qontract-reconcile 0.10.2.dev334__py3-none-any.whl → 0.10.2.dev439__py3-none-any.whl

reconcile/jira_permissions_validator.py

@@ -24,7 +24,7 @@ from reconcile.typed_queries.jiralert_settings import get_jiralert_settings
 from reconcile.utils import gql, metrics
 from reconcile.utils.defer import defer
 from reconcile.utils.disabled_integrations import integration_is_enabled
-from reconcile.utils.jira_client import JiraClient, JiraWatcherSettings
+from reconcile.utils.jira_client import IssueType, JiraClient, JiraWatcherSettings
 from reconcile.utils.runtime.integration import DesiredStateShardConfig
 from reconcile.utils.secret_reader import SecretReaderBase, create_secret_reader
 from reconcile.utils.semver_helper import make_semver
@@ -33,8 +33,6 @@ from reconcile.utils.state import State, init_state
 QONTRACT_INTEGRATION = "jira-permissions-validator"
 QONTRACT_INTEGRATION_VERSION = make_semver(1, 2, 0)
 
-NameToIdMap = dict[str, str]
-
 
 class BaseMetric(BaseModel):
     """Base class for metrics"""
@@ -64,9 +62,6 @@ class ValidationError(IntFlag):
     PROJECT_ARCHIVED = auto()
 
 
-CustomIssueFields = dict[str, dict[str, str]]
-
-
 class RunnerParams(TypedDict):
     boards: list[JiraBoardV1]
     board_check_interval_sec: int
@@ -77,6 +72,179 @@ class CacheSource(TypedDict):
     boards: list
 
 
+NameToIdMap = dict[str, str]
+CustomIssueFields = dict[str, dict[str, str]]
+NO_ERRORS = ValidationError(0)
+
+
+def _validate_project_archived(jira: JiraClient, board: JiraBoardV1) -> ValidationError:
+    """Validate that the project is not archived."""
+    if jira.is_archived:
+        logging.error(f"[{board.name}] project is archived")
+        return ValidationError.PROJECT_ARCHIVED
+    return NO_ERRORS
+
+
+def _validate_permissions(jira: JiraClient, board: JiraBoardV1) -> ValidationError:
+    """Validate that the bot has necessary permissions to create and transition issues."""
+    error = NO_ERRORS
+
+    if not jira.can_create_issues():
+        logging.error(f"[{board.name}] can not create issues in project")
+        error |= ValidationError.CANT_CREATE_ISSUE
+
+    if not jira.can_transition_issues():
+        logging.error(
+            f"[{board.name}] AppSRE Jira Bot user does not have the permission to change the issue status."
+        )
+        error |= ValidationError.CANT_TRANSITION_ISSUES
+
+    return error
+
+
+def _validate_components(jira: JiraClient, board: JiraBoardV1) -> ValidationError:
+    """Validate that all escalation policy components exist in the project."""
+    error = NO_ERRORS
+    components = jira.components()
+
+    for escalation_policy in board.escalation_policies or []:
+        for jira_component in escalation_policy.channels.jira_components or []:
+            if jira_component not in components:
+                logging.error(
+                    f"[{board.name}] escalation policy '{escalation_policy.name}' references a non existing Jira component "
+                    f"'{jira_component}'. Valid components: {components}"
+                )
+                error |= ValidationError.INVALID_COMPONENT
+
+    return error
+
+
+def _validate_issue_type(
+    jira: JiraClient, board: JiraBoardV1, default_issue_type: str
+) -> tuple[ValidationError, IssueType | None]:
+    """Validate that the issue type exists and has statuses."""
+    error = NO_ERRORS
+    issue_type = board.issue_type or default_issue_type
+    project_issue_type = jira.get_issue_type(issue_type)
+
+    if not project_issue_type:
+        project_issue_types_str = ", ".join(t.name for t in jira.project_issue_types())
+        logging.error(
+            f"[{board.name}] '{issue_type}' is not a valid issue type in project. Valid issue types: {project_issue_types_str}"
+        )
+        error |= ValidationError.INVALID_ISSUE_TYPE
+        return error, None
+
+    if not project_issue_type.statuses:
+        logging.error(
+            f"[{board.name}] '{issue_type}' doesn't have any status. Choose a different issue type."
+        )
+        error |= ValidationError.INVALID_ISSUE_TYPE
+
+    return error, project_issue_type
+
+
+def _validate_issue_states(
+    board: JiraBoardV1, project_issue_type: IssueType, default_reopen_state: str
+) -> ValidationError:
+    """Validate that reopen and resolve states are valid for the issue type."""
+    error = NO_ERRORS
+
+    reopen_state = board.issue_reopen_state or default_reopen_state
+    if reopen_state.lower() not in [t.lower() for t in project_issue_type.statuses]:
+        logging.error(
+            f"[{board.name}] '{reopen_state}' is not a valid state in project. Valid states: {project_issue_type.statuses}"
+        )
+        error |= ValidationError.INVALID_ISSUE_STATE
+
+    if board.issue_resolve_state and board.issue_resolve_state.lower() not in [
+        t.lower() for t in project_issue_type.statuses
+    ]:
+        logging.error(
+            f"[{board.name}] '{board.issue_resolve_state}' is not a valid state in project. Valid states: {project_issue_type.statuses}"
+        )
+        error |= ValidationError.INVALID_ISSUE_STATE
+
+    return error
+
+
+def _validate_issue_fields(
+    jira: JiraClient, board: JiraBoardV1, project_issue_type: IssueType
+) -> tuple[ValidationError, CustomIssueFields]:
+    """Validate that custom fields exist and have valid values."""
+    error = NO_ERRORS
+    custom_fields: CustomIssueFields = {}
+
+    for field in board.issue_fields or []:
+        project_issue_field = jira.project_issue_field(
+            issue_type_id=project_issue_type.id, field=field.name
+        )
+        if not project_issue_field:
+            logging.error(
+                f"[{board.name}] '{field.name}' is not a valid field for '{project_issue_type.name}' in this project."
+            )
+            error |= ValidationError.INVALID_ISSUE_FIELD
+            continue
+
+        for option in project_issue_field.options:
+            if option == field.value:
+                custom_fields[project_issue_field.id] = option.model_dump()
+                break
+        else:
+            logging.error(
+                f"[{board.name}] '{field.name}' has an invalid value '{field.value}'. Valid values: {project_issue_field.options}"
+            )
+            error |= ValidationError.INVALID_ISSUE_FIELD
+
+    return error, custom_fields
+
+
+def _validate_security_level(
+    board: JiraBoardV1, public_projects: Iterable[str]
+) -> ValidationError:
+    """Validate that public projects have a security level defined."""
+    if board.name in public_projects and "Security Level" not in [
+        f.name for f in board.issue_fields or []
+    ]:
+        logging.error(
+            f"[{board.name}] is a public project, but the security level is not defined. Please add 'Security Level' field to the issueFields!"
+        )
+        return ValidationError.PUBLIC_PROJECT_NO_SECURITY_LEVEL
+    return NO_ERRORS
+
+
+def _validate_priorities(
+    jira: JiraClient, board: JiraBoardV1, jira_server_priorities: NameToIdMap
+) -> ValidationError:
+    """Validate that all priority mappings are valid for the project."""
+    error = NO_ERRORS
+    project_priorities = jira.project_priority_scheme()
+    project_priorities_names = [
+        p_name
+        for project_p_id in project_priorities
+        for p_name, p_id in jira_server_priorities.items()
+        if p_id == project_p_id
+    ]
+
+    for priority in board.severity_priority_mappings.mappings:
+        if priority.priority not in jira_server_priorities:
+            logging.error(
+                f"[{board.name}] {priority.priority} is not a valid Jira priority. Valid priorities: {project_priorities_names}"
+            )
+            error |= ValidationError.INVALID_PRIORITY
+            continue
+        if (
+            project_priorities
+            and jira_server_priorities[priority.priority] not in project_priorities
+        ):
+            logging.error(
+                f"[{board.name}] {priority.priority} is not a valid priority in project. Valid priorities: {project_priorities_names}"
+            )
+            error |= ValidationError.INVALID_PRIORITY
+
+    return error
+
+
 def board_is_valid(
     jira: JiraClient,
     board: JiraBoardV1,
@@ -85,123 +253,52 @@ def board_is_valid(
     jira_server_priorities: NameToIdMap,
     public_projects: Iterable[str],
 ) -> tuple[ValidationError, CustomIssueFields]:
-    error = ValidationError(0)
+    """Validate all Jira board settings.
+
+    This method orchestrates multiple validation checks for a Jira board configuration.
+    Each validation is performed by a dedicated helper function that focuses on a specific
+    aspect of the board configuration.
+
+    Returns:
+        A tuple of (ValidationError flags, custom_fields dict)
+    """
+    error = NO_ERRORS
     custom_fields: CustomIssueFields = {}
 
     try:
-        if jira.is_archived:
-            logging.error(f"[{board.name}] project is archived")
-            return ValidationError.PROJECT_ARCHIVED, custom_fields
+        # Check if project is archived (early exit)
+        archived_error = _validate_project_archived(jira, board)
+        if archived_error:
+            return archived_error, custom_fields
 
-        if not jira.can_create_issues():
-            logging.error(f"[{board.name}] can not create issues in project")
-            error |= ValidationError.CANT_CREATE_ISSUE
+        # Validate permissions
+        error |= _validate_permissions(jira, board)
 
-        if not jira.can_transition_issues():
-            logging.error(
-                f"[{board.name}] AppSRE Jira Bot user does not have the permission to change the issue status."
-            )
-            error |= ValidationError.CANT_TRANSITION_ISSUES
-
-        components = jira.components()
-        for escalation_policy in board.escalation_policies or []:
-            for jira_component in escalation_policy.channels.jira_components or []:
-                if jira_component not in components:
-                    logging.error(
-                        f"[{board.name}] escalation policy '{escalation_policy.name}' references a non existing Jira component "
-                        f"'{jira_component}'. Valid components: {components}"
-                    )
-                    error |= ValidationError.INVALID_COMPONENT
+        # Validate components
+        error |= _validate_components(jira, board)
 
-        issue_type = board.issue_type or default_issue_type
-        project_issue_type = jira.get_issue_type(issue_type)
-        if not project_issue_type:
-            project_issue_types_str = ", ".join(
-                t.name for t in jira.project_issue_types()
-            )
-            logging.error(
-                f"[{board.name}] '{issue_type}' is not a valid issue type in project. Valid issue types: {project_issue_types_str}"
-            )
-            error |= ValidationError.INVALID_ISSUE_TYPE
+        # Validate issue type
+        issue_type_error, project_issue_type = _validate_issue_type(
+            jira, board, default_issue_type
+        )
+        error |= issue_type_error
 
+        # If issue type is valid, perform additional validations
         if project_issue_type:
-            # Check issue attributes
-            if not project_issue_type.statuses:
-                logging.error(
-                    f"[{board.name}] '{issue_type}' doesn't have any status. Choose a different issue type."
-                )
-                error |= ValidationError.INVALID_ISSUE_TYPE
-
-            reopen_state = board.issue_reopen_state or default_reopen_state
-            if reopen_state.lower() not in [
-                t.lower() for t in project_issue_type.statuses
-            ]:
-                logging.error(
-                    f"[{board.name}] '{reopen_state}' is not a valid state in project. Valid states: {project_issue_type.statuses}"
-                )
-                error |= ValidationError.INVALID_ISSUE_STATE
-
-            if board.issue_resolve_state and board.issue_resolve_state.lower() not in [
-                t.lower() for t in project_issue_type.statuses
-            ]:
-                logging.error(
-                    f"[{board.name}] '{board.issue_resolve_state}' is not a valid state in project. Valid states: {project_issue_type.statuses}"
-                )
-                error |= ValidationError.INVALID_ISSUE_STATE
+            error |= _validate_issue_states(
+                board, project_issue_type, default_reopen_state
+            )
+            fields_error, custom_fields = _validate_issue_fields(
+                jira, board, project_issue_type
+            )
+            error |= fields_error
 
-            for field in board.issue_fields or []:
-                project_issue_field = jira.project_issue_field(
-                    issue_type_id=project_issue_type.id, field=field.name
-                )
-                if not project_issue_field:
-                    logging.error(
-                        f"[{board.name}] '{field.name}' is not a valid field for '{project_issue_type.name}' in this project."
-                    )
+        # Validate security level for public projects
+        error |= _validate_security_level(board, public_projects)
 
-                    error |= ValidationError.INVALID_ISSUE_FIELD
-                    continue
+        # Validate priorities
+        error |= _validate_priorities(jira, board, jira_server_priorities)
 
-                for option in project_issue_field.options:
-                    if option == field.value:
-                        # cache the field id and option value/name for later use, e.g. in jiralert templates
-                        custom_fields[project_issue_field.id] = option.dict()
-                        break
-                else:
-                    # field.value is not in the allowed options
-                    logging.error(
-                        f"[{board.name}] '{field.name}' has an invalid value '{field.value}'. Valid values: {project_issue_field.options}"
-                    )
-                    error |= ValidationError.INVALID_ISSUE_FIELD
-                    continue
-
-        if board.name in public_projects and "Security Level" not in [
-            f.name for f in board.issue_fields or []
-        ]:
-            logging.error(
-                f"[{board.name}] is a public project, but the security level is not defined. Please add 'Security Level' field to the issueFields!"
-            )
-            error |= ValidationError.PUBLIC_PROJECT_NO_SECURITY_LEVEL
-
-        project_priorities = jira.project_priority_scheme()
-        # get the priority names from the project priorities ids
-        project_priorities_names = [
-            p_name
-            for project_p_id in project_priorities
-            for p_name, p_id in jira_server_priorities.items()
-            if p_id == project_p_id
-        ]
-        for priority in board.severity_priority_mappings.mappings:
-            if priority.priority not in jira_server_priorities:
-                logging.error(
-                    f"[{board.name}] {priority.priority} is not a valid Jira priority. Valid priorities: {project_priorities_names}"
-                )
-                error |= ValidationError.INVALID_PRIORITY
-                continue
-            if jira_server_priorities[priority.priority] not in project_priorities:
-                logging.error(
-                    f"[{board.name}] {priority.priority} is not a valid priority in project. Valid priorities: {project_priorities_names}"
-                )
-                error |= ValidationError.INVALID_PRIORITY
     except JIRAError as e:
         if e.status_code == 401:
             # sporadic 401 errors, retrying
@@ -228,25 +325,41 @@ def validate_boards(
     dry_run: bool,
     state: State,
     jira_client_class: type[JiraClient] = JiraClient,
+    use_cache: bool = False,
 ) -> bool:
+    """Validate all Jira boards.
+
+    The method iterates over all Jira boards and checks if the configuration is valid. If no errors
+    are found, it will skip the next check for the board until the next run time is reached.
+    The next run time is calculated based on the board's check interval and some randomness to avoid
+    all boards checking at the same time.
+
+    Additionally, for any Jira board with a permission error, a Prometheus metric will be set to trigger an alert.
+
+    Returns True if there were any errors. See ValidationError and log messages for details.
+    """
     error = False
     jira_clients: dict[str, JiraClient] = {}
     for board in jira_boards:
-        next_run_time = state.get(board.name, 0)
-        if time.time() <= next_run_time:
-            if not dry_run:
-                # always skip for non-dry-run mode
-                continue
-            # dry-run mode
-            elif len(jira_boards) > 1:
-                logging.info(f"[{board.name}] Use cache results. Skipping ...")
-                continue
+        if use_cache:
+            next_run_time = state.get(board.name, 0)
+            if time.time() <= next_run_time:
+                if not dry_run:
+                    # always skip for non-dry-run mode
+                    continue
+                # dry-run mode
+                elif len(jira_boards) > 1:
+                    logging.info(f"[{board.name}] Use cache results. Skipping ...")
+                    continue
 
         logging.debug(f"[{board.name}] checking ...")
         if board.server.server_url not in jira_clients:
             jira_clients[board.server.server_url] = jira_client_class.create(
                 project_name=board.name,
                 token=secret_reader.read_secret(board.server.token),
+                email=secret_reader.read_secret(board.server.email)
+                if board.server.email
+                else None,
                 server_url=board.server.server_url,
                 jira_watcher_settings=jira_client_settings,
             )
@@ -318,7 +431,7 @@ def get_jira_boards(
 
 
 def export_boards(boards: list[JiraBoardV1]) -> list[dict]:
-    return [board.dict() for board in boards]
+    return [board.model_dump() for board in boards]
 
 
 @defer
@@ -326,6 +439,7 @@ def run(
     dry_run: bool,
     jira_board_name: list[str] | None = None,
     board_check_interval_sec: int = 3600,
+    use_cache: bool = False,
     defer: Callable | None = None,
 ) -> None:
     gql_api = gql.get_api()
@@ -349,6 +463,7 @@ def run(
             board_check_interval_sec=board_check_interval_sec,
             dry_run=dry_run,
             state=state,
+            use_cache=use_cache,
         )
 
     if error:

reconcile/ldap_groups/integration.py

@@ -58,7 +58,7 @@ class LdapGroupsIntegration(QontractReconcileIntegration[LdapGroupsIntegrationPa
         """Return the desired state for early exit."""
         if not query_func:
             query_func = gql.get_api().query
-        return {"roles": [c.dict() for c in self.get_roles(query_func)]}
+        return {"roles": [c.model_dump() for c in self.get_roles(query_func)]}
 
     @defer
     def run(self, dry_run: bool, defer: Callable | None = None) -> None:

reconcile/ocm/types.py

@@ -1,10 +1,6 @@
 from __future__ import annotations
 
-from pydantic import (
-    BaseModel,
-    Extra,
-    Field,
-)
+from pydantic import BaseModel, Field, field_validator
 
 
 class OCMClusterAutoscale(BaseModel):
@@ -13,99 +9,82 @@ class OCMClusterAutoscale(BaseModel):
 
 
 class OCMClusterNetwork(BaseModel):
-    type: str | None
+    type: str | None = None
     vpc: str
     service: str
     pod: str
 
 
-class OCMClusterSpec(BaseModel):
-    autoscale: OCMClusterAutoscale | None
+class OCMClusterSpec(BaseModel, extra="forbid"):
+    autoscale: OCMClusterAutoscale | None = None
     channel: str
-    disable_user_workload_monitoring: bool | None
-    external_id: str | None
-    id: str | None
-    instance_type: str | None
-    multi_az: bool | None
-    nodes: int | None
+    disable_user_workload_monitoring: bool | None = None
+    external_id: str | None = None
+    id: str | None = None
+    instance_type: str | None = None
+    multi_az: bool | None = None
+    nodes: int | None = None
     private: bool
     product: str
     provider: str
-    provision_shard_id: str | None
+    provision_shard_id: str | None = None
     region: str
-    initial_version: str | None
+    initial_version: str | None = None
     version: str
-    hypershift: bool | None
+    hypershift: bool | None = None
+    fips: bool = False
 
-    class Config:
-        extra = Extra.forbid
+    @field_validator("fips", mode="before")
+    @classmethod
+    def set_fips_default(cls, v: bool | None) -> bool:
+        return v or False
 
 
-class OSDClusterSpec(OCMClusterSpec):
+class OSDClusterSpec(OCMClusterSpec, extra="forbid"):
     load_balancers: int
     storage: int
 
-    class Config:
-        extra = Extra.forbid
 
-
-class ROSAOcmAwsStsAttrs(BaseModel):
+class ROSAOcmAwsStsAttrs(BaseModel, extra="forbid"):
     installer_role_arn: str
     support_role_arn: str
-    controlplane_role_arn: str | None
+    controlplane_role_arn: str | None = None
     worker_role_arn: str
 
-    class Config:
-        extra = Extra.forbid
-
 
-class ROSAOcmAwsAttrs(BaseModel):
+class ROSAOcmAwsAttrs(BaseModel, extra="forbid"):
     creator_role_arn: str
-    sts: ROSAOcmAwsStsAttrs | None
-
-    class Config:
-        extra = Extra.forbid
+    sts: ROSAOcmAwsStsAttrs | None = None
 
 
-class ROSAClusterAWSAccount(BaseModel):
+class ROSAClusterAWSAccount(BaseModel, extra="forbid"):
     uid: str
-    rosa: ROSAOcmAwsAttrs | None
-    billing_account_id: str | None
+    rosa: ROSAOcmAwsAttrs | None = None
+    billing_account_id: str | None = None
 
-    class Config:
-        extra = Extra.forbid
 
-
-class ROSAClusterSpec(OCMClusterSpec):
+class ROSAClusterSpec(OCMClusterSpec, extra="forbid"):
     account: ROSAClusterAWSAccount
-    subnet_ids: list[str] | None
-    availability_zones: list[str] | None
-    oidc_endpoint_url: str | None
-
-    class Config:
-        extra = Extra.forbid
+    subnet_ids: list[str] | None = None
+    availability_zones: list[str] | None = None
+    oidc_endpoint_url: str | None = None
 
 
 class ClusterMachinePool(BaseModel):
     id: str
     instance_type: str
-    replicas: int | None
-    autoscale: OCMClusterAutoscale | None
+    replicas: int | None = None
+    autoscale: OCMClusterAutoscale | None = None
 
 
-class OCMSpec(BaseModel):
-    path: str | None
+class OCMSpec(BaseModel, validate_by_name=True, validate_by_alias=True):
+    path: str | None = None
     spec: OSDClusterSpec | ROSAClusterSpec | OCMClusterSpec
     machine_pools: list[ClusterMachinePool] = Field(
         default_factory=list, alias="machinePools"
     )
     network: OCMClusterNetwork
-    domain: str | None
+    domain: str | None = None
     server_url: str = Field("", alias="serverUrl")
     console_url: str = Field("", alias="consoleUrl")
     elb_fqdn: str = Field("", alias="elbFQDN")
-
-    class Config:
-        smart_union = True
-        # This is need to populate by either console_url or consoleUrl, for instance
-        allow_population_by_field_name = True

reconcile/ocm_aws_infrastructure_access.py

@@ -103,7 +103,7 @@ def fetch_desired_state(clusters: Iterable[Mapping[str, Any]]) -> list[dict[str,
     namespaces = get_namespaces()
     for namespace_info in namespaces:
         specs = get_external_resource_specs(
-            namespace_info.dict(by_alias=True), provision_provider=PROVIDER_AWS
+            namespace_info.model_dump(by_alias=True), provision_provider=PROVIDER_AWS
         )
         for spec in specs:
             if spec.provider != "aws-iam-service-account":

reconcile/ocm_clusters.py

@@ -248,13 +248,13 @@ def get_cluster_ocm_update_spec(
     if not desired_spec.network.type:
         desired_spec.network.type = "OVNKubernetes"
 
-    cspec = current_spec.spec.dict()
-    cspec[ocmmod.SPEC_ATTR_NETWORK] = current_spec.network.dict(
+    cspec = current_spec.spec.model_dump()
+    cspec[ocmmod.SPEC_ATTR_NETWORK] = current_spec.network.model_dump(
         exclude={IGNORE_NETWORK_TYPE_ATTR}
     )
 
-    dspec = desired_spec.spec.dict()
-    dspec[ocmmod.SPEC_ATTR_NETWORK] = desired_spec.network.dict(
+    dspec = desired_spec.spec.model_dump()
+    dspec[ocmmod.SPEC_ATTR_NETWORK] = desired_spec.network.model_dump(
         exclude={IGNORE_NETWORK_TYPE_ATTR}
     )
 

reconcile/ocm_labels/integration.py

@@ -4,7 +4,7 @@ import logging
 from typing import TYPE_CHECKING, Any
 
 from deepdiff import DeepHash
-from pydantic import validator
+from pydantic import field_validator
 
 from reconcile.aus.aus_label_source import (
     init_aus_cluster_label_source,
@@ -62,7 +62,8 @@ class OcmLabelsIntegrationParams(PydanticRunParams):
     managed_label_prefixes: list[str] = []
     ignored_label_prefixes: list[str] = []
 
-    @validator("managed_label_prefixes", "ignored_label_prefixes")
+    @field_validator("managed_label_prefixes", "ignored_label_prefixes")
+    @classmethod
     def must_end_with_dot(cls, v: list[str]) -> list[str]:
         return [prefix + "." if not prefix.endswith(".") else prefix for prefix in v]