qontract-reconcile 0.10.2.dev481__tar.gz → 0.10.2.dev484__tar.gz

{qontract_reconcile-0.10.2.dev481 → qontract_reconcile-0.10.2.dev484}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev481
+Version: 0.10.2.dev484
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev481 → qontract_reconcile-0.10.2.dev484}/reconcile/cli.py

@@ -776,16 +776,25 @@ def github_validator(ctx: click.Context) -> None:
 @use_jump_host()
 @click.pass_context
 def openshift_clusterrolebindings(
-    ctx: click.Context, thread_pool_size: int, internal: bool, use_jump_host: bool
+    ctx: click.Context,
+    thread_pool_size: int,
+    internal: bool,
+    use_jump_host: bool,
 ) -> None:
-    import reconcile.openshift_clusterrolebindings
+    from reconcile.openshift_bindings.openshift_clusterrolebindings import (
+        OpenShiftClusterRoleBindingsIntegration,
+        OpenShiftClusterRoleBindingsIntegrationParams,
+    )
 
-    run_integration(
-        reconcile.openshift_clusterrolebindings,
-        ctx,
-        thread_pool_size,
-        internal,
-        use_jump_host,
+    run_class_integration(
+        integration=OpenShiftClusterRoleBindingsIntegration(
+            OpenShiftClusterRoleBindingsIntegrationParams(
+                thread_pool_size=thread_pool_size,
+                internal=internal,
+                use_jump_host=use_jump_host,
+            )
+        ),
+        ctx=ctx,
     )
 
 
@@ -808,15 +817,21 @@ def openshift_rolebindings(
     use_jump_host: bool,
     support_role_ref: bool,
 ) -> None:
-    import reconcile.openshift_rolebindings
+    from reconcile.openshift_bindings.openshift_rolebindings import (
+        OpenShiftRoleBindingsIntegration,
+        OpenShiftRoleBindingsIntegrationParams,
+    )
 
-    run_integration(
-        reconcile.openshift_rolebindings,
-        ctx,
-        thread_pool_size,
-        internal,
-        use_jump_host,
-        support_role_ref,
+    run_class_integration(
+        integration=OpenShiftRoleBindingsIntegration(
+            OpenShiftRoleBindingsIntegrationParams(
+                thread_pool_size=thread_pool_size,
+                internal=internal,
+                use_jump_host=use_jump_host,
+                support_role_ref=support_role_ref,
+            )
+        ),
+        ctx=ctx,
     )
 
 

qontract_reconcile-0.10.2.dev484/reconcile/gql_definitions/common/app_interface_clusterrole.py

@@ -0,0 +1,104 @@
+"""
+Generated by qenerate plugin=pydantic_v2. DO NOT MODIFY MANUALLY!
+"""
+from collections.abc import Callable  # noqa: F401 # pylint: disable=W0611
+from datetime import datetime  # noqa: F401 # pylint: disable=W0611
+from enum import Enum  # noqa: F401 # pylint: disable=W0611
+from typing import (  # noqa: F401 # pylint: disable=W0611
+    Any,
+    Optional,
+    Union,
+)
+
+from pydantic import (  # noqa: F401 # pylint: disable=W0611
+    BaseModel,
+    ConfigDict,
+    Field,
+    Json,
+)
+
+
+DEFINITION = """
+query AppInterfaceClusterRoles {
+    clusterRoles: roles_v1 {
+    name
+    users {
+      org_username
+      github_username
+    }
+    bots {
+      openshift_serviceaccount
+    }
+    access {
+      cluster {
+        name
+        auth {
+          service
+        }
+      }
+      clusterRole
+    }
+    expirationDate
+  }
+}
+"""
+
+
+class ConfiguredBaseModel(BaseModel):
+    model_config = ConfigDict(
+        extra='forbid'
+    )
+
+
+class UserV1(ConfiguredBaseModel):
+    org_username: str = Field(..., alias="org_username")
+    github_username: str = Field(..., alias="github_username")
+
+
+class BotV1(ConfiguredBaseModel):
+    openshift_serviceaccount: Optional[str] = Field(..., alias="openshift_serviceaccount")
+
+
+class ClusterAuthV1(ConfiguredBaseModel):
+    service: str = Field(..., alias="service")
+
+
+class ClusterV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    auth: list[ClusterAuthV1] = Field(..., alias="auth")
+
+
+class AccessV1(ConfiguredBaseModel):
+    cluster: Optional[ClusterV1] = Field(..., alias="cluster")
+    cluster_role: Optional[str] = Field(..., alias="clusterRole")
+
+
+class RoleV1(ConfiguredBaseModel):
+    name: str = Field(..., alias="name")
+    users: list[UserV1] = Field(..., alias="users")
+    bots: list[BotV1] = Field(..., alias="bots")
+    access: Optional[list[AccessV1]] = Field(..., alias="access")
+    expiration_date: Optional[str] = Field(..., alias="expirationDate")
+
+
+class AppInterfaceClusterRolesQueryData(ConfiguredBaseModel):
+    cluster_roles: Optional[list[RoleV1]] = Field(..., alias="clusterRoles")
+
+
+def query(query_func: Callable, **kwargs: Any) -> AppInterfaceClusterRolesQueryData:
+    """
+    This is a convenience function which queries and parses the data into
+    concrete types. It should be compatible with most GQL clients.
+    You do not have to use it to consume the generated data classes.
+    Alternatively, you can also mime and alternate the behavior
+    of this function in the caller.
+
+    Parameters:
+        query_func (Callable): Function which queries your GQL Server
+        kwargs: optional arguments that will be passed to the query function
+
+    Returns:
+        AppInterfaceClusterRolesQueryData: queried data parsed into generated classes
+    """
+    raw_data: dict[Any, Any] = query_func(DEFINITION, **kwargs)
+    return AppInterfaceClusterRolesQueryData(**raw_data)

qontract_reconcile-0.10.2.dev484/reconcile/openshift_bindings/constants.py

@@ -0,0 +1,7 @@
+OPENSHIFT_ROLEBINDINGS_INTEGRATION_NAME = "openshift-rolebindings"
+OPENSHIFT_CLUSTERROLEBINDINGS_INTEGRATION_NAME = "openshift-clusterrolebindings"
+
+ROLE_BINDING_RESOURCE_KIND = "RoleBinding"
+CLUSTER_ROLE_BINDING_RESOURCE_KIND = "ClusterRoleBinding"
+ROLE_KIND = "Role"
+CLUSTER_ROLE_KIND = "ClusterRole"

qontract_reconcile-0.10.2.dev484/reconcile/openshift_bindings/models.py

@@ -0,0 +1,264 @@
+"""Shared data models for openshift-rolebindings and openshift-clusterrolebindings integrations."""
+
+from collections.abc import Sequence
+from typing import Any, Self
+
+from pydantic import BaseModel
+
+import reconcile.openshift_base as ob
+from reconcile.gql_definitions.common.app_interface_clusterrole import (
+    BotV1 as ClusterBotV1,
+)
+from reconcile.gql_definitions.common.app_interface_clusterrole import (
+    ClusterV1 as ClusterRoleClusterV1,
+)
+from reconcile.gql_definitions.common.app_interface_clusterrole import (
+    RoleV1 as ClusterRoleV1,
+)
+from reconcile.gql_definitions.common.app_interface_clusterrole import (
+    UserV1 as ClusterUserV1,
+)
+from reconcile.gql_definitions.common.app_interface_roles import (
+    AccessV1,
+    NamespaceV1,
+    RoleV1,
+    UserV1,
+)
+from reconcile.gql_definitions.common.app_interface_roles import (
+    BotV1 as RoleBotV1,
+)
+from reconcile.gql_definitions.common.app_interface_roles import (
+    ClusterV1 as RoleClusterV1,
+)
+from reconcile.openshift_bindings.constants import (
+    CLUSTER_ROLE_BINDING_RESOURCE_KIND,
+    CLUSTER_ROLE_KIND,
+    ROLE_BINDING_RESOURCE_KIND,
+    ROLE_KIND,
+)
+from reconcile.openshift_bindings.utils import is_valid_namespace
+from reconcile.utils.openshift_resource import OpenshiftResource as OR
+
+
+def get_usernames_from_users(
+    users: Sequence[UserV1 | ClusterUserV1] | None,
+    user_keys: list[str] | None = None,
+) -> set[str]:
+    return {
+        name
+        for user in users or []
+        for user_key in user_keys or []
+        if (name := getattr(user, user_key, None))
+    }
+
+
+class OCResource(BaseModel, arbitrary_types_allowed=True):
+    """Represents an OpenShift resource with metadata."""
+
+    resource: OR
+    resource_name: str
+    privileged: bool = False
+
+
+class OCResourceData(BaseModel):
+    body: dict[str, Any]
+    name: str
+
+
+class ServiceAccountSpec(BaseModel):
+    """Service account specification with namespace and name."""
+
+    sa_namespace_name: str
+    sa_name: str
+
+    @classmethod
+    def from_bots(cls, bots: Sequence[RoleBotV1 | ClusterBotV1] | None) -> list[Self]:
+        """Create ServiceAccountSpec list from bot configurations."""
+        return [
+            cls(
+                sa_namespace_name=full_service_account[0],
+                sa_name=full_service_account[1],
+            )
+            for bot in bots or []
+            if bot.openshift_serviceaccount
+            and (full_service_account := bot.openshift_serviceaccount.split("/"))
+            and len(full_service_account) == 2
+        ]
+
+
+class BindingSpec(BaseModel, arbitrary_types_allowed=True):
+    """Base specification for role bindings (cluster or namespace scoped)."""
+
+    role_name: str
+    role_kind: str  # "Role" or "ClusterRole"
+    cluster: RoleClusterV1 | ClusterRoleClusterV1
+    resource_kind: str
+    usernames: set[str]
+    openshift_service_accounts: list[ServiceAccountSpec]
+
+    def get_oc_resources(self) -> list[OCResourceData]:
+        user_oc_resources = [
+            self.construct_user_oc_resource(username) for username in self.usernames
+        ]
+        sa_oc_resources = [
+            self.construct_sa_oc_resource(sa.sa_namespace_name, sa.sa_name)
+            for sa in self.openshift_service_accounts
+        ]
+        return user_oc_resources + sa_oc_resources
+
+    def construct_user_oc_resource(self, username: str) -> OCResourceData:
+        name = f"{self.role_name}-{username}"
+        body: dict[str, Any] = {
+            "apiVersion": "rbac.authorization.k8s.io/v1",
+            "kind": self.resource_kind,
+            "metadata": {"name": name},
+            "roleRef": {"kind": self.role_kind, "name": self.role_name},
+            "subjects": [{"kind": "User", "name": username}],
+        }
+        return OCResourceData(body=body, name=name)
+
+    def construct_sa_oc_resource(
+        self, sa_namespace_name: str, sa_name: str
+    ) -> OCResourceData:
+        name = f"{self.role_name}-{sa_namespace_name}-{sa_name}"
+        body: dict[str, Any] = {
+            "apiVersion": "rbac.authorization.k8s.io/v1",
+            "kind": self.resource_kind,
+            "metadata": {"name": name},
+            "roleRef": {"kind": self.role_kind, "name": self.role_name},
+            "subjects": [
+                {
+                    "kind": "ServiceAccount",
+                    "name": sa_name,
+                    "namespace": sa_namespace_name,
+                }
+            ],
+        }
+        return OCResourceData(body=body, name=name)
+
+    def get_openshift_resources(
+        self,
+        integration_name: str,
+        integration_version: str,
+        privileged: bool = False,
+    ) -> list[OCResource]:
+        oc_resources = [
+            OCResource(
+                resource=OR(
+                    oc_resource_data.body,
+                    integration_name,
+                    integration_version,
+                    error_details=oc_resource_data.name,
+                ),
+                resource_name=oc_resource_data.name,
+                privileged=privileged,
+            )
+            for oc_resource_data in self.get_oc_resources()
+        ]
+        return oc_resources
+
+
+class RoleBindingSpec(BindingSpec):
+    """Namespace-scoped RoleBinding specification."""
+
+    namespace: NamespaceV1
+    privileged: bool = False
+
+    @classmethod
+    def create_role_binding_spec(
+        cls,
+        access: AccessV1,
+        users: list[UserV1] | None = None,
+        enforced_user_keys: list[str] | None = None,
+        bots: list[RoleBotV1] | None = None,
+        support_role_ref: bool = False,
+    ) -> Self | None:
+        """Create a RoleBindingSpec from access configuration."""
+        if not access.namespace:
+            return None
+        if not (access.role or access.cluster_role):
+            return None
+        privileged = access.namespace.cluster_admin or False
+        auth_dict = [
+            auth.model_dump(by_alias=True) for auth in access.namespace.cluster.auth
+        ]
+        usernames = get_usernames_from_users(
+            users,
+            ob.determine_user_keys_for_access(
+                access.namespace.cluster.name,
+                auth_dict,
+                enforced_user_keys,
+            ),
+        )
+        service_accounts = ServiceAccountSpec.from_bots(bots) if bots else []
+        role_kind = ROLE_KIND if access.role and support_role_ref else CLUSTER_ROLE_KIND
+        return cls(
+            role_name=access.role or access.cluster_role,
+            role_kind=role_kind,
+            namespace=access.namespace,
+            cluster=access.namespace.cluster,
+            privileged=privileged,
+            usernames=usernames,
+            openshift_service_accounts=service_accounts,
+            resource_kind=ROLE_BINDING_RESOURCE_KIND,
+        )
+
+    @classmethod
+    def create_rb_specs_from_role(
+        cls,
+        role: RoleV1,
+        enforced_user_keys: list[str] | None = None,
+        support_role_ref: bool = False,
+    ) -> list[Self]:
+        """Create list of RoleBindingSpec from a role configuration."""
+        rolebinding_spec_list = [
+            role_binding_spec
+            for access in role.access or []
+            if (
+                access.namespace
+                and is_valid_namespace(access.namespace)
+                and (
+                    role_binding_spec := cls.create_role_binding_spec(
+                        access,
+                        role.users,
+                        enforced_user_keys,
+                        role.bots,
+                        support_role_ref,
+                    )
+                )
+            )
+        ]
+        return rolebinding_spec_list
+
+
+class ClusterRoleBindingSpec(BindingSpec):
+    """Cluster-scoped ClusterRoleBinding specification."""
+
+    @classmethod
+    def create_cluster_role_binding_specs(
+        cls, cluster_role: ClusterRoleV1
+    ) -> list[Self]:
+        cluster_role_binding_specs = [
+            cls(
+                cluster=access.cluster,
+                usernames=get_usernames_from_users(
+                    users=cluster_role.users,
+                    user_keys=cls.get_user_keys(access.cluster),
+                ),
+                openshift_service_accounts=ServiceAccountSpec.from_bots(
+                    cluster_role.bots
+                ),
+                role_name=access.cluster_role,
+                role_kind=CLUSTER_ROLE_KIND,
+                resource_kind=CLUSTER_ROLE_BINDING_RESOURCE_KIND,
+            )
+            for access in cluster_role.access or []
+            if access.cluster and access.cluster_role
+        ]
+        return cluster_role_binding_specs
+
+    @classmethod
+    def get_user_keys(cls, cluster: ClusterRoleClusterV1) -> list[str] | None:
+        auth_dict = [auth.model_dump(by_alias=True) for auth in cluster.auth]
+        user_keys = ob.determine_user_keys_for_access(cluster.name, auth_dict)
+        return user_keys

qontract_reconcile-0.10.2.dev484/reconcile/openshift_bindings/openshift_clusterrolebindings.py

@@ -0,0 +1,129 @@
+"""OpenShift ClusterRoleBindings integration.
+
+Manages cluster-scoped ClusterRoleBindings across OpenShift clusters.
+"""
+
+import sys
+from collections.abc import Callable
+from typing import TYPE_CHECKING
+
+import reconcile.openshift_base as ob
+from reconcile.openshift_bindings.constants import (
+    OPENSHIFT_CLUSTERROLEBINDINGS_INTEGRATION_NAME,
+)
+from reconcile.openshift_bindings.models import ClusterRoleBindingSpec
+from reconcile.typed_queries.app_interface_clusterroles import (
+    get_app_interface_clusterroles,
+)
+from reconcile.typed_queries.clusters import get_clusters
+from reconcile.utils import expiration
+from reconcile.utils.constants import DEFAULT_THREAD_POOL_SIZE
+from reconcile.utils.defer import defer
+from reconcile.utils.oc import OC_Map
+from reconcile.utils.openshift_resource import ResourceInventory
+from reconcile.utils.runtime.integration import (
+    PydanticRunParams,
+    QontractReconcileIntegration,
+)
+from reconcile.utils.semver_helper import make_semver
+
+if TYPE_CHECKING:
+    from reconcile.gql_definitions.common.app_interface_clusterrole import RoleV1
+
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+QONTRACT_INTEGRATION_MANAGED_TYPE = "ClusterRoleBinding.rbac.authorization.k8s.io"
+NAMESPACE_CLUSTER_SCOPE = "cluster"
+
+
+class OpenShiftClusterRoleBindingsIntegrationParams(PydanticRunParams):
+    thread_pool_size: int = DEFAULT_THREAD_POOL_SIZE
+    internal: bool | None = None
+    use_jump_host: bool = True
+
+
+class OpenShiftClusterRoleBindingsIntegration(
+    QontractReconcileIntegration[OpenShiftClusterRoleBindingsIntegrationParams],
+):
+    """Manages ClusterRoleBindings across OpenShift clusters."""
+
+    @defer
+    def run(self, dry_run: bool, defer: Callable | None = None) -> None:
+        ri, oc_map = self.fetch_current_state()
+        if defer:
+            defer(oc_map.cleanup)
+        self.fetch_desired_state(
+            ri,
+            allowed_clusters=set(oc_map.clusters()),
+        )
+        ob.publish_metrics(ri, self.name)
+        ob.realize_data(dry_run, oc_map, ri, self.params.thread_pool_size)
+        if ri.has_error_registered():
+            sys.exit(1)
+
+    @property
+    def name(self) -> str:
+        return OPENSHIFT_CLUSTERROLEBINDINGS_INTEGRATION_NAME
+
+    @property
+    def integration_version(self) -> str:
+        return QONTRACT_INTEGRATION_VERSION
+
+    def fetch_current_state(self) -> tuple[ResourceInventory, OC_Map]:
+        clusters = [
+            cluster.model_dump(by_alias=True)
+            for cluster in get_clusters()
+            if cluster.managed_cluster_roles and cluster.automation_token is not None
+        ]
+        return ob.fetch_current_state(
+            clusters=clusters,
+            thread_pool_size=self.params.thread_pool_size,
+            integration=self.name,
+            integration_version=self.integration_version,
+            override_managed_types=[QONTRACT_INTEGRATION_MANAGED_TYPE],
+            internal=self.params.internal,
+            use_jump_host=self.params.use_jump_host,
+        )
+
+    def fetch_desired_state(
+        self,
+        ri: ResourceInventory | None,
+        allowed_clusters: set[str] | None = None,
+    ) -> None:
+        if allowed_clusters is not None and not allowed_clusters:
+            return
+        if ri is None:
+            return
+        cluster_roles: list[RoleV1] = expiration.filter(
+            get_app_interface_clusterroles()
+        )
+        cluster_role_binding_specs = [
+            cluster_role_binding_spec
+            for cluster_role in cluster_roles
+            for cluster_role_binding_spec in ClusterRoleBindingSpec.create_cluster_role_binding_specs(
+                cluster_role
+            )
+        ]
+        if allowed_clusters:
+            cluster_role_binding_specs = [
+                cluster_role_binding_spec
+                for cluster_role_binding_spec in cluster_role_binding_specs
+                if cluster_role_binding_spec.cluster.name in allowed_clusters
+            ]
+        for cluster_role_binding_spec in cluster_role_binding_specs:
+            for oc_resource in cluster_role_binding_spec.get_openshift_resources(
+                self.name,
+                self.integration_version,
+            ):
+                if not ri.get_desired(
+                    cluster_role_binding_spec.cluster.name,
+                    NAMESPACE_CLUSTER_SCOPE,
+                    QONTRACT_INTEGRATION_MANAGED_TYPE,
+                    oc_resource.resource_name,
+                ):
+                    ri.add_desired(
+                        cluster=cluster_role_binding_spec.cluster.name,
+                        namespace=NAMESPACE_CLUSTER_SCOPE,
+                        resource_type=QONTRACT_INTEGRATION_MANAGED_TYPE,
+                        name=oc_resource.resource_name,
+                        value=oc_resource.resource,
+                    )