qontract-reconcile 0.10.2.dev184__tar.gz → 0.10.2.dev186__tar.gz

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev184
+Version: 0.10.2.dev186
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile
@@ -99,7 +99,6 @@ OpenShift templates can be found [here](/openshift/qontract-reconcile.yaml). In
 `qontract-reconcile` includes the following integrations:
 
 ```text
-  acs-notifiers                   Manages RHACS notifier configurations
   acs-policies                    Manages RHACS security policy configurations
   acs-rbac                        Manages RHACS rbac configuration
   advanced-upgrade-scheduler      Manage Cluster Upgrade Policy schedules in

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/README.md

@@ -34,7 +34,6 @@ OpenShift templates can be found [here](/openshift/qontract-reconcile.yaml). In
 `qontract-reconcile` includes the following integrations:
 
 ```text
-  acs-notifiers                   Manages RHACS notifier configurations
   acs-policies                    Manages RHACS security policy configurations
   acs-rbac                        Manages RHACS rbac configuration
   advanced-upgrade-scheduler      Manage Cluster Upgrade Policy schedules in

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/reconcile/acs_policies.py

@@ -8,7 +8,6 @@ from reconcile.gql_definitions.acs.acs_policies import (
     AcsPolicyV1,
 )
 from reconcile.utils import gql
-from reconcile.utils.acs.notifiers import JiraNotifier
 from reconcile.utils.acs.policies import AcsPolicyApi, Policy, PolicyCondition, Scope
 from reconcile.utils.differ import diff_iterables
 from reconcile.utils.runtime.integration import (
@@ -63,21 +62,10 @@ class AcsPoliciesIntegration(QontractReconcileIntegration[NoParams]):
         conditions = [
             pc for c in gql_policy.conditions if (pc := self._build_policy_condition(c))
         ]
-        jira_notifier = (
-            notifier_name_to_id.get(
-                JiraNotifier.from_escalation_policy(
-                    gql_policy.integrations.notifiers.jira.escalation_policy
-                ).name
-            )
-            if gql_policy.integrations
-            and gql_policy.integrations.notifiers
-            and gql_policy.integrations.notifiers.jira
-            else None
-        )
         return Policy(
             name=gql_policy.name,
             description=gql_policy.description,
-            notifiers=[jira_notifier] if jira_notifier else [],
+            notifiers=[],
             severity=f"{gql_policy.severity.upper()}_SEVERITY",  # align with acs api severity value format
             scope=sorted(
                 [

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/reconcile/automated_actions/config/integration.py

@@ -16,10 +16,11 @@ from pydantic import BaseModel
 
 import reconcile.openshift_base as ob
 from reconcile.gql_definitions.automated_actions.instance import (
-    AutomatedActionArgumentOpenshiftV1,
-    AutomatedActionArgumentV1,
+    AutomatedActionActionListV1,
+    AutomatedActionOpenshiftWorkloadRestartArgumentV1,
+    AutomatedActionOpenshiftWorkloadRestartV1,
     AutomatedActionsInstanceV1,
-    PermissionAutomatedActionsV1,
+    AutomatedActionV1,
 )
 from reconcile.gql_definitions.automated_actions.instance import query as instance_query
 from reconcile.utils import expiration, gql
@@ -35,7 +36,7 @@ from reconcile.utils.runtime.integration import (
 from reconcile.utils.semver_helper import make_semver
 
 QONTRACT_INTEGRATION = "automated-actions-config"
-QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 1)
 
 
 class AutomatedActionsConfigIntegrationParams(PydanticRunParams):
@@ -51,7 +52,6 @@ class AutomatedActionsUser(BaseModel):
 
 
 class AutomatedActionsPolicy(BaseModel):
-    sub: str
     obj: str
     max_ops: int
     params: dict[str, str] = {}
@@ -89,89 +89,109 @@ class AutomatedActionsConfigIntegration(
         for instance in data.automated_actions_instances_v1 or []:
             if instance.deployment.delete:
                 continue
-            instance.permissions = list(
-                self.filter_permissions(instance.permissions or [])
-            )
+            instance.actions = list(self.filter_actions(instance.actions or []))
             yield instance
 
-    def is_enabled(self, argument: AutomatedActionArgumentV1) -> bool:
+    def is_enabled(
+        self, argument: AutomatedActionOpenshiftWorkloadRestartArgumentV1
+    ) -> bool:
         """Check if the integration is enabled for the given argument namespace."""
-        if isinstance(argument, AutomatedActionArgumentOpenshiftV1):
-            return (
-                integration_is_enabled("automated-actions", argument.namespace.cluster)
-                and not argument.namespace.delete
-            )
-        return True
+        return (
+            integration_is_enabled("automated-actions", argument.namespace.cluster)
+            and not argument.namespace.delete
+        )
 
-    def filter_permissions(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
-    ) -> Generator[PermissionAutomatedActionsV1, None, None]:
+    def filter_actions(
+        self, actions: Iterable[AutomatedActionV1]
+    ) -> Generator[AutomatedActionV1, None, None]:
         """Filter out expired roles and arguments (cluster.namespace) with disabled integrations."""
-        for permission in permissions:
-            # automated actions disabled for the cluster?
-            permission.arguments = [
-                arg for arg in permission.arguments or [] if self.is_enabled(arg)
+        for action in actions:
+            match action:
+                case AutomatedActionOpenshiftWorkloadRestartV1():
+                    # automated actions disabled for the cluster?
+                    action.openshift_workload_restart_arguments = [
+                        arg
+                        for arg in action.openshift_workload_restart_arguments or []
+                        if self.is_enabled(arg)
+                    ]
+
+            # Remove expired roles
+            for permission in action.permissions or []:
+                permission.roles = expiration.filter(permission.roles)
+
+            # Remove permissions without roles
+            action.permissions = [
+                permission
+                for permission in action.permissions or []
+                if permission.roles
             ]
-            # remove expired roles
-            permission.roles = expiration.filter(permission.roles)
-            if not permission.roles:
+
+            if not action.permissions:
                 continue
-            yield permission
+
+            yield action
 
     def compile_users(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
+        self, actions: Iterable[AutomatedActionV1]
     ) -> list[AutomatedActionsUser]:
-        """Compile all automated actions roles."""
+        """Compile a list of all automated actions users with their role relations."""
         users: dict[str, AutomatedActionsUser] = {}
-        for permission in permissions:
-            for role in permission.roles or []:
-                for user in (role.users or []) + (role.bots or []):
-                    if not user.org_username:
-                        continue
-                    aa_user = users.setdefault(
-                        user.org_username,
-                        AutomatedActionsUser(username=user.org_username, roles=[]),
-                    )
-                    aa_user.roles.add(role.name)
+        for action in actions:
+            for permission in action.permissions or []:
+                for role in permission.roles or []:
+                    for user in (role.users or []) + (role.bots or []):
+                        if not user.org_username:
+                            continue
+                        aa_user = users.setdefault(
+                            user.org_username,
+                            AutomatedActionsUser(username=user.org_username, roles=[]),
+                        )
+                        aa_user.roles.add(role.name)
 
         return list(users.values())
 
     def compile_roles(
-        self, permissions: Iterable[PermissionAutomatedActionsV1]
+        self, actions: Iterable[AutomatedActionV1]
     ) -> AutomatedActionRoles:
         """Compile all automated actions policies."""
         roles: AutomatedActionRoles = {}
 
-        for permission in permissions or []:
-            action = permission.action
-
-            parameters: list[dict[str, str]] = [] if permission.arguments else [{}]
-            for arg in permission.arguments or []:
-                match arg:
-                    case AutomatedActionArgumentOpenshiftV1():
-                        parameters.append({
+        for action in actions:
+            parameters: list[dict[str, str]] = []
+            match action:
+                case AutomatedActionActionListV1():
+                    # no special handling needed, just dump the values
+                    parameters.extend(
+                        arg.dict(exclude_none=True, exclude_defaults=True)
+                        for arg in action.action_list_arguments or []
+                    )
+                case AutomatedActionOpenshiftWorkloadRestartV1():
+                    parameters.extend(
+                        {
                             # all parameter values are regexes in the OPA policy
                             # therefore, cluster and namespace must be fixed to the current strings
                             "cluster": f"^{arg.namespace.cluster.name}$",
                             "namespace": f"^{arg.namespace.name}$",
-                            "kind": arg.kind_pattern,
-                            "name": arg.name_pattern,
-                        })
-                    case _:
-                        raise NotImplementedError(
-                            f"Unsupported argument type: {arg.q_type}"
+                            "kind": arg.kind,
+                            "name": arg.name,
+                        }
+                        for arg in action.openshift_workload_restart_arguments
+                    )
+
+            if not parameters:
+                parameters = [{}]
+
+            for permission in action.permissions or []:
+                for role in permission.roles or []:
+                    aa_role = roles.setdefault(role.name, [])
+                    aa_role.extend(
+                        AutomatedActionsPolicy(
+                            obj=action.q_type,
+                            max_ops=action.max_ops,
+                            params=params,
                         )
-            for role in permission.roles or []:
-                aa_role = roles.setdefault(role.name, [])
-                aa_role.extend(
-                    AutomatedActionsPolicy(
-                        sub=role.name,
-                        obj=action.operation_id,
-                        max_ops=action.max_ops,
-                        params=params,
+                        for params in parameters
                     )
-                    for params in parameters
-                )
         return roles
 
     def build_policy_file(
@@ -273,8 +293,8 @@ class AutomatedActionsConfigIntegration(
         ri = ResourceInventory()
 
         for instance in instances:
-            users = self.compile_users(instance.permissions or [])
-            policies = self.compile_roles(instance.permissions or [])
+            users = self.compile_users(instance.actions or [])
+            policies = self.compile_roles(instance.actions or [])
             if not users and not policies:
                 logging.info(
                     f"{instance.deployment.cluster.name}/{instance.deployment.name}: No enabled automated actions found. Skipping this instance!"

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/reconcile/cli.py

@@ -3719,17 +3719,6 @@ def acs_policies(ctx):
     )
 
 
-@integration.command(short_help="Manages RHACS notifier configurations")
-@click.pass_context
-def acs_notifiers(ctx):
-    from reconcile import acs_notifiers
-
-    run_class_integration(
-        integration=acs_notifiers.AcsNotifiersIntegration(),
-        ctx=ctx.obj,
-    )
-
-
 @integration.command(short_help="Manage Unleash feature toggles.")
 @click.option("--instance", help="Reconcile just this Unlash instance.", default=None)
 @click.pass_context

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/reconcile/gql_definitions/acs/acs_policies.py

@@ -24,40 +24,6 @@ query AcsPolicy {
     name
     description
     severity
-    integrations {
-      notifiers {
-        jira {
-          escalationPolicy {
-            name
-            channels {
-              jiraBoard {
-                name
-                server {
-                  serverUrl
-                }
-                severityPriorityMappings {
-                  name
-                  mappings {
-                    severity
-                    priority
-                  }
-                }
-                issueType
-                issueFields {
-                  name
-                  value
-                }
-                disable {
-                  integrations
-                }
-              }
-              jiraComponent
-              jiraLabels
-            }
-          }
-        }
-      }
-    }
     categories
     scope {
       level
@@ -107,61 +73,6 @@ class ConfiguredBaseModel(BaseModel):
         extra=Extra.forbid
 
 
-class JiraServerV1(ConfiguredBaseModel):
-    server_url: str = Field(..., alias="serverUrl")
-
-
-class SeverityPriorityMappingV1(ConfiguredBaseModel):
-    severity: str = Field(..., alias="severity")
-    priority: str = Field(..., alias="priority")
-
-
-class JiraSeverityPriorityMappingsV1(ConfiguredBaseModel):
-    name: str = Field(..., alias="name")
-    mappings: list[SeverityPriorityMappingV1] = Field(..., alias="mappings")
-
-
-class JiraBoardIssueFieldV1(ConfiguredBaseModel):
-    name: str = Field(..., alias="name")
-    value: str = Field(..., alias="value")
-
-
-class DisableJiraBoardAutomationsV1(ConfiguredBaseModel):
-    integrations: Optional[list[str]] = Field(..., alias="integrations")
-
-
-class JiraBoardV1(ConfiguredBaseModel):
-    name: str = Field(..., alias="name")
-    server: JiraServerV1 = Field(..., alias="server")
-    severity_priority_mappings: JiraSeverityPriorityMappingsV1 = Field(..., alias="severityPriorityMappings")
-    issue_type: Optional[str] = Field(..., alias="issueType")
-    issue_fields: Optional[list[JiraBoardIssueFieldV1]] = Field(..., alias="issueFields")
-    disable: Optional[DisableJiraBoardAutomationsV1] = Field(..., alias="disable")
-
-
-class AppEscalationPolicyChannelsV1(ConfiguredBaseModel):
-    jira_board: list[JiraBoardV1] = Field(..., alias="jiraBoard")
-    jira_component: Optional[str] = Field(..., alias="jiraComponent")
-    jira_labels: Optional[list[str]] = Field(..., alias="jiraLabels")
-
-
-class AppEscalationPolicyV1(ConfiguredBaseModel):
-    name: str = Field(..., alias="name")
-    channels: AppEscalationPolicyChannelsV1 = Field(..., alias="channels")
-
-
-class AcsPolicyIntegrationNotifierJiraV1(ConfiguredBaseModel):
-    escalation_policy: AppEscalationPolicyV1 = Field(..., alias="escalationPolicy")
-
-
-class AcsPolicyIntegrationNotifiersV1(ConfiguredBaseModel):
-    jira: Optional[AcsPolicyIntegrationNotifierJiraV1] = Field(..., alias="jira")
-
-
-class AcsPolicyIntegrationsV1(ConfiguredBaseModel):
-    notifiers: Optional[AcsPolicyIntegrationNotifiersV1] = Field(..., alias="notifiers")
-
-
 class AcsPolicyScopeV1(ConfiguredBaseModel):
     level: str = Field(..., alias="level")
 
@@ -218,7 +129,6 @@ class AcsPolicyV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     description: Optional[str] = Field(..., alias="description")
     severity: str = Field(..., alias="severity")
-    integrations: Optional[AcsPolicyIntegrationsV1] = Field(..., alias="integrations")
     categories: list[str] = Field(..., alias="categories")
     scope: Union[AcsPolicyScopeClusterV1, AcsPolicyScopeNamespaceV1, AcsPolicyScopeV1] = Field(..., alias="scope")
     conditions: list[Union[AcsPolicyConditionsCvssV1, AcsPolicyConditionsSeverityV1, AcsPolicyConditionsImageTagV1, AcsPolicyConditionsCveV1, AcsPolicyConditionsImageAgeV1, AcsPolicyConditionsV1]] = Field(..., alias="conditions")

{qontract_reconcile-0.10.2.dev184 → qontract_reconcile-0.10.2.dev186}/reconcile/gql_definitions/automated_actions/instance.py

@@ -69,27 +69,23 @@ query AutomatedActionsInstances {
         ...OcConnectionCluster
       }
     }
-    permissions {
-      roles {
-        name
-        users {
-          org_username
-        }
-        bots {
-          org_username
+    actions {
+      type
+      permissions {
+        roles {
+          name
+          users {
+            org_username
+          }
+          bots {
+            org_username
+          }
+          expirationDate
         }
-        expirationDate
       }
-
-      action {
-        operationId
-        retries
-        maxOps
-      }
-
-      arguments {
-        type
-        ... on AutomatedActionArgumentOpenshift_v1 {
+      maxOps
+      ... on AutomatedActionOpenshiftWorkloadRestart_v1 {
+        openshift_workload_restart_arguments: arguments {
           namespace {
             name
             delete
@@ -100,8 +96,14 @@ query AutomatedActionsInstances {
               }
             }
           }
-          kind_pattern
-          name_pattern
+          kind
+          name
+        }
+      }
+      ... on AutomatedActionActionList_v1 {
+        action_list_arguments: arguments {
+          action_user
+          max_age_minutes
         }
       }
     }
@@ -138,47 +140,54 @@ class RoleV1(ConfiguredBaseModel):
     expiration_date: Optional[str] = Field(..., alias="expirationDate")
 
 
-class AutomatedActionV1(ConfiguredBaseModel):
-    operation_id: str = Field(..., alias="operationId")
-    retries: int = Field(..., alias="retries")
-    max_ops: int = Field(..., alias="maxOps")
+class PermissionAutomatedActionsV1(ConfiguredBaseModel):
+    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
 
 
-class AutomatedActionArgumentV1(ConfiguredBaseModel):
+class AutomatedActionV1(ConfiguredBaseModel):
     q_type: str = Field(..., alias="type")
+    permissions: Optional[list[PermissionAutomatedActionsV1]] = Field(..., alias="permissions")
+    max_ops: int = Field(..., alias="maxOps")
 
 
 class DisableClusterAutomationsV1(ConfiguredBaseModel):
     integrations: Optional[list[str]] = Field(..., alias="integrations")
 
 
-class AutomatedActionArgumentOpenshiftV1_NamespaceV1_ClusterV1(ConfiguredBaseModel):
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1_ClusterV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     disable: Optional[DisableClusterAutomationsV1] = Field(..., alias="disable")
 
 
-class AutomatedActionArgumentOpenshiftV1_NamespaceV1(ConfiguredBaseModel):
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     delete: Optional[bool] = Field(..., alias="delete")
-    cluster: AutomatedActionArgumentOpenshiftV1_NamespaceV1_ClusterV1 = Field(..., alias="cluster")
+    cluster: AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1_ClusterV1 = Field(..., alias="cluster")
 
 
-class AutomatedActionArgumentOpenshiftV1(AutomatedActionArgumentV1):
-    namespace: AutomatedActionArgumentOpenshiftV1_NamespaceV1 = Field(..., alias="namespace")
-    kind_pattern: str = Field(..., alias="kind_pattern")
-    name_pattern: str = Field(..., alias="name_pattern")
+class AutomatedActionOpenshiftWorkloadRestartArgumentV1(ConfiguredBaseModel):
+    namespace: AutomatedActionOpenshiftWorkloadRestartArgumentV1_NamespaceV1 = Field(..., alias="namespace")
+    kind: str = Field(..., alias="kind")
+    name: str = Field(..., alias="name")
 
 
-class PermissionAutomatedActionsV1(ConfiguredBaseModel):
-    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
-    action: AutomatedActionV1 = Field(..., alias="action")
-    arguments: Optional[list[Union[AutomatedActionArgumentOpenshiftV1, AutomatedActionArgumentV1]]] = Field(..., alias="arguments")
+class AutomatedActionOpenshiftWorkloadRestartV1(AutomatedActionV1):
+    openshift_workload_restart_arguments: list[AutomatedActionOpenshiftWorkloadRestartArgumentV1] = Field(..., alias="openshift_workload_restart_arguments")
+
+
+class AutomatedActionActionListArgumentV1(ConfiguredBaseModel):
+    action_user: Optional[str] = Field(..., alias="action_user")
+    max_age_minutes: Optional[int] = Field(..., alias="max_age_minutes")
+
+
+class AutomatedActionActionListV1(AutomatedActionV1):
+    action_list_arguments: Optional[list[AutomatedActionActionListArgumentV1]] = Field(..., alias="action_list_arguments")
 
 
 class AutomatedActionsInstanceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     deployment: NamespaceV1 = Field(..., alias="deployment")
-    permissions: Optional[list[PermissionAutomatedActionsV1]] = Field(..., alias="permissions")
+    actions: Optional[list[Union[AutomatedActionOpenshiftWorkloadRestartV1, AutomatedActionActionListV1, AutomatedActionV1]]] = Field(..., alias="actions")
 
 
 class AutomatedActionsInstancesQueryData(ConfiguredBaseModel):