qontract-reconcile 0.10.2.dev414__py3-none-any.whl → 0.10.2.dev456__py3-none-any.whl

reconcile/aus/base.py

@@ -20,6 +20,11 @@ from pydantic import BaseModel
 from requests.exceptions import HTTPError
 from semver import VersionInfo
 
+from reconcile.aus.aus_sts_gate_handler import (
+    AUS_VERSION_GATE_APPROVALS_LABEL,
+    STS_GATE_LABEL,
+    AUSSTSGateHandler,
+)
 from reconcile.aus.cluster_version_data import (
     VersionData,
     VersionDataMap,
@@ -79,7 +84,9 @@ from reconcile.utils.datetime_util import (
 from reconcile.utils.defer import defer
 from reconcile.utils.disabled_integrations import integration_is_enabled
 from reconcile.utils.filtering import remove_none_values_from_dict
+from reconcile.utils.jobcontroller.controller import build_job_controller
 from reconcile.utils.ocm.addons import AddonService, AddonServiceV1, AddonServiceV2
+from reconcile.utils.ocm.base import LabelContainer
 from reconcile.utils.ocm.clusters import (
     OCMCluster,
 )
@@ -102,6 +109,7 @@ from reconcile.utils.runtime.integration import (
     PydanticRunParams,
     QontractReconcileIntegration,
 )
+from reconcile.utils.secret_reader import SecretReaderBase
 from reconcile.utils.semver_helper import (
     get_version_prefix,
     parse_semver,
@@ -112,11 +120,22 @@ from reconcile.utils.state import init_state
 MIN_DELTA_MINUTES = 6
 
 
+class RosaRoleUpgradeHandlerParams(PydanticRunParams):
+    job_controller_cluster: str
+    job_controller_namespace: str
+    rosa_job_service_account: str
+    rosa_role: str
+    rosa_job_image: str | None = None
+    integration_name: str
+    integration_version: str
+
+
 class AdvancedUpgradeSchedulerBaseIntegrationParams(PydanticRunParams):
     ocm_environment: str | None = None
     ocm_organization_ids: set[str] | None = None
     excluded_ocm_organization_ids: set[str] | None = None
     ignore_sts_clusters: bool = False
+    rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None
 
 
 class ReconcileError(Exception):
@@ -412,7 +431,12 @@ class AbstractUpgradePolicy(ABC, BaseModel):
     state: str | None = None
 
     @abstractmethod
-    def create(self, ocm_api: OCMBaseClient) -> None:
+    def create(
+        self,
+        ocm_api: OCMBaseClient,
+        rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+        secret_reader: SecretReaderBase | None = None,
+    ) -> None:
         pass
 
     @abstractmethod
@@ -436,7 +460,15 @@ class AddonUpgradePolicy(AbstractUpgradePolicy, arbitrary_types_allowed=True):
     addon_id: str
     addon_service: AddonService
 
-    def create(self, ocm_api: OCMBaseClient) -> None:
+    class Config:
+        arbitrary_types_allowed = True
+
+    def create(
+        self,
+        ocm_api: OCMBaseClient,
+        rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+        secret_reader: SecretReaderBase | None = None,
+    ) -> None:
         self.addon_service.create_addon_upgrade_policy(
             ocm_api=ocm_api,
             cluster_id=self.cluster.id,
@@ -469,14 +501,64 @@ class AddonUpgradePolicy(AbstractUpgradePolicy, arbitrary_types_allowed=True):
 class ClusterUpgradePolicy(AbstractUpgradePolicy):
     """Class to create ClusterUpgradePolicies in OCM"""
 
-    def create(self, ocm_api: OCMBaseClient) -> None:
+    organization_id: str
+    cluster_labels: LabelContainer
+
+    def create(
+        self,
+        ocm_api: OCMBaseClient,
+        rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+        secret_reader: SecretReaderBase | None = None,
+    ) -> None:
         policy = {
             "version": self.version,
             "schedule_type": "manual",
             "next_run": self.next_run,
         }
+        if (
+            rosa_role_upgrade_handler_params
+            and secret_reader
+            and self.should_upgrade_roles()
+        ):
+            logging.info(f"Updating account and operator roles for {self.cluster.name}")
+            aus_sts_gate_handler = AUSSTSGateHandler(
+                job_controller=build_job_controller(
+                    integration=rosa_role_upgrade_handler_params.integration_name,
+                    integration_version=rosa_role_upgrade_handler_params.integration_version,
+                    cluster=rosa_role_upgrade_handler_params.job_controller_cluster,
+                    namespace=rosa_role_upgrade_handler_params.job_controller_namespace,
+                    secret_reader=secret_reader,
+                    dry_run=False,
+                ),
+                aws_iam_role=rosa_role_upgrade_handler_params.rosa_role,
+                rosa_job_service_account=rosa_role_upgrade_handler_params.rosa_job_service_account,
+                rosa_job_image=rosa_role_upgrade_handler_params.rosa_job_image,
+            )
+            if not aus_sts_gate_handler.upgrade_rosa_roles(
+                ocm_api=ocm_api,
+                cluster=self.cluster,
+                dry_run=False,
+                upgrade_version=self.version,
+                ocm_org_id=self.organization_id,
+            ):
+                logging.error(
+                    f"Failed to update account and operator roles for {self.cluster.name}"
+                )
         create_upgrade_policy(ocm_api, self.cluster.id, policy)
 
+    def should_upgrade_roles(self) -> bool:
+        handler_csv = self.cluster_labels.get_label_value(
+            AUS_VERSION_GATE_APPROVALS_LABEL
+        )
+        if not handler_csv:
+            return False
+
+        return (
+            self.cluster.is_sts()
+            and self.cluster.is_rosa_classic()
+            and STS_GATE_LABEL in set(handler_csv.split(","))
+        )
+
     def delete(self, ocm_api: OCMBaseClient) -> None:
         raise NotImplementedError("ClusterUpgradePolicy.delete() not implemented")
 
@@ -494,7 +576,12 @@ class ClusterUpgradePolicy(AbstractUpgradePolicy):
 class ControlPlaneUpgradePolicy(AbstractUpgradePolicy):
     """Class to create and delete ControlPlanUpgradePolicies in OCM"""
 
-    def create(self, ocm_api: OCMBaseClient) -> None:
+    def create(
+        self,
+        ocm_api: OCMBaseClient,
+        rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+        secret_reader: SecretReaderBase | None = None,
+    ) -> None:
         policy = {
             "version": self.version,
             "schedule_type": "manual",
@@ -522,7 +609,12 @@ class NodePoolUpgradePolicy(AbstractUpgradePolicy):
 
     node_pool: str
 
-    def create(self, ocm_api: OCMBaseClient) -> None:
+    def create(
+        self,
+        ocm_api: OCMBaseClient,
+        rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+        secret_reader: SecretReaderBase | None = None,
+    ) -> None:
         policy = {
             "version": self.version,
             "schedule_type": "manual",
@@ -554,7 +646,13 @@ class UpgradePolicyHandler(BaseModel, extra="forbid"):
     action: str
     policy: AbstractUpgradePolicy
 
-    def act(self, dry_run: bool, ocm_api: OCMBaseClient) -> None:
+    def act(
+        self,
+        dry_run: bool,
+        ocm_api: OCMBaseClient,
+        rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+        secret_reader: SecretReaderBase | None = None,
+    ) -> None:
         logging.info(f"{self.action} {self.policy.summarize()}")
         if dry_run:
             return
@@ -564,7 +662,7 @@ class UpgradePolicyHandler(BaseModel, extra="forbid"):
         elif self.action == "delete":
             self.policy.delete(ocm_api)
         elif self.action == "create":
-            self.policy.create(ocm_api)
+            self.policy.create(ocm_api, rosa_role_upgrade_handler_params, secret_reader)
 
 
 def fetch_current_state(
@@ -582,6 +680,7 @@ def fetch_current_state(
             )
             current_state.extend(
                 AddonUpgradePolicy(
+                    organization_id=spec.org.org_id,
                     id=addon_upgrade_policy.id,
                     addon_id=addon_spec.addon.addon.id,
                     cluster=spec.cluster,
@@ -618,6 +717,8 @@ def fetch_current_state(
             for upgrade_policy in upgrade_policies:
                 policy = upgrade_policy | {
                     "cluster": spec.cluster,
+                    "organization_id": spec.org.org_id,
+                    "cluster_labels": spec.cluster_labels,
                 }
                 current_state.append(ClusterUpgradePolicy(**policy))
 
@@ -1016,6 +1117,8 @@ def _create_upgrade_policy(
         )
     return ClusterUpgradePolicy(
         cluster=spec.cluster,
+        organization_id=spec.org.org_id,
+        cluster_labels=spec.cluster_labels,
         version=version,
         schedule_type="manual",
         next_run=next_schedule,
@@ -1122,6 +1225,8 @@ def calculate_diff(
                     UpgradePolicyHandler(
                         action="create",
                         policy=AddonUpgradePolicy(
+                            action="create",
+                            organization_id=spec.org.org_id,
                             cluster=spec.cluster,
                             version=version,
                             schedule_type="manual",
@@ -1186,6 +1291,8 @@ def act(
     dry_run: bool,
     diffs: list[UpgradePolicyHandler],
     ocm_api: OCMBaseClient,
+    rosa_role_upgrade_handler_params: RosaRoleUpgradeHandlerParams | None = None,
+    secret_reader: SecretReaderBase | None = None,
     addon_id: str | None = None,
 ) -> None:
     diffs.sort(key=sort_diffs)
@@ -1198,7 +1305,7 @@ def act(
         ):
             continue
         try:
-            diff.act(dry_run, ocm_api)
+            diff.act(dry_run, ocm_api, rosa_role_upgrade_handler_params, secret_reader)
         except HTTPError as e:
             logging.error(f"{policy.cluster.name}: {e}: {e.response.text}")
 

reconcile/aus/models.py

@@ -14,6 +14,7 @@ from reconcile.aus.healthchecks import AUSClusterHealth
 from reconcile.gql_definitions.fragments.aus_organization import AUSOCMOrganization
 from reconcile.gql_definitions.fragments.upgrade_policy import ClusterUpgradePolicyV1
 from reconcile.utils.ocm.addons import OCMAddonInstallation
+from reconcile.utils.ocm.base import LabelContainer
 from reconcile.utils.ocm.clusters import OCMCluster
 from reconcile.utils.semver_helper import parse_semver
 
@@ -33,6 +34,7 @@ class ClusterUpgradeSpec(BaseModel):
 
     org: AUSOCMOrganization
     cluster: OCMCluster
+    cluster_labels: LabelContainer | None = None
     upgrade_policy: ClusterUpgradePolicyV1 = Field(..., alias="upgradePolicy")
     health: AUSClusterHealth
     node_pools: list[NodePoolSpec] = Field(default_factory=list, alias="nodePools")

reconcile/aus/ocm_addons_upgrade_scheduler_org.py

@@ -260,6 +260,7 @@ def calculate_diff(
                 aus.UpgradePolicyHandler(
                     action="delete",
                     policy=aus.AddonUpgradePolicy(
+                        organization_id=org_upgrade_spec.org.org_id,
                         cluster=current.cluster,
                         version=current.schedule_type,
                         id=current.id,

reconcile/aus/ocm_upgrade_scheduler.py

@@ -82,7 +82,14 @@ class OCMClusterUpgradeSchedulerIntegration(
                 version_data,
                 integration=self.name,
             )
-            aus.act(dry_run, diffs, ocm_api)
+
+            aus.act(
+                dry_run,
+                diffs,
+                ocm_api,
+                self.params.rosa_role_upgrade_handler_params,
+                self.secret_reader,
+            )
 
     def expose_version_data_metrics(
         self,

reconcile/aus/ocm_upgrade_scheduler_org.py

@@ -1,4 +1,5 @@
 from collections import defaultdict
+from dataclasses import dataclass
 
 from reconcile.aus.healthchecks import (
     AUSClusterHealthCheckProvider,
@@ -13,6 +14,7 @@ from reconcile.aus.node_pool_spec import get_node_pool_specs_by_org_cluster
 from reconcile.aus.ocm_upgrade_scheduler import OCMClusterUpgradeSchedulerIntegration
 from reconcile.gql_definitions.fragments.aus_organization import AUSOCMOrganization
 from reconcile.gql_definitions.fragments.ocm_environment import OCMEnvironment
+from reconcile.utils.ocm.base import LabelContainer
 from reconcile.utils.ocm.clusters import (
     OCMCluster,
     discover_clusters_for_organizations,
@@ -22,6 +24,12 @@ from reconcile.utils.ocm_base_client import init_ocm_base_client
 QONTRACT_INTEGRATION = "ocm-upgrade-scheduler-org"
 
 
+@dataclass
+class ClusterUpgradeSpecWithLabels:
+    cluster: OCMCluster
+    cluster_labels: LabelContainer
+
+
 class OCMClusterUpgradeSchedulerOrgIntegration(OCMClusterUpgradeSchedulerIntegration):
     @property
     def name(self) -> str:
@@ -60,7 +68,10 @@ class OCMClusterUpgradeSchedulerOrgIntegration(OCMClusterUpgradeSchedulerIntegra
                     specs=self._build_cluster_upgrade_specs(
                         org=org,
                         clusters_by_name={
-                            c.ocm_cluster.name: c.ocm_cluster
+                            c.ocm_cluster.name: ClusterUpgradeSpecWithLabels(
+                                cluster=c.ocm_cluster,
+                                cluster_labels=c.labels,
+                            )
                             for c in clusters_by_org[org.org_id]
                         },
                         cluster_health_provider=build_cluster_health_providers_for_organization(
@@ -79,7 +90,7 @@ class OCMClusterUpgradeSchedulerOrgIntegration(OCMClusterUpgradeSchedulerIntegra
     def _build_cluster_upgrade_specs(
         self,
         org: AUSOCMOrganization,
-        clusters_by_name: dict[str, OCMCluster],
+        clusters_by_name: dict[str, ClusterUpgradeSpecWithLabels],
         cluster_health_provider: AUSClusterHealthCheckProvider,
         node_pool_specs_by_cluster_id: dict[str, list[NodePoolSpec]],
     ) -> list[ClusterUpgradeSpec]:
@@ -87,12 +98,16 @@ class OCMClusterUpgradeSchedulerOrgIntegration(OCMClusterUpgradeSchedulerIntegra
             ClusterUpgradeSpec(
                 org=org,
                 upgradePolicy=cluster.upgrade_policy,
-                cluster=clusters_by_name[cluster.name],
+                cluster=clusters_by_name[cluster.name].cluster,
+                cluster_labels=clusters_by_name[cluster.name].cluster_labels,
                 health=cluster_health_provider.cluster_health(
-                    cluster_external_id=clusters_by_name[cluster.name].external_id,
+                    cluster_external_id=clusters_by_name[
+                        cluster.name
+                    ].cluster.external_id,
                     org_id=org.org_id,
                 ),
-                nodePools=node_pool_specs_by_cluster_id.get(ocm_cluster.id) or [],
+                nodePools=node_pool_specs_by_cluster_id.get(ocm_cluster.cluster.id)
+                or [],
             )
             for cluster in org.upgrade_policy_clusters or []
             # clusters that are not in the UUID dict will be ignored because

reconcile/aus/version_gate_approver.py

@@ -14,9 +14,6 @@ from reconcile.gql_definitions.common.ocm_environments import (
 )
 from reconcile.utils import gql
 from reconcile.utils.grouping import group_by
-from reconcile.utils.jobcontroller.controller import (
-    build_job_controller,
-)
 from reconcile.utils.ocm.base import (
     ClusterDetails,
     LabelContainer,
@@ -63,19 +60,7 @@ class VersionGateApprover(QontractReconcileIntegration[VersionGateApproverParams
 
     def initialize_handlers(self, query_func: Callable) -> None:
         self.handlers: dict[str, GateHandler] = {
-            sts_version_gate_handler.GATE_LABEL: sts_version_gate_handler.STSGateHandler(
-                job_controller=build_job_controller(
-                    integration=QONTRACT_INTEGRATION,
-                    integration_version=QONTRACT_INTEGRATION_VERSION,
-                    cluster=self.params.job_controller_cluster,
-                    namespace=self.params.job_controller_namespace,
-                    secret_reader=self.secret_reader,
-                    dry_run=False,
-                ),
-                aws_iam_role=self.params.rosa_role,
-                rosa_job_service_account=self.params.rosa_job_service_account,
-                rosa_job_image=self.params.rosa_job_image,
-            ),
+            sts_version_gate_handler.GATE_LABEL: sts_version_gate_handler.STSGateHandler(),
             ocp_gate_handler.GATE_LABEL: ocp_gate_handler.OCPGateHandler(),
             ingress_gate_handler.GATE_LABEL: ingress_gate_handler.IngressGateHandler(),
         }

reconcile/aus/version_gates/sts_version_gate_handler.py

@@ -1,27 +1,16 @@
-import logging
-
 from reconcile.aus.version_gates.handler import GateHandler
-from reconcile.utils.jobcontroller.controller import K8sJobController
 from reconcile.utils.ocm.base import OCMCluster, OCMVersionGate
 from reconcile.utils.ocm_base_client import OCMBaseClient
-from reconcile.utils.rosa.rosa_cli import RosaCliError
-from reconcile.utils.rosa.session import RosaSession
 
 GATE_LABEL = "api.openshift.com/gate-sts"
 
 
 class STSGateHandler(GateHandler):
-    def __init__(
-        self,
-        job_controller: K8sJobController,
-        aws_iam_role: str,
-        rosa_job_service_account: str | None = None,
-        rosa_job_image: str | None = None,
-    ) -> None:
-        self.job_controller = job_controller
-        self.aws_iam_role = aws_iam_role
-        self.rosa_job_image = rosa_job_image
-        self.rosa_job_service_account = rosa_job_service_account
+    """
+    This handler is used to handle the STS version gate.
+    Right now we just ack all gate-sts gates
+    The actual job of role upgrade is now a part of AUS and is handled by the AUSSTSGateHandler.
+    """
 
     @staticmethod
     def gate_applicable_to_cluster(cluster: OCMCluster) -> bool:
@@ -41,60 +30,4 @@ class STSGateHandler(GateHandler):
         gate: OCMVersionGate,
         dry_run: bool,
     ) -> bool:
-        if (
-            not cluster.id
-            or not cluster.aws
-            or not cluster.aws.sts
-            or not cluster.is_sts()
-        ):
-            # checked already but mypy :/
-            return False
-
-        if cluster.is_rosa_hypershift():
-            # thanks to hypershift managed policies, there is nothing to do for us here
-            # returning True will ack the version gate
-            return True
-        if not cluster.is_rosa_classic():
-            # we manage roels only for rosa classic clusters
-            # returning here will prevent OSD STS clusters to be handled right now
-            logging.error(
-                f"Cluster {cluster.id} is not a ROSA cluster. "
-                "STS version gates are only handled for ROSA classic clusters."
-            )
-            return False
-
-        rosa = RosaSession(
-            aws_account_id=cluster.aws.aws_account_id,
-            aws_region=cluster.region.id,
-            aws_iam_role=self.aws_iam_role,
-            ocm_org_id=ocm_org_id,
-            ocm_api=ocm_api,
-            job_controller=self.job_controller,
-            image=self.rosa_job_image,
-            service_account=self.rosa_job_service_account,
-        )
-
-        try:
-            # account role handling
-            account_role_prefix = cluster.aws.account_role_prefix
-            if not account_role_prefix:
-                raise Exception(
-                    f"Can't upgrade account roles. Cluster {cluster.name} does not define spec.aws.account_role_prefix"
-                )
-            rosa.upgrade_account_roles(
-                role_prefix=account_role_prefix,
-                minor_version=gate.version_raw_id_prefix,
-                channel_group=cluster.version.channel_group,
-                dry_run=dry_run,
-            )
-
-            # operator role handling
-            rosa.upgrade_operator_roles(
-                cluster_id=cluster.id,
-                dry_run=dry_run,
-            )
-        except RosaCliError as e:
-            logging.error(f"Failed to upgrade roles for cluster {cluster.name}: {e}")
-            e.write_logs_to_logger(logging.error)
-            return False
         return True

reconcile/automated_actions/config/integration.py

@@ -7,7 +7,7 @@ from collections.abc import (
 from typing import Any
 
 import yaml
-from kubernetes.client import (  # type: ignore[attr-defined]
+from kubernetes.client import (
     ApiClient,
     V1ConfigMap,
     V1ObjectMeta,

reconcile/aws_ecr_image_pull_secrets.py

@@ -21,7 +21,7 @@ def get_password(token: str) -> str:
 
 def construct_dockercfg_secret_data(data: Mapping[str, Any]) -> dict[str, str]:
     auth_data = data["authorizationData"][0]
-    server = auth_data["proxyEndpoint"]
+    server = auth_data["proxyEndpoint"].replace("https://", "")
     token = auth_data["authorizationToken"]
     password = get_password(token)
     data = {

reconcile/change_owners/change_owners.py

@@ -23,6 +23,7 @@ from reconcile.change_owners.changes import (
 )
 from reconcile.change_owners.decision import (
     ChangeDecision,
+    ChangeResponsibles,
     DecisionCommand,
     apply_decisions_to_changes,
     get_approver_decisions_from_mr_comments,
@@ -115,6 +116,77 @@ def manage_conditional_label(
     return set(new_labels)
 
 
+def build_status_message(
+    self_serviceable: bool,
+    authoritative: bool,
+    change_admitted: bool,
+    approver_reachability: set[str],
+    supported_commands: list[str],
+) -> str:
+    """
+    Build a user-friendly status message based on the MR state.
+    """
+    approver_section = _build_approver_contact_section(approver_reachability)
+
+    # Check if changes are not admitted (security gate - takes priority)
+    if not change_admitted:
+        return f"""## ⏸️ Approval Required
+Your changes need `/good-to-test` approval from a listed approver before review can begin.
+
+{approver_section}"""
+
+    commands_text = (
+        f"**Available commands:** {' '.join(f'`{cmd}`' for cmd in supported_commands)}"
+    )
+
+    code_warning = ""
+    if not authoritative:
+        code_warning = "⚠️ **Code changes outside of data and resources detected** - please review carefully\n\n"
+
+    if self_serviceable:
+        return f"""## ✅ Ready for Review
+Get `/lgtm` approval from the listed approvers below.
+
+{code_warning}{approver_section}
+
+{commands_text}"""
+
+    return f"""## 🔍 AppSRE Review Required
+**What happens next:**
+* AppSRE will review via their [review queue](https://gitlab.cee.redhat.com/service/app-interface-output/-/blob/master/app-interface-review-queue.md)
+* Please don't ping directly unless this is **urgent**
+* See [etiquette guide](https://gitlab.cee.redhat.com/service/app-interface#app-interface-etiquette) for more info
+
+{code_warning}{approver_section}
+
+{commands_text}"""
+
+
+def _build_approver_contact_section(approver_reachability: set[str]) -> str:
+    """Build the approver contact information section."""
+    if not approver_reachability:
+        return ""
+
+    return "**Reach out to approvers:**\n" + "\n".join([
+        f"* {ar}" for ar in approver_reachability
+    ])
+
+
+def _format_change_responsible(cr: ChangeResponsibles) -> str:
+    """
+    Format a ChangeResponsibles object.
+    """
+    usernames = [
+        f"@{a.org_username}"
+        if (a.tag_on_merge_requests or len(cr.approvers) == 1)
+        else a.org_username
+        for a in cr.approvers
+    ]
+
+    usernames_text = " ".join(usernames)
+    return f"<details><summary>{cr.context}</summary>{usernames_text}</details>"
+
+
 def write_coverage_report_to_mr(
     self_serviceable: bool,
     change_decisions: list[ChangeDecision],
@@ -135,14 +207,11 @@ def write_coverage_report_to_mr(
         startswith=change_coverage_report_header,
     )
 
-    # add new report comment
+    # Build change coverage table
     results = []
     approver_reachability = set()
     for d in change_decisions:
-        approvers = [
-            f"{cr.context} - {' '.join([f'@{a.org_username}' if (a.tag_on_merge_requests or len(cr.approvers) == 1) else a.org_username for a in cr.approvers])}"
-            for cr in d.change_responsibles
-        ]
+        approvers = [_format_change_responsible(cr) for cr in d.change_responsibles]
         if d.coverable_by_fragment_decisions:
             approvers.append(
                 "automatically approved if all sub-properties are approved"
@@ -164,41 +233,33 @@ def write_coverage_report_to_mr(
             item["status"] = "hold"
         elif d.is_approved():
             item["status"] = "approved"
-        item["approvers"] = approvers
+        item["approvers"] = "".join(approvers)
         results.append(item)
+
     coverage_report = format_table(
         results, ["file", "change", "status", "approvers"], table_format="github"
     )
 
-    self_serviceability_hint = "All changes require an `/lgtm` from a listed approver "
-    if not self_serviceable:
-        self_serviceability_hint += (
-            "but <b>not all changes are self-serviceable and require AppSRE approval</b>."
-            "The AppSRE Interrupt Catcher (IC) will review your Merge Request (MR) as it comes up in their "
-            "<a href='https://gitlab.cee.redhat.com/service/app-interface-output/-/blob/master/app-interface-review-queue.md'>queue</a>, "
-            "please do not ping them directly unless this is <b>urgent</b>."
-            "\nPlease see https://gitlab.cee.redhat.com/service/app-interface#app-interface-etiquette for more information. Thank you :)"
-        )
-    if not authoritative:
-        self_serviceability_hint += "\n\nchanges outside of data and resources detected - <b>PAY EXTRA ATTENTION WHILE REVIEWING</b>\n\n"
-
-    if not change_admitted:
-        self_serviceability_hint += "\n\nchanges are not admitted. Please request `/good-to-test` from one of the approvers.\n\n"
-
-    approver_reachability_hint = "Reach out to approvers for reviews"
-    if approver_reachability:
-        approver_reachability_hint += " on\n" + "\n".join([
-            f"* {ar}" for ar in approver_reachability or []
-        ])
-    gl.add_comment_to_merge_request(
-        merge_request,
-        f"{change_coverage_report_header}<br/>"
-        f"{self_serviceability_hint}\n"
-        f"{coverage_report}\n\n"
-        f"{approver_reachability_hint}\n\n"
-        + f"Supported commands: {' '.join([f'`{d.value}`' for d in DecisionCommand])} ",
+    # Build user-friendly status message
+    supported_commands = [d.value for d in DecisionCommand]
+    status_message = build_status_message(
+        self_serviceable=self_serviceable,
+        authoritative=authoritative,
+        change_admitted=change_admitted,
+        approver_reachability=approver_reachability,
+        supported_commands=supported_commands,
     )
 
+    # Create the full comment
+    full_comment = f"""{change_coverage_report_header}
+
+{status_message}
+
+## 📋 Change Summary
+{coverage_report}"""
+
+    gl.add_comment_to_merge_request(merge_request, full_comment)
+
 
 def write_coverage_report_to_stdout(change_decisions: list[ChangeDecision]) -> None:
     results = []
@@ -391,7 +452,12 @@ def run(
                 good_to_test_approvers,
             )
             approver_decisions = get_approver_decisions_from_mr_comments(
-                gl.get_merge_request_comments(merge_request, include_description=True)
+                gl.get_merge_request_comments(
+                    merge_request,
+                    include_description=True,
+                    include_approvals=True,
+                    approval_body=DecisionCommand.APPROVED.value,
+                )
             )
             change_decisions = apply_decisions_to_changes(
                 changes,