qontract-reconcile 0.10.2.dev183__tar.gz → 0.10.2.dev185__tar.gz

{qontract_reconcile-0.10.2.dev183 → qontract_reconcile-0.10.2.dev185}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev183
+Version: 0.10.2.dev185
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev183 → qontract_reconcile-0.10.2.dev185}/reconcile/automated_actions/config/integration.py

@@ -16,10 +16,11 @@ from pydantic import BaseModel
 
 import reconcile.openshift_base as ob
 from reconcile.gql_definitions.automated_actions.instance import (
-    AutomatedActionArgumentOpenshiftV1,
-    AutomatedActionArgumentV1,
+    AutomatedActionActionListV1,
+    AutomatedActionOpenshiftWorkloadRestartArgumentV1,
+    AutomatedActionOpenshiftWorkloadRestartV1,
     AutomatedActionsInstanceV1,
-    PermissionAutomatedActionsV1,
+    AutomatedActionV1,
 )
 from reconcile.gql_definitions.automated_actions.instance import query as instance_query
 from reconcile.utils import expiration, gql
@@ -35,7 +36,7 @@ from reconcile.utils.runtime.integration import (
 from reconcile.utils.semver_helper import make_semver
 
 QONTRACT_INTEGRATION = "automated-actions-config"
-QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 1)
 
 
 class AutomatedActionsConfigIntegrationParams(PydanticRunParams):
@@ -51,7 +52,6 @@ class AutomatedActionsUser(BaseModel):
 
 
 class AutomatedActionsPolicy(BaseModel):
-    sub: str
     obj: str
     max_ops: int
     params: dict[str, str] = {}
@@ -89,89 +89,109 @@ class AutomatedActionsConfigIntegration(
         for instance in data.automated_actions_instances_v1 or []:
             if instance.deployment.delete:
                 continue
-            instance.permissions = list(
-                self.filter_permissions(instance.permissions or [])
-            )
+            instance.actions = list(self.filter_actions(instance.actions or []))
             yield instance
 
-    def is_enabled(self, argument: AutomatedActionArgumentV1) -> bool:
+    def is_enabled(
+        self, argument: AutomatedActionOpenshiftWorkloadRestartArgumentV1
+    ) -> bool:
         """Check if the integration is enabled for the given argument namespace."""
-        if isinstance(argument, AutomatedActionArgumentOpenshiftV1):
-            return (
-                integration_is_enabled("automated-actions", argument.namespace.cluster)
-                and not argument.namespace.delete
-            )
-        return True
+        return (
+            integration_is_enabled("automated-actions", argument.namespace.cluster)
+            and not argument.namespace.delete
+        )
 
-    def filter_permissions(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
-    ) -> Generator[PermissionAutomatedActionsV1, None, None]:
+    def filter_actions(
+        self, actions: Iterable[AutomatedActionV1]
+    ) -> Generator[AutomatedActionV1, None, None]:
         """Filter out expired roles and arguments (cluster.namespace) with disabled integrations."""
-        for permission in permissions:
-            # automated actions disabled for the cluster?
-            permission.arguments = [
-                arg for arg in permission.arguments or [] if self.is_enabled(arg)
+        for action in actions:
+            match action:
+                case AutomatedActionOpenshiftWorkloadRestartV1():
+                    # automated actions disabled for the cluster?
+                    action.openshift_workload_restart_arguments = [
+                        arg
+                        for arg in action.openshift_workload_restart_arguments or []
+                        if self.is_enabled(arg)
+                    ]
+
+            # Remove expired roles
+            for permission in action.permissions or []:
+                permission.roles = expiration.filter(permission.roles)
+
+            # Remove permissions without roles
+            action.permissions = [
+                permission
+                for permission in action.permissions or []
+                if permission.roles
             ]
-            # remove expired roles
-            permission.roles = expiration.filter(permission.roles)
-            if not permission.roles:
+
+            if not action.permissions:
                 continue
-            yield permission
+
+            yield action
 
     def compile_users(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
+        self, actions: Iterable[AutomatedActionV1]
     ) -> list[AutomatedActionsUser]:
-        """Compile all automated actions roles."""
+        """Compile a list of all automated actions users with their role relations."""
         users: dict[str, AutomatedActionsUser] = {}
-        for permission in permissions:
-            for role in permission.roles or []:
-                for user in (role.users or []) + (role.bots or []):
-                    if not user.org_username:
-                        continue
-                    aa_user = users.setdefault(
-                        user.org_username,
-                        AutomatedActionsUser(username=user.org_username, roles=[]),
-                    )
-                    aa_user.roles.add(role.name)
+        for action in actions:
+            for permission in action.permissions or []:
+                for role in permission.roles or []:
+                    for user in (role.users or []) + (role.bots or []):
+                        if not user.org_username:
+                            continue
+                        aa_user = users.setdefault(
+                            user.org_username,
+                            AutomatedActionsUser(username=user.org_username, roles=[]),
+                        )
+                        aa_user.roles.add(role.name)
 
         return list(users.values())
 
     def compile_roles(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
+        self, actions: Iterable[AutomatedActionV1]
     ) -> AutomatedActionRoles:
         """Compile all automated actions policies."""
         roles: AutomatedActionRoles = {}
 
-        for permission in permissions or []:
-            action = permission.action
-
-            parameters: list[dict[str, str]] = [] if permission.arguments else [{}]
-            for arg in permission.arguments or []:
-                match arg:
-                    case AutomatedActionArgumentOpenshiftV1():
-                        parameters.append({
+        for action in actions:
+            parameters: list[dict[str, str]] = []
+            match action:
+                case AutomatedActionActionListV1():
+                    # no special handling needed, just dump the values
+                    parameters.extend(
+                        arg.dict(exclude_none=True, exclude_defaults=True)
+                        for arg in action.action_list_arguments or []
+                    )
+                case AutomatedActionOpenshiftWorkloadRestartV1():
+                    parameters.extend(
+                        {
                             # all parameter values are regexes in the OPA policy
                             # therefore, cluster and namespace must be fixed to the current strings
                             "cluster": f"^{arg.namespace.cluster.name}$",
                             "namespace": f"^{arg.namespace.name}$",
-                            "kind": arg.kind_pattern,
-                            "name": arg.name_pattern,
-                        })
-                    case _:
-                        raise NotImplementedError(
-                            f"Unsupported argument type: {arg.q_type}"
+                            "kind": arg.kind,
+                            "name": arg.name,
+                        }
+                        for arg in action.openshift_workload_restart_arguments
+                    )
+
+            if not parameters:
+                parameters = [{}]
+
+            for permission in action.permissions or []:
+                for role in permission.roles or []:
+                    aa_role = roles.setdefault(role.name, [])
+                    aa_role.extend(
+                        AutomatedActionsPolicy(
+                            obj=action.q_type,
+                            max_ops=action.max_ops,
+                            params=params,
                         )
-            for role in permission.roles or []:
-                aa_role = roles.setdefault(role.name, [])
-                aa_role.extend(
-                    AutomatedActionsPolicy(
-                        sub=role.name,
-                        obj=action.operation_id,
-                        max_ops=action.max_ops,
-                        params=params,
+                        for params in parameters
                     )
-                    for params in parameters
-                )
         return roles
 
     def build_policy_file(
@@ -273,8 +293,8 @@ class AutomatedActionsConfigIntegration(
         ri = ResourceInventory()
 
         for instance in instances:
-            users = self.compile_users(instance.permissions or [])
-            policies = self.compile_roles(instance.permissions or [])
+            users = self.compile_users(instance.actions or [])
+            policies = self.compile_roles(instance.actions or [])
             if not users and not policies:
                 logging.info(
                     f"{instance.deployment.cluster.name}/{instance.deployment.name}: No enabled automated actions found. Skipping this instance!"

{qontract_reconcile-0.10.2.dev183 → qontract_reconcile-0.10.2.dev185}/reconcile/dashdotdb_dora.py

@@ -34,7 +34,7 @@ from reconcile.typed_queries.saas_files import get_saas_files
 from reconcile.utils.github_api import GithubRepositoryApi
 from reconcile.utils.gitlab_api import GitLabApi
 from reconcile.utils.secret_reader import create_secret_reader
-from reconcile.utils.vcs import GITHUB_BASE_URL
+from reconcile.utils.vcs import VCS
 
 QONTRACT_INTEGRATION = "dashdotdb-dora"
 
@@ -422,19 +422,21 @@ class DashdotdbDORA(DashdotdbBase):
             return rc, []
 
         LOG.info("Fetching commits %s", rc)
-        if rc.repo_url.startswith(GITHUB_BASE_URL):
-            try:
-                commits = self._github_compare_commits(rc)
-            except GithubException as e:
-                if e.status == 404:
-                    LOG.info(
-                        f"Ignoring RepoChanges for {rc} because could not calculate them: {e.data['message']}"
-                    )
-                    return rc, []
-        elif rc.repo_url.startswith(self.gl.server):
-            commits = self._gitlab_compare_commits(rc)
-        else:
-            raise Exception(f"Unknown git hosting {rc.repo_url}")
+        repo_info = VCS.parse_repo_url(rc.repo_url)
+        match repo_info.platform:
+            case "github":
+                try:
+                    commits = self._github_compare_commits(rc, repo_info.name)
+                except GithubException as e:
+                    if e.status == 404:
+                        LOG.info(
+                            f"Ignoring RepoChanges for {rc} because could not calculate them: {e.data['message']}"
+                        )
+                        return rc, []
+            case "gitlab":
+                commits = self._gitlab_compare_commits(rc, repo_info.name)
+            case _:
+                raise Exception(f"Unknown git hosting {rc.repo_url}")
 
         return rc, commits
 
@@ -455,13 +457,10 @@ class DashdotdbDORA(DashdotdbBase):
 
         return app_env, datetime.fromisoformat(response.json()["finish_timestamp"])
 
-    def _gitlab_compare_commits(self, rc: RepoChanges) -> list[Commit]:
+    def _gitlab_compare_commits(self, rc: RepoChanges, repo: str) -> list[Commit]:
         if not rc.repo_url or not rc.ref_from or not rc.ref_to:
             return []
 
-        prefix = "https://gitlab.cee.redhat.com/"
-        repo = rc.repo_url[rc.repo_url.startswith(prefix) and len(prefix) :]
-
         commits = self.gl.repository_compare(repo, rc.ref_from, rc.ref_to)
 
         return [
@@ -473,12 +472,10 @@ class DashdotdbDORA(DashdotdbBase):
             for commit in commits
         ]
 
-    def _github_compare_commits(self, rc: RepoChanges) -> list[Commit]:
+    def _github_compare_commits(self, rc: RepoChanges, repo: str) -> list[Commit]:
         if not rc.repo_url:
             return []
 
-        repo = rc.repo_url.removeprefix(GITHUB_BASE_URL).rstrip("/")
-
         return [
             Commit(rc.repo_url, commit.sha, commit.commit.committer.date)
             for commit in self.gh_api(repo).compare(rc.ref_from, rc.ref_to)

{qontract_reconcile-0.10.2.dev183 → qontract_reconcile-0.10.2.dev185}/reconcile/github_repo_permissions_validator.py

@@ -11,7 +11,7 @@ from reconcile.jenkins_job_builder import init_jjb
 from reconcile.utils.jjb_client import JJB
 from reconcile.utils.secret_reader import SecretReader
 from reconcile.utils.semver_helper import make_semver
-from reconcile.utils.vcs import GITHUB_BASE_URL
+from reconcile.utils.vcs import VCS
 
 QONTRACT_INTEGRATION = "github-repo-permissions-validator"
 QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
@@ -46,8 +46,8 @@ def run(dry_run: bool, instance_name: str) -> None:
     error = False
     for job in pr_check_jobs:
         repo_url = jjb.get_repo_url(job)
-        repo_name = repo_url.removeprefix(GITHUB_BASE_URL).rstrip("/")
-        repo = gh.get_repo(repo_name)
+        repo_info = VCS.parse_repo_url(repo_url)
+        repo = gh.get_repo(repo_info.name)
         permissions = repo.permissions
         if not permissions.push and repo_url not in invitations:
             logging.error(f"missing write permissions for bot in repo {repo_url}")

{qontract_reconcile-0.10.2.dev183 → qontract_reconcile-0.10.2.dev185}/reconcile/gql_definitions/automated_actions/instance.py

@@ -69,27 +69,23 @@ query AutomatedActionsInstances {
         ...OcConnectionCluster
       }
     }
-    permissions {
-      roles {
-        name
-        users {
-          org_username
-        }
-        bots {
-          org_username
+    actions {
+      type
+      permissions {
+        roles {
+          name
+          users {
+            org_username
+          }
+          bots {
+            org_username
+          }
+          expirationDate
         }
-        expirationDate
       }
-
-      action {
-        operationId
-        retries
-        maxOps
-      }
-
-      arguments {
-        type
-        ... on AutomatedActionArgumentOpenshift_v1 {
+      maxOps
+      ... on AutomatedActionOpenshiftWorkloadRestart_v1 {
+        openshift_workload_restart_arguments: arguments {
           namespace {
             name
             delete
@@ -100,8 +96,14 @@ query AutomatedActionsInstances {
               }
             }
           }
-          kind_pattern
-          name_pattern
+          kind
+          name
+        }
+      }
+      ... on AutomatedActionActionList_v1 {
+        action_list_arguments: arguments {
+          action_user
+          max_age_minutes
         }
       }
     }
@@ -138,47 +140,54 @@ class RoleV1(ConfiguredBaseModel):
     expiration_date: Optional[str] = Field(..., alias="expirationDate")
 
 
-class AutomatedActionV1(ConfiguredBaseModel):
-    operation_id: str = Field(..., alias="operationId")
-    retries: int = Field(..., alias="retries")
-    max_ops: int = Field(..., alias="maxOps")
+class PermissionAutomatedActionsV1(ConfiguredBaseModel):
+    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
 
 
-class AutomatedActionArgumentV1(ConfiguredBaseModel):
+class AutomatedActionV1(ConfiguredBaseModel):
     q_type: str = Field(..., alias="type")
+    permissions: Optional[list[PermissionAutomatedActionsV1]] = Field(..., alias="permissions")
+    max_ops: int = Field(..., alias="maxOps")
 
 
 class DisableClusterAutomationsV1(ConfiguredBaseModel):
     integrations: Optional[list[str]] = Field(..., alias="integrations")
 
 
-class AutomatedActionArgumentOpenshiftV1_NamespaceV1_ClusterV1(ConfiguredBaseModel):
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1_ClusterV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     disable: Optional[DisableClusterAutomationsV1] = Field(..., alias="disable")
 
 
-class AutomatedActionArgumentOpenshiftV1_NamespaceV1(ConfiguredBaseModel):
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     delete: Optional[bool] = Field(..., alias="delete")
-    cluster: AutomatedActionArgumentOpenshiftV1_NamespaceV1_ClusterV1 = Field(..., alias="cluster")
+    cluster: AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1_ClusterV1 = Field(..., alias="cluster")
 
 
-class AutomatedActionArgumentOpenshiftV1(AutomatedActionArgumentV1):
-    namespace: AutomatedActionArgumentOpenshiftV1_NamespaceV1 = Field(..., alias="namespace")
-    kind_pattern: str = Field(..., alias="kind_pattern")
-    name_pattern: str = Field(..., alias="name_pattern")
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1(ConfiguredBaseModel):
+    namespace: AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1 = Field(..., alias="namespace")
+    kind: str = Field(..., alias="kind")
+    name: str = Field(..., alias="name")
 
 
-class PermissionAutomatedActionsV1(ConfiguredBaseModel):
-    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
-    action: AutomatedActionV1 = Field(..., alias="action")
-    arguments: Optional[list[Union[AutomatedActionArgumentOpenshiftV1, AutomatedActionArgumentV1]]] = Field(..., alias="arguments")
+class AutomatedActionOpenshiftWorkloadRestartV1(AutomatedActionV1):
+    openshift_workload_restart_arguments: list[AutomatedActionOpenshiftWorkloadRestartArgumentV1] = Field(..., alias="openshift_workload_restart_arguments")
+
+
+class AutomatedActionActionListArgumentV1(ConfiguredBaseModel):
+    action_user: Optional[str] = Field(..., alias="action_user")
+    max_age_minutes: Optional[int] = Field(..., alias="max_age_minutes")
+
+
+class AutomatedActionActionListV1(AutomatedActionV1):
+    action_list_arguments: Optional[list[AutomatedActionActionListArgumentV1]] = Field(..., alias="action_list_arguments")
 
 
 class AutomatedActionsInstanceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     deployment: NamespaceV1 = Field(..., alias="deployment")
-    permissions: Optional[list[PermissionAutomatedActionsV1]] = Field(..., alias="permissions")
+    actions: Optional[list[Union[AutomatedActionOpenshiftWorkloadRestartV1, AutomatedActionActionListV1, AutomatedActionV1]]] = Field(..., alias="actions")
 
 
 class AutomatedActionsInstancesQueryData(ConfiguredBaseModel):