qontract-reconcile 0.10.2.dev310__py3-none-any.whl → 0.10.2.dev439__py3-none-any.whl

reconcile/oum/labelset.py

@@ -1,4 +1,5 @@
 from collections import defaultdict
+from typing import Annotated
 
 from pydantic import BaseModel
 
@@ -22,9 +23,10 @@ class _GroupMappingLabelset(BaseModel):
     the sre-capabilities.user-mgmt.$provider prefix.
     """
 
-    authz_roles: dict[str, CSV] | None = sre_capability_labels.labelset_groupfield(
-        group_prefix="authz."
-    )
+    authz_roles: Annotated[
+        dict[str, CSV] | None,
+        sre_capability_labels.labelset_groupfield(group_prefix="authz."),
+    ]
 
 
 def build_cluster_config_from_labels(

reconcile/oum/models.py

@@ -56,7 +56,7 @@ class ClusterUserManagementSpec(BaseModel):
     errors: list[ClusterError] = Field(default_factory=list)
 
 
-class ClusterRoleReconcileResult(BaseModel):
+class ClusterRoleReconcileResult(BaseModel, arbitrary_types_allowed=True):
     """
     Holds the result of a cluster role reconciliation.
     """
@@ -64,6 +64,3 @@ class ClusterRoleReconcileResult(BaseModel):
     users_added: int = 0
     users_removed: int = 0
     error: Exception | None = None
-
-    class Config:
-        arbitrary_types_allowed = True

reconcile/oum/providers.py

@@ -33,7 +33,7 @@ class LdapGroupMemberProvider(GroupMemberProvider):
         if len(group_ids) == 0:
             return {}
         with self.ldap_client as lc:
-            groups_members_by_dn = lc.get_group_members(group_dn_mapping.keys())
+            groups_members_by_dn = lc.get_group_members(set(group_dn_mapping.keys()))
         return {
             group_dn_mapping[dn]: members
             for dn, members in groups_members_by_dn.items()

reconcile/prometheus_rules_tester/integration.py

@@ -42,7 +42,7 @@ QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
 PROVIDERS = ["prometheus-rule"]
 
 NAMESPACE_NAME = "openshift-customer-monitoring"
-DEFAULT_PROMTOOL_VERSION = "2.55.1"
+DEFAULT_PROMTOOL_VERSION = "3.2.1"
 
 
 class TestContent(BaseModel):
@@ -56,7 +56,7 @@ class Test(BaseModel):
     rule_path: str
     rule: dict
     rule_length: int
-    tests: list[TestContent] | None
+    tests: list[TestContent] | None = None
     result: CommandExecutionResult | None = None
     promtool_version: str
 
@@ -76,7 +76,7 @@ def fetch_rule_and_tests(
     openshift_resource = orb.fetch_openshift_resource(
         resource=rule.resource,
         parent=rule.namespace,
-        settings=vault_settings.dict(by_alias=True),
+        settings=vault_settings.model_dump(by_alias=True),
     )
 
     rule_body = openshift_resource.body
@@ -96,7 +96,7 @@ def fetch_rule_and_tests(
             test_raw_yaml = process_extracurlyjinja2_template(
                 body=test_raw_yaml,
                 vars=variables,
-                settings=vault_settings.dict(by_alias=True),
+                settings=vault_settings.model_dump(by_alias=True),
             )
 
         test_yaml_spec = yaml.safe_load(test_raw_yaml)

reconcile/quay_mirror.py

@@ -66,7 +66,7 @@ class QuayMirror:
     }
     """
 
-    response_cache: dict[tuple[str, str], Response] = {}
+    response_cache: dict[tuple[str, str | None], Response] = {}
 
     def __init__(
         self,

reconcile/queries.py

@@ -477,6 +477,12 @@ AWS_ACCOUNTS_QUERY = """
       integrations
     }
     deleteKeys
+    organization {
+      payerAccount {
+        organizationAccountTags
+      }
+      tags
+    }
     {% if reset_passwords %}
     resetPasswords {
       user {
@@ -499,6 +505,12 @@ AWS_ACCOUNTS_QUERY = """
         name
         uid
         supportedDeploymentRegions
+        organization {
+          payerAccount {
+            organizationAccountTags
+          }
+          tags
+        }
       }
       ... on AWSAccountSharingOptionAMI_v1 {
         regex
@@ -606,6 +618,12 @@ awsInfrastructureManagementAccounts {
       version
       format
     }
+    organization {
+      payerAccount {
+        organizationAccountTags
+      }
+      tags
+    }
   }
   accessLevel
   default
@@ -636,6 +654,12 @@ awsInfrastructureAccess {
         version
         format
       }
+      organization {
+        payerAccount {
+          organizationAccountTags
+        }
+        tags
+      }
     }
     roles {
       users {
@@ -745,6 +769,12 @@ CLUSTERS_QUERY = """
             version
             format
           }
+          organization {
+            payerAccount {
+                organizationAccountTags
+            }
+            tags
+          }
           rosa {
             ocm_environments {
               ocm {
@@ -773,6 +803,7 @@ CLUSTERS_QUERY = """
       private
       provision_shard_id
       disable_user_workload_monitoring
+      fips
     }
     externalConfiguration {
       labels
@@ -829,6 +860,12 @@ CLUSTERS_QUERY = """
                 version
                 format
               }
+              organization {
+                payerAccount {
+                  organizationAccountTags
+                }
+                tags
+              }
             }
             vpc_id
             cidr_block
@@ -847,6 +884,12 @@ CLUSTERS_QUERY = """
               version
               format
             }
+            organization {
+              payerAccount {
+                organizationAccountTags
+              }
+              tags
+            }
           }
           tags
         }
@@ -861,6 +904,12 @@ CLUSTERS_QUERY = """
               version
               format
             }
+            organization {
+              payerAccount {
+                organizationAccountTags
+              }
+              tags
+            }
           }
           tags
           cidrBlock
@@ -889,6 +938,12 @@ CLUSTERS_QUERY = """
                     version
                     format
                   }
+                  organization {
+                    payerAccount {
+                      organizationAccountTags
+                    }
+                    tags
+                  }
                 }
               }
               accessLevel
@@ -914,6 +969,12 @@ CLUSTERS_QUERY = """
                       version
                       format
                     }
+                    organization {
+                      payerAccount {
+                        organizationAccountTags
+                      }
+                      tags
+                    }
                   }
                 }
               }
@@ -1067,6 +1128,12 @@ CLUSTER_PEERING_QUERY = """
           version
           format
         }
+        organization {
+          payerAccount {
+            organizationAccountTags
+          }
+          tags
+        }
       }
       accessLevel
       default
@@ -1088,6 +1155,12 @@ CLUSTER_PEERING_QUERY = """
             version
             format
           }
+          organization {
+            payerAccount {
+              organizationAccountTags
+            }
+            tags
+          }
         }
       }
     }
@@ -1112,6 +1185,12 @@ CLUSTER_PEERING_QUERY = """
                 version
                 format
               }
+              organization {
+                payerAccount {
+                  organizationAccountTags
+                }
+                tags
+              }
             }
             vpc_id
             cidr_block
@@ -1131,6 +1210,12 @@ CLUSTER_PEERING_QUERY = """
               version
               format
             }
+            organization {
+              payerAccount {
+                organizationAccountTags
+              }
+              tags
+            }
           }
           tags
           assumeRole
@@ -1146,6 +1231,12 @@ CLUSTER_PEERING_QUERY = """
               version
               format
             }
+            organization {
+              payerAccount {
+                organizationAccountTags
+              }
+              tags
+            }
           }
           tags
           cidrBlock
@@ -1175,6 +1266,12 @@ CLUSTER_PEERING_QUERY = """
                     version
                     format
                   }
+                  organization {
+                    payerAccount {
+                      organizationAccountTags
+                    }
+                    tags
+                  }
                 }
               }
             }
@@ -1190,6 +1287,12 @@ CLUSTER_PEERING_QUERY = """
                   version
                   format
                 }
+                organization {
+                  payerAccount {
+                    organizationAccountTags
+                  }
+                  tags
+                }
               }
               accessLevel
               default
@@ -1216,6 +1319,12 @@ CLUSTER_PEERING_QUERY = """
                             version
                             format
                           }
+                          organization {
+                            payerAccount {
+                              organizationAccountTags
+                            }
+                            tags
+                          }
                         }
                       }
                     }
@@ -1231,6 +1340,12 @@ CLUSTER_PEERING_QUERY = """
                       version
                       format
                     }
+                    organization {
+                      payerAccount {
+                        organizationAccountTags
+                      }
+                      tags
+                    }
                   }
                 }
               }
@@ -2230,6 +2345,12 @@ JIRA_BOARDS_QUICK_QUERY = """
         version
         format
       }
+      email {
+        path
+        field
+        version
+        format
+      }
     }
   }
 }
@@ -2336,6 +2457,12 @@ DNS_ZONES_QUERY = """
         version
         format
       }
+      organization {
+        payerAccount {
+          organizationAccountTags
+        }
+        tags
+      }
     }
     vpc {
       vpc_id
@@ -2697,6 +2824,10 @@ APP_METADATA = """
               path
               field
             }
+            email {
+              path
+              field
+            }
           }
         }
         slackUserGroup {

reconcile/requests_sender.py

@@ -1,6 +1,8 @@
 import logging
 import sys
+from collections.abc import Callable, Mapping
 from subprocess import CalledProcessError
+from typing import Any
 
 from reconcile import (
     queries,
@@ -44,7 +46,9 @@ Encrypted credentials:
 """
 
 
-def get_encrypted_credentials(credentials_name, user, settings):
+def get_encrypted_credentials(
+    credentials_name: str, user: Mapping[str, Any], settings: Mapping[str, Any]
+) -> str | None:
     credentials_map = settings["credentials"]
     credentials_map_item = [c for c in credentials_map if c["name"] == credentials_name]
     if len(credentials_map_item) != 1:
@@ -59,7 +63,7 @@ def get_encrypted_credentials(credentials_name, user, settings):
 
 
 @defer
-def run(dry_run, defer=None):
+def run(dry_run: bool, defer: Callable | None = None) -> None:
     settings = queries.get_app_interface_settings()
     vault_settings = get_app_interface_vault_settings()
     secret_reader = create_secret_reader(use_vault=vault_settings.vault)
@@ -76,7 +80,8 @@ def run(dry_run, defer=None):
         integration=QONTRACT_INTEGRATION,
         secret_reader=secret_reader,
     )
-    defer(state.cleanup)
+    if defer:
+        defer(state.cleanup)
     credentials_requests = queries.get_credentials_requests()
 
     # validate no 2 requests have the same name

reconcile/resource_scraper.py

@@ -1,8 +1,5 @@
 import logging
 import sys
-from typing import (
-    cast,
-)
 
 from reconcile.status import ExitCodes
 from reconcile.typed_queries.app_interface_vault_settings import (
@@ -14,7 +11,6 @@ from reconcile.utils.oc_map import init_oc_map_from_clusters
 from reconcile.utils.secret_reader import create_secret_reader
 from reconcile.utils.vault import (
     VaultClient,
-    _VaultClient,
 )
 
 QONTRACT_INTEGRATION = "resource-scraper"
@@ -63,7 +59,7 @@ def run(
             results.append(item)
 
     if not dry_run:
-        vault_client = cast("_VaultClient", VaultClient())
+        vault_client = VaultClient.get_instance()
         for item in results:
             secret = {
                 "path": f"{vault_output_path}/{QONTRACT_INTEGRATION}/{item['cluster']}/{namespace_name}/{item['name']}",

reconcile/rhidp/common.py

@@ -7,10 +7,7 @@ from enum import StrEnum
 from typing import Any
 from urllib.parse import urlparse
 
-from pydantic import (
-    BaseModel,
-    root_validator,
-)
+from pydantic import BaseModel, model_validator
 
 from reconcile.gql_definitions.common.ocm_environments import (
     query as ocm_environment_query,
@@ -63,7 +60,8 @@ class ClusterAuth(BaseModel):
     issuer: str
     status: str
 
-    @root_validator
+    @model_validator(mode="before")
+    @classmethod
     def name_no_spaces(
         cls, values: MutableMapping[str, Any]
     ) -> MutableMapping[str, Any]:

reconcile/rhidp/sso_client/base.py

@@ -1,3 +1,4 @@
+import http
 import logging
 from collections.abc import (
     Iterable,
@@ -10,6 +11,7 @@ from urllib.parse import (
 )
 
 import jwt
+from requests import HTTPError
 
 from reconcile.rhidp.common import (
     Cluster,
@@ -138,7 +140,7 @@ def fetch_current_state(
     secret_reader: VaultSecretReader, vault_input_path: str
 ) -> list[str]:
     """Fetch all existing SSO client IDs from vault."""
-    return secret_reader.vault_client.list(vault_input_path)  # type: ignore[attr-defined] # mypy doesn't recognize the VaultClient.__new__ method
+    return secret_reader.vault_client.list(vault_input_path)
 
 
 def fetch_desired_state(
@@ -234,10 +236,10 @@ def create_sso_client(
         vault_secret_id=sso_client_id,
     )
 
-    secret_reader.vault_client.write(  # type: ignore[attr-defined] # mypy doesn't recognize the VaultClient.__new__ method
+    secret_reader.vault_client.write(
         secret={
             "path": secret.path,
-            "data": sso_client.dict(),
+            "data": sso_client.model_dump(),
         },
         decode_base64=False,
     )
@@ -256,11 +258,18 @@ def delete_sso_client(
     )
     sso_client = SSOClient(**secret_reader.read_all_secret(secret=secret))
     keycloak_api = keycloak_map.get(sso_client.issuer)
-    keycloak_api.delete_client(
-        registration_client_uri=sso_client.registration_client_uri,
-        registration_access_token=sso_client.registration_access_token,
-    )
+    try:
+        keycloak_api.delete_client(
+            registration_client_uri=sso_client.registration_client_uri,
+            registration_access_token=sso_client.registration_access_token,
+        )
+    except HTTPError as e:
+        if e.response.status_code != http.HTTPStatus.UNAUTHORIZED:
+            logging.error(f"Failed to delete SSO client {sso_client_id}: {e}")
+            raise
+        # something went wrong with the registration token, maybe it expired
+        logging.error(
+            f"Failed to delete SSO client {sso_client_id} due to unauthorized error: {e}. Continuing to delete the vault secret."
+        )
 
-    secret_reader.vault_client.delete(  # type: ignore[attr-defined] # mypy doesn't recognize the VaultClient.__new__ method
-        path=secret.path
-    )
+    secret_reader.vault_client.delete(path=secret.path)

reconcile/saas_auto_promotions_manager/merge_request_manager/renderer.py

@@ -177,7 +177,7 @@ def is_namespace_addressed_by_selector(
     # json representation of namespace to filter on
     # remove all the None values to simplify the jsonpath expressions
     namespace_as_dict = {
-        "namespace": [namespace.dict(by_alias=True, exclude_none=True)]
+        "namespace": [namespace.model_dump(by_alias=True, exclude_none=True)]
     }
 
     do_include = any(

reconcile/saas_auto_promotions_manager/subscriber.py

@@ -2,7 +2,7 @@ import hashlib
 import logging
 from collections.abc import Iterable
 from dataclasses import dataclass
-from datetime import UTC, datetime, timedelta
+from datetime import timedelta
 
 from croniter import croniter
 
@@ -13,6 +13,7 @@ from reconcile.saas_auto_promotions_manager.publisher import (
     DeploymentInfo,
     Publisher,
 )
+from reconcile.utils.datetime_util import utc_now
 from reconcile.utils.slo_document_manager import SLODocumentManager
 
 CONTENT_HASH_LENGTH = 32
@@ -113,7 +114,7 @@ class Subscriber:
         We accumulate the time a ref is running on all publishers for this subscriber.
         We compare that accumulated time with the soak_days setting of the subscriber.
         """
-        now = datetime.now(UTC)
+        now = utc_now()
         delta = timedelta(days=0)
         for channel in self.channels:
             for publisher in channel.publishers:
@@ -136,7 +137,7 @@ class Subscriber:
                 self.schedule,
             )
             return False
-        return croniter.match(self.schedule, datetime.now(UTC), day_or=False)
+        return croniter.match(self.schedule, utc_now(), day_or=False)
 
     def _compute_desired_ref(self) -> None:
         """

reconcile/sendgrid_teammates.py

@@ -1,5 +1,7 @@
 import logging
 import sys
+from collections.abc import Iterable, Mapping
+from typing import Any
 
 import sendgrid
 from sretoolbox.utils import retry
@@ -17,18 +19,22 @@ class SendGridAPIError(Exception):
 
 
 class Teammate:
-    def __init__(self, email, pending_token=None, username=None):
+    def __init__(
+        self, email: str, pending_token: str | None = None, username: str | None = None
+    ) -> None:
         self.email = email
-        self.username = username or email.split("@")[0]
+        self.username = username or email.split("@", maxsplit=1)[0]
         self.pending_token = pending_token
 
     @property
-    def pending(self):
+    def pending(self) -> bool:
         return bool(self.pending_token)
 
 
-def fetch_desired_state(users):
-    desired_state = {}
+def fetch_desired_state(
+    users: Iterable[Mapping[str, Any]],
+) -> dict[str, list[Teammate]]:
+    desired_state: dict[str, list[Teammate]] = {}
     for user in users:
         roles = user.get("roles") or []
         for role in roles:
@@ -42,7 +48,7 @@ def fetch_desired_state(users):
 
 
 @retry()
-def fetch_current_state(sg_client):
+def fetch_current_state(sg_client: sendgrid.SendGridAPIClient) -> list[Teammate]:
     state = []
     limit = 100
 
@@ -79,7 +85,7 @@ def fetch_current_state(sg_client):
     return state
 
 
-def raise_if_error(response):
+def raise_if_error(response: Any) -> None:
     """
     Raises an SendGridAPIError if the request has returned an error
     """
@@ -87,7 +93,12 @@ def raise_if_error(response):
         raise SendGridAPIError(response.body.decode("utf-8"))
 
 
-def act(dry_run, sg_client, desired_state, current_state):
+def act(
+    dry_run: bool,
+    sg_client: sendgrid.SendGridAPIClient,
+    desired_state: Iterable[Teammate],
+    current_state: Iterable[Teammate],
+) -> bool:
     """
     Reconciles current state with desired state.
 
@@ -145,7 +156,7 @@ def act(dry_run, sg_client, desired_state, current_state):
     return error
 
 
-def run(dry_run):
+def run(dry_run: bool) -> None:
     settings = queries.get_app_interface_settings()
     secret_reader = SecretReader(settings=settings)
 

reconcile/skupper_network/integration.py

@@ -85,7 +85,7 @@ def compile_skupper_sites(
                 or skupper_network.site_controller_templates
             ):
                 tmpl_vars = tmpl.variables or {}
-                tmpl_vars["resource"] = {"namespace": ns.dict(by_alias=True)}
+                tmpl_vars["resource"] = {"namespace": ns.model_dump(by_alias=True)}
 
                 site_controller_objects.append(
                     load_site_controller_template(tmpl.path, tmpl_vars)
@@ -304,6 +304,6 @@ def early_exit_desired_state(*args: Any, **kwargs: Any) -> dict[str, Any]:
     skupper_networks = get_skupper_networks(gqlapi.query)
     return {
         "skupper_sites": [
-            site.dict() for site in compile_skupper_sites(skupper_networks)
+            site.model_dump() for site in compile_skupper_sites(skupper_networks)
         ],
     }