qontract-reconcile 0.10.2.dev247__tar.gz → 0.10.2.dev249__tar.gz

{qontract_reconcile-0.10.2.dev247 → qontract_reconcile-0.10.2.dev249}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev247
+Version: 0.10.2.dev249
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile
@@ -205,7 +205,6 @@ OpenShift templates can be found [here](/openshift/qontract-reconcile.yaml). In
   ocm-clusters                    Manages clusters via OCM.
   ocm-external-configuration-labels
                                   Manage External Configuration labels in OCM.
-  ocm-github-idp                  Manage GitHub Identity Providers in OCM.
   ocm-groups                      Manage membership in OpenShift groups via
                                   OCM.
   ocm-internal-notifications      Notifications to internal Red Hat users

{qontract_reconcile-0.10.2.dev247 → qontract_reconcile-0.10.2.dev249}/README.md

@@ -140,7 +140,6 @@ OpenShift templates can be found [here](/openshift/qontract-reconcile.yaml). In
   ocm-clusters                    Manages clusters via OCM.
   ocm-external-configuration-labels
                                   Manage External Configuration labels in OCM.
-  ocm-github-idp                  Manage GitHub Identity Providers in OCM.
   ocm-groups                      Manage membership in OpenShift groups via
                                   OCM.
   ocm-internal-notifications      Notifications to internal Red Hat users

{qontract_reconcile-0.10.2.dev247 → qontract_reconcile-0.10.2.dev249}/pyproject.toml

@@ -256,7 +256,6 @@ module = [
     "reconcile.ocm_aws_infrastructure_access",
     "reconcile.ocm_clusters",
     "reconcile.ocm_external_configuration_labels",
-    "reconcile.ocm_github_idp",
     "reconcile.ocm_groups",
     "reconcile.ocm_machine_pools",
     "reconcile.ocm_upgrade_scheduler_org_updater",

{qontract_reconcile-0.10.2.dev247 → qontract_reconcile-0.10.2.dev249}/reconcile/cli.py

@@ -2958,15 +2958,6 @@ def ocm_aws_infrastructure_access(ctx: click.Context) -> None:
     run_integration(reconcile.ocm_aws_infrastructure_access, ctx)
 
 
-@integration.command(short_help="Manage GitHub Identity Providers in OCM.")
-@vault_input_path
-@click.pass_context
-def ocm_github_idp(ctx: click.Context, vault_input_path: str) -> None:
-    import reconcile.ocm_github_idp
-
-    run_integration(reconcile.ocm_github_idp, ctx, vault_input_path)
-
-
 @integration.command(
     short_help="Manage OIDC cluster configuration in OCM organizations based on OCM labels. Part of RHIDP."
 )

{qontract_reconcile-0.10.2.dev247 → qontract_reconcile-0.10.2.dev249}/reconcile/status_board.py

@@ -5,9 +5,7 @@ from abc import (
 )
 from collections.abc import Iterable, Mapping
 from enum import Enum
-from typing import (
-    Optional,
-)
+from itertools import chain
 
 from pydantic import BaseModel
 
@@ -122,11 +120,11 @@ class Product(AbstractStatusBoard):
 
 
 class Application(AbstractStatusBoard):
-    product: Optional["Product"]
+    product: Product
     services: list["Service"] | None
 
     def create(self, ocm: OCMBaseClient) -> None:
-        if self.product and self.product.id:
+        if self.product.id:
             spec = self.to_ocm_spec()
             self.id = create_application(ocm, spec)
         else:
@@ -147,7 +145,7 @@ class Application(AbstractStatusBoard):
         return f'Application: "{self.name}" "{self.fullname}"'
 
     def to_ocm_spec(self) -> ApplicationOCMSpec:
-        product_id = self.product.id if self.product and self.product.id else ""
+        product_id = self.product.id or ""
         return {
             "name": self.name,
             "fullname": self.fullname,
@@ -160,18 +158,12 @@ class Application(AbstractStatusBoard):
 
 
 class Service(AbstractStatusBoard):
-    # `application` here is used to create a flat map to easily compare state.
-    # This field is optional so we can create the Service object without the
-    # need to create an Application object first.
-    # This filed is needed when we are creating a Service on teh OCM API.
-    # This field is not used when we are mapping the services that belongs to an
-    # application in that case we use the `services` field in Application class.
-    application: Optional["Application"]
+    application: Application
     metadata: ServiceMetadataSpec
 
     def create(self, ocm: OCMBaseClient) -> None:
         spec = self.to_ocm_spec()
-        if self.application and self.application.id:
+        if self.application.id:
             self.id = create_service(ocm, spec)
         else:
             logging.warning("Missing application id for service")
@@ -187,7 +179,7 @@ class Service(AbstractStatusBoard):
             logging.error(f'Trying to update Service "{self.name}" without id')
             return
         spec = self.to_ocm_spec()
-        if self.application and self.application.id:
+        if self.application.id:
             update_service(ocm, self.id, spec)
         else:
             logging.warning("Missing application id for service")
@@ -196,9 +188,7 @@ class Service(AbstractStatusBoard):
         return f'Service: "{self.name}" "{self.fullname}"'
 
     def to_ocm_spec(self) -> ServiceOCMSpec:
-        application_id = (
-            self.application.id if self.application and self.application.id else ""
-        )
+        application_id = self.application.id or ""
 
         return {
             "name": self.name,
@@ -281,21 +271,24 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
                 logging.error(f'Product "{p.name}" has no id')
                 continue
             p.applications = [
-                Application(**a) for a in get_product_applications(ocm_api, p.id)
+                Application(**a, product=p)
+                for a in get_product_applications(ocm_api, p.id)
             ]
             for a in p.applications:
                 if not a.id:
                     logging.error(f'Application "{a.name}" has no id')
                     continue
                 a.services = [
-                    Service(**s) for s in get_application_services(ocm_api, a.id)
+                    Service(**s, application=a)
+                    for s in get_application_services(ocm_api, a.id)
                 ]
 
         return products
 
     @staticmethod
     def desired_abstract_status_board_map(
-        desired_product_apps: Mapping[str, set[str]], slodocs: list[SLODocumentV1]
+        desired_product_apps: Mapping[str, set[str]],
+        slodocs: list[SLODocumentV1],
     ) -> dict[str, AbstractStatusBoard]:
         """
         Returns a Mapping of all the AbstractStatusBoard data objects as dictionaries.
@@ -304,25 +297,26 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
         on Status Board OCM API.
         """
         desired_abstract_status_board_map: dict[str, AbstractStatusBoard] = {}
-        for product, apps in desired_product_apps.items():
-            desired_abstract_status_board_map[product] = Product(
-                name=product, fullname=product, applications=[], metadata={}
+        for product_name, apps in desired_product_apps.items():
+            product = Product(
+                id=None, name=product_name, fullname=product_name, applications=[]
             )
+            desired_abstract_status_board_map[product_name] = product
             for a in apps:
-                key = f"{product}/{a}"
+                key = f"{product_name}/{a}"
                 desired_abstract_status_board_map[key] = Application(
+                    id=None,
                     name=a,
                     fullname=key,
                     services=[],
-                    product=desired_abstract_status_board_map[product],
-                    metadata={},
+                    product=product,
                 )
         for slodoc in slodocs:
             products = [
                 ns.namespace.environment.product.name for ns in slodoc.namespaces
             ]
             for slo in slodoc.slos or []:
-                for product in products:
+                for product_name in products:
                     if slodoc.app.parent_app:
                         app = f"{slodoc.app.parent_app.name}-{slodoc.app.name}"
                     else:
@@ -330,8 +324,8 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
 
                     # Check if the product or app is excluded from the desired list
                     product_or_app_excluded = (
-                        product not in desired_product_apps
-                        or app not in desired_product_apps.get(product, set())
+                        product_name not in desired_product_apps
+                        or app not in desired_product_apps.get(product_name, set())
                     )
 
                     # Check if statusBoard label exists and is explicitly disabled
@@ -344,8 +338,8 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
                     if product_or_app_excluded or not status_board_enabled:
                         continue
 
-                    key = f"{product}/{app}/{slo.name}"
-                    metadata = {
+                    key = f"{product_name}/{app}/{slo.name}"
+                    metadata: ServiceMetadataSpec = {
                         "sli_type": slo.sli_type,
                         "sli_specification": slo.sli_specification,
                         "slo_details": slo.slo_details,
@@ -354,11 +348,12 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
                         "window": slo.slo_parameters.window,
                     }
                     desired_abstract_status_board_map[key] = Service(
+                        id=None,
                         name=slo.name,
                         fullname=key,
                         metadata=metadata,
                         application=desired_abstract_status_board_map[
-                            f"{product}/{app}"
+                            f"{product_name}/{app}"
                         ],
                     )
 
@@ -382,7 +377,6 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
     def get_diff(
         desired_abstract_status_board_map: Mapping[str, AbstractStatusBoard],
         current_abstract_status_board_map: Mapping[str, AbstractStatusBoard],
-        current_products: Mapping[str, Product],
     ) -> list[StatusBoardHandler]:
         return_list: list[StatusBoardHandler] = []
 
@@ -391,6 +385,9 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
             desired_abstract_status_board_map,
         )
 
+        for pair in chain(diff_result.identical.values(), diff_result.change.values()):
+            pair.desired.id = pair.current.id
+
         return_list.extend(
             StatusBoardHandler(action=Action.create, status_board_object=o)
             for o in diff_result.add.values()
@@ -460,14 +457,9 @@ class StatusBoardExporterIntegration(QontractReconcileIntegration):
             current_abstract_status_board_map = self.current_abstract_status_board_map(
                 current_products_applications_services
             )
-
-            current_products = {
-                p.name: p for p in current_products_applications_services
-            }
             diff = self.get_diff(
                 desired_abstract_status_board_map,
                 current_abstract_status_board_map,
-                current_products,
             )
 
             self.apply_diff(dry_run, ocm_api, diff)

{qontract_reconcile-0.10.2.dev247 → qontract_reconcile-0.10.2.dev249}/reconcile/utils/ocm/ocm.py

@@ -337,62 +337,6 @@ class OCM:  # pylint: disable=too-many-public-methods
             aws_infrastructure_access_role_grant_id = rg["id"]
             self._delete(f"{api}/{aws_infrastructure_access_role_grant_id}")
 
-    def get_github_idp_teams(self, cluster):
-        """Returns a list of details of GitHub IDP providers
-
-        :param cluster: cluster name
-
-        :type cluster: string
-        """
-        result_idps = []
-        cluster_id = self.cluster_ids.get(cluster)
-        if not cluster_id:
-            return result_idps
-        api = f"{CS_API_BASE}/v1/clusters/{cluster_id}/identity_providers"
-        idps = self._get_json(api).get("items")
-        if not idps:
-            return result_idps
-
-        for idp in idps:
-            if idp["type"] != "GithubIdentityProvider":
-                continue
-            idp_name = idp["name"]
-            idp_github = idp["github"]
-
-            item = {
-                "id": idp["id"],
-                "cluster": cluster,
-                "name": idp_name,
-                "client_id": idp_github["client_id"],
-                "teams": idp_github.get("teams"),
-            }
-            result_idps.append(item)
-        return result_idps
-
-    def create_github_idp_teams(self, spec):
-        """Creates a new GitHub IDP
-
-        :param cluster: cluster name
-        :param spec: required information for idp creation
-
-        :type cluster: string
-        :type spec: dictionary
-        """
-        cluster = spec["cluster"]
-        cluster_id = self.cluster_ids[cluster]
-        api = f"{CS_API_BASE}/v1/clusters/{cluster_id}/identity_providers"
-        payload = {
-            "type": "GithubIdentityProvider",
-            "mapping_method": "add",
-            "name": spec["name"],
-            "github": {
-                "client_id": spec["client_id"],
-                "client_secret": spec["client_secret"],
-                "teams": spec["teams"],
-            },
-        }
-        self._post(api, payload)
-
     def get_kubeconfig(self, cluster: str) -> str | None:
         """Returns the cluster credentials (kubeconfig)
 

qontract_reconcile-0.10.2.dev247/reconcile/ocm_github_idp.py

@@ -1,117 +0,0 @@
-import logging
-import sys
-from collections.abc import Mapping
-from typing import Any
-
-from reconcile import queries
-from reconcile.status import ExitCodes
-from reconcile.utils.disabled_integrations import integration_is_enabled
-from reconcile.utils.ocm import OCMMap
-from reconcile.utils.secret_reader import SecretReader
-
-QONTRACT_INTEGRATION = "ocm-github-idp"
-
-
-def fetch_current_state(clusters, settings):
-    current_state = []
-    ocm_map = OCMMap(
-        clusters=clusters, integration=QONTRACT_INTEGRATION, settings=settings
-    )
-
-    for cluster_info in clusters:
-        cluster = cluster_info["name"]
-        ocm = ocm_map.get(cluster)
-        idps = ocm.get_github_idp_teams(cluster)
-        current_state.extend(idps)
-
-    return ocm_map, current_state
-
-
-def fetch_desired_state(clusters, vault_input_path, settings):
-    desired_state = []
-    error = False
-    secret_reader = SecretReader(settings=settings)
-    for cluster_info in clusters:
-        cluster = cluster_info["name"]
-        for auth in cluster_info["auth"]:
-            if auth["service"] != "github-org-team":
-                continue
-
-            org = auth["org"]
-            team = auth["team"]
-            secret = {
-                "path": f"{vault_input_path}/{QONTRACT_INTEGRATION}/{auth['service']}/{org}/{team}"
-            }
-            try:
-                oauth_data = secret_reader.read_all(secret)
-                client_id = oauth_data["client-id"]
-                client_secret = oauth_data["client-secret"]
-            except Exception:
-                logging.error(f"unable to read secret in path {secret['path']}")
-                error = True
-                continue
-            item = {
-                "cluster": cluster,
-                "name": f"github-{org}",
-                "client_id": client_id,
-                "client_secret": client_secret,
-                "teams": [f"{org}/{team}"],
-            }
-            desired_state.append(item)
-
-    return desired_state, error
-
-
-def sanitize(state):
-    return {k: v for k, v in state.items() if k not in {"client_secret", "id"}}
-
-
-def act(dry_run, ocm_map, current_state, desired_state):
-    sanitized_current_state = [sanitize(d) for d in current_state]
-    sanitized_desired_state = [sanitize(d) for d in desired_state]
-    to_add = [d for d in desired_state if sanitize(d) not in sanitized_current_state]
-    for item in to_add:
-        cluster = item["cluster"]
-        idp_name = item["name"]
-        team = item["teams"][0]
-        logging.info(["create_github_idp", cluster, idp_name, team])
-
-        if not dry_run:
-            ocm = ocm_map.get(cluster)
-            ocm.create_github_idp_teams(item)
-
-    to_remove = [d for d in current_state if sanitize(d) not in sanitized_desired_state]
-    for item in to_remove:
-        cluster = item["cluster"]
-        idp_name = item["name"]
-        team = item["teams"][0]
-        logging.info(["remove_github_idp", cluster, idp_name, team])
-
-        if not dry_run:
-            ocm = ocm_map.get(cluster)
-            ocm.delete_idp(cluster, item["id"])
-
-
-def _cluster_is_compatible(cluster: Mapping[str, Any]) -> bool:
-    return cluster.get("ocm") is not None and cluster.get("auth") is not None
-
-
-def run(dry_run, vault_input_path=""):
-    if not vault_input_path:
-        logging.error("must supply vault input path")
-        sys.exit(1)
-    settings = queries.get_app_interface_settings()
-    clusters = [
-        c
-        for c in queries.get_clusters()
-        if integration_is_enabled(QONTRACT_INTEGRATION, c) and _cluster_is_compatible(c)
-    ]
-    if not clusters:
-        logging.debug("No github-idp definitions found in app-interface")
-        sys.exit(ExitCodes.SUCCESS)
-
-    ocm_map, current_state = fetch_current_state(clusters, settings)
-    desired_state, error = fetch_desired_state(clusters, vault_input_path, settings)
-    if error:
-        sys.exit(1)
-    act(dry_run, ocm_map, current_state, desired_state)