qontract-reconcile 0.10.2.dev297__tar.gz → 0.10.2.dev299__tar.gz

{qontract_reconcile-0.10.2.dev297 → qontract_reconcile-0.10.2.dev299}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev297
+Version: 0.10.2.dev299
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev297 → qontract_reconcile-0.10.2.dev299}/reconcile/gql_definitions/introspection.json

@@ -47157,13 +47157,9 @@
                             "description": null,
                             "args": [],
                             "type": {
-                                "kind": "NON_NULL",
-                                "name": null,
-                                "ofType": {
-                                    "kind": "SCALAR",
-                                    "name": "String",
-                                    "ofType": null
-                                }
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
@@ -47173,13 +47169,9 @@
                             "description": null,
                             "args": [],
                             "type": {
-                                "kind": "NON_NULL",
-                                "name": null,
-                                "ofType": {
-                                    "kind": "SCALAR",
-                                    "name": "String",
-                                    "ofType": null
-                                }
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
                             },
                             "isDeprecated": false,
                             "deprecationReason": null

{qontract_reconcile-0.10.2.dev297 → qontract_reconcile-0.10.2.dev299}/reconcile/gql_definitions/rhcs/certs.py

@@ -61,6 +61,24 @@ query RhcsCerts {
         annotations
       }
     }
+    sharedResources {
+      openshiftResources {
+        provider
+        ... on NamespaceOpenshiftResourceRhcsCert_v1 {
+          secret_name
+          service_account_name
+          service_account_password {
+            ... on VaultSecret_v1 {
+              path
+              field
+              version
+            }
+          }
+          auto_renew_threshold_days
+          annotations
+        }
+      }
+    }
     cluster {
       name
       serverUrl
@@ -112,6 +130,32 @@ class NamespaceOpenshiftResourceRhcsCertV1(NamespaceOpenshiftResourceV1):
     annotations: Optional[Json] = Field(..., alias="annotations")
 
 
+class SharedResourcesV1_NamespaceOpenshiftResourceV1(ConfiguredBaseModel):
+    provider: str = Field(..., alias="provider")
+
+
+class SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1_VaultSecretV1(ConfiguredBaseModel):
+    ...
+
+
+class SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1_VaultSecretV1_VaultSecretV1(SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1_VaultSecretV1):
+    path: str = Field(..., alias="path")
+    field: str = Field(..., alias="field")
+    version: Optional[int] = Field(..., alias="version")
+
+
+class SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1(SharedResourcesV1_NamespaceOpenshiftResourceV1):
+    secret_name: str = Field(..., alias="secret_name")
+    service_account_name: str = Field(..., alias="service_account_name")
+    service_account_password: Union[SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1_VaultSecretV1_VaultSecretV1, SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1_VaultSecretV1] = Field(..., alias="service_account_password")
+    auto_renew_threshold_days: Optional[int] = Field(..., alias="auto_renew_threshold_days")
+    annotations: Optional[Json] = Field(..., alias="annotations")
+
+
+class SharedResourcesV1(ConfiguredBaseModel):
+    openshift_resources: list[Union[SharedResourcesV1_NamespaceOpenshiftResourceV1_NamespaceOpenshiftResourceRhcsCertV1, SharedResourcesV1_NamespaceOpenshiftResourceV1]] = Field(..., alias="openshiftResources")
+
+
 class DisableClusterAutomationsV1(ConfiguredBaseModel):
     integrations: Optional[list[str]] = Field(..., alias="integrations")
 
@@ -132,6 +176,7 @@ class NamespaceV1(ConfiguredBaseModel):
     delete: Optional[bool] = Field(..., alias="delete")
     cluster_admin: Optional[bool] = Field(..., alias="clusterAdmin")
     openshift_resources: Optional[list[Union[NamespaceOpenshiftResourceRhcsCertV1, NamespaceOpenshiftResourceV1]]] = Field(..., alias="openshiftResources")
+    shared_resources: Optional[list[SharedResourcesV1]] = Field(..., alias="sharedResources")
     cluster: ClusterV1 = Field(..., alias="cluster")
 
 

{qontract_reconcile-0.10.2.dev297 → qontract_reconcile-0.10.2.dev299}/reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py

@@ -817,8 +817,8 @@ class NamespaceTerraformResourceS3CloudFrontPublicKeyV1(NamespaceTerraformResour
 
 class NamespaceTerraformResourceALBMutualAuthenticationV1(ConfiguredBaseModel):
     mode: str = Field(..., alias="mode")
-    ca_cert_bundle_s3_bucket_name: str = Field(..., alias="ca_cert_bundle_s3_bucket_name")
-    ca_cert_bundle_s3_bucket_key: str = Field(..., alias="ca_cert_bundle_s3_bucket_key")
+    ca_cert_bundle_s3_bucket_name: Optional[str] = Field(..., alias="ca_cert_bundle_s3_bucket_name")
+    ca_cert_bundle_s3_bucket_key: Optional[str] = Field(..., alias="ca_cert_bundle_s3_bucket_key")
 
 
 class NamespaceTerraformResourceALBTargetHealthcheckV1(ConfiguredBaseModel):

{qontract_reconcile-0.10.2.dev297 → qontract_reconcile-0.10.2.dev299}/reconcile/openshift_rhcs_certs.py

@@ -2,7 +2,7 @@ import logging
 import sys
 import time
 from collections.abc import Callable, Iterable, Mapping
-from typing import Any
+from typing import Any, cast
 
 import reconcile.openshift_base as ob
 import reconcile.openshift_resources_base as orb
@@ -67,20 +67,25 @@ class OpenshiftRhcsCertExpiration(GaugeMetric):
         return "qontract_reconcile_rhcs_cert_expiration_timestamp"
 
 
+def _is_rhcs_cert(obj: Any) -> bool:
+    return getattr(obj, "provider", None) == "rhcs-cert"
+
+
 def get_namespaces_with_rhcs_certs(
-    query_func: Callable, cluster_name: Iterable[str] | None = None
+    query_func: Callable,
+    cluster_name: Iterable[str] | None = None,
 ) -> list[NamespaceV1]:
-    return [
-        ns
-        for ns in rhcs_certs_query(query_func=query_func).namespaces or []
-        if integration_is_enabled(QONTRACT_INTEGRATION, ns.cluster)
-        and not bool(ns.delete)
-        and (not cluster_name or ns.cluster.name in cluster_name)
-        and any(
-            isinstance(r, NamespaceOpenshiftResourceRhcsCertV1)
-            for r in ns.openshift_resources or []
-        )
-    ]
+    result: list[NamespaceV1] = []
+    for ns in rhcs_certs_query(query_func=query_func).namespaces or []:
+        ob.aggregate_shared_resources_typed(cast("Any", ns))  # mypy: ignore[arg-type]
+        if (
+            integration_is_enabled(QONTRACT_INTEGRATION, ns.cluster)
+            and not bool(ns.delete)
+            and (not cluster_name or ns.cluster.name in cluster_name)
+            and any(_is_rhcs_cert(r) for r in ns.openshift_resources or [])
+        ):
+            result.append(ns)
+    return result
 
 
 def construct_rhcs_cert_oc_secret(
@@ -224,17 +229,16 @@ def fetch_desired_state(
 ) -> None:
     vault = VaultClient()
     cert_provider = get_rhcs_provider_settings(query_func=query_func)
-
     for ns in namespaces:
         for cert_resource in ns.openshift_resources or []:
-            if isinstance(cert_resource, NamespaceOpenshiftResourceRhcsCertV1):
+            if _is_rhcs_cert(cert_resource):
                 ri.add_desired_resource(
                     cluster=ns.cluster.name,
                     namespace=ns.name,
                     resource=fetch_openshift_resource_for_cert_resource(
                         dry_run,
                         ns,
-                        cert_resource,
+                        cast("NamespaceOpenshiftResourceRhcsCertV1", cert_resource),
                         vault,
                         cert_provider,
                     ),

{qontract_reconcile-0.10.2.dev297 → qontract_reconcile-0.10.2.dev299}/reconcile/utils/terrascript_aws_client.py

@@ -5563,22 +5563,27 @@ class TerrascriptClient:
 
         # mutual authentication section
         if mutual_authentication := resource.get("mutual_authentication"):
-            trust_store_values = {
-                "ca_certificates_bundle_s3_bucket": mutual_authentication[
-                    "ca_cert_bundle_s3_bucket_name"
-                ],
-                "ca_certificates_bundle_s3_key": mutual_authentication[
-                    "ca_cert_bundle_s3_bucket_key"
-                ],
-            }
-            trust_store = aws_lb_trust_store(
-                f"{identifier}-trust-store", **trust_store_values
-            )
-            tf_resources.append(trust_store)
-            values["mutual_authentication"] = {
-                "mode": mutual_authentication["mode"],
-                "trust_store_arn": f"${{{trust_store.arn}}}",
-            }
+            if mutual_authentication["mode"] in {"off", "passthrough"}:
+                values["mutual_authentication"] = {
+                    "mode": mutual_authentication["mode"],
+                }
+            else:
+                trust_store_values = {
+                    "ca_certificates_bundle_s3_bucket": mutual_authentication[
+                        "ca_cert_bundle_s3_bucket_name"
+                    ],
+                    "ca_certificates_bundle_s3_key": mutual_authentication[
+                        "ca_cert_bundle_s3_bucket_key"
+                    ],
+                }
+                trust_store = aws_lb_trust_store(
+                    f"{identifier}-trust-store", **trust_store_values
+                )
+                tf_resources.append(trust_store)
+                values["mutual_authentication"] = {
+                    "mode": mutual_authentication["mode"],
+                    "trust_store_arn": f"${{{trust_store.arn}}}",
+                }
 
         forward_identifier = f"{identifier}-forward"
         forward_lbl_tf_resource = aws_lb_listener(forward_identifier, **values)