qontract-reconcile 0.10.2.dev307__tar.gz → 0.10.2.dev314__tar.gz

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev307
+Version: 0.10.2.dev314
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/pyproject.toml

@@ -286,14 +286,7 @@ module = [
     "reconcile.utils.ocm_base_client",
     "reconcile.utils.ocm.ocm",
     "reconcile.utils.openshift_resource",
-    "reconcile.utils.openssl",
     "reconcile.utils.raw_github_api",
-    "reconcile.utils.repo_owners",
-    "reconcile.utils.runtime.meta",
-    "reconcile.utils.sharding",
-    "reconcile.utils.sqs_gateway",
-    "reconcile.utils.terraform_client",
-    "reconcile.utils.terrascript_aws_client",
     "reconcile.utils.vault",
     # untyped tests
     "reconcile.test.oc.test_oc_connection_parameters",
@@ -333,7 +326,6 @@ module = [
     "reconcile.test.test_openshift_saas_deploy",
     "reconcile.test.test_openshift_upgrade_watcher",
     "reconcile.test.test_prometheus_rules_tester",
-    "reconcile.test.test_repo_owners",
     "reconcile.test.test_requests_sender",
     "reconcile.test.test_saasherder_allowed_secret_paths",
     "reconcile.test.test_secret_reader",
@@ -365,11 +357,8 @@ module = [
     "reconcile.test.utils.test_parse_dhms_duration",
     "reconcile.test.utils.test_promotion_state",
     "reconcile.test.utils.test_semver_helper",
-    "reconcile.test.utils.test_sharding",
     "reconcile.test.utils.test_smtp_client",
-    "reconcile.test.utils.test_terraform_client",
     "reconcile.test.utils.test_terraform",
-    "reconcile.test.utils.test_terrascript_aws_client",
     "reconcile.test.utils.test_terrascript_cloudflare_client",
     "reconcile.test.utils.test_terrascript_cloudflare_resources",
 ]

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/gql_definitions/common/aws_vpc_requests.py

@@ -58,10 +58,13 @@ fragment VPCRequest on VPCRequest_v1 {
   cidr_block {
     networkAddress
   }
+  vpc_tags
   subnets {
-    private 
+    private
     public
     availability_zones
+    private_subnet_tags
+    public_subnet_tags
   }
 }
 

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/gql_definitions/fragments/aws_vpc_request.py

@@ -54,6 +54,8 @@ class VPCRequestSubnetsListsV1(ConfiguredBaseModel):
     private: Optional[list[str]] = Field(..., alias="private")
     public: Optional[list[str]] = Field(..., alias="public")
     availability_zones: Optional[list[str]] = Field(..., alias="availability_zones")
+    private_subnet_tags: Optional[Json] = Field(..., alias="private_subnet_tags")
+    public_subnet_tags: Optional[Json] = Field(..., alias="public_subnet_tags")
 
 
 class VPCRequest(ConfiguredBaseModel):
@@ -62,4 +64,5 @@ class VPCRequest(ConfiguredBaseModel):
     account: AWSAccountV1 = Field(..., alias="account")
     region: str = Field(..., alias="region")
     cidr_block: NetworkV1 = Field(..., alias="cidr_block")
+    vpc_tags: Optional[Json] = Field(..., alias="vpc_tags")
     subnets: Optional[VPCRequestSubnetsListsV1] = Field(..., alias="subnets")

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/gql_definitions/introspection.json

@@ -10948,18 +10948,6 @@
                             "isDeprecated": false,
                             "deprecationReason": null
                         },
-                        {
-                            "name": "slack_username",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
                         {
                             "name": "pagerduty_username",
                             "description": null,
@@ -27860,6 +27848,18 @@
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
+                        },
+                        {
+                            "name": "vpc_tags",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "JSON",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
                         }
                     ],
                     "inputFields": null,
@@ -28089,6 +28089,30 @@
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
+                        },
+                        {
+                            "name": "private_subnet_tags",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "JSON",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "public_subnet_tags",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "JSON",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
                         }
                     ],
                     "inputFields": null,

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/prometheus_rules_tester/integration.py

@@ -42,7 +42,7 @@ QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
 PROVIDERS = ["prometheus-rule"]
 
 NAMESPACE_NAME = "openshift-customer-monitoring"
-DEFAULT_PROMTOOL_VERSION = "2.55.1"
+DEFAULT_PROMTOOL_VERSION = "3.2.1"
 
 
 class TestContent(BaseModel):

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/terraform_tgw_attachments.py

@@ -93,7 +93,7 @@ class Accepter(BaseModel):
     region: str
     vpc_id: str | None
     route_table_ids: list[str] | None
-    subnets_id_az: list[dict] | None
+    subnets_id_az: list[dict[str, str]] | None
     account: ClusterAccountProviderInfo
     api_security_group_id: str | None
 

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/terraform_users.py

@@ -81,8 +81,10 @@ QONTRACT_INTEGRATION = "terraform_users"
 QONTRACT_INTEGRATION_VERSION = make_semver(0, 4, 2)
 QONTRACT_TF_PREFIX = "qrtf"
 
+Role = dict[str, Any]
 
-def get_tf_roles() -> list[dict[str, Any]]:
+
+def get_tf_roles() -> list[Role]:
     gqlapi = gql.get_api()
     roles: list[dict] = expiration.filter(gqlapi.query(TF_QUERY)["roles"])
     return [

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/terraform_vpc_peerings.py

@@ -565,7 +565,7 @@ def build_desired_state_vpc(
 @defer
 def run(
     dry_run: bool,
-    print_to_file: bool | None = None,
+    print_to_file: str | None = None,
     enable_deletion: bool = False,
     thread_pool_size: int = DEFAULT_THREAD_POOL_SIZE,
     account_name: str | None = None,

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/terraform_vpc_resources/integration.py

@@ -31,7 +31,11 @@ from reconcile.utils.runtime.integration import (
 from reconcile.utils.secret_reader import create_secret_reader
 from reconcile.utils.semver_helper import make_semver
 from reconcile.utils.terraform_client import TerraformClient
-from reconcile.utils.terrascript_aws_client import TerrascriptClient
+from reconcile.utils.terrascript_aws_client import (
+    VPC_REQUEST_DEFAULT_PRIVATE_SUBNET_TAGS,
+    VPC_REQUEST_DEFAULT_PUBLIC_SUBNET_TAGS,
+    TerrascriptClient,
+)
 from reconcile.utils.vcs import VCS
 
 QONTRACT_INTEGRATION = "terraform_vpc_resources"
@@ -90,14 +94,28 @@ class TerraformVpcResources(QontractReconcileIntegration[TerraformVpcResourcesPa
                 f"{request.identifier}-public_subnets", {}
             ).get("value", [])
 
+            if request.subnets:
+                private_subnet_tags = VPC_REQUEST_DEFAULT_PRIVATE_SUBNET_TAGS | (
+                    request.subnets.private_subnet_tags or {}
+                )
+                public_subnet_tags = VPC_REQUEST_DEFAULT_PUBLIC_SUBNET_TAGS | (
+                    request.subnets.public_subnet_tags or {}
+                )
+            else:
+                private_subnet_tags = VPC_REQUEST_DEFAULT_PRIVATE_SUBNET_TAGS
+                public_subnet_tags = VPC_REQUEST_DEFAULT_PUBLIC_SUBNET_TAGS
+
             values = {
                 "static": {
                     "vpc_id": outputs_per_account.get(
                         f"{request.identifier}-vpc_id", {}
                     ).get("value"),
+                    "vpc_tags": request.vpc_tags or {},
                     "subnets": {
                         "private": private_subnets,
                         "public": public_subnets,
+                        "private_subnet_tags": private_subnet_tags,
+                        "public_subnet_tags": public_subnet_tags,
                     },
                     "account_name": request.account.name,
                     "region": request.region,

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/utils/openssl.py

@@ -1,12 +1,12 @@
 from OpenSSL import crypto
 
 
-def certificate_matches_host(certificate, host):
+def certificate_matches_host(certificate: bytes, host: str) -> bool:
     common_name = get_certificate_common_name(certificate)
     return host.endswith(common_name.replace("*.", ""))
 
 
-def get_certificate_common_name(certificate):
+def get_certificate_common_name(certificate: bytes) -> str:
     cert = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
     subject = cert.get_subject()
     return subject.CN

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/utils/repo_owners.py

@@ -1,9 +1,13 @@
 import logging
 import os
 import pathlib
+from collections.abc import Iterable, Mapping
 
 from ruamel import yaml
 
+from reconcile.utils.github_api import GithubRepositoryApi
+from reconcile.utils.gitlab_api import GitLabApi
+
 _LOG = logging.getLogger(__name__)
 
 
@@ -12,38 +16,24 @@ class RepoOwners:
     Abstracts the owners of a repository with per-path granularity.
     """
 
-    def __init__(self, git_cli, ref="master", recursive=True):
+    def __init__(
+        self,
+        git_cli: GitLabApi | GithubRepositoryApi,
+        ref: str = "master",
+        recursive: bool = True,
+    ) -> None:
         self._git_cli = git_cli
         self._ref = ref
-        self._owners_map = None
+        self._owners_map: dict[str, dict[str, set[str]]] | None = None
         self._recursive = recursive
 
     @property
-    def owners_map(self):
+    def owners_map(self) -> dict[str, dict[str, set[str]]]:
         if self._owners_map is None:
             self._owners_map = self._get_owners_map()
         return self._owners_map
 
-    def get_owners(self):
-        """
-        Gets all the owners of the repository.
-
-        :return: the repository owners
-        :rtype: dict
-        """
-        repo_owners = {"approvers": set(), "reviewers": set()}
-
-        if "." in self.owners_map:
-            repo_owners["approvers"].update(self.owners_map["."]["approvers"])
-            repo_owners["reviewers"].update(self.owners_map["."]["reviewers"])
-
-        for owners in self.owners_map.values():
-            repo_owners["approvers"].update(owners["approvers"])
-            repo_owners["reviewers"].update(owners["reviewers"])
-
-        return repo_owners
-
-    def get_root_owners(self):
+    def get_root_owners(self) -> dict[str, list[str]]:
         """
         Gets all the owners defined in the repository root.
 
@@ -56,7 +46,7 @@ class RepoOwners:
 
         return {"approvers": [], "reviewers": []}
 
-    def get_path_owners(self, path):
+    def get_path_owners(self, path: str) -> dict[str, list[str]]:
         """
         Gets all the owners of a given path, no matter in which
         level of the filesystem tree the owner was specified.
@@ -67,7 +57,7 @@ class RepoOwners:
         :return: the path owners
         :rtype: dict
         """
-        path_owners = {"approvers": set(), "reviewers": set()}
+        path_owners: dict[str, set[str]] = {"approvers": set(), "reviewers": set()}
 
         if "." in self.owners_map:
             path_owners["approvers"].update(self.owners_map["."]["approvers"])
@@ -80,7 +70,7 @@ class RepoOwners:
 
         return self._set_to_sorted_list(path_owners)
 
-    def get_path_closest_owners(self, path):
+    def get_path_closest_owners(self, path: str) -> dict[str, list[str]]:
         """
         Gets all closest owners of a given path, no matter in which
         level of the filesystem tree the owner was specified.
@@ -108,7 +98,7 @@ class RepoOwners:
 
         return {"approvers": [], "reviewers": []}
 
-    def _get_owners_map(self):
+    def _get_owners_map(self) -> dict[str, dict[str, set[str]]]:
         """
         Maps all the OWNERS files content to their respective
         owned directory.
@@ -173,7 +163,7 @@ class RepoOwners:
             }
         return owners_map
 
-    def _get_aliases(self):
+    def _get_aliases(self) -> dict[str, list[str]] | None:
         """
         Retrieves the approvers aliases from the OWNERS_ALIASES file.
 
@@ -191,7 +181,9 @@ class RepoOwners:
         return aliases["aliases"]
 
     @staticmethod
-    def _set_to_sorted_list(owners):
+    def _set_to_sorted_list(
+        owners: Mapping[str, Iterable[str]],
+    ) -> dict[str, list[str]]:
         approvers = owners["approvers"]
         sorted_approvers = sorted(approvers) if approvers else []
 

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/utils/runtime/meta.py

@@ -1,5 +1,6 @@
 import dataclasses
 from dataclasses import dataclass
+from typing import Any
 
 
 @dataclass
@@ -8,5 +9,5 @@ class IntegrationMeta:
     args: list[str]
     short_help: str | None
 
-    def to_dict(self):
+    def to_dict(self) -> dict[str, Any]:
         return dataclasses.asdict(self)

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/utils/sharding.py

@@ -8,7 +8,7 @@ SHARDS = int(os.environ.get("SHARDS", "1"))
 SHARD_ID = int(os.environ.get("SHARD_ID", "0"))
 
 
-def is_in_shard(value):
+def is_in_shard(value: str) -> bool:
     if SHARDS == 1:
         return True
 

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/utils/sqs_gateway.py

@@ -1,5 +1,7 @@
 import json
 import os
+from collections.abc import Iterable, Mapping
+from typing import Any, Self
 
 from reconcile.utils.aws_api import AWSApi
 from reconcile.utils.secret_reader import SecretReader
@@ -12,7 +14,9 @@ class SQSGatewayInitError(Exception):
 class SQSGateway:
     """Wrapper around SQS AWS SDK"""
 
-    def __init__(self, accounts, secret_reader: SecretReader):
+    def __init__(
+        self, accounts: Iterable[Mapping[str, Any]], secret_reader: SecretReader
+    ) -> None:
         queue_url = os.environ.get("gitlab_pr_submitter_queue_url")  # noqa: SIM112
         if not queue_url:
             raise SQSGatewayInitError(
@@ -30,17 +34,17 @@ class SQSGateway:
         self.sqs = self._aws_api.get_session_client(session, "sqs")
         self.queue_url = queue_url
 
-    def __enter__(self):
+    def __enter__(self) -> Self:
         return self
 
-    def __exit__(self, *ext):
+    def __exit__(self, *ext: Any) -> None:
         self.cleanup()
 
-    def cleanup(self):
+    def cleanup(self) -> None:
         self._aws_api.cleanup()
 
     @staticmethod
-    def get_queue_account(accounts, queue_url):
+    def get_queue_account(accounts: Iterable[Mapping[str, Any]], queue_url: str) -> str:
         queue_account_uid = queue_url.split("/")[3]
         queue_account_name = [
             a["name"] for a in accounts if a["uid"] == queue_account_uid
@@ -49,14 +53,14 @@ class SQSGateway:
             raise SQSGatewayInitError(f"account uid not found: {queue_account_uid}")
         return queue_account_name[0]
 
-    def send_message(self, body):
+    def send_message(self, body: Mapping[str, Any]) -> None:
         self.sqs.send_message(QueueUrl=self.queue_url, MessageBody=json.dumps(body))
 
     def receive_messages(
         self,
-        visibility_timeout=30,
-        wait_time_seconds=20,
-    ):
+        visibility_timeout: int = 30,
+        wait_time_seconds: int = 20,
+    ) -> list[tuple[str, dict[str, Any]]]:
         messages = self.sqs.receive_message(
             QueueUrl=self.queue_url,
             VisibilityTimeout=visibility_timeout,
@@ -64,5 +68,5 @@ class SQSGateway:
         ).get("Messages", [])
         return [(m["ReceiptHandle"], json.loads(m["Body"])) for m in messages]
 
-    def delete_message(self, receipt_handle):
+    def delete_message(self, receipt_handle: str) -> None:
         self.sqs.delete_message(QueueUrl=self.queue_url, ReceiptHandle=receipt_handle)

{qontract_reconcile-0.10.2.dev307 → qontract_reconcile-0.10.2.dev314}/reconcile/utils/terraform_client.py

@@ -5,8 +5,8 @@ import shutil
 import tempfile
 from collections import defaultdict
 from collections.abc import (
-    Generator,
     Iterable,
+    Iterator,
     Mapping,
 )
 from contextlib import contextmanager
@@ -86,8 +86,8 @@ class TerraformClient:
         working_dirs: Mapping[str, str],
         thread_pool_size: int,
         aws_api: AWSApi | None = None,
-        init_users=False,
-    ):
+        init_users: bool = False,
+    ) -> None:
         self.integration = integration
         self.integration_version = integration_version
         self.integration_prefix = integration_prefix
@@ -101,7 +101,7 @@ class TerraformClient:
 
         self.specs: list[TerraformSpec] = []
         self.init_specs()
-        self.outputs: dict = {}
+        self.outputs: dict[str, Any] = {}
         self.init_outputs()
 
         self.OUTPUT_TYPE_SECRETS = "Secrets"
@@ -112,19 +112,19 @@ class TerraformClient:
         if init_users:
             self.init_existing_users()
 
-    def init_existing_users(self):
+    def init_existing_users(self) -> None:
         self.users = {
             account: list(self.format_output(output, self.OUTPUT_TYPE_PASSWORDS).keys())
             for account, output in self.outputs.items()
         }
 
-    def increment_apply_count(self):
+    def increment_apply_count(self) -> None:
         self.apply_count += 1
 
     def should_apply(self) -> bool:
         return self.apply_count > 0
 
-    def get_new_users(self):
+    def get_new_users(self) -> list[tuple[str, Any, str, Any]]:
         new_users = []
         self.init_outputs()  # get updated output
         for account, output in self.outputs.items():
@@ -141,7 +141,7 @@ class TerraformClient:
                 ))
         return new_users
 
-    def init_specs(self):
+    def init_specs(self) -> None:
         self.specs = [
             TerraformSpec(name=name, working_dir=wd)
             for name, wd in self.working_dirs.items()
@@ -152,7 +152,7 @@ class TerraformClient:
     @contextmanager
     def _terraform_log_file(
         self, working_dir: str
-    ) -> Generator[tuple[IO, dict[str, str]], None, None]:
+    ) -> Iterator[tuple[IO[bytes], dict[str, str]]]:
         with tempfile.NamedTemporaryFile(dir=working_dir) as f:
             env = {
                 "TF_LOG": TERRAFORM_LOG_LEVEL,
@@ -161,7 +161,7 @@ class TerraformClient:
             yield f, env
 
     @retry(exceptions=TerraformCommandError)
-    def terraform_init(self, spec: TerraformSpec):
+    def terraform_init(self, spec: TerraformSpec) -> None:
         with self._terraform_log_file(spec.working_dir) as (f, env):
             return_code, stdout, stderr = lean_tf.init(spec.working_dir, env=env)
             log = f.read().decode("utf-8")
@@ -171,12 +171,12 @@ class TerraformClient:
                 return_code, "init", output=stdout, stderr=stderr
             )
 
-    def init_outputs(self):
+    def init_outputs(self) -> None:
         results = threaded.run(self.terraform_output, self.specs, self.thread_pool_size)
         self.outputs = dict(results)
 
     @retry(exceptions=TerraformCommandError)
-    def terraform_output(self, spec: TerraformSpec):
+    def terraform_output(self, spec: TerraformSpec) -> tuple[str, Any]:
         with self._terraform_log_file(spec.working_dir) as (f, env):
             return_code, stdout, stderr = lean_tf.output(spec.working_dir, env=env)
             log = f.read().decode("utf-8")
@@ -194,17 +194,17 @@ class TerraformClient:
         return spec.name, json.loads(stdout)
 
     # terraform plan
-    def plan(self, enable_deletion):
+    def plan(self, enable_deletion: bool) -> tuple[bool, bool]:
         errors = False
         disabled_deletions_detected = False
-        results = threaded.run(
+        results: list[tuple[bool, list[AccountUser], bool]] = threaded.run(
             self.terraform_plan,
             self.specs,
             self.thread_pool_size,
             enable_deletion=enable_deletion,
         )
 
-        self.created_users = []
+        self.created_users: list[AccountUser] = []
         for disabled_deletion_detected, created_users, error in results:
             if error:
                 errors = True
@@ -278,7 +278,7 @@ class TerraformClient:
         self,
         spec: TerraformSpec,
         enable_deletion: bool,
-    ) -> tuple[bool, list]:
+    ) -> tuple[bool, list[AccountUser]]:
         disabled_deletion_detected = False
         name = spec.name
         account_enable_deletion = self.accounts[name].get("enableDeletion") or False
@@ -412,7 +412,9 @@ class TerraformClient:
                             )
         return disabled_deletion_detected, created_users
 
-    def deletion_approved(self, account_name, resource_type, resource_name):
+    def deletion_approved(
+        self, account_name: str, resource_type: str, resource_name: str
+    ) -> bool:
         account = self.accounts[account_name]
         deletion_approvals = account.get("deletionApprovals")
         if not deletion_approvals:
@@ -439,11 +441,11 @@ class TerraformClient:
         return False
 
     # terraform apply
-    def apply(self):
+    def apply(self) -> bool:
         errors = threaded.run(self.terraform_apply, self.specs, self.thread_pool_size)
         return any(errors)
 
-    def terraform_apply(self, spec: TerraformSpec):
+    def terraform_apply(self, spec: TerraformSpec) -> bool:
         with self._terraform_log_file(spec.working_dir) as (f, env):
             return_code, stdout, stderr = lean_tf.apply(
                 spec.working_dir,
@@ -486,9 +488,9 @@ class TerraformClient:
 
         return replicas_info
 
-    def format_output(self, output, type):
+    def format_output(self, output: Any, type: str) -> dict[str, dict[str, Any]]:
         # data is a dictionary of dictionaries
-        data = {}
+        data: dict[str, dict[str, Any]] = {}
         if output is None:
             return data
 
@@ -643,7 +645,7 @@ class TerraformClient:
         return error_occured
 
     @staticmethod
-    def split_to_lines(*outputs):
+    def split_to_lines(*outputs: str) -> Any:
         split_outputs = []
         try:
             for output in outputs:
@@ -656,7 +658,7 @@ class TerraformClient:
             return split_outputs[0]
         return split_outputs
 
-    def cleanup(self):
+    def cleanup(self) -> None:
         if self._aws_api is not None:
             self._aws_api.cleanup()
         for wd in self.working_dirs.values():
@@ -757,7 +759,7 @@ class TerraformClient:
 
     def validate_db_upgrade(
         self, account_name: str, resource_name: str, resource_change: Mapping[str, Any]
-    ):
+    ) -> None:
         """
         Determine whether the RDS engine version upgrade is valid.
 
@@ -862,7 +864,7 @@ class TerraformClient:
             ],
         }
 
-        def is_supported(engine, version):
+        def is_supported(engine: str, version: str) -> bool:
             parsed_version = pkg_version.parse(version)
             if engine == "mysql":
                 return any(