qontract-reconcile 0.10.2.dev361__py3-none-any.whl → 0.10.2.dev474__py3-none-any.whl

reconcile/terraform_tgw_attachments.py

@@ -32,6 +32,7 @@ from reconcile.typed_queries.app_interface_vault_settings import (
     get_app_interface_vault_settings,
 )
 from reconcile.typed_queries.clusters_with_peering import get_clusters_with_peering
+from reconcile.typed_queries.external_resources import get_settings
 from reconcile.typed_queries.terraform_tgw_attachments.aws_accounts import (
     get_aws_accounts,
 )
@@ -68,7 +69,7 @@ class ValidationError(Exception):
 class TGWAccountProviderInfo(BaseModel):
     name: str
     uid: str
-    assume_role: str | None
+    assume_role: str | None = None
     assume_region: str
 
 
@@ -80,10 +81,10 @@ class Requester(BaseModel):
     tgw_id: str
     tgw_arn: str
     region: str
-    routes: list[dict] | None
-    rules: list[dict] | None
-    hostedzones: list[str] | None
-    cidr_block: str | None
+    routes: list[dict] | None = None
+    rules: list[dict] | None = None
+    hostedzones: list[str] | None = None
+    cidr_block: str | None = None
     cidr_blocks: list[str]
     account: TGWAccountProviderInfo
 
@@ -91,11 +92,11 @@ class Requester(BaseModel):
 class Accepter(BaseModel):
     cidr_block: str
     region: str
-    vpc_id: str | None
-    route_table_ids: list[str] | None
-    subnets_id_az: list[dict[str, str]] | None
+    vpc_id: str | None = None
+    route_table_ids: list[str] | None = None
+    subnets_id_az: list[dict[str, str]] | None = None
     account: ClusterAccountProviderInfo
-    api_security_group_id: str | None
+    api_security_group_id: str | None = None
 
 
 class DesiredStateItem(BaseModel):
@@ -192,7 +193,7 @@ def _build_desired_state_tgw_connection(
         yield None
 
     account_tgws = awsapi.get_tgws_details(
-        peer_connection.account.dict(by_alias=True),
+        peer_connection.account.model_dump(by_alias=True),
         cluster_region,
         cluster_cidr_block,
         tags=peer_connection.tags or {},
@@ -274,7 +275,7 @@ def _build_accepter(
     )
     (vpc_id, route_table_ids, subnets_id_az, api_security_group_id) = (
         awsapi.get_cluster_vpc_details(
-            account.dict(by_alias=True),
+            account.model_dump(by_alias=True),
             route_tables=bool(peer_connection.manage_routes),
             subnets=True,
             hcp_vpc_endpoint_sg=allow_hcp_private_api_access,
@@ -317,12 +318,12 @@ def _build_ocm_map(
     clusters: Iterable[ClusterV1],
     vault_settings: AppInterfaceSettingsV1,
 ) -> OCMMap | None:
-    ocm_clusters = [c.dict(by_alias=True) for c in clusters if c.ocm]
+    ocm_clusters = [c.model_dump(by_alias=True) for c in clusters if c.ocm]
     return (
         OCMMap(
             clusters=ocm_clusters,
             integration=QONTRACT_INTEGRATION,
-            settings=vault_settings.dict(by_alias=True),
+            settings=vault_settings.model_dump(by_alias=True),
         )
         if ocm_clusters
         # this is a case for an OCP cluster which is not provisioned
@@ -346,7 +347,7 @@ def _populate_tgw_attachments_working_dirs(
     accounts_by_infra_account_name: dict[str, list[dict[str, Any]]] = {}
     for item in desired_state:
         accounts_by_infra_account_name.setdefault(item.infra_acount_name, []).append(
-            item.accepter.account.dict(by_alias=True)
+            item.accepter.account.model_dump(by_alias=True)
         )
     for infra_account_name, accounts in accounts_by_infra_account_name.items():
         ts.populate_additional_providers(infra_account_name, accounts)
@@ -428,7 +429,9 @@ def setup(
     print_to_file: str | None = None,
 ) -> tuple[SecretReaderBase, AWSApi, Terraform, Terrascript]:
     tgw_clusters = desired_state_data_source.clusters
-    all_accounts = [a.dict(by_alias=True) for a in desired_state_data_source.accounts]
+    all_accounts = [
+        a.model_dump(by_alias=True) for a in desired_state_data_source.accounts
+    ]
     account_by_name = {a["name"]: a for a in all_accounts}
     vault_settings = get_app_interface_vault_settings()
     secret_reader = create_secret_reader(vault_settings.vault)
@@ -444,13 +447,18 @@ def setup(
         raise RuntimeError("Could not find VPC ID for cluster")
 
     _validate_tgw_connection_names(desired_state)
-
+    try:
+        default_tags = get_settings().default_tags
+    except ValueError:
+        # no external resources settings found
+        default_tags = None
     ts = Terrascript(
         QONTRACT_INTEGRATION,
         "",
         thread_pool_size,
         tgw_accounts,
-        settings=vault_settings.dict(by_alias=True),
+        settings=vault_settings.model_dump(by_alias=True),
+        default_tags=default_tags,
     )
     tgw_rosa_cluster_accounts = [
         account_by_name[c.spec.account.name]
@@ -510,7 +518,7 @@ def run(
 ) -> None:
     desired_state_data_source = _fetch_desired_state_data_source(account_name)
     tgw_accounts = [
-        a.dict(by_alias=True)
+        a.model_dump(by_alias=True)
         for a in _filter_tgw_accounts(
             desired_state_data_source.accounts, desired_state_data_source.clusters
         )
@@ -567,7 +575,7 @@ def early_exit_desired_state(*args: Any, **kwargs: Any) -> dict[str, Any]:
     desired_state = _fetch_desired_state_data_source()
     for a in desired_state.accounts:
         a.deletion_approvals = []
-    return desired_state.dict(by_alias=True)
+    return desired_state.model_dump(by_alias=True)
 
 
 def desired_state_shard_config() -> DesiredStateShardConfig:

reconcile/terraform_users.py

@@ -11,6 +11,7 @@ from reconcile import (
 )
 from reconcile.change_owners.diff import IDENTIFIER_FIELD_NAME
 from reconcile.gql_definitions.common.pgp_reencryption_settings import query
+from reconcile.typed_queries.external_resources import get_settings
 from reconcile.utils import (
     expiration,
     gql,
@@ -126,12 +127,18 @@ def setup(
     participating_aws_accounts = _filter_participating_aws_accounts(accounts, roles)
 
     settings = queries.get_app_interface_settings()
+    try:
+        default_tags = get_settings().default_tags
+    except ValueError:
+        # no external resources settings found
+        default_tags = None
     ts = Terrascript(
         QONTRACT_INTEGRATION,
         QONTRACT_TF_PREFIX,
         thread_pool_size,
         participating_aws_accounts,
         settings=settings,
+        default_tags=default_tags,
     )
     err = ts.populate_users(
         roles,

reconcile/terraform_vpc_peerings.py

@@ -7,6 +7,7 @@ from typing import Any, TypedDict
 import reconcile.utils.terraform_client as terraform
 import reconcile.utils.terrascript_aws_client as terrascript
 from reconcile import queries
+from reconcile.typed_queries import external_resources
 from reconcile.utils import (
     aws_api,
     ocm,
@@ -654,8 +655,18 @@ def run(
         ])
 
     account_by_name = {a["name"]: a for a in accounts}
+    try:
+        default_tags = external_resources.get_settings().default_tags
+    except ValueError:
+        # no external resources settings found
+        default_tags = None
     with terrascript.TerrascriptClient(
-        QONTRACT_INTEGRATION, "", thread_pool_size, infra_accounts, settings=settings
+        QONTRACT_INTEGRATION,
+        "",
+        thread_pool_size,
+        infra_accounts,
+        settings=settings,
+        default_tags=default_tags,
     ) as ts:
         rosa_cluster_accounts = [
             account_by_name[c["spec"]["account"]["name"]]
@@ -664,8 +675,8 @@ def run(
         ]
         ts.populate_configs(rosa_cluster_accounts)
 
-        for infra_account_name, items in participating_accounts.items():
-            ts.populate_additional_providers(infra_account_name, items)
+        for infra_account_name, accounts in participating_accounts.items():
+            ts.populate_additional_providers(infra_account_name, accounts)
         ts.populate_vpc_peerings(desired_state)
         working_dirs = ts.dump(print_to_file=print_to_file)
         terraform_configurations = ts.terraform_configurations()

reconcile/terraform_vpc_resources/integration.py

@@ -20,9 +20,11 @@ from reconcile.typed_queries.app_interface_vault_settings import (
     get_app_interface_vault_settings,
 )
 from reconcile.typed_queries.aws_vpc_requests import get_aws_vpc_requests
+from reconcile.typed_queries.external_resources import get_settings
 from reconcile.typed_queries.github_orgs import get_github_orgs
 from reconcile.typed_queries.gitlab_instances import get_gitlab_instances
 from reconcile.utils import gql
+from reconcile.utils.disabled_integrations import integration_is_enabled
 from reconcile.utils.runtime.integration import (
     DesiredStateShardConfig,
     PydanticRunParams,
@@ -61,12 +63,14 @@ class TerraformVpcResources(QontractReconcileIntegration[TerraformVpcResourcesPa
     ) -> list[AWSAccountV1]:
         """Return a list of accounts extracted from the provided VPCRequests.
         If account_name is given returns the account object with that name."""
-        accounts = [vpc.account for vpc in data]
-
-        if account_name:
-            accounts = [account for account in accounts if account.name == account_name]
-
-        return accounts
+        return [
+            vpc.account
+            for vpc in data
+            if (
+                integration_is_enabled(self.name, vpc.account)
+                and (not account_name or vpc.account.name == account_name)
+            )
+        ]
 
     def _handle_outputs(
         self, requests: Iterable[VPCRequest], outputs: Mapping[str, Any]
@@ -154,20 +158,28 @@ class TerraformVpcResources(QontractReconcileIntegration[TerraformVpcResourcesPa
         if data:
             accounts = self._filter_accounts(data, account_name)
             if account_name and not accounts:
-                msg = f"The account {account_name} doesn't have any managed vpc. Verify your input"
+                msg = f"The account {account_name} doesn't have any managed vpcs or the {QONTRACT_INTEGRATION} integration is disabled for this account. Verify your input"
                 logging.debug(msg)
                 sys.exit(ExitCodes.SUCCESS)
         else:
             logging.debug("No VPC requests found, nothing to do.")
             sys.exit(ExitCodes.SUCCESS)
 
-        accounts_untyped: list[dict] = [acc.dict(by_alias=True) for acc in accounts]
+        accounts_untyped: list[dict] = [
+            acc.model_dump(by_alias=True) for acc in accounts
+        ]
+        try:
+            default_tags = get_settings().default_tags
+        except ValueError:
+            # no external resources settings found
+            default_tags = None
         with TerrascriptClient(
             integration=QONTRACT_INTEGRATION,
             integration_prefix=QONTRACT_TF_PREFIX,
             thread_pool_size=thread_pool_size,
             accounts=accounts_untyped,
             secret_reader=secret_reader,
+            default_tags=default_tags,
         ) as ts_client:
             ts_client.populate_vpc_requests(data, AWS_PROVIDER_VERSION)
 

reconcile/terraform_vpc_resources/merge_request.py

@@ -1,5 +1,6 @@
 import re
 import string
+from enum import StrEnum
 
 from pydantic import BaseModel
 
@@ -9,6 +10,12 @@ PROMOTION_DATA_SEPARATOR = "**DO NOT MANUALLY CHANGE ANYTHING BELOW THIS LINE**"
 VERSION = "0.1.0"
 LABEL = "terraform-vpc-resources"
 
+
+class Action(StrEnum):
+    CREATE = "create"
+    UPDATE = "update"
+
+
 VERSION_REF = "tf_vpc_resources_version"
 ACCOUNT_REF = "account"
 COMPILED_REGEXES = {
@@ -53,5 +60,8 @@ class Renderer:
     def render_description(self, account: str) -> str:
         return DESC.safe_substitute(account=account)
 
-    def render_title(self, account: str) -> str:
-        return f"[auto] VPC data file creation to {account}"
+    def render_title(self, account: str, action: Action) -> str:
+        return f"[auto] {action} VPC data file for {account}"
+
+    def render_update_title(self, account: str) -> str:
+        return f"[auto] VPC data file update for {account}"

reconcile/terraform_vpc_resources/merge_request_manager.py

@@ -5,6 +5,7 @@ from pydantic import BaseModel
 
 from reconcile.terraform_vpc_resources.merge_request import (
     LABEL,
+    Action,
     Info,
     Renderer,
 )
@@ -28,6 +29,7 @@ class VPCRequestMR(MergeRequestBase):
         vpc_tmpl_file_path: str,
         vpc_tmpl_file_content: str,
         labels: list[str],
+        action: Action,
     ):
         super().__init__()
         self._title = title
@@ -35,6 +37,7 @@ class VPCRequestMR(MergeRequestBase):
         self._vpc_tmpl_file_path = vpc_tmpl_file_path
         self._vpc_tmpl_file_content = vpc_tmpl_file_content
         self.labels = labels
+        self._action = action
 
     @property
     def title(self) -> str:
@@ -45,12 +48,21 @@ class VPCRequestMR(MergeRequestBase):
         return self._description
 
     def process(self, gitlab_cli: GitLabApi) -> None:
-        gitlab_cli.create_file(
-            branch_name=self.branch,
-            file_path=self._vpc_tmpl_file_path,
-            commit_message="add vpc datafile",
-            content=self._vpc_tmpl_file_content,
-        )
+        # Create or update file based on whether it already exists
+        if self._action == Action.UPDATE:
+            gitlab_cli.update_file(
+                branch_name=self.branch,
+                file_path=self._vpc_tmpl_file_path,
+                commit_message="update vpc datafile",
+                content=self._vpc_tmpl_file_content,
+            )
+        else:
+            gitlab_cli.create_file(
+                branch_name=self.branch,
+                file_path=self._vpc_tmpl_file_path,
+                commit_message="add vpc datafile",
+                content=self._vpc_tmpl_file_content,
+            )
 
 
 class MrData(BaseModel):
@@ -73,26 +85,37 @@ class MergeRequestManager(MergeRequestManagerBase[Info]):
         self._renderer = renderer
         self._auto_merge_enabled = auto_merge_enabled
 
-    def create_merge_request(self, data: MrData) -> None:
-        """Open a new MR, if not already present, for a VPC datafile and close any outdated before."""
-        if not self._housekeeping_ran:
-            self.housekeeping()
-
+    def _create_action(self, data: MrData) -> Action | None:
         if self._merge_request_already_exists({"account": data.account}):
             logging.info("MR already exists for %s", data.account)
             return None
-
         try:
-            self._vcs.get_file_content_from_app_interface_ref(file_path=data.path)
-            # the file exists, nothing to do
-            return None
+            existing_content = self._vcs.get_file_content_from_app_interface_ref(
+                file_path=data.path
+            )
         except GitlabGetError as e:
-            if e.response_code != 404:
-                raise
+            if e.response_code == 404:
+                return Action.CREATE
+            raise
+
+        if existing_content.strip() != data.content.strip():
+            return Action.UPDATE
+
+        logging.info("VPC data file exists and is up-to-date for %s", data.account)
+        return None
+
+    def create_merge_request(self, data: MrData) -> None:
+        """Open a new MR for VPC datafile updates, or update existing if changed."""
+        if not self._housekeeping_ran:
+            self.housekeeping()
+        action = self._create_action(data)
+        if action is None:
+            return
 
         description = self._renderer.render_description(account=data.account)
-        title = self._renderer.render_title(account=data.account)
-        logging.info("Open MR for %s", data.account)
+        title = self._renderer.render_title(account=data.account, action=action)
+
+        logging.info("Open MR for %s (%s)", data.account, action)
         mr_labels = [LABEL]
         if self._auto_merge_enabled:
             mr_labels.append(AUTO_MERGE)
@@ -103,5 +126,6 @@ class MergeRequestManager(MergeRequestManagerBase[Info]):
                 description=description,
                 vpc_tmpl_file_content=data.content,
                 labels=mr_labels,
+                action=action,
             )
         )

reconcile/typed_queries/aws_account_tags.py

@@ -0,0 +1,41 @@
+import json
+from collections.abc import Mapping
+
+from reconcile.gql_definitions.fragments.aws_organization import (
+    AWSOrganization,
+)
+
+
+def get_aws_account_tags(
+    organization: AWSOrganization | Mapping | None,
+) -> dict[str, str]:
+    """
+    Get AWS account tags by merging payer account tags
+
+    Args:
+        organization: AWSOrganization | Mapping | None - The organization object from which to extract tags.
+
+    Returns:
+        dict[str, str]: A dictionary containing the merged tags from the payer account and the account itself.
+    """
+    if organization is None:
+        return {}
+
+    match organization:
+        case AWSOrganization():
+            payer_account_tags = (
+                organization.payer_account.organization_account_tags or {}
+            )
+            account_tags = organization.tags or {}
+        case Mapping():
+            payer_account_tags = organization.get("payerAccount", {}).get(
+                "organizationAccountTags", {}
+            )
+            if isinstance(payer_account_tags, str):
+                payer_account_tags = json.loads(payer_account_tags)
+
+            account_tags = organization.get("tags", {})
+            if isinstance(account_tags, str):
+                account_tags = json.loads(account_tags)
+
+    return payer_account_tags | account_tags

reconcile/typed_queries/cost_report/app_names.py

@@ -6,7 +6,7 @@ from reconcile.utils.gql import GqlApi
 
 class App(BaseModel):
     name: str
-    parent_app_name: str | None
+    parent_app_name: str | None = None
 
 
 def get_app_names(

reconcile/typed_queries/cost_report/cost_namespaces.py

@@ -13,7 +13,7 @@ class CostNamespace(BaseModel, frozen=True):
     labels: CostNamespaceLabels
     app_name: str
     cluster_name: str
-    cluster_external_id: str | None
+    cluster_external_id: str | None = None
 
 
 def get_cost_namespaces(
@@ -32,7 +32,7 @@ def get_cost_namespaces(
     return [
         CostNamespace(
             name=namespace.name,
-            labels=CostNamespaceLabels.parse_obj(namespace.labels or {}),
+            labels=CostNamespaceLabels.model_validate(namespace.labels or {}),
             app_name=namespace.app.name,
             cluster_name=namespace.cluster.name,
             cluster_external_id=namespace.cluster.spec.external_id

reconcile/typed_queries/saas_files.py

@@ -6,7 +6,6 @@ from typing import Any
 from jsonpath_ng.exceptions import JsonPathParserError
 from pydantic import (
     BaseModel,
-    Extra,
     Field,
     Json,
 )
@@ -43,6 +42,7 @@ from reconcile.gql_definitions.fragments.saas_target_namespace import (
     SaasTargetNamespace,
 )
 from reconcile.utils import gql
+from reconcile.utils.environ import used_for_security_is_enabled
 from reconcile.utils.exceptions import (
     AppInterfaceSettingsError,
     ParameterError,
@@ -51,7 +51,12 @@ from reconcile.utils.json import json_dumps
 from reconcile.utils.jsonpath import parse_jsonpath
 
 
-class SaasResourceTemplateTarget(ConfiguredBaseModel):
+class SaasResourceTemplateTarget(
+    ConfiguredBaseModel,
+    validate_by_alias=True,
+    # ignore `namespaceSelector` and 'provider' fields from the GQL schema
+    extra="ignore",
+):
     path: str | None = Field(..., alias="path")
     name: str | None = Field(..., alias="name")
     # the namespace must be required to fulfill the saas file schema (utils.saasherder.interface.SaasFile)
@@ -74,17 +79,17 @@ class SaasResourceTemplateTarget(ConfiguredBaseModel):
         self, parent_saas_file_name: str, parent_resource_template_name: str
     ) -> str:
         """Returns a unique identifier for a target."""
-        return hashlib.blake2s(
-            f"{parent_saas_file_name}:{parent_resource_template_name}:{self.name or 'default'}:{self.namespace.cluster.name}:{self.namespace.name}".encode(),
-            digest_size=20,
-        ).hexdigest()
-
-    class Config:
-        # ignore `namespaceSelector` and 'provider' fields from the GQL schema
-        extra = Extra.ignore
+        data = f"{parent_saas_file_name}:{parent_resource_template_name}:{self.name or 'default'}:{self.namespace.cluster.name}:{self.namespace.name}".encode()
+        if used_for_security_is_enabled():
+            # When USED_FOR_SECURITY is enabled, use blake2s without digest_size and truncate to 20 bytes
+            # This is needed for FIPS compliance where digest_size parameter is not supported
+            return hashlib.sha256(data).digest()[:20].hex()
+        else:
+            # Default behavior: use blake2s with digest_size=20
+            return hashlib.blake2s(data, digest_size=20).hexdigest()
 
 
-class SaasResourceTemplate(ConfiguredBaseModel):
+class SaasResourceTemplate(ConfiguredBaseModel, validate_by_alias=True):
     name: str = Field(..., alias="name")
     url: str = Field(..., alias="url")
     path: str = Field(..., alias="path")
@@ -97,7 +102,7 @@ class SaasResourceTemplate(ConfiguredBaseModel):
     targets: list[SaasResourceTemplateTarget] = Field(..., alias="targets")
 
 
-class SaasFile(ConfiguredBaseModel):
+class SaasFile(ConfiguredBaseModel, validate_by_alias=True):
     path: str = Field(..., alias="path")
     name: str = Field(..., alias="name")
     labels: Json | None = Field(..., alias="labels")
@@ -221,7 +226,7 @@ class SaasFileList:
             with self._namespaces_as_dict_lock:
                 self._namespaces_as_dict_cache = {
                     "namespace": [
-                        ns.dict(by_alias=True, exclude_none=True)
+                        ns.model_dump(by_alias=True, exclude_none=True)
                         for ns in self.namespaces
                     ]
                 }
@@ -283,7 +288,7 @@ class SaasFileList:
             if app_name and saas_file.app.name != app_name:
                 continue
 
-            sf = saas_file.copy(deep=True)
+            sf = saas_file.model_copy(deep=True)
             if env_name:
                 for rt in sf.resource_templates[:]:
                     for target in rt.targets[:]:
@@ -314,7 +319,7 @@ def convert_parameters_to_json_string(root: dict[str, Any]) -> dict[str, Any]:
 
 
 def export_model(model: BaseModel) -> dict[str, Any]:
-    return convert_parameters_to_json_string(model.dict(by_alias=True))
+    return convert_parameters_to_json_string(model.model_dump(by_alias=True))
 
 
 def get_saas_files(

reconcile/typed_queries/status_board.py

@@ -32,7 +32,7 @@ def get_selected_app_names(
             prefix = f"{namespace.app.parent_app.name}-"
         name = f"{prefix}{namespace.app.name}"
         selected_app_names.add(name)
-        app = namespace.app.dict(by_alias=True)
+        app = namespace.app.model_dump(by_alias=True)
         app["name"] = name
         apps["apps"].append(app)
 
@@ -40,7 +40,7 @@ def get_selected_app_names(
             name = f"{namespace.app.name}-{child.name}"
             if name not in selected_app_names:
                 selected_app_names.add(f"{namespace.app.name}-{child.name}")
-                child_dict = child.dict(by_alias=True)
+                child_dict = child.model_dump(by_alias=True)
                 child_dict["name"] = name
                 apps["apps"].append(child_dict)
 

reconcile/unleash_feature_toggles/integration.py

@@ -31,7 +31,7 @@ QONTRACT_INTEGRATION_VERSION = make_semver(1, 0, 0)
 
 
 class UnleashTogglesIntegrationParams(PydanticRunParams):
-    instance: str | None
+    instance: str | None = None
 
 
 def feature_toggle_equal(c: FeatureToggle, d: FeatureToggleUnleashV1) -> bool:
@@ -68,7 +68,9 @@ class UnleashTogglesIntegration(
         if not query_func:
             query_func = gql.get_api().query
         return {
-            "toggles": [ft.dict() for ft in self.get_unleash_instances(query_func)],
+            "toggles": [
+                ft.model_dump() for ft in self.get_unleash_instances(query_func)
+            ],
         }
 
     def get_unleash_instances(

reconcile/utils/acs/base.py

@@ -6,7 +6,7 @@ from typing import (
 )
 
 import requests
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict
 
 from reconcile.gql_definitions.acs.acs_instances import AcsInstanceV1
 from reconcile.gql_definitions.acs.acs_instances import query as acs_instances_query
@@ -19,8 +19,11 @@ class AcsBaseApi(BaseModel):
     timeout: int = 30
     session: requests.Session = requests.Session()
 
-    class Config:
-        arbitrary_types_allowed = True
+    model_config = ConfigDict(
+        validate_by_name=True,
+        validate_by_alias=True,
+        arbitrary_types_allowed=True,
+    )
 
     def __enter__(self) -> Self:
         return self

reconcile/utils/acs/policies.py

@@ -11,7 +11,7 @@ class Scope(BaseModel):
     """
 
     cluster: str
-    namespace: str | None
+    namespace: str | None = None
 
 
 class PolicyCondition(BaseModel):
@@ -23,7 +23,7 @@ class PolicyCondition(BaseModel):
     """
 
     field_name: str
-    negate: bool | None
+    negate: bool | None = None
     values: list[str]