qontract-reconcile 0.10.2.dev428__tar.gz → 0.10.2.dev448__tar.gz

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev428
+Version: 0.10.2.dev448
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

qontract_reconcile-0.10.2.dev448/reconcile/aus/aus_sts_gate_handler.py

@@ -0,0 +1,59 @@
+import logging
+
+from reconcile.utils.jobcontroller.controller import K8sJobController
+from reconcile.utils.ocm.base import OCMCluster
+from reconcile.utils.ocm_base_client import OCMBaseClient
+from reconcile.utils.rosa.rosa_cli import RosaCliError
+from reconcile.utils.rosa.session import RosaSession
+from reconcile.utils.semver_helper import get_version_prefix
+
+STS_GATE_LABEL = "api.openshift.com/gate-sts"
+AUS_VERSION_GATE_APPROVALS_LABEL = "sre-capabilities.aus.version-gate-approvals"
+
+
+class AUSSTSGateHandler:
+    def __init__(
+        self,
+        job_controller: K8sJobController,
+        aws_iam_role: str,
+        rosa_job_service_account: str | None = None,
+        rosa_job_image: str | None = None,
+    ) -> None:
+        self.job_controller = job_controller
+        self.aws_iam_role = aws_iam_role
+        self.rosa_job_image = rosa_job_image
+        self.rosa_job_service_account = rosa_job_service_account
+
+    def upgrade_rosa_roles(
+        self,
+        cluster: OCMCluster,
+        upgrade_version: str,
+        dry_run: bool,
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+    ) -> bool:
+        if not cluster.aws:
+            return False
+        rosa = RosaSession(
+            aws_account_id=cluster.aws.aws_account_id,
+            aws_region=cluster.region.id,
+            aws_iam_role=self.aws_iam_role,
+            ocm_org_id=ocm_org_id,
+            ocm_api=ocm_api,
+            job_controller=self.job_controller,
+            image=self.rosa_job_image,
+            service_account=self.rosa_job_service_account,
+        )
+        policy_version = get_version_prefix(upgrade_version)
+        try:
+            rosa.upgrade_rosa_roles(
+                cluster_name=cluster.name,
+                upgrade_version=upgrade_version,
+                policy_version=policy_version,
+                dry_run=dry_run,
+            )
+        except RosaCliError as e:
+            logging.error(f"Failed to upgrade roles for cluster {cluster.name}: {e}")
+            e.write_logs_to_logger(logging.error)
+            return False
+        return True

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/aus/base.py

@@ -20,6 +20,11 @@ from pydantic import BaseModel
 from requests.exceptions import HTTPError
 from semver import VersionInfo
 
+from reconcile.aus.aus_sts_gate_handler import (
+    AUS_VERSION_GATE_APPROVALS_LABEL,
+    STS_GATE_LABEL,
+    AUSSTSGateHandler,
+)
 from reconcile.aus.cluster_version_data import (
     VersionData,
     VersionDataMap,
@@ -46,7 +51,7 @@ from reconcile.aus.models import (
     OrganizationUpgradeSpec,
     Sector,
 )
-from reconcile.aus.version_gates import HANDLERS, sts_version_gate_handler
+from reconcile.aus.version_gates import HANDLERS
 from reconcile.gql_definitions.advanced_upgrade_service.aus_organization import (
     query as aus_organizations_query,
 )
@@ -113,8 +118,6 @@ from reconcile.utils.semver_helper import (
 from reconcile.utils.state import init_state
 
 MIN_DELTA_MINUTES = 6
-STS_GATE_LABEL = "api.openshift.com/gate-sts"
-AUS_VERSION_GATE_APPROVALS_LABEL = "sre-capabilities.aus.version-gate-approvals"
 
 
 class RosaRoleUpgradeHandlerParams(PydanticRunParams):
@@ -518,7 +521,7 @@ class ClusterUpgradePolicy(AbstractUpgradePolicy):
             and self.should_upgrade_roles()
         ):
             logging.info(f"Updating account and operator roles for {self.cluster.name}")
-            sts_gate_handler = sts_version_gate_handler.STSGateHandler(
+            aus_sts_gate_handler = AUSSTSGateHandler(
                 job_controller=build_job_controller(
                     integration=rosa_role_upgrade_handler_params.integration_name,
                     integration_version=rosa_role_upgrade_handler_params.integration_version,
@@ -531,7 +534,7 @@ class ClusterUpgradePolicy(AbstractUpgradePolicy):
                 rosa_job_service_account=rosa_role_upgrade_handler_params.rosa_job_service_account,
                 rosa_job_image=rosa_role_upgrade_handler_params.rosa_job_image,
             )
-            if not sts_gate_handler.upgrade_rosa_roles_v2(
+            if not aus_sts_gate_handler.upgrade_rosa_roles(
                 ocm_api=ocm_api,
                 cluster=self.cluster,
                 dry_run=False,
@@ -549,6 +552,7 @@ class ClusterUpgradePolicy(AbstractUpgradePolicy):
         )
         if not handler_csv:
             return False
+
         return (
             self.cluster.is_sts()
             and self.cluster.is_rosa_classic()

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/aus/version_gate_approver.py

@@ -14,9 +14,6 @@ from reconcile.gql_definitions.common.ocm_environments import (
 )
 from reconcile.utils import gql
 from reconcile.utils.grouping import group_by
-from reconcile.utils.jobcontroller.controller import (
-    build_job_controller,
-)
 from reconcile.utils.ocm.base import (
     ClusterDetails,
     LabelContainer,
@@ -63,19 +60,7 @@ class VersionGateApprover(QontractReconcileIntegration[VersionGateApproverParams
 
     def initialize_handlers(self, query_func: Callable) -> None:
         self.handlers: dict[str, GateHandler] = {
-            sts_version_gate_handler.GATE_LABEL: sts_version_gate_handler.STSGateHandler(
-                job_controller=build_job_controller(
-                    integration=QONTRACT_INTEGRATION,
-                    integration_version=QONTRACT_INTEGRATION_VERSION,
-                    cluster=self.params.job_controller_cluster,
-                    namespace=self.params.job_controller_namespace,
-                    secret_reader=self.secret_reader,
-                    dry_run=False,
-                ),
-                aws_iam_role=self.params.rosa_role,
-                rosa_job_service_account=self.params.rosa_job_service_account,
-                rosa_job_image=self.params.rosa_job_image,
-            ),
+            sts_version_gate_handler.GATE_LABEL: sts_version_gate_handler.STSGateHandler(),
             ocp_gate_handler.GATE_LABEL: ocp_gate_handler.OCPGateHandler(),
             ingress_gate_handler.GATE_LABEL: ingress_gate_handler.IngressGateHandler(),
         }

qontract_reconcile-0.10.2.dev448/reconcile/aus/version_gates/sts_version_gate_handler.py

@@ -0,0 +1,33 @@
+from reconcile.aus.version_gates.handler import GateHandler
+from reconcile.utils.ocm.base import OCMCluster, OCMVersionGate
+from reconcile.utils.ocm_base_client import OCMBaseClient
+
+GATE_LABEL = "api.openshift.com/gate-sts"
+
+
+class STSGateHandler(GateHandler):
+    """
+    This handler is used to handle the STS version gate.
+    Right now we just ack all gate-sts gates
+    The actual job of role upgrade is now a part of AUS and is handled by the AUSSTSGateHandler.
+    """
+
+    @staticmethod
+    def gate_applicable_to_cluster(cluster: OCMCluster) -> bool:
+        """
+        The STS Gate is applicable to all clusters with STS enabled.
+        This could potentially also be OSD STS clusters. While this handler
+        does not handle OSD clusters as of now, it is still important that
+        we report the STS gate to be applicable to OSD STS clusters.
+        """
+        return cluster.is_sts()
+
+    def handle(
+        self,
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+        cluster: OCMCluster,
+        gate: OCMVersionGate,
+        dry_run: bool,
+    ) -> bool:
+        return True

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/aws_ecr_image_pull_secrets.py

@@ -21,7 +21,7 @@ def get_password(token: str) -> str:
 
 def construct_dockercfg_secret_data(data: Mapping[str, Any]) -> dict[str, str]:
     auth_data = data["authorizationData"][0]
-    server = auth_data["proxyEndpoint"]
+    server = auth_data["proxyEndpoint"].replace("https://", "")
     token = auth_data["authorizationToken"]
     password = get_password(token)
     data = {

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/cli.py

@@ -53,7 +53,7 @@ TERRAFORM_VERSION_REGEX = r"^Terraform\sv([\d]+\.[\d]+\.[\d]+)$"
 OC_VERSIONS = ["4.19.0", "4.16.2"]
 OC_VERSION_REGEX = r"^Client\sVersion:\s([\d]+\.[\d]+\.[\d]+)"
 
-HELM_VERSIONS = ["3.11.1"]
+HELM_VERSIONS = ["3.19.2"]
 HELM_VERSION_REGEX = r"^version.BuildInfo{Version:\"v([\d]+\.[\d]+\.[\d]+)\".*$"
 
 

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/external_resources/secrets_sync.py

@@ -448,9 +448,8 @@ class VaultSecretsReconciler(SecretsReconciler):
         secret_path = self.secret_path(self.vault_path, spec)
         try:
             logging.debug("Reading Secret %s", secret_path)
-            data = self.secrets_reader.read_all({"path": secret_path})
-            spec.metadata[SECRET_UPDATED_AT] = data[SECRET_UPDATED_AT]
-            del data[SECRET_UPDATED_AT]
+            data = self.secrets_reader.read_all({"path": secret_path}).copy()
+            spec.metadata[SECRET_UPDATED_AT] = data.pop(SECRET_UPDATED_AT)
             spec.secret = data
         except SecretNotFoundError:
             logging.info("Error getting secret from vault, skipping. [%s]", secret_path)

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/common/aws_vpc_requests.py

@@ -48,6 +48,9 @@ fragment VPCRequest on VPCRequest_v1 {
     automationToken {
       ...VaultSecret
     }
+    disable {
+      integrations
+    }
     supportedDeploymentRegions
     resourcesDefaultRegion
     providerVersion

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/common/clusters.py

@@ -113,6 +113,7 @@ query Clusters($name: String) {
     managedGroups
     managedClusterRoles
     insecureSkipTLSVerify
+    allowedToBypassPublicPeeringRestriction
     jumpHost {
       ...CommonJumphostFields
     }
@@ -635,6 +636,7 @@ class ClusterV1(ConfiguredBaseModel):
     managed_groups: Optional[list[str]] = Field(..., alias="managedGroups")
     managed_cluster_roles: Optional[bool] = Field(..., alias="managedClusterRoles")
     insecure_skip_tls_verify: Optional[bool] = Field(..., alias="insecureSkipTLSVerify")
+    allowed_to_bypass_public_peering_restriction: Optional[bool] = Field(..., alias="allowedToBypassPublicPeeringRestriction")
     jump_host: Optional[CommonJumphostFields] = Field(..., alias="jumpHost")
     auth: list[Union[ClusterAuthGithubOrgTeamV1, ClusterAuthGithubOrgV1, ClusterAuthV1]] = Field(..., alias="auth")
     ocm: Optional[OpenShiftClusterManagerV1] = Field(..., alias="ocm")

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/external_resources/external_resources_namespaces.py

@@ -372,6 +372,7 @@ query ExternalResourcesNamespaces {
             identifier
             defaults
             es_identifier
+            policy
             output_resource_name
             annotations
             tags
@@ -933,6 +934,7 @@ class NamespaceTerraformResourceKinesisV1(NamespaceTerraformResourceAWSV1):
     identifier: str = Field(..., alias="identifier")
     defaults: str = Field(..., alias="defaults")
     es_identifier: Optional[str] = Field(..., alias="es_identifier")
+    policy: Optional[str] = Field(..., alias="policy")
     output_resource_name: Optional[str] = Field(..., alias="output_resource_name")
     annotations: Optional[str] = Field(..., alias="annotations")
     tags: Optional[str] = Field(..., alias="tags")
@@ -1167,7 +1169,7 @@ class NamespaceTerraformResourceMskV1(NamespaceTerraformResourceAWSV1):
 
 class NamespaceTerraformProviderResourceAWSV1(NamespaceExternalResourceV1):
     provisioner: AWSAccountV1 = Field(..., alias="provisioner")
-    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceRDSProxyV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
+    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceRDSProxyV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
 
 
 class EnvironmentV1(ConfiguredBaseModel):

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/fragments/aws_vpc_request.py

@@ -28,6 +28,10 @@ class ConfiguredBaseModel(BaseModel):
     )
 
 
+class DisableClusterAutomationsV1(ConfiguredBaseModel):
+    integrations: Optional[list[str]] = Field(..., alias="integrations")
+
+
 class DeletionApprovalV1(ConfiguredBaseModel):
     q_type: str = Field(..., alias="type")
     name: str = Field(..., alias="name")
@@ -39,6 +43,7 @@ class AWSAccountV1(ConfiguredBaseModel):
     uid: str = Field(..., alias="uid")
     terraform_username: Optional[str] = Field(..., alias="terraformUsername")
     automation_token: VaultSecret = Field(..., alias="automationToken")
+    disable: Optional[DisableClusterAutomationsV1] = Field(..., alias="disable")
     supported_deployment_regions: Optional[list[str]] = Field(..., alias="supportedDeploymentRegions")
     resources_default_region: str = Field(..., alias="resourcesDefaultRegion")
     provider_version: str = Field(..., alias="providerVersion")

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/introspection.json

@@ -6489,6 +6489,18 @@
                             "isDeprecated": false,
                             "deprecationReason": null
                         },
+                        {
+                            "name": "allowedToBypassPublicPeeringRestriction",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "Boolean",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
                         {
                             "name": "namespaces",
                             "description": null,
@@ -47669,6 +47681,18 @@
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
+                        },
+                        {
+                            "name": "bucket_policy",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "JSON",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
                         }
                     ],
                     "inputFields": null,
@@ -48278,6 +48302,18 @@
                             "isDeprecated": false,
                             "deprecationReason": null
                         },
+                        {
+                            "name": "policy",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "JSON",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
                         {
                             "name": "output_resource_name",
                             "description": null,

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py

@@ -243,6 +243,7 @@ query TerraformResourcesNamespaces {
             defaults
             output_resource_name
             storage_class
+            bucket_policy
             annotations
           }
           ... on NamespaceTerraformResourceS3SQS_v1 {
@@ -299,6 +300,7 @@ query TerraformResourcesNamespaces {
             identifier
             defaults
             es_identifier
+            policy
             output_resource_name
             annotations
           }
@@ -774,6 +776,7 @@ class NamespaceTerraformResourceS3CloudFrontV1(NamespaceTerraformResourceAWSV1):
     defaults: str = Field(..., alias="defaults")
     output_resource_name: Optional[str] = Field(..., alias="output_resource_name")
     storage_class: Optional[str] = Field(..., alias="storage_class")
+    bucket_policy: Optional[str] = Field(..., alias="bucket_policy")
     annotations: Optional[str] = Field(..., alias="annotations")
 
 
@@ -836,6 +839,7 @@ class NamespaceTerraformResourceKinesisV1(NamespaceTerraformResourceAWSV1):
     identifier: str = Field(..., alias="identifier")
     defaults: str = Field(..., alias="defaults")
     es_identifier: Optional[str] = Field(..., alias="es_identifier")
+    policy: Optional[str] = Field(..., alias="policy")
     output_resource_name: Optional[str] = Field(..., alias="output_resource_name")
     annotations: Optional[str] = Field(..., alias="annotations")
 
@@ -1100,7 +1104,7 @@ class NamespaceTerraformResourceMskV1(NamespaceTerraformResourceAWSV1):
 
 
 class NamespaceTerraformProviderResourceAWSV1(NamespaceExternalResourceV1):
-    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceRDSProxyV1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
+    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceRDSProxyV1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
 
 
 class EnvironmentV1(ConfiguredBaseModel):

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/vpc_peerings_validator/vpc_peerings_validator.py

@@ -23,6 +23,7 @@ from reconcile.gql_definitions.vpc_peerings_validator.vpc_peerings_validator_pee
 DEFINITION = """
 fragment VpcPeeringsValidatorPeeredCluster on Cluster_v1 {
   name
+  allowedToBypassPublicPeeringRestriction
   network {
     vpc
   }
@@ -35,6 +36,7 @@ fragment VpcPeeringsValidatorPeeredCluster on Cluster_v1 {
 query VpcPeeringsValidator {
   clusters: clusters_v1 {
     name
+    allowedToBypassPublicPeeringRestriction
     network {
       vpc
     }
@@ -128,6 +130,7 @@ class ClusterPeeringV1(ConfiguredBaseModel):
 
 class ClusterV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
+    allowed_to_bypass_public_peering_restriction: Optional[bool] = Field(..., alias="allowedToBypassPublicPeeringRestriction")
     network: Optional[ClusterNetworkV1] = Field(..., alias="network")
     spec: Optional[ClusterSpecV1] = Field(..., alias="spec")
     internal: Optional[bool] = Field(..., alias="internal")

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/gql_definitions/vpc_peerings_validator/vpc_peerings_validator_peered_cluster_fragment.py

@@ -34,6 +34,7 @@ class ClusterSpecV1(ConfiguredBaseModel):
 
 class VpcPeeringsValidatorPeeredCluster(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
+    allowed_to_bypass_public_peering_restriction: Optional[bool] = Field(..., alias="allowedToBypassPublicPeeringRestriction")
     network: Optional[ClusterNetworkV1] = Field(..., alias="network")
     spec: Optional[ClusterSpecV1] = Field(..., alias="spec")
     internal: Optional[bool] = Field(..., alias="internal")

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/templates/rosa-classic-cluster-creation.sh.j2

@@ -47,7 +47,7 @@ rosa create cluster -y --cluster-name={{ cluster_name }} \
     --service-cidr {{ cluster.network.service }} \
     --pod-cidr {{ cluster.network.pod }} \
     --host-prefix 23 \
-    --replicas {{ cluster.machine_pools | length }} \
+    --replicas 3 \
     --compute-machine-type {{ cluster.machine_pools[0].instance_type }} \
     {% if cluster.spec.disable_user_workload_monitoring -%}
     --disable-workload-monitoring \

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/templates/rosa-hcp-cluster-creation.sh.j2

@@ -47,7 +47,7 @@ rosa create cluster --cluster-name={{ cluster_name }} \
     --service-cidr {{ cluster.network.service }} \
     --pod-cidr {{ cluster.network.pod }} \
     --host-prefix 23 \
-    --replicas {{ cluster.machine_pools | length }} \
+    --replicas 3 \
     --compute-machine-type {{ cluster.machine_pools[0].instance_type }} \
     {% if cluster.spec.private -%}
     --private \

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/terraform_vpc_resources/integration.py

@@ -24,6 +24,7 @@ from reconcile.typed_queries.external_resources import get_settings
 from reconcile.typed_queries.github_orgs import get_github_orgs
 from reconcile.typed_queries.gitlab_instances import get_gitlab_instances
 from reconcile.utils import gql
+from reconcile.utils.disabled_integrations import integration_is_enabled
 from reconcile.utils.runtime.integration import (
     DesiredStateShardConfig,
     PydanticRunParams,
@@ -62,12 +63,14 @@ class TerraformVpcResources(QontractReconcileIntegration[TerraformVpcResourcesPa
     ) -> list[AWSAccountV1]:
         """Return a list of accounts extracted from the provided VPCRequests.
         If account_name is given returns the account object with that name."""
-        accounts = [vpc.account for vpc in data]
-
-        if account_name:
-            accounts = [account for account in accounts if account.name == account_name]
-
-        return accounts
+        return [
+            vpc.account
+            for vpc in data
+            if (
+                integration_is_enabled(self.name, vpc.account)
+                and (not account_name or vpc.account.name == account_name)
+            )
+        ]
 
     def _handle_outputs(
         self, requests: Iterable[VPCRequest], outputs: Mapping[str, Any]
@@ -155,7 +158,7 @@ class TerraformVpcResources(QontractReconcileIntegration[TerraformVpcResourcesPa
         if data:
             accounts = self._filter_accounts(data, account_name)
             if account_name and not accounts:
-                msg = f"The account {account_name} doesn't have any managed vpc. Verify your input"
+                msg = f"The account {account_name} doesn't have any managed vpcs or the {QONTRACT_INTEGRATION} integration is disabled for this account. Verify your input"
                 logging.debug(msg)
                 sys.exit(ExitCodes.SUCCESS)
         else:

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/typed_queries/saas_files.py

@@ -42,6 +42,7 @@ from reconcile.gql_definitions.fragments.saas_target_namespace import (
     SaasTargetNamespace,
 )
 from reconcile.utils import gql
+from reconcile.utils.environ import used_for_security_is_enabled
 from reconcile.utils.exceptions import (
     AppInterfaceSettingsError,
     ParameterError,
@@ -78,10 +79,14 @@ class SaasResourceTemplateTarget(
         self, parent_saas_file_name: str, parent_resource_template_name: str
     ) -> str:
         """Returns a unique identifier for a target."""
-        return hashlib.blake2s(
-            f"{parent_saas_file_name}:{parent_resource_template_name}:{self.name or 'default'}:{self.namespace.cluster.name}:{self.namespace.name}".encode(),
-            digest_size=20,
-        ).hexdigest()
+        data = f"{parent_saas_file_name}:{parent_resource_template_name}:{self.name or 'default'}:{self.namespace.cluster.name}:{self.namespace.name}".encode()
+        if used_for_security_is_enabled():
+            # When USED_FOR_SECURITY is enabled, use blake2s without digest_size and truncate to 20 bytes
+            # This is needed for FIPS compliance where digest_size parameter is not supported
+            return hashlib.blake2s(data).digest()[:20].hex()
+        else:
+            # Default behavior: use blake2s with digest_size=20
+            return hashlib.blake2s(data, digest_size=20).hexdigest()
 
 
 class SaasResourceTemplate(ConfiguredBaseModel, validate_by_alias=True):

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/utils/environ.py

@@ -4,6 +4,11 @@ from functools import wraps
 from typing import Any
 
 
+def used_for_security_is_enabled() -> bool:
+    used_for_security_env = os.getenv("USED_FOR_SECURITY", "false")
+    return used_for_security_env.lower() == "true"
+
+
 def environ(variables: Iterable[str] | None = None) -> Callable:
     """Check that environment variables are set before execution."""
     if variables is None:

{qontract_reconcile-0.10.2.dev428 → qontract_reconcile-0.10.2.dev448}/reconcile/utils/jjb_client.py

@@ -33,6 +33,10 @@ from reconcile.utils.vcs import GITHUB_BASE_URL
 JJB_INI = "[jenkins]\nurl = https://JENKINS_URL"
 
 
+class MissingJobUrlError(Exception):
+    pass
+
+
 class JJB:
     """Wrapper around Jenkins Jobs"""
 
@@ -335,7 +339,7 @@ class JJB:
                 job_name = job["name"]
                 try:
                     repos.add(self.get_repo_url(job))
-                except KeyError:
+                except MissingJobUrlError:
                     logging.debug(f"missing github url: {job_name}")
         return repos
 
@@ -355,7 +359,19 @@ class JJB:
 
     @staticmethod
     def get_repo_url(job: Mapping[str, Any]) -> str:
-        repo_url_raw = job["properties"][0]["github"]["url"]
+        repo_url_raw = job.get("properties", [{}])[0].get("github", {}).get("url")
+
+        # we may be in a Github Branch Source type of job
+        if not repo_url_raw:
+            gh_org = job.get("scm", [{}])[0].get("github", {}).get("repo-owner")
+            gh_repo = job.get("scm", [{}])[0].get("github", {}).get("repo")
+            if gh_org and gh_repo:
+                repo_url_raw = f"https://github.com/{gh_org}/{gh_repo}/"
+            else:
+                raise MissingJobUrlError(
+                    f"Cannot find job url for {job['display-name']}"
+                )
+
         return repo_url_raw.strip("/").replace(".git", "")
 
     @staticmethod
@@ -404,7 +420,7 @@ class JJB:
                 try:
                     if self.get_repo_url(job).lower() == repo_url.rstrip("/").lower():
                         return job
-                except KeyError:
+                except MissingJobUrlError:
                     # something wrong here. ignore this job
                     pass
         raise ValueError(f"job with {job_type=} and {repo_url=} not found")