qontract-reconcile 0.10.2.dev28__tar.gz → 0.10.2.dev30__tar.gz

{qontract_reconcile-0.10.2.dev28 → qontract_reconcile-0.10.2.dev30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev28
+Version: 0.10.2.dev30
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev28 → qontract_reconcile-0.10.2.dev30}/pyproject.toml

@@ -111,6 +111,8 @@ app-interface-metrics-exporter = "tools.app_interface_metrics_exporter:main"
 app-interface-reporter = "tools.app_interface_reporter:main"
 glitchtip-access-reporter = "tools.glitchtip_access_reporter:main"
 glitchtip-access-revalidation = "tools.glitchtip_access_revalidation:main"
+app-sre-tekton-access-reporter = "tools.app_sre_tekton_access_reporter:main"
+app-sre-tekton-access-revalidation = "tools.app_sre_tekton_access_revalidation:main"
 qontract-cli = "tools.qontract_cli:root"
 qontract-reconcile = "reconcile.cli:integration"
 run-integration = "reconcile.run_integration:main"

qontract_reconcile-0.10.2.dev30/reconcile/gql_definitions/app_sre_tekton_access_revalidation/roles.py

@@ -0,0 +1,86 @@
+"""
+Generated by qenerate plugin=pydantic_v1. DO NOT MODIFY MANUALLY!
+"""
+from collections.abc import Callable  # noqa: F401 # pylint: disable=W0611
+from datetime import datetime  # noqa: F401 # pylint: disable=W0611
+from enum import Enum  # noqa: F401 # pylint: disable=W0611
+from typing import (  # noqa: F401 # pylint: disable=W0611
+    Any,
+    Optional,
+    Union,
+)
+
+from pydantic import (  # noqa: F401 # pylint: disable=W0611
+    BaseModel,
+    Extra,
+    Field,
+    Json,
+)
+
+
+DEFINITION = """
+query AppSRETektonAccessRevalidationRoles {
+  roles: roles_v1 {
+    path
+    access {
+      role
+      namespace {
+        path
+      }
+    }
+    users {
+      org_username
+      path
+    }
+  }
+}
+"""
+
+
+class ConfiguredBaseModel(BaseModel):
+    class Config:
+        smart_union=True
+        extra=Extra.forbid
+
+
+class NamespaceV1(ConfiguredBaseModel):
+    path: str = Field(..., alias="path")
+
+
+class AccessV1(ConfiguredBaseModel):
+    role: Optional[str] = Field(..., alias="role")
+    namespace: Optional[NamespaceV1] = Field(..., alias="namespace")
+
+
+class UserV1(ConfiguredBaseModel):
+    org_username: str = Field(..., alias="org_username")
+    path: str = Field(..., alias="path")
+
+
+class RoleV1(ConfiguredBaseModel):
+    path: str = Field(..., alias="path")
+    access: Optional[list[AccessV1]] = Field(..., alias="access")
+    users: list[UserV1] = Field(..., alias="users")
+
+
+class AppSRETektonAccessRevalidationRolesQueryData(ConfiguredBaseModel):
+    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
+
+
+def query(query_func: Callable, **kwargs: Any) -> AppSRETektonAccessRevalidationRolesQueryData:
+    """
+    This is a convenience function which queries and parses the data into
+    concrete types. It should be compatible with most GQL clients.
+    You do not have to use it to consume the generated data classes.
+    Alternatively, you can also mime and alternate the behavior
+    of this function in the caller.
+
+    Parameters:
+        query_func (Callable): Function which queries your GQL Server
+        kwargs: optional arguments that will be passed to the query function
+
+    Returns:
+        AppSRETektonAccessRevalidationRolesQueryData: queried data parsed into generated classes
+    """
+    raw_data: dict[Any, Any] = query_func(DEFINITION, **kwargs)
+    return AppSRETektonAccessRevalidationRolesQueryData(**raw_data)

qontract_reconcile-0.10.2.dev30/reconcile/gql_definitions/app_sre_tekton_access_revalidation/users.py

@@ -0,0 +1,92 @@
+"""
+Generated by qenerate plugin=pydantic_v1. DO NOT MODIFY MANUALLY!
+"""
+from collections.abc import Callable  # noqa: F401 # pylint: disable=W0611
+from datetime import datetime  # noqa: F401 # pylint: disable=W0611
+from enum import Enum  # noqa: F401 # pylint: disable=W0611
+from typing import (  # noqa: F401 # pylint: disable=W0611
+    Any,
+    Optional,
+    Union,
+)
+
+from pydantic import (  # noqa: F401 # pylint: disable=W0611
+    BaseModel,
+    Extra,
+    Field,
+    Json,
+)
+
+
+DEFINITION = """
+query AppSRETektonAccessRevalidationUsers {
+  users: users_v1 {
+    name
+    org_username
+    roles {
+      access {
+        role
+        namespace {
+          name
+          cluster {
+            name
+          }
+        }
+      }
+    }
+  }
+}
+"""
+
+
+class ConfiguredBaseModel(BaseModel):
+    class Config:
+        smart_union=True
+        extra=Extra.forbid
+
+
+class ClusterV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+
+
+class NamespaceV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    cluster: ClusterV1 = Field(..., alias="cluster")
+
+
+class AccessV1(ConfiguredBaseModel):
+    role: Optional[str] = Field(..., alias="role")
+    namespace: Optional[NamespaceV1] = Field(..., alias="namespace")
+
+
+class RoleV1(ConfiguredBaseModel):
+    access: Optional[list[AccessV1]] = Field(..., alias="access")
+
+
+class UserV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    org_username: str = Field(..., alias="org_username")
+    roles: Optional[list[RoleV1]] = Field(..., alias="roles")
+
+
+class AppSRETektonAccessRevalidationUsersQueryData(ConfiguredBaseModel):
+    users: Optional[list[UserV1]] = Field(..., alias="users")
+
+
+def query(query_func: Callable, **kwargs: Any) -> AppSRETektonAccessRevalidationUsersQueryData:
+    """
+    This is a convenience function which queries and parses the data into
+    concrete types. It should be compatible with most GQL clients.
+    You do not have to use it to consume the generated data classes.
+    Alternatively, you can also mime and alternate the behavior
+    of this function in the caller.
+
+    Parameters:
+        query_func (Callable): Function which queries your GQL Server
+        kwargs: optional arguments that will be passed to the query function
+
+    Returns:
+        AppSRETektonAccessRevalidationUsersQueryData: queried data parsed into generated classes
+    """
+    raw_data: dict[Any, Any] = query_func(DEFINITION, **kwargs)
+    return AppSRETektonAccessRevalidationUsersQueryData(**raw_data)

{qontract_reconcile-0.10.2.dev28 → qontract_reconcile-0.10.2.dev30}/reconcile/gql_definitions/common/pipeline_providers.py

@@ -95,7 +95,12 @@ query PipelineProviders {
       }
       namespace {
         name
+        path
         clusterAdmin
+        app {
+          name
+          path
+        }
         cluster {
           name
           serverUrl
@@ -193,6 +198,11 @@ class PipelinesProviderTektonProviderDefaultsV1(ConfiguredBaseModel):
     deploy_resources: Optional[DeployResourcesV1] = Field(..., alias="deployResources")
 
 
+class AppV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    path: str = Field(..., alias="path")
+
+
 class DisableClusterAutomationsV1(ConfiguredBaseModel):
     integrations: Optional[list[str]] = Field(..., alias="integrations")
 
@@ -210,7 +220,9 @@ class ClusterV1(ConfiguredBaseModel):
 
 class NamespaceV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
+    path: str = Field(..., alias="path")
     cluster_admin: Optional[bool] = Field(..., alias="clusterAdmin")
+    app: AppV1 = Field(..., alias="app")
     cluster: ClusterV1 = Field(..., alias="cluster")
 
 

qontract_reconcile-0.10.2.dev30/reconcile/utils/mr/app_sre_tekton_access_report.py

@@ -0,0 +1,45 @@
+from pydantic import BaseModel
+
+from reconcile.utils.mr.update_access_report_base import UpdateAccessReportBase
+
+
+class UpdateAppSRETektonAccessReport(UpdateAccessReportBase):
+    name = "app_sre_tekton_access_report_mr"
+    short_description = "AppSRE Tekton Access Report"
+    template = """
+| Username | Name | Apps with pipeline namespace access |
+| -------- | ---- | ----------------------------------- |
+{% for user in users|sort -%}
+| {{ user.org_username }} | {{ user.name }} |{% for app in user.apps %} {{app}}{% if not loop.last%},{% endif %}{% endfor %} |
+{% endfor %}
+""".strip()
+
+
+# User model
+class AppSRETektonAccessReportUserModel(BaseModel):
+    org_username: str
+    name: str
+    apps: set[str]
+
+    def __lt__(self, other: object) -> bool:
+        if not isinstance(other, AppSRETektonAccessReportUserModel):
+            raise NotImplementedError(
+                "Cannot compare to non AppSRETektonAccessReportUser objects."
+            )
+        return self.org_username < other.org_username
+
+
+# Mutable User class
+class AppSRETektonAccessReportUser:
+    def __init__(self, name: str, org_username: str, apps: set):
+        self._org_username = org_username
+        self._name = name
+        self._apps = apps
+
+    def add_app(self, app: str) -> None:
+        self._apps.add(app)
+
+    def generate_model(self) -> AppSRETektonAccessReportUserModel:
+        return AppSRETektonAccessReportUserModel(
+            name=self._name, org_username=self._org_username, apps=self._apps
+        )

qontract_reconcile-0.10.2.dev30/reconcile/utils/mr/glitchtip_access_reporter.py

@@ -0,0 +1,40 @@
+from pydantic import BaseModel
+
+from reconcile.utils.mr.update_access_report_base import UpdateAccessReportBase
+
+
+class UpdateGlitchtipAccessReport(UpdateAccessReportBase):
+    name = "glitchtip_access_report_mr"
+    short_description = "glitchtip access report"
+    template = """
+| Username | Name | Organizations and Access Levels |
+| -------- | ---- | ------------------------------- |
+{% for user in users|sort -%}
+| {{ user.username }} | {{ user.name }} |{% for org in user.organizations %} {{org.name}} ({{ org.access_level }}){% if not loop.last%},{% endif %}{% endfor %} |
+{% endfor %}
+""".strip()
+
+
+class GlitchtipAccessReportOrg(BaseModel):
+    name: str
+    access_level: str
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, GlitchtipAccessReportOrg):
+            raise NotImplementedError(
+                "Cannot compare to non GlitchtipAccessReportOrg objects."
+            )
+        return self.name == other.name
+
+
+class GlitchtipAccessReportUser(BaseModel):
+    name: str
+    username: str
+    organizations: list[GlitchtipAccessReportOrg]
+
+    def __lt__(self, other: object) -> bool:
+        if not isinstance(other, GlitchtipAccessReportUser):
+            raise NotImplementedError(
+                "Cannot compare to non GlitchtipAccessReportUser objects."
+            )
+        return self.username < other.username

qontract_reconcile-0.10.2.dev28/reconcile/utils/mr/glitchtip_access_reporter.py → qontract_reconcile-0.10.2.dev30/reconcile/utils/mr/update_access_report_base.py

@@ -1,8 +1,10 @@
 import logging
+from abc import abstractmethod
 from collections.abc import Sequence
 from datetime import UTC, date
 from datetime import datetime as dt
 from pathlib import Path
+from typing import TypeVar
 
 from jinja2 import Template
 from pydantic import BaseModel
@@ -11,68 +13,54 @@ from reconcile.utils.gitlab_api import GitLabApi
 from reconcile.utils.mr.base import MergeRequestBase
 from reconcile.utils.mr.labels import AUTO_MERGE
 
-CURRENT_USERS_TABLE_TEMPLATE = """
-| Username | Name | Organizations and Access Levels |
-| -------- | ---- | ------------------------------- |
-{% for user in users|sort -%}
-| {{ user.username }} | {{ user.name }} |{% for org in user.organizations %} {{org.name}} ({{ org.access_level }}){% if not loop.last%},{% endif %}{% endfor %} |
-{% endfor %}
-""".strip()
+AccessReportUser = TypeVar("AccessReportUser", bound=BaseModel)
 
 
-class GlitchtipAccessReportOrg(BaseModel):
-    name: str
-    access_level: str
-
-    def __eq__(self, other: object) -> bool:
-        if not isinstance(other, GlitchtipAccessReportOrg):
-            raise NotImplementedError(
-                "Cannot compare to non GlitchtipAccessReportOrg objects."
-            )
-        return self.name == other.name
-
-
-class GlitchtipAccessReportUser(BaseModel):
-    name: str
-    username: str
-    organizations: list[GlitchtipAccessReportOrg]
-
-    def __lt__(self, other: object) -> bool:
-        if not isinstance(other, GlitchtipAccessReportUser):
-            raise NotImplementedError(
-                "Cannot compare to non GlitchtipAccessReportUser objects."
-            )
-        return self.username < other.username
-
-
-class UpdateGlitchtipAccessReport(MergeRequestBase):
-    name = "glitchtip_access_report_mr"
-
+class UpdateAccessReportBase(MergeRequestBase):
     def __init__(
         self,
-        users: Sequence[GlitchtipAccessReportUser],
-        glitchtip_access_revalidation_workbook: Path,
+        users: Sequence[AccessReportUser],
+        workbook_path: Path,
         dry_run: bool = True,
     ):
         super().__init__()
         self.labels = [AUTO_MERGE]
         self._users = users
-        self._glitchtip_access_revalidation_workbook = str(
-            glitchtip_access_revalidation_workbook
-        )
+        self._workbook_file_name = str(workbook_path)
         self._isodate = dt.now(tz=UTC).isoformat()
         self._dry_run = dry_run
 
+    @property
+    @abstractmethod
+    def short_description(self) -> str:
+        """
+        Short Description of the Merge Request (without dates). It will be used to
+        build the Merge Request description as seen in the UI.
+
+        :return: Merge Request description as seen in the Gitlab Web UI without date.
+        :rtype: str
+        """
+
+    @property
+    @abstractmethod
+    def template(self) -> str:
+        """
+        Jinja2 template to generate the report main table.
+
+        :return: report jinja2 template.
+        :rtype: str
+        """
+
     @property
     def title(self) -> str:
         return f"[{self.name}] reports for {self._isodate}"
 
     @property
     def description(self) -> str:
-        return f"glitchtip access report for {self._isodate}"
+        return f"{self.short_description} for {self._isodate}"
 
     def _render_current_users_table(self) -> str:
-        template = Template(CURRENT_USERS_TABLE_TEMPLATE, keep_trailing_newline=True)
+        template = Template(self.template, keep_trailing_newline=True)
         return template.render(users=self._users)
 
     def _render_tracking_table_row(self, old_number_of_users: int) -> str:
@@ -113,22 +101,22 @@ class UpdateGlitchtipAccessReport(MergeRequestBase):
 
     def process(self, gitlab_cli: GitLabApi) -> None:
         workbook_md = gitlab_cli.project.files.get(
-            file_path=self._glitchtip_access_revalidation_workbook, ref=self.branch
+            file_path=self._workbook_file_name, ref=self.branch
         )
         workbook_md = self._update_workbook(workbook_md.decode().decode("utf-8"))
 
         if not self._dry_run:
             logging.info(
-                f"updating glitchtip access report: {self._glitchtip_access_revalidation_workbook}"
+                f"updating {self.short_description}: {self._workbook_file_name}"
             )
             gitlab_cli.update_file(
                 branch_name=self.branch,
-                file_path=self._glitchtip_access_revalidation_workbook,
-                commit_message="update glitchtip access report",
+                file_path=self._workbook_file_name,
+                commit_message=f"update {self.short_description}",
                 content=workbook_md,
             )
         else:
             logging.info(
-                f"dry-run: not updating glitchtip access report: {self._glitchtip_access_revalidation_workbook}"
+                f"dry-run: not updating {self.short_description}: {self._workbook_file_name}"
             )
             logging.info(workbook_md)

qontract_reconcile-0.10.2.dev30/tools/app_sre_tekton_access_reporter.py

@@ -0,0 +1,99 @@
+import logging
+from collections import defaultdict
+from pathlib import Path
+
+import click
+
+from reconcile import mr_client_gateway
+from reconcile.cli import (
+    config_file,
+    dry_run,
+    gitlab_project_id,
+    log_level,
+)
+from reconcile.gql_definitions.app_sre_tekton_access_revalidation.users import (
+    query as users_query,
+)
+from reconcile.typed_queries.tekton_pipeline_providers import (
+    get_tekton_pipeline_providers,
+)
+from reconcile.utils import gql
+from reconcile.utils.mr.app_sre_tekton_access_report import (
+    AppSRETektonAccessReportUser,
+    UpdateAppSRETektonAccessReport,
+)
+from reconcile.utils.runtime.environment import init_env
+
+
+@click.command()
+@config_file
+@dry_run
+@log_level
+@gitlab_project_id
+@click.option(
+    "--workbook-path",
+    help="path to AppSRE Tekton access revalidation workbook markdown file",
+    default="docs/app-sre/tekton/access-revalidation-workbook.md",
+)
+def main(
+    configfile: str,
+    dry_run: bool,
+    log_level: str,
+    gitlab_project_id: int,
+    workbook_path: str,
+) -> None:
+    """Update AppSRE Tekton access report.
+
+    This script updates the AppSRE Tekton access report (markdown file) with the latest
+    access information.
+    """
+
+    init_env(log_level=log_level, config_file=configfile)
+
+    # pipeline providers namespaces dict, containing the all the pipelines namespaces
+    # the (cluster_name, namespace_name) tuple to app_name correspondence.
+    pp_namespaces_apps = {
+        (p.namespace.cluster.name, p.namespace.name): p.namespace.app.name
+        for p in get_tekton_pipeline_providers()
+    }
+
+    report_users: dict[str, AppSRETektonAccessReportUser] = {}
+    users = users_query(query_func=gql.get_api().query).users or []
+    for u in users:
+        namespace_roles = defaultdict(set)
+        for r in u.roles or []:
+            if r.access is None:
+                continue
+
+            for a in r.access:
+                if a.namespace is None:
+                    continue
+
+                namespace_tuple = (a.namespace.cluster.name, a.namespace.name)
+                namespace_roles[namespace_tuple].add(a.role)
+
+        for namespace_tuple, roles in namespace_roles.items():
+            if pp_app := pp_namespaces_apps.get(namespace_tuple):
+                if "tekton-trigger-access" in roles or "view" in roles:
+                    if ru := report_users.get(u.org_username):
+                        ru.add_app(pp_app)
+                    else:
+                        report_users[u.org_username] = AppSRETektonAccessReportUser(
+                            name=u.name, org_username=u.org_username, apps={pp_app}
+                        )
+
+    mr = UpdateAppSRETektonAccessReport(
+        users=[u.generate_model() for u in report_users.values()],
+        workbook_path=Path(workbook_path),
+        dry_run=dry_run,
+    )
+    with mr_client_gateway.init(
+        gitlab_project_id=gitlab_project_id, sqs_or_gitlab="gitlab"
+    ) as mr_cli:
+        result = mr.submit(cli=mr_cli)
+        if result:
+            logging.info(["created_mr", result.web_url])
+
+
+if __name__ == "__main__":
+    main()  # pylint: disable=no-value-for-parameter

qontract_reconcile-0.10.2.dev30/tools/app_sre_tekton_access_revalidation.py

@@ -0,0 +1,90 @@
+import logging
+from pathlib import Path
+
+import click
+
+from reconcile import mr_client_gateway
+from reconcile.cli import (
+    config_file,
+    dry_run,
+    gitlab_project_id,
+    log_level,
+)
+from reconcile.typed_queries.tekton_pipeline_providers import (
+    get_tekton_pipeline_providers,
+)
+from reconcile.utils.mr.labels import AUTO_MERGE
+from reconcile.utils.mr.notificator import (
+    CreateAppInterfaceNotificator,
+    Notification,
+)
+from reconcile.utils.runtime.environment import init_env
+
+EMAIL_BODY = """Hello app-interface service owner,
+
+Access to all Tekton pipelines namespaces must be revalidated regularly. This ensures
+that the access is still valid and is needed to safeguard against unauthorized access.
+
+Please review, within one week, that all your app-interface roles that grant access to
+those namespaces are assigned to the appropriate users. In order to help you identifying
+those roles and users, please take a look into the app-interface documentation:
+https://gitlab.cee.redhat.com/service/app-interface/-/blob/master/docs/app-sre/tekton/access-revalidation.md
+
+If you have questions about this, please post a question in the #sd-app-sre Slack channel.
+
+Thank you,
+
+The AppSRE team
+"""
+
+
+@click.command()
+@config_file
+@dry_run
+@log_level
+@gitlab_project_id
+@click.option(
+    "--email-dir",
+    help="app-interface dir to store new AppSRE Tekton revalidation emails",
+    default="data/app-interface/emails/app-sre-tekton",
+)
+def main(
+    configfile: str,
+    dry_run: bool,
+    log_level: str,
+    gitlab_project_id: int,
+    email_dir: str,
+) -> None:
+    """Revalidate Glitchtip access.
+
+    This script sends an email (via MR) to all app-interface service owners (apps)
+    that have a pipelines provider associated to the application. The email asks the
+    service owners to revalidate the access to the pipelines providers namespaces.
+    """
+    init_env(log_level=log_level, config_file=configfile)
+
+    apps = {p.namespace.app.path for p in get_tekton_pipeline_providers()}
+    notification = Notification(
+        notification_type="Action Required",
+        short_description="AppSRE Tekton Access Revalidation",
+        description=EMAIL_BODY,
+        services=list(apps),
+        recipients=[],
+    )
+    mr = CreateAppInterfaceNotificator(
+        notification,
+        labels=[AUTO_MERGE],
+        email_base_path=Path(email_dir),
+        dry_run=dry_run,
+    )
+
+    with mr_client_gateway.init(
+        gitlab_project_id=gitlab_project_id, sqs_or_gitlab="gitlab"
+    ) as mr_cli:
+        result = mr.submit(cli=mr_cli)
+        if result:
+            logging.info(["created_mr", result.web_url])
+
+
+if __name__ == "__main__":
+    main()  # pylint: disable=no-value-for-parameter

{qontract_reconcile-0.10.2.dev28 → qontract_reconcile-0.10.2.dev30}/tools/glitchtip_access_reporter.py

@@ -77,9 +77,7 @@ def main(
 
     mr = UpdateGlitchtipAccessReport(
         users=list(users.values()),
-        glitchtip_access_revalidation_workbook=Path(
-            glitchtip_access_revalidation_workbook_path
-        ),
+        workbook_path=Path(glitchtip_access_revalidation_workbook_path),
         dry_run=dry_run,
     )
     with mr_client_gateway.init(