qontract-reconcile 0.10.2.dev184__py3-none-any.whl → 0.10.2.dev185__py3-none-any.whl

{qontract_reconcile-0.10.2.dev184.dist-info → qontract_reconcile-0.10.2.dev185.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev184
+Version: 0.10.2.dev185
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev184.dist-info → qontract_reconcile-0.10.2.dev185.dist-info}/RECORD

@@ -141,7 +141,7 @@ reconcile/aus/version_gates/ocp_gate_handler.py,sha256=RW1ppDaCZXVegV9AzzqYXxDUu
 reconcile/aus/version_gates/sts_version_gate_handler.py,sha256=swwwz0YyvrEBf_InqrRRBCt2QzHYNvvq8jz9aYwElh4,3663
 reconcile/automated_actions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/automated_actions/config/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/automated_actions/config/integration.py,sha256=iOzR8PyWwKmUoB6Zx4bmbWFEiDPsP9tXuWia_bSW4vA,10921
+reconcile/automated_actions/config/integration.py,sha256=gDNUKxs8m_4GWH0GnW9QXubtsBF6idc0kHxo05hdj0U,11633
 reconcile/aws_account_manager/README.md,sha256=_XFM3GZNHUzv--e_navqJuaUWpjC6QrHfulreHynFf0,262
 reconcile/aws_account_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/aws_account_manager/integration.py,sha256=XTamC824imAezzVoQhhwdMOawNcPCOghR_y7i_8bpJI,15343
@@ -227,7 +227,7 @@ reconcile/glitchtip_project_alerts/integration.py,sha256=BgMx-NyV9mTuv7Sotb2OioC
 reconcile/glitchtip_project_dsn/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/glitchtip_project_dsn/integration.py,sha256=2iugub-kHYkHNK33n0v9_TeWonuxCPah_VkoTPvaajE,8077
 reconcile/gql_definitions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/introspection.json,sha256=lgoJW52hU7zL4UKNpKywvyL--o36MggUI1eFWWlvYLk,2300074
+reconcile/gql_definitions/introspection.json,sha256=MT1HCR90ZahZxjrgaBEp34JNhjaEiDRblQK-qfSrfF0,2316277
 reconcile/gql_definitions/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/acs/acs_instances.py,sha256=L91WW9LbhJbBSrECqShQpFtjoBOsmNIYLRpMbx1io5o,2181
 reconcile/gql_definitions/acs/acs_policies.py,sha256=9IFpGAcrZ8nTFC05q3-12nwkNOEkquHB2-XbVq5_jy4,7219
@@ -241,7 +241,7 @@ reconcile/gql_definitions/app_sre_tekton_access_revalidation/__init__.py,sha256=
 reconcile/gql_definitions/app_sre_tekton_access_revalidation/roles.py,sha256=8Y4NsS5T7tumDWxY5MuoV50MK2i-DsLYSpCRjb7KaLE,2353
 reconcile/gql_definitions/app_sre_tekton_access_revalidation/users.py,sha256=XdVxBxiyTR6Cy939EHNw__0k7iWrZWlhrgS5DakST0I,2504
 reconcile/gql_definitions/automated_actions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/automated_actions/instance.py,sha256=D50v0exLeK5hvjQKvxQ5V-6DnYZo_L6cX_Gaf3PGREs,5491
+reconcile/gql_definitions/automated_actions/instance.py,sha256=73vRFDvrD9t2cY1Y8jmjfVPNJ_osPrI8fHTAQz0CGv4,6105
 reconcile/gql_definitions/aws_account_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/aws_account_manager/aws_accounts.py,sha256=vF51KrY2gwX0J9vESiaRMPQqdAMEtz9f_tBq52bInp0,5148
 reconcile/gql_definitions/aws_ami_cleanup/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -807,7 +807,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=UfwwRLS5Ya4_Nh1w5n1dvoYtchQvYE9yj1VANt2IKqI,3925
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=zEDbGr18ZeHNQwW8pUsr2JRjuXIPz--WAGJxZo9sv_Y,894
-qontract_reconcile-0.10.2.dev184.dist-info/METADATA,sha256=4cOL2ogbG9Fe9GL834sDkyleO4EK2cgWR-AoP0ZIuls,24627
-qontract_reconcile-0.10.2.dev184.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-qontract_reconcile-0.10.2.dev184.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev184.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev185.dist-info/METADATA,sha256=-GBtujthD8qi9Bdj1oIRUOc5iAeTf-Xa5Lp5jpTyTPE,24627
+qontract_reconcile-0.10.2.dev185.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+qontract_reconcile-0.10.2.dev185.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev185.dist-info/RECORD,,

reconcile/automated_actions/config/integration.py

@@ -16,10 +16,11 @@ from pydantic import BaseModel
 
 import reconcile.openshift_base as ob
 from reconcile.gql_definitions.automated_actions.instance import (
-    AutomatedActionArgumentOpenshiftV1,
-    AutomatedActionArgumentV1,
+    AutomatedActionActionListV1,
+    AutomatedActionOpenshiftWorkloadRestartArgumentV1,
+    AutomatedActionOpenshiftWorkloadRestartV1,
     AutomatedActionsInstanceV1,
-    PermissionAutomatedActionsV1,
+    AutomatedActionV1,
 )
 from reconcile.gql_definitions.automated_actions.instance import query as instance_query
 from reconcile.utils import expiration, gql
@@ -35,7 +36,7 @@ from reconcile.utils.runtime.integration import (
 from reconcile.utils.semver_helper import make_semver
 
 QONTRACT_INTEGRATION = "automated-actions-config"
-QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 1)
 
 
 class AutomatedActionsConfigIntegrationParams(PydanticRunParams):
@@ -51,7 +52,6 @@ class AutomatedActionsUser(BaseModel):
 
 
 class AutomatedActionsPolicy(BaseModel):
-    sub: str
     obj: str
     max_ops: int
     params: dict[str, str] = {}
@@ -89,89 +89,109 @@ class AutomatedActionsConfigIntegration(
         for instance in data.automated_actions_instances_v1 or []:
             if instance.deployment.delete:
                 continue
-            instance.permissions = list(
-                self.filter_permissions(instance.permissions or [])
-            )
+            instance.actions = list(self.filter_actions(instance.actions or []))
             yield instance
 
-    def is_enabled(self, argument: AutomatedActionArgumentV1) -> bool:
+    def is_enabled(
+        self, argument: AutomatedActionOpenshiftWorkloadRestartArgumentV1
+    ) -> bool:
         """Check if the integration is enabled for the given argument namespace."""
-        if isinstance(argument, AutomatedActionArgumentOpenshiftV1):
-            return (
-                integration_is_enabled("automated-actions", argument.namespace.cluster)
-                and not argument.namespace.delete
-            )
-        return True
+        return (
+            integration_is_enabled("automated-actions", argument.namespace.cluster)
+            and not argument.namespace.delete
+        )
 
-    def filter_permissions(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
-    ) -> Generator[PermissionAutomatedActionsV1, None, None]:
+    def filter_actions(
+        self, actions: Iterable[AutomatedActionV1]
+    ) -> Generator[AutomatedActionV1, None, None]:
         """Filter out expired roles and arguments (cluster.namespace) with disabled integrations."""
-        for permission in permissions:
-            # automated actions disabled for the cluster?
-            permission.arguments = [
-                arg for arg in permission.arguments or [] if self.is_enabled(arg)
+        for action in actions:
+            match action:
+                case AutomatedActionOpenshiftWorkloadRestartV1():
+                    # automated actions disabled for the cluster?
+                    action.openshift_workload_restart_arguments = [
+                        arg
+                        for arg in action.openshift_workload_restart_arguments or []
+                        if self.is_enabled(arg)
+                    ]
+
+            # Remove expired roles
+            for permission in action.permissions or []:
+                permission.roles = expiration.filter(permission.roles)
+
+            # Remove permissions without roles
+            action.permissions = [
+                permission
+                for permission in action.permissions or []
+                if permission.roles
             ]
-            # remove expired roles
-            permission.roles = expiration.filter(permission.roles)
-            if not permission.roles:
+
+            if not action.permissions:
                 continue
-            yield permission
+
+            yield action
 
     def compile_users(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
+        self, actions: Iterable[AutomatedActionV1]
     ) -> list[AutomatedActionsUser]:
-        """Compile all automated actions roles."""
+        """Compile a list of all automated actions users with their role relations."""
         users: dict[str, AutomatedActionsUser] = {}
-        for permission in permissions:
-            for role in permission.roles or []:
-                for user in (role.users or []) + (role.bots or []):
-                    if not user.org_username:
-                        continue
-                    aa_user = users.setdefault(
-                        user.org_username,
-                        AutomatedActionsUser(username=user.org_username, roles=[]),
-                    )
-                    aa_user.roles.add(role.name)
+        for action in actions:
+            for permission in action.permissions or []:
+                for role in permission.roles or []:
+                    for user in (role.users or []) + (role.bots or []):
+                        if not user.org_username:
+                            continue
+                        aa_user = users.setdefault(
+                            user.org_username,
+                            AutomatedActionsUser(username=user.org_username, roles=[]),
+                        )
+                        aa_user.roles.add(role.name)
 
         return list(users.values())
 
     def compile_roles(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
+        self, actions: Iterable[AutomatedActionV1]
     ) -> AutomatedActionRoles:
         """Compile all automated actions policies."""
         roles: AutomatedActionRoles = {}
 
-        for permission in permissions or []:
-            action = permission.action
-
-            parameters: list[dict[str, str]] = [] if permission.arguments else [{}]
-            for arg in permission.arguments or []:
-                match arg:
-                    case AutomatedActionArgumentOpenshiftV1():
-                        parameters.append({
+        for action in actions:
+            parameters: list[dict[str, str]] = []
+            match action:
+                case AutomatedActionActionListV1():
+                    # no special handling needed, just dump the values
+                    parameters.extend(
+                        arg.dict(exclude_none=True, exclude_defaults=True)
+                        for arg in action.action_list_arguments or []
+                    )
+                case AutomatedActionOpenshiftWorkloadRestartV1():
+                    parameters.extend(
+                        {
                             # all parameter values are regexes in the OPA policy
                             # therefore, cluster and namespace must be fixed to the current strings
                             "cluster": f"^{arg.namespace.cluster.name}$",
                             "namespace": f"^{arg.namespace.name}$",
-                            "kind": arg.kind_pattern,
-                            "name": arg.name_pattern,
-                        })
-                    case _:
-                        raise NotImplementedError(
-                            f"Unsupported argument type: {arg.q_type}"
+                            "kind": arg.kind,
+                            "name": arg.name,
+                        }
+                        for arg in action.openshift_workload_restart_arguments
+                    )
+
+            if not parameters:
+                parameters = [{}]
+
+            for permission in action.permissions or []:
+                for role in permission.roles or []:
+                    aa_role = roles.setdefault(role.name, [])
+                    aa_role.extend(
+                        AutomatedActionsPolicy(
+                            obj=action.q_type,
+                            max_ops=action.max_ops,
+                            params=params,
                         )
-            for role in permission.roles or []:
-                aa_role = roles.setdefault(role.name, [])
-                aa_role.extend(
-                    AutomatedActionsPolicy(
-                        sub=role.name,
-                        obj=action.operation_id,
-                        max_ops=action.max_ops,
-                        params=params,
+                        for params in parameters
                     )
-                    for params in parameters
-                )
         return roles
 
     def build_policy_file(
@@ -273,8 +293,8 @@ class AutomatedActionsConfigIntegration(
         ri = ResourceInventory()
 
         for instance in instances:
-            users = self.compile_users(instance.permissions or [])
-            policies = self.compile_roles(instance.permissions or [])
+            users = self.compile_users(instance.actions or [])
+            policies = self.compile_roles(instance.actions or [])
             if not users and not policies:
                 logging.info(
                     f"{instance.deployment.cluster.name}/{instance.deployment.name}: No enabled automated actions found. Skipping this instance!"

reconcile/gql_definitions/automated_actions/instance.py

@@ -69,27 +69,23 @@ query AutomatedActionsInstances {
         ...OcConnectionCluster
       }
     }
-    permissions {
-      roles {
-        name
-        users {
-          org_username
-        }
-        bots {
-          org_username
+    actions {
+      type
+      permissions {
+        roles {
+          name
+          users {
+            org_username
+          }
+          bots {
+            org_username
+          }
+          expirationDate
         }
-        expirationDate
       }
-
-      action {
-        operationId
-        retries
-        maxOps
-      }
-
-      arguments {
-        type
-        ... on AutomatedActionArgumentOpenshift_v1 {
+      maxOps
+      ... on AutomatedActionOpenshiftWorkloadRestart_v1 {
+        openshift_workload_restart_arguments: arguments {
           namespace {
             name
             delete
@@ -100,8 +96,14 @@ query AutomatedActionsInstances {
               }
             }
           }
-          kind_pattern
-          name_pattern
+          kind
+          name
+        }
+      }
+      ... on AutomatedActionActionList_v1 {
+        action_list_arguments: arguments {
+          action_user
+          max_age_minutes
         }
       }
     }
@@ -138,47 +140,54 @@ class RoleV1(ConfiguredBaseModel):
     expiration_date: Optional[str] = Field(..., alias="expirationDate")
 
 
-class AutomatedActionV1(ConfiguredBaseModel):
-    operation_id: str = Field(..., alias="operationId")
-    retries: int = Field(..., alias="retries")
-    max_ops: int = Field(..., alias="maxOps")
+class PermissionAutomatedActionsV1(ConfiguredBaseModel):
+    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
 
 
-class AutomatedActionArgumentV1(ConfiguredBaseModel):
+class AutomatedActionV1(ConfiguredBaseModel):
     q_type: str = Field(..., alias="type")
+    permissions: Optional[list[PermissionAutomatedActionsV1]] = Field(..., alias="permissions")
+    max_ops: int = Field(..., alias="maxOps")
 
 
 class DisableClusterAutomationsV1(ConfiguredBaseModel):
     integrations: Optional[list[str]] = Field(..., alias="integrations")
 
 
-class AutomatedActionArgumentOpenshiftV1_NamespaceV1_ClusterV1(ConfiguredBaseModel):
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1_ClusterV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     disable: Optional[DisableClusterAutomationsV1] = Field(..., alias="disable")
 
 
-class AutomatedActionArgumentOpenshiftV1_NamespaceV1(ConfiguredBaseModel):
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     delete: Optional[bool] = Field(..., alias="delete")
-    cluster: AutomatedActionArgumentOpenshiftV1_NamespaceV1_ClusterV1 = Field(..., alias="cluster")
+    cluster: AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1_ClusterV1 = Field(..., alias="cluster")
 
 
-class AutomatedActionArgumentOpenshiftV1(AutomatedActionArgumentV1):
-    namespace: AutomatedActionArgumentOpenshiftV1_NamespaceV1 = Field(..., alias="namespace")
-    kind_pattern: str = Field(..., alias="kind_pattern")
-    name_pattern: str = Field(..., alias="name_pattern")
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1(ConfiguredBaseModel):
+    namespace: AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1 = Field(..., alias="namespace")
+    kind: str = Field(..., alias="kind")
+    name: str = Field(..., alias="name")
 
 
-class PermissionAutomatedActionsV1(ConfiguredBaseModel):
-    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
-    action: AutomatedActionV1 = Field(..., alias="action")
-    arguments: Optional[list[Union[AutomatedActionArgumentOpenshiftV1, AutomatedActionArgumentV1]]] = Field(..., alias="arguments")
+class AutomatedActionOpenshiftWorkloadRestartV1(AutomatedActionV1):
+    openshift_workload_restart_arguments: list[AutomatedActionOpenshiftWorkloadRestartArgumentV1] = Field(..., alias="openshift_workload_restart_arguments")
+
+
+class AutomatedActionActionListArgumentV1(ConfiguredBaseModel):
+    action_user: Optional[str] = Field(..., alias="action_user")
+    max_age_minutes: Optional[int] = Field(..., alias="max_age_minutes")
+
+
+class AutomatedActionActionListV1(AutomatedActionV1):
+    action_list_arguments: Optional[list[AutomatedActionActionListArgumentV1]] = Field(..., alias="action_list_arguments")
 
 
 class AutomatedActionsInstanceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     deployment: NamespaceV1 = Field(..., alias="deployment")
-    permissions: Optional[list[PermissionAutomatedActionsV1]] = Field(..., alias="permissions")
+    actions: Optional[list[Union[AutomatedActionOpenshiftWorkloadRestartV1, AutomatedActionActionListV1, AutomatedActionV1]]] = Field(..., alias="actions")
 
 
 class AutomatedActionsInstancesQueryData(ConfiguredBaseModel):