qontract-reconcile 0.10.2.dev476__py3-none-any.whl → 0.10.2.dev478__py3-none-any.whl

{qontract_reconcile-0.10.2.dev476.dist-info → qontract_reconcile-0.10.2.dev478.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev476
+Version: 0.10.2.dev478
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev476.dist-info → qontract_reconcile-0.10.2.dev478.dist-info}/RECORD

@@ -186,14 +186,15 @@ reconcile/endpoints_discovery/merge_request.py,sha256=vKcfcSLodR_q1iQxFjEceHA-OT
 reconcile/endpoints_discovery/merge_request_manager.py,sha256=hFq-Dxw7IDB2D34zYMQPKM8Lh-PznklQE5LUSye1VJA,6297
 reconcile/external_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/external_resources/aws.py,sha256=kh5p9KsYB7naewVPLPtcCjnIrUECmdR6lUgDrzIlL1k,11985
-reconcile/external_resources/factories.py,sha256=ftHFxEvzFp-oAOOLeR9viTLLVz0g6Hgs8ZNEsJKKOcs,5903
+reconcile/external_resources/cloudflare.py,sha256=7Yq31L_enR-iyAAsVx_Z-QVbRjh_GmFyuxVBCTej5a8,2426
+reconcile/external_resources/factories.py,sha256=52GzEmEaLhriG0AQzHh0R8n3IwnGvwpxVCv8U0glGC4,8506
 reconcile/external_resources/integration.py,sha256=Fcc7MjixGx6bE6K4fgXx6yFomVoJavsOLhhDgL7VJgg,7040
 reconcile/external_resources/integration_secrets_sync.py,sha256=M2uOFi2JXWhiw3hQyE_4NVPQmPIYGHlghRti5eLWhkw,1738
-reconcile/external_resources/manager.py,sha256=3CNpp-QHR3d-A4C4wMj4KvrAG0lWTwW5jcFA8AR-g4w,18363
+reconcile/external_resources/manager.py,sha256=dwDFqvN5GDnmSKBHVxQt2Wb4hspJQiS7gyITylA2Y8U,18856
 reconcile/external_resources/meta.py,sha256=RM8qGE6UoJR58nLqABReIJrrdmx4Tqt_OcdlT-QygGs,620
 reconcile/external_resources/metrics.py,sha256=ahvlgrc48B214NwBq-G6ncwQE3Qrtif61jtOrklfylQ,3903
-reconcile/external_resources/model.py,sha256=Kfwxm9TLa6j7Vs-rxXQTIQoNmJPHilSJbjLdlQmNZc4,15172
-reconcile/external_resources/reconciler.py,sha256=hb32ERLhxkNR-RRYWaE0ngjKjHBM8uarBy8bDVPGGmE,9732
+reconcile/external_resources/model.py,sha256=8kw2-Y0DxHpdNxaxdfM6xD_cyS40MElTHgfD-Sm2j2E,15405
+reconcile/external_resources/reconciler.py,sha256=-jXny_rFnUpPs_VFbA0Iig37-icOu-9i6R-KXjPuWb8,10150
 reconcile/external_resources/secrets_sync.py,sha256=vdcy2Ydz67pKkSHT2U0-Ucu9cxMr99r15RovLTxmoZU,16162
 reconcile/external_resources/state.py,sha256=zWla2_j6BI1FBrSPqRRfuo55bXK0QWAxtEeafb8ffTg,13811
 reconcile/fleet_labeler/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -214,7 +215,7 @@ reconcile/glitchtip_project_alerts/integration.py,sha256=prje61EOuLEIZLLxlJS_YN0
 reconcile/glitchtip_project_dsn/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/glitchtip_project_dsn/integration.py,sha256=3GgcqUM6hWhLpo9Yx5Xr9vrdexF-WNevVCNL9bJ0Upc,8162
 reconcile/gql_definitions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/introspection.json,sha256=liDjRAOJ0_ZN7bagOacrd1yGlybaxK8V9rQTflnecxo,2429961
+reconcile/gql_definitions/introspection.json,sha256=FjXblj7vGdpsRA1RkrIQyXQ2t9B60ERqHIt7WRKBoGg,2432241
 reconcile/gql_definitions/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/acs/acs_instances.py,sha256=VySMcnWddg-jXj-bj_ddLIwLX3u1GSFUm02H8rJDBYU,2167
 reconcile/gql_definitions/acs/acs_policies.py,sha256=jEV1U8j4VYL9ih17JSK1tiz2s_1CegVECmXU-NVEQvA,4333
@@ -307,7 +308,7 @@ reconcile/gql_definitions/endpoints_discovery/apps.py,sha256=p3hvzvrtkCCQfQoJ3mi
 reconcile/gql_definitions/external_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/external_resources/aws_accounts.py,sha256=bRzfuPDLJvVJRx7IzqAJKnqpd7SBWdj3trI1rNPeYnU,2033
 reconcile/gql_definitions/external_resources/external_resources_modules.py,sha256=w07PFh526GaYnZRe-SH92MaxA-aeD2TDT2kG_3Da_HE,3241
-reconcile/gql_definitions/external_resources/external_resources_namespaces.py,sha256=DGKKoJK7rOng2FBan8vxunLdlysX9Hb9_GTPsm2wyf8,46616
+reconcile/gql_definitions/external_resources/external_resources_namespaces.py,sha256=kb6-sHCAZ6-mW-4SGeLWex-MGQ69VkxpTsJQj1L-__Q,48172
 reconcile/gql_definitions/external_resources/external_resources_settings.py,sha256=RvAMgipgH3MoLfWaqCPaYUy8GS3v0Dr4Cod17OsaNx0,3567
 reconcile/gql_definitions/external_resources/fragments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/external_resources/fragments/external_resources_module_overrides.py,sha256=jjABgAhVx7LO3NJd9l90JH8s-_TJFvduBZRbdVquLfY,1313
@@ -417,7 +418,7 @@ reconcile/gql_definitions/terraform_cloudflare_dns/app_interface_cloudflare_dns_
 reconcile/gql_definitions/terraform_cloudflare_dns/terraform_cloudflare_zones.py,sha256=F9A6csePJZNUxr0N7-8CC_RcZ4RPMdNwuFMaBtXZqzQ,5817
 reconcile/gql_definitions/terraform_cloudflare_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_cloudflare_resources/terraform_cloudflare_accounts.py,sha256=Wd6i1oo5WxlyXHeab2GuyXL8xgpm1NXCphCyMdQ2MLw,3707
-reconcile/gql_definitions/terraform_cloudflare_resources/terraform_cloudflare_resources.py,sha256=4oLz5UbTbQJPnZ_X-pCzUafvgSH2f0JzMUnmfeFx_sg,12244
+reconcile/gql_definitions/terraform_cloudflare_resources/terraform_cloudflare_resources.py,sha256=btJaFYHp1jxOXEsScRTIgLDlgoyytTdFBFBHvH7ymjY,12257
 reconcile/gql_definitions/terraform_cloudflare_users/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_cloudflare_users/app_interface_setting_cloudflare_and_vault.py,sha256=gRxCfy4X9otRyOHtTo038gdYYD3lJ6FTz0yiGavGbfY,1956
 reconcile/gql_definitions/terraform_cloudflare_users/terraform_cloudflare_roles.py,sha256=CFYS6kM0q3Wqrsyr7zhCLfeAkVK_Z6pD5xmkMwOyrG4,4012
@@ -665,7 +666,7 @@ reconcile/utils/terraform_client.py,sha256=VexlnYM9h-2-g6Y8HiE48BFi8AX-mYLhIapl2
 reconcile/utils/terrascript_aws_client.py,sha256=qazXB2Re1DFReDcHwplcIF7_SmlE__z0XJv6hvd0L50,307485
 reconcile/utils/three_way_diff_strategy.py,sha256=yDEbP3HWvDDVzo_8FEbcT0pA6lz72HviXZkh5wmzkkY,4837
 reconcile/utils/throughput.py,sha256=KNDCVsCLSp89V4pO3sEUd7bJUuh6gNfsxsc_18rEv_Y,357
-reconcile/utils/vault.py,sha256=e5zo-PmqG6ccp87-Ip6d3_RPZ1eZEtawS1WbRAVP73Y,15366
+reconcile/utils/vault.py,sha256=6gYe-EKrYnz3SI_JM8gSpbXT9yfMrwDAw23kgiH7pV4,15573
 reconcile/utils/vcs.py,sha256=RDqe4bz01n_oU4VJRjSbbmWn-yqvFNCKCkC8JXgSfuU,10304
 reconcile/utils/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/utils/acs/base.py,sha256=G10mrztmTbdwcSuuXu4cp5gGH2Ogv9vZAAOBQUdl7e0,2625
@@ -776,11 +777,11 @@ tools/app_sre_tekton_access_reporter.py,sha256=5qmkevJdlb2j_lpGC5Pu1Pmo0eomX5Zxz
 tools/app_sre_tekton_access_revalidation.py,sha256=vwL1o_j7oSTOhrHNH1znpgjA2LHGzb8yc5iG3aaY4m0,2684
 tools/glitchtip_access_reporter.py,sha256=wnaiDGW4MkYONV_erltnJ6nGkEj0kQrAiv04NNnOS0k,2859
 tools/glitchtip_access_revalidation.py,sha256=jjeLO53LTbz_LfQw3G2Cs8lVLO_6xqU39BYyTH3cEPE,2764
-tools/qontract_cli.py,sha256=DZU_DuN28IdqIZCykD06-Ze-zSrE9aKGU3a1ZEFIUIk,160262
+tools/qontract_cli.py,sha256=70fp6gxuEjvEDooqThUyPV6AuXk2UjCFq9rp3-i6bUw,160266
 tools/template_validation.py,sha256=imLeY5zYE_ITk0yl99pqkoqcG2psFG0jLYKTZ7NXLcY,3393
 tools/cli_commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 tools/cli_commands/container_images_report.py,sha256=8mAjCS6XR0yD7k0mfiVBlt6xbYU47q_ftdYNi5o5VKE,5566
-tools/cli_commands/erv2.py,sha256=LTZ_9aZVEonTD65Rbd5BpkK1loh3WemmyX4xJBj6YwI,26081
+tools/cli_commands/erv2.py,sha256=0qx-BZJex4SUNpnSxlIkr3r7buOzjmMHhmB46C9cnJ0,24051
 tools/cli_commands/gpg_encrypt.py,sha256=EzCR3JvlCfO-a8VLG-mArD3edwM-aa0mUrDj1y0_NW0,5032
 tools/cli_commands/systems_and_tools.py,sha256=cBSHPOzjWhbYVFr50zsre5vGcVnovFkrZVSGsssUgqU,16985
 tools/cli_commands/cost_report/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -802,7 +803,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=uQv2QJAmUXP1g2GPIH30WTlvL9soY6m9lefpZEVDM5w,3965
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=KcYVfa3UmJHVP_ocgrKe8NkrO5IDB9aWEDydSokPcRk,975
-qontract_reconcile-0.10.2.dev476.dist-info/METADATA,sha256=mAm_YQtL6ZrhALV1PX-EnnQmdunNb3rFar3g0qbKxyU,24948
-qontract_reconcile-0.10.2.dev476.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-qontract_reconcile-0.10.2.dev476.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev476.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev478.dist-info/METADATA,sha256=vyQsjxw1NoAHqnLG1q2_-8QMpttGry95GFqp6ZdtNJc,24948
+qontract_reconcile-0.10.2.dev478.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+qontract_reconcile-0.10.2.dev478.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev478.dist-info/RECORD,,

reconcile/external_resources/cloudflare.py

@@ -0,0 +1,80 @@
+from abc import ABC, abstractmethod
+from typing import Any
+
+from reconcile.external_resources.model import (
+    ExternalResource,
+    ExternalResourceKey,
+    ExternalResourceModuleConfiguration,
+    ExternalResourcesInventory,
+)
+from reconcile.utils.exceptions import SecretIncompleteError
+from reconcile.utils.external_resource_spec import (
+    ExternalResourceSpec,
+)
+from reconcile.utils.external_resources import ResourceValueResolver
+from reconcile.utils.secret_reader import SecretReaderBase
+
+
+class CloudflareResourceFactory(ABC):
+    def __init__(
+        self, er_inventory: ExternalResourcesInventory, secret_reader: SecretReaderBase
+    ):
+        self.er_inventory = er_inventory
+        self.secret_reader = secret_reader
+
+    @abstractmethod
+    def resolve(
+        self,
+        spec: ExternalResourceSpec,
+        module_conf: ExternalResourceModuleConfiguration,
+    ) -> dict[str, Any]: ...
+
+    @abstractmethod
+    def validate(
+        self,
+        resource: ExternalResource,
+        module_conf: ExternalResourceModuleConfiguration,
+    ) -> None: ...
+
+    def find_linked_resources(
+        self, spec: ExternalResourceSpec
+    ) -> set[ExternalResourceKey]:
+        """Method to find dependant resources. Resources in this list
+        will be reconciled every time the parent resource finishes its reconciliation."""
+        return set()
+
+
+def get_account_id(
+    secret_reader: SecretReaderBase, api_credentials: dict[str, Any]
+) -> str:
+    creds = secret_reader.read_all(api_credentials)
+    account_id = creds.get("account_id")
+    if not account_id:
+        raise SecretIncompleteError(
+            f"secret {api_credentials['path']} incomplete: account_id missing"
+        )
+    return account_id
+
+
+class CloudflareDefaultResourceFactory(CloudflareResourceFactory):
+    def resolve(
+        self,
+        spec: ExternalResourceSpec,
+        module_conf: ExternalResourceModuleConfiguration,
+    ) -> dict[str, Any]:
+        account_id = get_account_id(
+            self.secret_reader,
+            spec.provisioner["api_credentials"],
+        )
+        resolved_values = ResourceValueResolver(
+            spec=spec, identifier_as_value=True
+        ).resolve()
+        return resolved_values | {
+            "account_id": account_id,
+        }
+
+    def validate(
+        self,
+        resource: ExternalResource,
+        module_conf: ExternalResourceModuleConfiguration,
+    ) -> None: ...

reconcile/external_resources/factories.py

@@ -11,6 +11,10 @@ from reconcile.external_resources.aws import (
     AWSRdsFactory,
     AWSResourceFactory,
 )
+from reconcile.external_resources.cloudflare import (
+    CloudflareDefaultResourceFactory,
+    CloudflareResourceFactory,
+)
 from reconcile.external_resources.meta import QONTRACT_INTEGRATION
 from reconcile.external_resources.model import (
     ExternalResource,
@@ -171,3 +175,67 @@ class AWSExternalResourceFactory(ExternalResourceFactory):
     ) -> set[ExternalResourceKey]:
         f = self.resource_factories.get_factory(spec.provider)
         return f.find_linked_resources(spec)
+
+
+def setup_cloudflare_resource_factories(
+    er_inventory: ExternalResourcesInventory, secret_reader: SecretReaderBase
+) -> ObjectFactory[CloudflareResourceFactory]:
+    return ObjectFactory[CloudflareResourceFactory](
+        factories={},
+        default_factory=CloudflareDefaultResourceFactory(er_inventory, secret_reader),
+    )
+
+
+class CloudflareExternalResourceFactory(ExternalResourceFactory):
+    def __init__(
+        self,
+        module_inventory: ModuleInventory,
+        er_inventory: ExternalResourcesInventory,
+        secret_reader: SecretReaderBase,
+        provision_factories: ObjectFactory[ModuleProvisionDataFactory],
+        resource_factories: ObjectFactory[CloudflareResourceFactory],
+    ):
+        self.provision_factories = provision_factories
+        self.resource_factories = resource_factories
+        self.module_inventory = module_inventory
+        self.er_inventory = er_inventory
+        self.secret_reader = secret_reader
+
+    def create_external_resource(
+        self,
+        spec: ExternalResourceSpec,
+        module_conf: ExternalResourceModuleConfiguration,
+    ) -> ExternalResource:
+        f = self.resource_factories.get_factory(spec.provider)
+        data = f.resolve(spec, module_conf)
+
+        module_type = self.module_inventory.get_from_spec(spec).module_type
+        provision_factory = self.provision_factories.get_factory(module_type)
+        module_provision_data = provision_factory.create_provision_data(spec)
+
+        provision = ExternalResourceProvision(
+            provision_provider=spec.provision_provider,
+            provisioner=spec.provisioner_name,
+            provider=spec.provider,
+            identifier=spec.identifier,
+            target_cluster=spec.cluster_name,
+            target_namespace=spec.namespace_name,
+            target_secret_name=spec.output_resource_name,
+            module_provision_data=module_provision_data,
+        )
+
+        return ExternalResource(data=data, provision=provision)
+
+    def validate_external_resource(
+        self,
+        resource: ExternalResource,
+        module_conf: ExternalResourceModuleConfiguration,
+    ) -> None:
+        f = self.resource_factories.get_factory(resource.provision.provider)
+        f.validate(resource, module_conf)
+
+    def find_linked_resources(
+        self, spec: ExternalResourceSpec
+    ) -> set[ExternalResourceKey]:
+        f = self.resource_factories.get_factory(spec.provider)
+        return f.find_linked_resources(spec)

reconcile/external_resources/manager.py

@@ -7,11 +7,13 @@ from sretoolbox.utils import threaded
 
 from reconcile.external_resources.factories import (
     AWSExternalResourceFactory,
+    CloudflareExternalResourceFactory,
     ExternalResourceFactory,
     ModuleProvisionDataFactory,
     ObjectFactory,
     TerraformModuleProvisionDataFactory,
     setup_aws_resource_factories,
+    setup_cloudflare_resource_factories,
 )
 from reconcile.external_resources.metrics import publish_metrics
 from reconcile.external_resources.model import (
@@ -55,6 +57,9 @@ def setup_factories(
     secret_reader: SecretReaderBase,
 ) -> ObjectFactory[ExternalResourceFactory]:
     tf_factory = TerraformModuleProvisionDataFactory(settings=settings)
+    provision_factories = ObjectFactory[ModuleProvisionDataFactory](
+        factories={"terraform": tf_factory}
+    )
 
     return ObjectFactory[ExternalResourceFactory](
         factories={
@@ -62,14 +67,21 @@ def setup_factories(
                 module_inventory=module_inventory,
                 er_inventory=er_inventory,
                 secret_reader=secret_reader,
-                provision_factories=ObjectFactory[ModuleProvisionDataFactory](
-                    factories={"terraform": tf_factory, "cdktf": tf_factory}
-                ),
+                provision_factories=provision_factories,
                 resource_factories=setup_aws_resource_factories(
                     er_inventory, secret_reader
                 ),
                 default_tags=cast("dict[str, str]", settings.default_tags),
-            )
+            ),
+            "cloudflare": CloudflareExternalResourceFactory(
+                module_inventory=module_inventory,
+                er_inventory=er_inventory,
+                secret_reader=secret_reader,
+                provision_factories=provision_factories,
+                resource_factories=setup_cloudflare_resource_factories(
+                    er_inventory, secret_reader
+                ),
+            ),
         }
     )
 

reconcile/external_resources/model.py

@@ -15,6 +15,8 @@ from reconcile.gql_definitions.external_resources.external_resources_modules imp
 )
 from reconcile.gql_definitions.external_resources.external_resources_namespaces import (
     NamespaceTerraformProviderResourceAWSV1,
+    NamespaceTerraformProviderResourceCloudflareV1,
+    NamespaceTerraformResourceCloudflareZoneV1,
     NamespaceTerraformResourceCloudWatchV1,
     NamespaceTerraformResourceElastiCacheV1,
     NamespaceTerraformResourceKMSV1,
@@ -90,7 +92,10 @@ class ExternalResourceKey(BaseModel, frozen=True):
         return f"{self.provision_provider}/{self.provisioner_name}/{self.provider}/{self.identifier}"
 
 
-SUPPORTED_RESOURCE_PROVIDERS = NamespaceTerraformProviderResourceAWSV1
+SUPPORTED_RESOURCE_PROVIDERS = (
+    NamespaceTerraformProviderResourceAWSV1
+    | NamespaceTerraformProviderResourceCloudflareV1
+)
 SUPPORTED_RESOURCE_TYPES = (
     NamespaceTerraformResourceRDSV1
     | NamespaceTerraformResourceMskV1
@@ -98,6 +103,7 @@ SUPPORTED_RESOURCE_TYPES = (
     | NamespaceTerraformResourceKMSV1
     | NamespaceTerraformResourceCloudWatchV1
     | NamespaceTerraformResourceRDSProxyV1
+    | NamespaceTerraformResourceCloudflareZoneV1
 )
 
 
@@ -138,7 +144,8 @@ class ExternalResourcesInventory(MutableMapping):
                     FLAG_RESOURCE_MANAGED_BY_ERV2,
                     FLAG_DELETE_RESOURCE,
                     MODULE_OVERRIDES,
-                }
+                },
+                by_alias=True,
             ),
             namespace=namespace.model_dump(by_alias=True),
         )
@@ -406,7 +413,7 @@ class ModuleProvisionData(BaseModel):
 
 
 class TerraformModuleProvisionData(ModuleProvisionData):
-    """Specific Provision Options for modules based on Terraform or CDKTF"""
+    """Specific Provision Options for modules based on Terraform"""
 
     tf_state_bucket: str
     tf_state_region: str

reconcile/external_resources/reconciler.py

@@ -6,6 +6,7 @@ from typing import Any
 from kubernetes.client import (
     V1Container,
     V1EmptyDirVolumeSource,
+    V1EnvFromSource,
     V1EnvVar,
     V1EnvVarSource,
     V1JobSpec,
@@ -15,6 +16,7 @@ from kubernetes.client import (
     V1PodSpec,
     V1PodTemplateSpec,
     V1ResourceRequirements,
+    V1SecretEnvSource,
     V1SecretVolumeSource,
     V1Volume,
     V1VolumeMount,
@@ -116,6 +118,14 @@ class ReconciliationK8sJob(K8sJob, BaseModel, frozen=True):
                     value=self.reconciliation.action.value,
                 ),
             ],
+            env_from=[
+                V1EnvFromSource(
+                    secret_ref=V1SecretEnvSource(
+                        name=f"dotenv-{self.reconciliation.key.provision_provider}-{self.reconciliation.key.provisioner_name}",
+                        optional=True,
+                    )
+                ),
+            ],
             volume_mounts=[
                 V1VolumeMount(
                     name="credentials",
@@ -192,7 +202,7 @@ class ReconciliationK8sJob(K8sJob, BaseModel, frozen=True):
                         V1Volume(
                             name="credentials",
                             secret=V1SecretVolumeSource(
-                                secret_name=f"credentials-{self.reconciliation.key.provisioner_name}",
+                                secret_name=f"credentials-{self.reconciliation.key.provision_provider}-{self.reconciliation.key.provisioner_name}",
                             ),
                         ),
                         V1Volume(

reconcile/gql_definitions/external_resources/external_resources_namespaces.py

@@ -570,6 +570,26 @@ query ExternalResourcesNamespaces {
           }
         }
       }
+      ... on NamespaceTerraformProviderResourceCloudflare_v1 {
+        provisioner {
+          name
+          apiCredentials {
+          ...VaultSecret
+          }
+        }
+        resources {
+          ... on NamespaceTerraformResourceCloudflareZone_v1 {
+            provider
+            identifier
+            defaults
+            delete
+            managed_by_erv2
+            module_overrides {
+              ...ExternalResourcesModuleOverrides
+            }
+          }
+        }
+      }
     }
     environment {
       name
@@ -1173,6 +1193,29 @@ class NamespaceTerraformProviderResourceAWSV1(NamespaceExternalResourceV1):
     resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceRDSProxyV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
 
 
+class CloudflareAccountV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    api_credentials: VaultSecret = Field(..., alias="apiCredentials")
+
+
+class NamespaceTerraformResourceCloudflareV1(ConfiguredBaseModel):
+    ...
+
+
+class NamespaceTerraformResourceCloudflareZoneV1(NamespaceTerraformResourceCloudflareV1):
+    provider: str = Field(..., alias="provider")
+    identifier: str = Field(..., alias="identifier")
+    defaults: str = Field(..., alias="defaults")
+    delete: Optional[bool] = Field(..., alias="delete")
+    managed_by_erv2: Optional[bool] = Field(..., alias="managed_by_erv2")
+    module_overrides: Optional[ExternalResourcesModuleOverrides] = Field(..., alias="module_overrides")
+
+
+class NamespaceTerraformProviderResourceCloudflareV1(NamespaceExternalResourceV1):
+    provisioner: CloudflareAccountV1 = Field(..., alias="provisioner")
+    resources: list[Union[NamespaceTerraformResourceCloudflareZoneV1, NamespaceTerraformResourceCloudflareV1]] = Field(..., alias="resources")
+
+
 class EnvironmentV1(ConfiguredBaseModel):
     name: str = Field(..., alias="name")
     labels: str = Field(..., alias="labels")
@@ -1213,7 +1256,7 @@ class NamespaceV1(ConfiguredBaseModel):
     delete: Optional[bool] = Field(..., alias="delete")
     cluster_admin: Optional[bool] = Field(..., alias="clusterAdmin")
     managed_external_resources: Optional[bool] = Field(..., alias="managedExternalResources")
-    external_resources: Optional[list[Union[NamespaceTerraformProviderResourceAWSV1, NamespaceExternalResourceV1]]] = Field(..., alias="externalResources")
+    external_resources: Optional[list[Union[NamespaceTerraformProviderResourceAWSV1, NamespaceTerraformProviderResourceCloudflareV1, NamespaceExternalResourceV1]]] = Field(..., alias="externalResources")
     environment: EnvironmentV1 = Field(..., alias="environment")
     app: AppV1 = Field(..., alias="app")
     cluster: NamespaceV1_ClusterV1 = Field(..., alias="cluster")

reconcile/gql_definitions/introspection.json

@@ -42711,6 +42711,22 @@
                             "isDeprecated": false,
                             "deprecationReason": null
                         },
+                        {
+                            "name": "defaults",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "NON_NULL",
+                                "name": null,
+                                "ofType": {
+                                    "kind": "SCALAR",
+                                    "name": "String",
+                                    "ofType": null
+                                }
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
                         {
                             "name": "zone",
                             "description": null,
@@ -42727,6 +42743,42 @@
                             "isDeprecated": false,
                             "deprecationReason": null
                         },
+                        {
+                            "name": "delete",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "Boolean",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "managed_by_erv2",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "Boolean",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "module_overrides",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "OBJECT",
+                                "name": "ExternalResourcesModuleOverrides_v1",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
                         {
                             "name": "plan",
                             "description": null,
@@ -42800,7 +42852,7 @@
                             "deprecationReason": null
                         },
                         {
-                            "name": "records",
+                            "name": "dns_records",
                             "description": null,
                             "args": [],
                             "type": {
@@ -42891,6 +42943,113 @@
                     "enumValues": null,
                     "possibleTypes": null
                 },
+                {
+                    "kind": "OBJECT",
+                    "name": "ExternalResourcesModuleOverrides_v1",
+                    "description": null,
+                    "fields": [
+                        {
+                            "name": "module_type",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "channel",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "image",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "version",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "reconcile_timeout_minutes",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "Int",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "outputs_secret_image",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "outputs_secret_version",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "String",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
+                        {
+                            "name": "resources",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "OBJECT",
+                                "name": "DeployResources_v1",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        }
+                    ],
+                    "inputFields": null,
+                    "interfaces": [],
+                    "enumValues": null,
+                    "possibleTypes": null
+                },
                 {
                     "kind": "OBJECT",
                     "name": "CloudflareZoneArgo_v1",
@@ -45058,113 +45217,6 @@
                     "enumValues": null,
                     "possibleTypes": null
                 },
-                {
-                    "kind": "OBJECT",
-                    "name": "ExternalResourcesModuleOverrides_v1",
-                    "description": null,
-                    "fields": [
-                        {
-                            "name": "module_type",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "channel",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "image",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "version",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "reconcile_timeout_minutes",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "Int",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "outputs_secret_image",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "outputs_secret_version",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "SCALAR",
-                                "name": "String",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        },
-                        {
-                            "name": "resources",
-                            "description": null,
-                            "args": [],
-                            "type": {
-                                "kind": "OBJECT",
-                                "name": "DeployResources_v1",
-                                "ofType": null
-                            },
-                            "isDeprecated": false,
-                            "deprecationReason": null
-                        }
-                    ],
-                    "inputFields": null,
-                    "interfaces": [],
-                    "enumValues": null,
-                    "possibleTypes": null
-                },
                 {
                     "kind": "OBJECT",
                     "name": "NamespaceTerraformResourceRDS_v1",

reconcile/gql_definitions/terraform_cloudflare_resources/terraform_cloudflare_resources.py

@@ -104,7 +104,7 @@ query TerraformCloudflareResources {
             cache_reserve {
               enabled
             }
-            records {
+            records: dns_records {
               identifier
               name
               type

reconcile/utils/vault.py

@@ -185,7 +185,10 @@ class VaultClient:
                         mount_point=self.kube_auth_mount,
                     )
                 except Exception as e:
-                    LOG.error(e)
+                    LOG.error(
+                        f"Failed to authenticate to Vault server {self._client.url} "
+                        f"using role '{self.kube_auth_role}' on mount '{self.kube_auth_mount}': {e}"
+                    )
         else:
             self._client.auth_approle(self.role_id, self.secret_id)
 

tools/cli_commands/erv2.py

@@ -170,62 +170,6 @@ class Erv2Cli:
             else:
                 rich_print("[b red]External Resource does not exist")
 
-    def build_cdktf(self, credentials: Path) -> None:
-        """Run the CDKTF container and return the generated CDKTF json."""
-        input_file = self.temp / "input.json"
-        input_file.write_text(self.input_data)
-
-        # delete previous ERv2 container
-        run(["docker", "rm", "-f", "erv2"], capture_output=True, check=True)
-
-        try:
-            cdktf_outdir = "/tmp/cdktf.out"
-
-            # run cdktf synth
-            with task(self.progress_spinner, "-- Running CDKTF synth"):
-                run(["docker", "pull", self.image], check=True, capture_output=True)
-                run(
-                    [
-                        "docker",
-                        "run",
-                        "--name",
-                        "erv2",
-                        "-v",
-                        f"{input_file!s}:/inputs/input.json:Z",
-                        "-v",
-                        f"{credentials!s}:/credentials:Z",
-                        "-e",
-                        "AWS_SHARED_CREDENTIALS_FILE=/credentials",
-                        "--entrypoint",
-                        "cdktf",
-                        self.image,
-                        "synth",
-                        "--output",
-                        cdktf_outdir,
-                    ],
-                    check=True,
-                    capture_output=True,
-                )
-
-            # # get the cdk.tf.json
-            with task(self.progress_spinner, "-- Copying the generated cdk.tf.json"):
-                run(
-                    [
-                        "docker",
-                        "cp",
-                        f"erv2:{cdktf_outdir}/stacks/CDKTF/cdk.tf.json",
-                        str(self.temp),
-                    ],
-                    check=True,
-                    capture_output=True,
-                )
-        except CalledProcessError as e:
-            if e.stderr:
-                print(e.stderr.decode("utf-8"))
-            if e.stdout:
-                print(e.stdout.decode("utf-8"))
-            raise
-
     def build_terraform(self, credentials: Path) -> None:
         input_file = self.temp / "input.json"
         input_file.write_text(self.input_data)
@@ -323,7 +267,7 @@ class Erv2Cli:
             raise
 
     def force_unlock(self, credentials: Path, lock_id: str) -> None:
-        """Run 'terraform force-unlock' in a CDKTF container."""
+        """Run 'terraform force-unlock' in a terraform container."""
         input_file = self.temp / "input.json"
         input_file.write_text(self.input_data)
 

tools/qontract_cli.py

@@ -4430,7 +4430,7 @@ def request_reconciliation(ctx: click.Context) -> None:
 )
 @click.option(
     "--skip-build/--no-skip-build",
-    help="Skip/Do not skip the terraform and CDKTF builds. Default: build everything!",
+    help="Skip/Do not skip the terraform builds. Default: build everything!",
     default=False,
 )
 @click.pass_context
@@ -4463,8 +4463,8 @@ def migrate(ctx: click.Context, dry_run: bool, skip_build: bool) -> None:
     temp_tfr.mkdir(exist_ok=True)
 
     with progress_spinner() as progress:
-        with task(progress, "Preparing AWS credentials for CDKTF and local terraform"):
-            # prepare AWS credentials for CDKTF and local terraform
+        with task(progress, "Preparing AWS credentials for local terraform"):
+            # prepare AWS credentials for local terraform
             credentials_file = tempdir / "credentials"
             credentials_file.write_text(
                 _get_external_resources_credentials(
@@ -4486,10 +4486,10 @@ def migrate(ctx: click.Context, dry_run: bool, skip_build: bool) -> None:
 
         with task(progress, "(erv2) Building the terraform configuration"):
             if not skip_build:
-                if erv2cli.module_type == "cdktf":
-                    erv2cli.build_cdktf(credentials_file)
-                else:
+                if erv2cli.module_type == "terraform":
                     erv2cli.build_terraform(credentials_file)
+                else:
+                    raise ValueError(f"Unsupported module type: {erv2cli.module_type}")
             erv2_tf_cli = TerraformCli(
                 temp_erv2, dry_run=dry_run, progress_spinner=progress
             )