qontract-reconcile 0.10.2.dev310__py3-none-any.whl → 0.10.2.dev439__py3-none-any.whl

reconcile/utils/repo_owners.py

@@ -1,9 +1,13 @@
 import logging
 import os
 import pathlib
+from collections.abc import Iterable, Mapping
 
 from ruamel import yaml
 
+from reconcile.utils.github_api import GithubRepositoryApi
+from reconcile.utils.gitlab_api import GitLabApi
+
 _LOG = logging.getLogger(__name__)
 
 
@@ -12,38 +16,24 @@ class RepoOwners:
     Abstracts the owners of a repository with per-path granularity.
     """
 
-    def __init__(self, git_cli, ref="master", recursive=True):
+    def __init__(
+        self,
+        git_cli: GitLabApi | GithubRepositoryApi,
+        ref: str = "master",
+        recursive: bool = True,
+    ) -> None:
         self._git_cli = git_cli
         self._ref = ref
-        self._owners_map = None
+        self._owners_map: dict[str, dict[str, set[str]]] | None = None
         self._recursive = recursive
 
     @property
-    def owners_map(self):
+    def owners_map(self) -> dict[str, dict[str, set[str]]]:
         if self._owners_map is None:
             self._owners_map = self._get_owners_map()
         return self._owners_map
 
-    def get_owners(self):
-        """
-        Gets all the owners of the repository.
-
-        :return: the repository owners
-        :rtype: dict
-        """
-        repo_owners = {"approvers": set(), "reviewers": set()}
-
-        if "." in self.owners_map:
-            repo_owners["approvers"].update(self.owners_map["."]["approvers"])
-            repo_owners["reviewers"].update(self.owners_map["."]["reviewers"])
-
-        for owners in self.owners_map.values():
-            repo_owners["approvers"].update(owners["approvers"])
-            repo_owners["reviewers"].update(owners["reviewers"])
-
-        return repo_owners
-
-    def get_root_owners(self):
+    def get_root_owners(self) -> dict[str, list[str]]:
         """
         Gets all the owners defined in the repository root.
 
@@ -56,7 +46,7 @@ class RepoOwners:
 
         return {"approvers": [], "reviewers": []}
 
-    def get_path_owners(self, path):
+    def get_path_owners(self, path: str) -> dict[str, list[str]]:
         """
         Gets all the owners of a given path, no matter in which
         level of the filesystem tree the owner was specified.
@@ -67,7 +57,7 @@ class RepoOwners:
         :return: the path owners
         :rtype: dict
         """
-        path_owners = {"approvers": set(), "reviewers": set()}
+        path_owners: dict[str, set[str]] = {"approvers": set(), "reviewers": set()}
 
         if "." in self.owners_map:
             path_owners["approvers"].update(self.owners_map["."]["approvers"])
@@ -80,7 +70,7 @@ class RepoOwners:
 
         return self._set_to_sorted_list(path_owners)
 
-    def get_path_closest_owners(self, path):
+    def get_path_closest_owners(self, path: str) -> dict[str, list[str]]:
         """
         Gets all closest owners of a given path, no matter in which
         level of the filesystem tree the owner was specified.
@@ -108,7 +98,7 @@ class RepoOwners:
 
         return {"approvers": [], "reviewers": []}
 
-    def _get_owners_map(self):
+    def _get_owners_map(self) -> dict[str, dict[str, set[str]]]:
         """
         Maps all the OWNERS files content to their respective
         owned directory.
@@ -173,7 +163,7 @@ class RepoOwners:
             }
         return owners_map
 
-    def _get_aliases(self):
+    def _get_aliases(self) -> dict[str, list[str]] | None:
         """
         Retrieves the approvers aliases from the OWNERS_ALIASES file.
 
@@ -191,7 +181,9 @@ class RepoOwners:
         return aliases["aliases"]
 
     @staticmethod
-    def _set_to_sorted_list(owners):
+    def _set_to_sorted_list(
+        owners: Mapping[str, Iterable[str]],
+    ) -> dict[str, list[str]]:
         approvers = owners["approvers"]
         sorted_approvers = sorted(approvers) if approvers else []
 

reconcile/utils/rhcsv2_certs.py

@@ -1,25 +1,146 @@
+import base64
 import re
-from datetime import UTC, datetime
+from datetime import UTC
+from enum import StrEnum
 
 import requests
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.serialization import pkcs12
 from cryptography.x509.oid import NameOID
 from pydantic import BaseModel, Field
 
 
-class RhcsV2Cert(BaseModel):
+class CertificateFormat(StrEnum):
+    PEM = "PEM"
+    PKCS12 = "PKCS12"
+
+
+class RhcsV2CertPem(BaseModel, validate_by_name=True, validate_by_alias=True):
     certificate: str = Field(alias="tls.crt")
     private_key: str = Field(alias="tls.key")
     ca_cert: str = Field(alias="ca.crt")
     expiration_timestamp: int
 
-    class Config:
-        allow_population_by_field_name = True
+
+class RhcsV2CertPkcs12(BaseModel, validate_by_name=True, validate_by_alias=True):
+    pkcs12_keystore: str = Field(alias="keystore.pkcs12.b64")
+    pkcs12_truststore: str = Field(alias="truststore.pkcs12.b64")
+    expiration_timestamp: int
+
+
+def extract_cert(text: str) -> re.Match:
+    # The CA webform returns an HTML page with inline JS that builds an array of “outputList”
+    # objects. Each object looks roughly like:
+    #   outputList = new Object;
+    #   outputList.outputId = "pretty_cert";
+    #   outputList.outputSyntax = "pretty_print";
+    #   outputList.outputVal = "    Certificate:\n ... Not  After: ...";
+    #   outputListSet[0] = outputList;
+    #
+    #   outputList = new Object;
+    #   outputList.outputId = "b64_cert";
+    #   outputList.outputSyntax = "pretty_print";
+    #   outputList.outputVal = "-----BEGIN CERTIFICATE-----\n...base64...\n-----END CERTIFICATE-----\n";
+    #   outputListSet[1] = outputList;
+    #
+    # We must extract the PEM from the *b64_cert* block (the pretty_cert block contains prose
+    # and formatting and is not reliable for parsing).
+    #
+    # The regex below:
+    # - Anchors on `outputId = "b64_cert"` so we only consider the base64 block.
+    # - Tolerates arbitrary whitespace around `=` and `.` (services sometimes reformat JS).
+    # - Jumps non-greedily over whatever properties sit between outputId and outputVal.
+    # - Captures only the PEM body (BEGIN…END), excluding any trailing newline/escape junk.
+    # - Accepts multiple terminators after the closing quote: literal "\\r\\n", literal "\\n",
+    #   or a real newline (`\r?\n`), followed by optional whitespace and the semicolon.
+    # - Uses DOTALL so `.` spans line breaks inside the JS/HTML blob.
+
+    cert_pem = re.search(
+        r'outputList\s*\.\s*outputId\s*=\s*"b64_cert".*?'
+        r'outputList\s*\.\s*outputVal\s*=\s*"'
+        r"(-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----)"
+        r"(?:\\r\\n|\\n|\r?\n)?\s*",
+        text,
+        re.DOTALL,
+    )
+    if not cert_pem:
+        raise ValueError("Could not extract certificate PEM from response")
+    return cert_pem
+
+
+def get_cert_expiry_timestamp(js_escaped_pem: str) -> int:
+    """Extract certificate expiry timestamp from JavaScript-escaped PEM."""
+
+    # Convert JavaScript-escaped PEM to proper format: .encode() is needed because
+    # unicode_escape decoder only works on bytes, then decode JS escape sequences
+    pem_raw = js_escaped_pem.encode().decode("unicode_escape").replace("\\/", "/")
+    cert = x509.load_pem_x509_certificate(pem_raw.encode())
+    dt_expiry = cert.not_valid_after.replace(tzinfo=UTC)
+    return int(dt_expiry.timestamp())
+
+
+def _format_pem(
+    private_key: rsa.RSAPrivateKey,
+    cert_pem: str,
+    ca_pem: str,
+    cert_expiry_timestamp: int,
+) -> RhcsV2CertPem:
+    """Generate RhcsV2Cert with PEM components."""
+    private_key_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode()
+    return RhcsV2CertPem(
+        private_key=private_key_pem,
+        certificate=cert_pem.encode().decode("unicode_escape").replace("\\/", "/"),
+        ca_cert=ca_pem,
+        expiration_timestamp=cert_expiry_timestamp,
+    )
+
+
+def _format_pkcs12(
+    private_key: rsa.RSAPrivateKey,
+    cert_pem: str,
+    ca_pem: str,
+    uid: str,
+    pwd: str,
+    cert_expiry_timestamp: int,
+) -> RhcsV2CertPkcs12:
+    """Generate PKCS#12 keystore and truststore components, returns base64-encoded strings."""
+    clean_cert_pem = cert_pem.encode().decode("unicode_escape").replace("\\/", "/")
+    cert_obj = x509.load_pem_x509_certificate(clean_cert_pem.encode())
+    ca_obj = x509.load_pem_x509_certificate(ca_pem.encode())
+    keystore_p12 = pkcs12.serialize_key_and_certificates(
+        name=uid.encode("utf-8"),
+        key=private_key,
+        cert=cert_obj,
+        cas=[ca_obj],
+        encryption_algorithm=serialization.BestAvailableEncryption(pwd.encode("utf-8")),
+    )
+    truststore_p12 = pkcs12.serialize_key_and_certificates(
+        name=b"ca-trust",
+        key=None,
+        cert=None,
+        cas=[ca_obj],
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    return RhcsV2CertPkcs12(
+        pkcs12_keystore=base64.b64encode(keystore_p12).decode("utf-8"),
+        pkcs12_truststore=base64.b64encode(truststore_p12).decode("utf-8"),
+        expiration_timestamp=cert_expiry_timestamp,
+    )
 
 
-def generate_cert(issuer_url: str, uid: str, pwd: str, ca_url: str) -> RhcsV2Cert:
+def generate_cert(
+    issuer_url: str,
+    uid: str,
+    pwd: str,
+    ca_url: str,
+    cert_format: CertificateFormat = CertificateFormat.PEM,
+) -> RhcsV2CertPem | RhcsV2CertPkcs12:
     private_key = rsa.generate_private_key(65537, 4096)
     csr = (
         x509.CertificateSigningRequestBuilder()
@@ -30,6 +151,7 @@ def generate_cert(issuer_url: str, uid: str, pwd: str, ca_url: str) -> RhcsV2Cer
         )
         .sign(private_key, hashes.SHA256())
     )
+
     data = {
         "uid": uid,
         "pwd": pwd,
@@ -39,38 +161,19 @@ def generate_cert(issuer_url: str, uid: str, pwd: str, ca_url: str) -> RhcsV2Cer
         "renewal": "false",
         "xmlOutput": "false",
     }
-    response = requests.post(issuer_url, data=data)
+    response = requests.post(issuer_url, data=data, timeout=30)
     response.raise_for_status()
+    cert_pem = extract_cert(response.text).group(1)
+    cert_expiry_timestamp = get_cert_expiry_timestamp(cert_pem)
 
-    cert_pem = re.search(
-        r'outputList\.outputVal="(-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----(?:\\n|\r?\n)?)";',
-        response.text,
-        re.DOTALL,
-    )
-    if not cert_pem:
-        raise ValueError("Could not extract certificate PEM from response")
-    cert_expiry = re.search(r"Not\s+After:\s+(.*?UTC)(?:\\n|\r?\n)?", response.text)
-    if not cert_expiry:
-        raise ValueError("Could not extract expiration date from response")
-    # Weekday, Month Day, Year HH:MM:SS PM/AM Timezone
-    dt_expiry = datetime.strptime(cert_expiry.group(1), "%A, %B %d, %Y %I:%M:%S %p %Z")
-    dt_expiry = dt_expiry.replace(tzinfo=UTC)
-    private_key_pem = private_key.private_bytes(
-        encoding=serialization.Encoding.PEM,
-        format=serialization.PrivateFormat.TraditionalOpenSSL,
-        encryption_algorithm=serialization.NoEncryption(),
-    ).decode()
-
-    response = requests.get(ca_url)
+    response = requests.get(ca_url, timeout=30)
     response.raise_for_status()
     ca_pem = response.text
 
-    return RhcsV2Cert(
-        private_key=private_key_pem,
-        certificate=cert_pem.group(1)
-        .encode()
-        .decode("unicode_escape")
-        .replace("\\/", "/"),
-        ca_cert=ca_pem,
-        expiration_timestamp=int(dt_expiry.timestamp()),
-    )
+    match cert_format:
+        case CertificateFormat.PKCS12:
+            return _format_pkcs12(
+                private_key, cert_pem, ca_pem, uid, pwd, cert_expiry_timestamp
+            )
+        case CertificateFormat.PEM:
+            return _format_pem(private_key, cert_pem, ca_pem, cert_expiry_timestamp)

reconcile/utils/rosa/session.py

@@ -178,6 +178,22 @@ class RosaSession:
             )
             result.write_logs_to_logger(logging.info)
 
+    def upgrade_rosa_roles(
+        self,
+        cluster_name: str,
+        upgrade_version: str,
+        policy_version: str,
+        dry_run: bool,
+    ) -> None:
+        logging.info(
+            f"Upgrade  roles in AWS account {self.aws_account_id} to {upgrade_version}"
+        )
+        if not dry_run:
+            result = self.cli_execute(
+                f"rosa upgrade roles  -c {cluster_name} --cluster-version {upgrade_version}  --policy-version {policy_version} -y -m=auto"
+            )
+            result.write_logs_to_logger(logging.info)
+
 
 def generate_rosa_creation_script(
     cluster_name: str, cluster: OCMSpec, dry_run: bool

reconcile/utils/runtime/integration.py

@@ -7,7 +7,6 @@ from dataclasses import dataclass
 from types import ModuleType
 from typing import (
     Any,
-    Generic,
     Optional,
     TypeVar,
 )
@@ -120,7 +119,7 @@ class PydanticRunParams(RunParams, BaseModel):
     def copy_and_update(
         self: PydanticRunParamsSelfTypeVar, update: dict[str, Any]
     ) -> PydanticRunParamsSelfTypeVar:
-        return self.copy(update=update)
+        return self.model_copy(update=update)
 
     def get(self, field: str) -> Any:
         return getattr(self, field)
@@ -144,7 +143,7 @@ IntegrationClassTypeVar = TypeVar(
 )
 
 
-class QontractReconcileIntegration(ABC, Generic[RunParamsTypeVar]):
+class QontractReconcileIntegration[RunParamsTypeVar: RunParams](ABC):
     """
     The base class for all integrations. It defines the basic interface to interact
     with an integration and offers hook methods that allow the integration to opt

reconcile/utils/runtime/meta.py

@@ -1,5 +1,6 @@
 import dataclasses
 from dataclasses import dataclass
+from typing import Any
 
 
 @dataclass
@@ -8,5 +9,5 @@ class IntegrationMeta:
     args: list[str]
     short_help: str | None
 
-    def to_dict(self):
+    def to_dict(self) -> dict[str, Any]:
         return dataclasses.asdict(self)

reconcile/utils/runtime/runner.py

@@ -156,7 +156,7 @@ def run_integration_cfg(run_cfg: IntegrationRunConfiguration) -> None:
         _integration_wet_run(run_cfg.integration)
 
 
-def _integration_wet_run(
+def _integration_wet_run[RunParamsTypeVar: RunParams](
     integration: QontractReconcileIntegration[RunParamsTypeVar],
 ) -> None:
     """
@@ -165,7 +165,7 @@ def _integration_wet_run(
     integration.run(False)
 
 
-def _integration_dry_run(
+def _integration_dry_run[RunParamsTypeVar: RunParams](
     integration: QontractReconcileIntegration[RunParamsTypeVar],
     desired_state_diff: DesiredStateDiff | None,
 ) -> None:

reconcile/utils/saasherder/interfaces.py

@@ -1,7 +1,7 @@
 # ruff: noqa: N801
 from __future__ import annotations
 
-from collections.abc import Mapping, Sequence, Set
+from collections.abc import Sequence
 from typing import (
     TYPE_CHECKING,
     Any,
@@ -12,6 +12,8 @@ from typing import (
 from reconcile.utils import oc_connection_parameters
 
 if TYPE_CHECKING:
+    from pydantic.main import IncEx
+
     from reconcile.gql_definitions.fragments.saas_slo_document import SLODocument
     from reconcile.utils.secret_reader import HasSecret
 
@@ -27,18 +29,12 @@ class SaasFileSecretParameters(Protocol):
     @property
     def secret(self) -> HasSecret: ...
 
-    def dict(
-        self,
-        *,
-        by_alias: bool = False,
-        include: AbstractSetIntStr | MappingIntStrAny | None = None,
+    def model_dump(
+        self, *, by_alias: bool = False, include: IncEx | None = None
     ) -> dict[str, Any]: ...
 
 
 SaasSecretParameters = Sequence[SaasFileSecretParameters] | None
-# Taken from pydantic.typing
-AbstractSetIntStr = Set[int | str]
-MappingIntStrAny = Mapping[int | str, Any]
 
 
 @runtime_checkable
@@ -212,11 +208,8 @@ class SaasResourceTemplateTargetNamespace(Protocol):
     @property
     def cluster(self) -> oc_connection_parameters.Cluster: ...
 
-    def dict(
-        self,
-        *,
-        by_alias: bool = False,
-        include: AbstractSetIntStr | MappingIntStrAny | None = None,
+    def model_dump(
+        self, *, by_alias: bool = False, include: IncEx | None = None
     ) -> dict[str, Any]: ...
 
 
@@ -249,7 +242,7 @@ class SaasResourceTemplateTargetPromotion(Protocol):
     @property
     def promotion_data(self) -> Sequence[SaasPromotionData] | None: ...
 
-    def dict(self, *, by_alias: bool = False) -> dict[str, Any]: ...
+    def model_dump(self, *, by_alias: bool = False) -> dict[str, Any]: ...
 
 
 class Channel(Protocol):
@@ -274,7 +267,7 @@ class SaasPromotion(Protocol):
     @property
     def subscribe(self) -> list[Channel] | None: ...
 
-    def dict(self, *, by_alias: bool = False) -> dict[str, Any]: ...
+    def model_dump(self, *, by_alias: bool = False) -> dict[str, Any]: ...
 
 
 class SaasResourceTemplateTarget_SaasSecretParameters(Protocol):
@@ -295,7 +288,7 @@ class SaasResourceTemplateTargetUpstream(Protocol):
     @property
     def instance(self) -> SaasJenkinsInstance: ...
 
-    def dict(self, *, by_alias: bool = False) -> dict[str, Any]: ...
+    def model_dump(self, *, by_alias: bool = False) -> dict[str, Any]: ...
 
 
 class SaasQuayInstance(Protocol):
@@ -315,7 +308,7 @@ class SaasResourceTemplateTargetImage(Protocol):
     @property
     def org(self) -> SaasQuayOrg: ...
 
-    def dict(self, *, by_alias: bool = False) -> dict[str, Any]: ...
+    def model_dump(self, *, by_alias: bool = False) -> dict[str, Any]: ...
 
 
 class SaasResourceTemplateTarget(HasParameters, HasSecretParameters, Protocol):
@@ -344,7 +337,7 @@ class SaasResourceTemplateTarget(HasParameters, HasSecretParameters, Protocol):
         self, parent_saas_file_name: str, parent_resource_template_name: str
     ) -> str: ...
 
-    def dict(self, *, by_alias: bool = False) -> dict[str, Any]: ...
+    def model_dump(self, *, by_alias: bool = False) -> dict[str, Any]: ...
 
 
 class SaasResourceTemplate(HasParameters, HasSecretParameters, Protocol):
@@ -381,7 +374,7 @@ class ManagedResourceName(Protocol):
     resource: str
     resource_names: list[str]
 
-    def dict(self) -> dict[str, str]: ...
+    def model_dump(self) -> dict[str, str]: ...
 
 
 class SaasFile(HasParameters, HasSecretParameters, Protocol):

reconcile/utils/saasherder/models.py

@@ -7,15 +7,13 @@ from enum import Enum
 from typing import Any, NotRequired, TypedDict
 
 from github import Github
-from pydantic import (
-    BaseModel,
-    Field,
-)
+from pydantic import BaseModel, Field, model_validator
 
 from reconcile.gql_definitions.fragments.saas_slo_document import (
     SLODocument,
 )
 from reconcile.utils.jenkins_api import JobBuildState
+from reconcile.utils.json import json_dumps
 from reconcile.utils.oc_connection_parameters import Cluster
 from reconcile.utils.saasherder.interfaces import (
     HasParameters,
@@ -206,7 +204,12 @@ TriggerSpecUnion = (
 )
 
 
-class Namespace(BaseModel):
+class Namespace(
+    BaseModel,
+    validate_by_name=True,
+    validate_by_alias=True,
+    arbitrary_types_allowed=True,
+):
     name: str
     environment: SaasEnvironment
     app: SaasApp
@@ -216,29 +219,19 @@ class Namespace(BaseModel):
         ..., alias="managedResourceNames"
     )
 
-    class Config:
-        arbitrary_types_allowed = True
-        allow_population_by_field_name = True
-
 
-class PromotionChannelData(BaseModel):
+class PromotionChannelData(BaseModel, validate_by_name=True, validate_by_alias=True):
     q_type: str = Field(..., alias="type")
 
-    class Config:
-        allow_population_by_field_name = True
 
-
-class ParentSaasPromotion(BaseModel):
+class ParentSaasPromotion(BaseModel, validate_by_name=True, validate_by_alias=True):
     q_type: str = Field(..., alias="type")
-    parent_saas: str | None
-    target_config_hash: str | None
-
-    class Config:
-        allow_population_by_field_name = True
+    parent_saas: str | None = None
+    target_config_hash: str | None = None
 
 
 class PromotionData(BaseModel):
-    channel: str | None
+    channel: str | None = None
     data: list[ParentSaasPromotion | PromotionChannelData] | None = None
 
 
@@ -263,6 +256,17 @@ class Promotion(BaseModel):
     saas_file_paths: list[str] | None = None
     target_paths: list[str] | None = None
 
+    @model_validator(mode="before")
+    @classmethod
+    def handle_gql_classes(cls, data: Any) -> Any:
+        if data.get("promotion_data"):
+            data["promotion_data"] = [
+                # convert a GQL class to a dict
+                item.model_dump() if hasattr(item, "model_dump") else item
+                for item in data["promotion_data"]
+            ]
+        return data
+
 
 @dataclass
 class ImageAuth:
@@ -422,7 +426,7 @@ class TargetSpec:
                 elif v is False:
                     parameters[k] = "false"
                 elif any(isinstance(v, t) for t in [dict, list, tuple]):
-                    parameters[k] = json.dumps(v)
+                    parameters[k] = json_dumps(v)
         return parameters
 
     def _collect_secret_parameters(