconcile/quay_mirror.py,sha256=0KtQFwrvMNtlsPJ9F_-ICaVIjgIUjFxqipvAPcvyg3Q,15338
 reconcile/quay_mirror_org.py,sha256=tXKuF6JtmaNRwu8_g_65U_Vpd6sFBYeXmJA-flVhylE,10764
 reconcile/quay_permissions.py,sha256=9KOutS1w4RFQqkvMSy54VtsKNx56-phzP6yI_rEW-B8,4244
@@ -188,10 +188,10 @@ reconcile/cna/assets/asset_factory.py,sha256=7T7X_J6xIsoGETqBRI45_EyIKEdQcnRPt_G
 reconcile/cna/assets/null.py,sha256=85mVh97atCoC0aLuX47poTZiyOthmziJeBsUw0c924w,1658
 reconcile/dynatrace_token_provider/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/dynatrace_token_provider/dependencies.py,sha256=lvkdwqHMsn_2kgj-tUIJdTUnUNxVoS6z8k4nPkGglnQ,3129
-reconcile/dynatrace_token_provider/integration.py,sha256=d2iAQ_NUUIVN4I0_Y-LQQtWuWuzclJcXGQC8dEWYGvQ,26365
+reconcile/dynatrace_token_provider/integration.py,sha256=1D6gIEwKvkzE9JDOcLb9EAP6JW8OK2OLNuiHAyot_XQ,28329
 reconcile/dynatrace_token_provider/metrics.py,sha256=oP-6NTZENFdvWiS0krnmX6tq3xyOzQ8e6vS0CZWYUuw,1496
-reconcile/dynatrace_token_provider/model.py,sha256=gkpqo5rRRueBXnIMjp4EEHqBUBuU65TRI8zpdb8GJ0A,241
-reconcile/dynatrace_token_provider/ocm.py,sha256=bryaK7xs7ygttUyZuSD9Up4laUhP6OUTr2VBbFiclpA,4298
+reconcile/dynatrace_token_provider/model.py,sha256=L6THhpPnSIeJ5n61IHhDT_JTiSEr_uWmgJAw83RUC_w,477
+reconcile/dynatrace_token_provider/ocm.py,sha256=EPknDhLXkySs8Nv8jrrl12oRoe2bRFWx_CMiHpPQhmM,3734
 reconcile/dynatrace_token_provider/validate.py,sha256=40_9QmHoB3-KBc0k_0D4QO00PpNNPS-gU9Z6cIcWga8,1920
 reconcile/endpoints_discovery/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/endpoints_discovery/integration.py,sha256=p50wu4OWO3RmL2A9TvjhRZkTYUe-l9aec4vgu0bxq8w,14926
@@ -227,7 +227,7 @@ reconcile/glitchtip_project_alerts/integration.py,sha256=BgMx-NyV9mTuv7Sotb2OioC
 reconcile/glitchtip_project_dsn/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/glitchtip_project_dsn/integration.py,sha256=2iugub-kHYkHNK33n0v9_TeWonuxCPah_VkoTPvaajE,8077
 reconcile/gql_definitions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/introspection.json,sha256=8tA2_ZuvhmWLNRV1-JvZeVTdyUDYAVvdSe0mvxm_Uag,2286927
+reconcile/gql_definitions/introspection.json,sha256=cO8ytMUFP2x_mD8oq0pkcrgSFSj7epYDcdQTJCGTw-I,2289286
 reconcile/gql_definitions/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/acs/acs_instances.py,sha256=L91WW9LbhJbBSrECqShQpFtjoBOsmNIYLRpMbx1io5o,2181
 reconcile/gql_definitions/acs/acs_policies.py,sha256=bN5i4mks10Z23KJSj7jqp966Osq2dps4d-sPH9gjxEA,7008
@@ -392,7 +392,7 @@ reconcile/gql_definitions/openshift_groups/managed_roles.py,sha256=rsHMgDWwnh0RR
 reconcile/gql_definitions/openshift_serviceaccount_tokens/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/openshift_serviceaccount_tokens/tokens.py,sha256=FeraeQThHl2UbhTuCPDwm3ltczF_jfZn5E3Squ8-znw,3313
 reconcile/gql_definitions/quay_membership/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/quay_membership/quay_membership.py,sha256=H2xHvdNr3K0QzB2dituwStUIWCqePt35dkgeUZycECM,2824
+reconcile/gql_definitions/quay_membership/quay_membership.py,sha256=MKBkrE-1YYelaAAxOdpqUwCo45kOVC8q29vXArqK_zM,3075
 reconcile/gql_definitions/rhidp/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/rhidp/organizations.py,sha256=dW9y3ewFu3E-DFrZAi_SEewHYR0MWYeOB52vwnVcq5E,2580
 reconcile/gql_definitions/service_dependencies/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -797,7 +797,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=UfwwRLS5Ya4_Nh1w5n1dvoYtchQvYE9yj1VANt2IKqI,3925
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=zEDbGr18ZeHNQwW8pUsr2JRjuXIPz--WAGJxZo9sv_Y,894
-qontract_reconcile-0.10.2.dev155.dist-info/METADATA,sha256=SCv6zhblOoa_txf4pnB9rfLD7oODuJ5n_FDMgerKyYU,24627
-qontract_reconcile-0.10.2.dev155.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-qontract_reconcile-0.10.2.dev155.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev155.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev157.dist-info/METADATA,sha256=a0v4VwAX4CUOblutkjBWxC1LUvx_HwYZUsCE6exNgto,24627
+qontract_reconcile-0.10.2.dev157.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+qontract_reconcile-0.10.2.dev157.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev157.dist-info/RECORD,,

reconcile/dynatrace_token_provider/integration.py

@@ -13,12 +13,15 @@ from reconcile.dynatrace_token_provider.metrics import (
     DTPOrganizationErrorRate,
     DTPTokensManagedGauge,
 )
-from reconcile.dynatrace_token_provider.model import DynatraceAPIToken, K8sSecret
-from reconcile.dynatrace_token_provider.ocm import (
-    DTP_LABEL_SEARCH,
-    DTP_TENANT_V2_LABEL,
+from reconcile.dynatrace_token_provider.model import (
     Cluster,
+    DynatraceAPIToken,
+    K8sSecret,
+    TokenSpecTenantBinding,
+)
+from reconcile.dynatrace_token_provider.ocm import (
     OCMClient,
+    OCMCluster,
 )
 from reconcile.dynatrace_token_provider.validate import validate_token_specs
 from reconcile.gql_definitions.dynatrace_token_provider.token_specs import (
@@ -37,6 +40,7 @@ from reconcile.utils.ocm.base import (
     OCMServiceLogSeverity,
 )
 from reconcile.utils.ocm.labels import subscription_label_filter
+from reconcile.utils.ocm.sre_capability_labels import sre_capability_label_key
 from reconcile.utils.openshift_resource import (
     QONTRACT_ANNOTATION_INTEGRATION,
     QONTRACT_ANNOTATION_INTEGRATION_VERSION,
@@ -50,6 +54,9 @@ from reconcile.utils.semver_helper import make_semver
 QONTRACT_INTEGRATION_VERSION = make_semver(2, 0, 1)
 QONTRACT_INTEGRATION = "dynatrace-token-provider"
 SYNCSET_AND_MANIFEST_ID = "ext-dynatrace-tokens-dtp"
+DTP_LABEL_SEARCH = sre_capability_label_key("dtp", "%")
+DTP_TENANT_V2_LABEL = sre_capability_label_key("dtp.v2", "tenant")
+DTP_SPEC_V2_LABEL = sre_capability_label_key("dtp.v2", "token-spec")
 
 
 class ReconcileErrorSummary(Exception):
@@ -103,6 +110,27 @@ class DynatraceTokenProviderIntegration(QontractReconcileIntegration[NoParams]):
                     cnt,
                 )
 
+    def _parse_ocm_data_to_cluster(self, ocm_cluster: OCMCluster) -> Cluster | None:
+        dt_tenant = ocm_cluster.labels.get(DTP_TENANT_V2_LABEL)
+        token_spec_name = ocm_cluster.labels.get(DTP_SPEC_V2_LABEL)
+        if not dt_tenant or not token_spec_name:
+            logging.warning(
+                f"[Missing DTP labels] {ocm_cluster.id=} {ocm_cluster.subscription_id=} {dt_tenant=} {token_spec_name=}"
+            )
+            return None
+        return Cluster(
+            id=ocm_cluster.id,
+            external_id=ocm_cluster.external_id,
+            organization_id=ocm_cluster.organization_id,
+            is_hcp=ocm_cluster.is_hcp,
+            dt_token_bindings=[
+                TokenSpecTenantBinding(
+                    spec_name=token_spec_name,
+                    tenant_id=dt_tenant,
+                )
+            ],
+        )
+
     def _filter_clusters(
         self,
         clusters: Iterable[Cluster],
@@ -110,18 +138,19 @@ class DynatraceTokenProviderIntegration(QontractReconcileIntegration[NoParams]):
     ) -> list[Cluster]:
         filtered_clusters = []
         for cluster in clusters:
-            token_spec = token_spec_by_name.get(cluster.token_spec_name)
-            if not token_spec:
-                logging.debug(
-                    f"[{cluster.id=}] Skipping cluster. {cluster.token_spec_name=} does not exist."
-                )
-                continue
-            if cluster.organization_id in token_spec.ocm_org_ids:
-                filtered_clusters.append(cluster)
-            else:
-                logging.debug(
-                    f"[{cluster.id=}] Skipping cluster for {token_spec.name=}. {cluster.organization_id=} is not defined in {token_spec.ocm_org_ids=}."
-                )
+            for token_binding in cluster.dt_token_bindings:
+                token_spec = token_spec_by_name.get(token_binding.spec_name)
+                if not token_spec:
+                    logging.debug(
+                        f"[{cluster.id=}] Skipping cluster. {token_binding.spec_name=} does not exist."
+                    )
+                    continue
+                if cluster.organization_id in token_spec.ocm_org_ids:
+                    filtered_clusters.append(cluster)
+                else:
+                    logging.debug(
+                        f"[{cluster.id=}] Skipping cluster for {token_spec.name=}. {cluster.organization_id=} is not defined in {token_spec.ocm_org_ids=}."
+                    )
         return filtered_clusters
 
     def reconcile(self, dry_run: bool, dependencies: Dependencies) -> None:
@@ -131,17 +160,26 @@ class DynatraceTokenProviderIntegration(QontractReconcileIntegration[NoParams]):
         with metrics.transactional_metrics(self.name):
             unhandled_exceptions = []
             for ocm_env_name, ocm_client in dependencies.ocm_client_by_env_name.items():
-                clusters: list[Cluster] = []
+                ocm_clusters: list[OCMCluster] = []
                 try:
-                    clusters = ocm_client.discover_clusters_by_labels(
+                    ocm_clusters = ocm_client.discover_clusters_by_labels(
                         label_filter=subscription_label_filter().like(
                             "key", DTP_LABEL_SEARCH
                         ),
                     )
                 except Exception as e:
                     unhandled_exceptions.append(f"{ocm_env_name}: {e}")
-                if not clusters:
+                if not ocm_clusters:
                     continue
+                clusters: list[Cluster] = [
+                    cluster
+                    for ocm_cluster in ocm_clusters
+                    if (
+                        cluster := self._parse_ocm_data_to_cluster(
+                            ocm_cluster=ocm_cluster
+                        )
+                    )
+                ]
                 filtered_clusters = self._filter_clusters(
                     clusters=clusters,
                     token_spec_by_name=dependencies.token_spec_by_name,
@@ -157,79 +195,80 @@ class DynatraceTokenProviderIntegration(QontractReconcileIntegration[NoParams]):
                     len(clusters),
                 )
                 for cluster in filtered_clusters:
-                    try:
-                        with DTPOrganizationErrorRate(
-                            integration=self.name,
-                            ocm_env=ocm_env_name,
-                            org_id=cluster.organization_id,
-                        ):
-                            tenant_id = cluster.dt_tenant
-                            if not tenant_id:
-                                _expose_errors_as_service_log(
-                                    ocm_client,
-                                    cluster_uuid=cluster.external_id,
-                                    error=f"Missing label {DTP_TENANT_V2_LABEL}",
-                                )
-                                logging.warn(
-                                    f"[{cluster.id=}] Missing value for label {DTP_TENANT_V2_LABEL}"
-                                )
-                                continue
-                            if (
-                                tenant_id
-                                not in dependencies.dynatrace_client_by_tenant_id
+                    for token_binding in cluster.dt_token_bindings:
+                        try:
+                            with DTPOrganizationErrorRate(
+                                integration=self.name,
+                                ocm_env=ocm_env_name,
+                                org_id=cluster.organization_id,
                             ):
-                                _expose_errors_as_service_log(
-                                    ocm_client,
-                                    cluster_uuid=cluster.external_id,
-                                    error=f"Dynatrace tenant {tenant_id} does not exist",
-                                )
-                                logging.warn(
-                                    f"[{cluster.id=}] Dynatrace {tenant_id=} does not exist"
-                                )
-                                continue
-                            dt_client = dependencies.dynatrace_client_by_tenant_id[
-                                tenant_id
-                            ]
+                                tenant_id = token_binding.tenant_id
+                                if not tenant_id:
+                                    _expose_errors_as_service_log(
+                                        ocm_client,
+                                        cluster_uuid=cluster.external_id,
+                                        error=f"Missing label {DTP_TENANT_V2_LABEL}",
+                                    )
+                                    logging.warning(
+                                        f"[{cluster.id=}] Missing value for label {DTP_TENANT_V2_LABEL}"
+                                    )
+                                    continue
+                                if (
+                                    tenant_id
+                                    not in dependencies.dynatrace_client_by_tenant_id
+                                ):
+                                    _expose_errors_as_service_log(
+                                        ocm_client,
+                                        cluster_uuid=cluster.external_id,
+                                        error=f"Dynatrace tenant {tenant_id} does not exist",
+                                    )
+                                    logging.warning(
+                                        f"[{cluster.id=}] Dynatrace {tenant_id=} does not exist"
+                                    )
+                                    continue
+                                dt_client = dependencies.dynatrace_client_by_tenant_id[
+                                    tenant_id
+                                ]
 
-                            token_spec = dependencies.token_spec_by_name.get(
-                                cluster.token_spec_name
-                            )
-                            if not token_spec:
-                                _expose_errors_as_service_log(
-                                    ocm_client,
-                                    cluster_uuid=cluster.external_id,
-                                    error=f"Token spec {cluster.token_spec_name} does not exist",
-                                )
-                                logging.warn(
-                                    f"[{cluster.id=}] Token spec '{cluster.token_spec_name}' does not exist"
+                                token_spec = dependencies.token_spec_by_name.get(
+                                    token_binding.spec_name
                                 )
-                                continue
-                            if tenant_id not in existing_dtp_tokens:
-                                existing_dtp_tokens[tenant_id] = (
-                                    dt_client.get_token_ids_map_for_name_prefix(
-                                        prefix="dtp"
+                                if not token_spec:
+                                    _expose_errors_as_service_log(
+                                        ocm_client,
+                                        cluster_uuid=cluster.external_id,
+                                        error=f"Token spec {token_binding.spec_name} does not exist",
+                                    )
+                                    logging.warning(
+                                        f"[{cluster.id=}] Token spec '{token_binding.spec_name}' does not exist"
+                                    )
+                                    continue
+                                if tenant_id not in existing_dtp_tokens:
+                                    existing_dtp_tokens[tenant_id] = (
+                                        dt_client.get_token_ids_map_for_name_prefix(
+                                            prefix="dtp"
+                                        )
                                     )
-                                )
 
-                            """
-                            Note, that we consciously do not parallelize cluster processing
-                            for now. We want to keep stress on OCM at a minimum. The amount
-                            of tagged clusters is currently feasible to be processed sequentially.
-                            """
-                            self.process_cluster(
-                                dry_run=dry_run,
-                                cluster=cluster,
-                                dt_client=dt_client,
-                                ocm_client=ocm_client,
-                                existing_dtp_tokens=existing_dtp_tokens[tenant_id],
-                                tenant_id=tenant_id,
-                                token_spec=token_spec,
-                                ocm_env_name=ocm_env_name,
+                                """
+                                Note, that we consciously do not parallelize cluster processing
+                                for now. We want to keep stress on OCM at a minimum. The amount
+                                of tagged clusters is currently feasible to be processed sequentially.
+                                """
+                                self.process_cluster(
+                                    dry_run=dry_run,
+                                    cluster=cluster,
+                                    dt_client=dt_client,
+                                    ocm_client=ocm_client,
+                                    existing_dtp_tokens=existing_dtp_tokens[tenant_id],
+                                    tenant_id=tenant_id,
+                                    token_spec=token_spec,
+                                    ocm_env_name=ocm_env_name,
+                                )
+                        except Exception as e:
+                            unhandled_exceptions.append(
+                                f"{ocm_env_name}/{cluster.organization_id}/{cluster.id}: {e}"
                             )
-                    except Exception as e:
-                        unhandled_exceptions.append(
-                            f"{ocm_env_name}/{cluster.organization_id}/{cluster.id}: {e}"
-                        )
                 self._expose_token_metrics()
 
         if unhandled_exceptions:

reconcile/dynatrace_token_provider/model.py

@@ -12,3 +12,16 @@ class K8sSecret(BaseModel):
     namespace_name: str
     secret_name: str
     tokens: list[DynatraceAPIToken]
+
+
+class TokenSpecTenantBinding(BaseModel):
+    spec_name: str
+    tenant_id: str
+
+
+class Cluster(BaseModel):
+    id: str
+    external_id: str
+    organization_id: str
+    is_hcp: bool
+    dt_token_bindings: list[TokenSpecTenantBinding]

reconcile/dynatrace_token_provider/ocm.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import logging
 from collections.abc import Mapping
 from datetime import timedelta
 from typing import Any
@@ -21,7 +20,6 @@ from reconcile.utils.ocm.manifests import (
     patch_manifest,
 )
 from reconcile.utils.ocm.service_log import create_service_log
-from reconcile.utils.ocm.sre_capability_labels import sre_capability_label_key
 from reconcile.utils.ocm.syncsets import (
     create_syncset,
     get_syncset,
@@ -35,35 +33,25 @@ from reconcile.utils.ocm_base_client import (
 Thin abstractions of reconcile.ocm module to reduce coupling.
 """
 
-DTP_LABEL_SEARCH = sre_capability_label_key("dtp", "%")
-DTP_TENANT_V2_LABEL = sre_capability_label_key("dtp.v2", "tenant")
-DTP_SPEC_V2_LABEL = sre_capability_label_key("dtp.v2", "token-spec")
 
-
-class Cluster(BaseModel):
+class OCMCluster(BaseModel):
     id: str
     external_id: str
     organization_id: str
-    dt_tenant: str
-    token_spec_name: str
+    subscription_id: str
     is_hcp: bool
+    labels: Mapping[str, str]
 
     @staticmethod
-    def from_cluster_details(cluster: ClusterDetails) -> Cluster | None:
-        dt_tenant = cluster.labels.get_label_value(DTP_TENANT_V2_LABEL)
-        token_spec_name = cluster.labels.get_label_value(DTP_SPEC_V2_LABEL)
-        if not dt_tenant or not token_spec_name:
-            logging.warning(
-                f"[Missing DTP labels] {cluster.ocm_cluster.id=} {cluster.ocm_cluster.subscription.id=} {dt_tenant=} {token_spec_name=}"
-            )
-            return None
-        return Cluster(
+    def from_cluster_details(cluster: ClusterDetails) -> OCMCluster | None:
+        labels = {key: label.value for key, label in cluster.labels.labels.items()}
+        return OCMCluster(
             id=cluster.ocm_cluster.id,
             external_id=cluster.ocm_cluster.external_id,
             organization_id=cluster.organization_id,
-            dt_tenant=dt_tenant,
-            token_spec_name=token_spec_name,
+            subscription_id=cluster.ocm_cluster.subscription.id,
             is_hcp=cluster.ocm_cluster.is_rosa_hypershift(),
+            labels=labels,
         )
 
 
@@ -117,13 +105,13 @@ class OCMClient:
             manifest_map=manifest_map,
         )
 
-    def discover_clusters_by_labels(self, label_filter: Filter) -> list[Cluster]:
+    def discover_clusters_by_labels(self, label_filter: Filter) -> list[OCMCluster]:
         return [
             cluster
             for ocm_cluster in discover_clusters_by_labels(
                 ocm_api=self._ocm_client, label_filter=label_filter
             )
-            if (cluster := Cluster.from_cluster_details(ocm_cluster))
+            if (cluster := OCMCluster.from_cluster_details(ocm_cluster))
         ]
 
     def create_service_log(

reconcile/gql_definitions/introspection.json

@@ -11541,6 +11541,30 @@
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
+                        },
+                        {
+                            "name": "external_users",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "NON_NULL",
+                                "name": null,
+                                "ofType": {
+                                    "kind": "LIST",
+                                    "name": null,
+                                    "ofType": {
+                                        "kind": "NON_NULL",
+                                        "name": null,
+                                        "ofType": {
+                                            "kind": "OBJECT",
+                                            "name": "ExternalUser_v1",
+                                            "ofType": null
+                                        }
+                                    }
+                                }
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
                         }
                     ],
                     "inputFields": null,
@@ -27145,13 +27169,21 @@
                             "description": null,
                             "args": [],
                             "type": {
-                                "kind": "NON_NULL",
-                                "name": null,
-                                "ofType": {
-                                    "kind": "SCALAR",
-                                    "name": "String",
-                                    "ofType": null
-                                }
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "quay_username",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
@@ -27179,6 +27211,26 @@
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
+                        },
+                        {
+                            "name": "roles",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "LIST",
+                                "name": null,
+                                "ofType": {
+                                    "kind": "NON_NULL",
+                                    "name": null,
+                                    "ofType": {
+                                        "kind": "OBJECT",
+                                        "name": "Role_v1",
+                                        "ofType": null
+                                    }
+                                }
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
                         }
                     ],
                     "inputFields": null,

reconcile/gql_definitions/quay_membership/quay_membership.py

@@ -37,6 +37,9 @@ query QuayMembership {
         bots {
           quay_username
         }
+        external_users {
+          quay_username
+        }
         expirationDate
       }
     }
@@ -72,9 +75,14 @@ class BotV1(ConfiguredBaseModel):
     quay_username: Optional[str] = Field(..., alias="quay_username")
 
 
+class ExternalUserV1(ConfiguredBaseModel):
+    quay_username: Optional[str] = Field(..., alias="quay_username")
+
+
 class RoleV1(ConfiguredBaseModel):
     users: list[UserV1] = Field(..., alias="users")
     bots: list[BotV1] = Field(..., alias="bots")
+    external_users: list[ExternalUserV1] = Field(..., alias="external_users")
     expiration_date: Optional[str] = Field(..., alias="expirationDate")
 
 

reconcile/quay_membership.py

@@ -5,6 +5,7 @@ from collections.abc import Sequence
 from reconcile.gql_definitions.quay_membership import quay_membership
 from reconcile.gql_definitions.quay_membership.quay_membership import (
     BotV1,
+    ExternalUserV1,
     PermissionQuayOrgTeamV1,
     UserV1,
 )
@@ -80,7 +81,7 @@ def fetch_current_state(quay_api_store):
     return state
 
 
-def get_usernames(users: Sequence[UserV1 | BotV1]) -> list[str]:
+def get_usernames(users: Sequence[UserV1 | BotV1 | ExternalUserV1]) -> list[str]:
     return [u.quay_username for u in users if u.quay_username]
 
 
@@ -92,7 +93,11 @@ def fetch_desired_state():
         p = process_permission(permission)
         members: list[str] = []
         for role in expiration.filter(permission.roles):
-            members += get_usernames(role.users) + get_usernames(role.bots)
+            members += (
+                get_usernames(role.users)
+                + get_usernames(role.bots)
+                + get_usernames(role.external_users)
+            )
 
         state.add(p, members)