qontract-reconcile 0.9.1rc298__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/aus/version_gate_approver.py

@@ -0,0 +1,204 @@
+import logging
+from collections.abc import Callable, Iterable
+
+from reconcile.aus.advanced_upgrade_service import aus_label_key
+from reconcile.aus.base import gates_to_agree, get_orgs_for_environment
+from reconcile.aus.version_gates import (
+    ingress_gate_handler,
+    ocp_gate_handler,
+    sts_version_gate_handler,
+)
+from reconcile.aus.version_gates.handler import GateHandler
+from reconcile.gql_definitions.common.ocm_environments import (
+    query as ocm_environment_query,
+)
+from reconcile.utils import gql
+from reconcile.utils.grouping import group_by
+from reconcile.utils.jobcontroller.controller import (
+    build_job_controller,
+)
+from reconcile.utils.ocm.base import (
+    ClusterDetails,
+    LabelContainer,
+    OCMCluster,
+    OCMVersionGate,
+)
+from reconcile.utils.ocm.clusters import discover_clusters_by_labels
+from reconcile.utils.ocm.search_filters import Filter
+from reconcile.utils.ocm.upgrades import (
+    create_version_agreement,
+    get_version_agreement,
+    get_version_gates,
+)
+from reconcile.utils.ocm_base_client import (
+    OCMBaseClient,
+    init_ocm_base_client,
+    init_ocm_base_client_for_org,
+)
+from reconcile.utils.runtime.integration import (
+    PydanticRunParams,
+    QontractReconcileIntegration,
+)
+from reconcile.utils.semver_helper import make_semver
+
+QONTRACT_INTEGRATION = "version-gate-approver"
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+
+
+class VersionGateApproverParams(PydanticRunParams):
+    job_controller_cluster: str
+    job_controller_namespace: str
+    rosa_job_service_account: str
+    rosa_role: str
+    rosa_job_image: str | None = None
+
+
+class VersionGateApprover(QontractReconcileIntegration[VersionGateApproverParams]):
+    @property
+    def name(self) -> str:
+        return QONTRACT_INTEGRATION
+
+    def initialize_handlers(self, query_func: Callable) -> None:
+        self.handlers: dict[str, GateHandler] = {
+            sts_version_gate_handler.GATE_LABEL: sts_version_gate_handler.STSGateHandler(
+                job_controller=build_job_controller(
+                    integration=QONTRACT_INTEGRATION,
+                    integration_version=QONTRACT_INTEGRATION_VERSION,
+                    cluster=self.params.job_controller_cluster,
+                    namespace=self.params.job_controller_namespace,
+                    secret_reader=self.secret_reader,
+                    dry_run=False,
+                ),
+                aws_iam_role=self.params.rosa_role,
+                rosa_job_service_account=self.params.rosa_job_service_account,
+                rosa_job_image=self.params.rosa_job_image,
+            ),
+            ocp_gate_handler.GATE_LABEL: ocp_gate_handler.OCPGateHandler(),
+            ingress_gate_handler.GATE_LABEL: ingress_gate_handler.IngressGateHandler(),
+        }
+
+    def run(self, dry_run: bool) -> None:
+        gql_api = gql.get_api()
+        self.initialize_handlers(gql_api.query)
+        environments = ocm_environment_query(gql_api.query).environments
+        for env in environments:
+            with init_ocm_base_client(env, self.secret_reader) as ocm_api:
+                self.process_environment(
+                    ocm_env_name=env.name,
+                    ocm_api=ocm_api,
+                    query_func=gql_api.query,
+                    dry_run=dry_run,
+                )
+
+    def process_environment(
+        self,
+        ocm_env_name: str,
+        ocm_api: OCMBaseClient,
+        query_func: Callable,
+        dry_run: bool,
+    ) -> None:
+        """
+        Find all clusters with AUS labels in the organization and process them
+        org by org.
+        """
+        # lookup clusters
+        clusters = discover_clusters_by_labels(
+            ocm_api=ocm_api,
+            label_filter=Filter().like("key", aus_label_key("%")),
+        )
+        clusters_by_org_id = group_by(clusters, lambda c: c.organization_id)
+
+        # lookup version gates
+        gates = get_version_gates(ocm_api)
+
+        # lookup organization metadata
+        organizations = get_orgs_for_environment(
+            integration=QONTRACT_INTEGRATION,
+            ocm_env_name=ocm_env_name,
+            query_func=query_func,
+            ocm_organization_ids=set(clusters_by_org_id.keys()),
+        )
+
+        for org in organizations:
+            with init_ocm_base_client_for_org(org, self.secret_reader) as ocm_org_api:
+                self.process_organization(
+                    clusters=clusters_by_org_id.get(org.org_id, []),
+                    gates=gates,
+                    ocm_api=ocm_org_api,
+                    dry_run=dry_run,
+                )
+
+    def process_organization(
+        self,
+        clusters: Iterable[ClusterDetails],
+        gates: list[OCMVersionGate],
+        ocm_api: OCMBaseClient,
+        dry_run: bool,
+    ) -> None:
+        """
+        Process all clusters in an organization.
+        """
+        for cluster in clusters:
+            unacked_gates = gates_to_agree(
+                cluster=cluster.ocm_cluster,
+                gates=gates,
+                acked_gate_ids={
+                    agreement["version_gate"]["id"]
+                    for agreement in get_version_agreement(
+                        ocm_api, cluster.ocm_cluster.id
+                    )
+                },
+            )
+            if not unacked_gates:
+                continue
+            self.process_cluster(
+                cluster=cluster.ocm_cluster,
+                enabled_gate_handlers=get_enabled_gate_handlers(cluster.labels),
+                gates=unacked_gates,
+                ocm_api=ocm_api,
+                ocm_org_id=cluster.organization_id,
+                dry_run=dry_run,
+            )
+
+    def process_cluster(
+        self,
+        cluster: OCMCluster,
+        enabled_gate_handlers: set[str],
+        gates: list[OCMVersionGate],
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+        dry_run: bool,
+    ) -> None:
+        """
+        Process all unacknowledged gates for a cluster.
+        """
+        for gate in gates:
+            if gate.label in self.handlers and gate.label not in enabled_gate_handlers:
+                continue
+            logging.info(
+                f"handle gate {gate.label} for cluster {cluster.name} {{gate_id = {gate.id}), version = {gate.version_raw_id_prefix}, cluster_id = {cluster.id}, org_id = {ocm_org_id}}}"
+            )
+            success = self.handlers[gate.label].handle(
+                ocm_api=ocm_api,
+                ocm_org_id=ocm_org_id,
+                cluster=cluster,
+                gate=gate,
+                dry_run=dry_run,
+            )
+            if success and not dry_run:
+                create_version_agreement(ocm_api, gate.id, cluster.id)
+            elif not success:
+                logging.error(
+                    f"failed to handle gate {gate.label} for cluster {cluster.name} {{gate_id = {gate.id}), version = {gate.version_raw_id_prefix}, cluster_id = {cluster.id}, org_id = {ocm_org_id}}}"
+                )
+
+
+def get_enabled_gate_handlers(labels: LabelContainer) -> set[str]:
+    """
+    Get the set of enabled gate handlers from the labels. Default to the OCP
+    gate to keep backwards compatibility (for now).
+    """
+    handler_csv = labels.get_label_value(aus_label_key("version-gate-approvals"))
+    if not handler_csv:
+        return {ocp_gate_handler.GATE_LABEL}
+    return set(handler_csv.split(","))

reconcile/aus/version_gates/__init__.py

@@ -0,0 +1,12 @@
+from reconcile.aus.version_gates import (
+    ingress_gate_handler,
+    ocp_gate_handler,
+    sts_version_gate_handler,
+)
+from reconcile.aus.version_gates.handler import GateHandler
+
+HANDLERS: dict[str, type[GateHandler]] = {
+    ocp_gate_handler.GATE_LABEL: ocp_gate_handler.OCPGateHandler,
+    sts_version_gate_handler.GATE_LABEL: sts_version_gate_handler.STSGateHandler,
+    ingress_gate_handler.GATE_LABEL: ingress_gate_handler.IngressGateHandler,
+}

reconcile/aus/version_gates/handler.py

@@ -0,0 +1,33 @@
+from abc import ABC, abstractmethod
+
+from reconcile.utils.ocm.base import OCMCluster, OCMVersionGate
+from reconcile.utils.ocm_base_client import OCMBaseClient
+
+
+class GateHandler(ABC):
+    """
+    A protocol for version gate handlers.
+    """
+
+    @staticmethod
+    @abstractmethod
+    def gate_applicable_to_cluster(cluster: OCMCluster) -> bool:
+        """
+        Check if the gate represented by this handler is applicable for the given cluster.
+        """
+        ...
+
+    @abstractmethod
+    def handle(
+        self,
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+        cluster: OCMCluster,
+        gate: OCMVersionGate,
+        dry_run: bool,
+    ) -> bool:
+        """
+        Take all necessary actions required by a version gate.
+        If successful, return True. Otherwise, return False.
+        """
+        ...

reconcile/aus/version_gates/ingress_gate_handler.py

@@ -0,0 +1,32 @@
+from reconcile.aus.version_gates.handler import GateHandler
+from reconcile.utils.ocm.base import OCMCluster, OCMVersionGate
+from reconcile.utils.ocm_base_client import OCMBaseClient
+
+GATE_LABEL = "api.openshift.com/gate-ingress"
+
+
+class IngressGateHandler(GateHandler):
+    """
+    https://access.redhat.com/node/7028653
+    """
+
+    @staticmethod
+    def gate_applicable_to_cluster(_: OCMCluster) -> bool:
+        # applicable to all cluster types
+        return True
+
+    def handle(
+        self,
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+        cluster: OCMCluster,
+        gate: OCMVersionGate,
+        dry_run: bool,
+    ) -> bool:
+        # there is no automatic remediation for this gate
+        # users need to manually do the required changes to their clusters
+        # and then need to ack the gate on their own or let version-gate-approver
+        # do it for them when they list this gate under upgradePolicy.versionGateApprovals
+        # in their cluster file or the sre-capabilities.aus.version-gate-approvals
+        # OCM subscription label
+        return True

reconcile/aus/version_gates/ocp_gate_handler.py

@@ -0,0 +1,26 @@
+from reconcile.aus.version_gates.handler import GateHandler
+from reconcile.utils.ocm.base import OCMCluster, OCMVersionGate
+from reconcile.utils.ocm_base_client import OCMBaseClient
+
+GATE_LABEL = "api.openshift.com/gate-ocp"
+
+
+class OCPGateHandler(GateHandler):
+    """
+    Right now we just ack all gate-ocp gates...
+    We could do better in the future, e.g. inspecting insights findings on the cluster
+    """
+
+    @staticmethod
+    def gate_applicable_to_cluster(_: OCMCluster) -> bool:
+        return True
+
+    def handle(
+        self,
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+        cluster: OCMCluster,
+        gate: OCMVersionGate,
+        dry_run: bool,
+    ) -> bool:
+        return True

reconcile/aus/version_gates/sts_version_gate_handler.py

@@ -0,0 +1,100 @@
+import logging
+
+from reconcile.aus.version_gates.handler import GateHandler
+from reconcile.utils.jobcontroller.controller import K8sJobController
+from reconcile.utils.ocm.base import OCMCluster, OCMVersionGate
+from reconcile.utils.ocm_base_client import OCMBaseClient
+from reconcile.utils.rosa.rosa_cli import RosaCliException
+from reconcile.utils.rosa.session import RosaSession
+
+GATE_LABEL = "api.openshift.com/gate-sts"
+
+
+class STSGateHandler(GateHandler):
+    def __init__(
+        self,
+        job_controller: K8sJobController,
+        aws_iam_role: str,
+        rosa_job_service_account: str | None = None,
+        rosa_job_image: str | None = None,
+    ) -> None:
+        self.job_controller = job_controller
+        self.aws_iam_role = aws_iam_role
+        self.rosa_job_image = rosa_job_image
+        self.rosa_job_service_account = rosa_job_service_account
+
+    @staticmethod
+    def gate_applicable_to_cluster(cluster: OCMCluster) -> bool:
+        """
+        The STS Gate is applicable to all clusters with STS enabled.
+        This could potentially also be OSD STS clusters. While this handler
+        does not handle OSD clusters as of now, it is still important that
+        we report the STS gate to be applicable to OSD STS clusters.
+        """
+        return cluster.is_sts()
+
+    def handle(
+        self,
+        ocm_api: OCMBaseClient,
+        ocm_org_id: str,
+        cluster: OCMCluster,
+        gate: OCMVersionGate,
+        dry_run: bool,
+    ) -> bool:
+        if (
+            not cluster.id
+            or not cluster.aws
+            or not cluster.aws.sts
+            or not cluster.is_sts()
+        ):
+            # checked already but mypy :/
+            return False
+
+        if cluster.is_rosa_hypershift():
+            # thanks to hypershift managed policies, there is nothing to do for us here
+            # returning True will ack the version gate
+            return True
+        if not cluster.is_rosa_classic():
+            # we manage roels only for rosa classic clusters
+            # returning here will prevent OSD STS clusters to be handled right now
+            logging.error(
+                f"Cluster {cluster.id} is not a ROSA cluster. "
+                "STS version gates are only handled for ROSA classic clusters."
+            )
+            return False
+
+        rosa = RosaSession(
+            aws_account_id=cluster.aws.aws_account_id,
+            aws_region=cluster.region.id,
+            aws_iam_role=self.aws_iam_role,
+            ocm_org_id=ocm_org_id,
+            ocm_api=ocm_api,
+            job_controller=self.job_controller,
+            image=self.rosa_job_image,
+            service_account=self.rosa_job_service_account,
+        )
+
+        try:
+            # account role handling
+            account_role_prefix = cluster.aws.account_role_prefix
+            if not account_role_prefix:
+                raise Exception(
+                    f"Can't upgrade account roles. Cluster {cluster.name} does not define spec.aws.account_role_prefix"
+                )
+            rosa.upgrade_account_roles(
+                role_prefix=account_role_prefix,
+                minor_version=gate.version_raw_id_prefix,
+                channel_group=cluster.version.channel_group,
+                dry_run=dry_run,
+            )
+
+            # operator role handling
+            rosa.upgrade_operator_roles(
+                cluster_id=cluster.id,
+                dry_run=dry_run,
+            )
+        except RosaCliException as e:
+            logging.error(f"Failed to upgrade roles for cluster {cluster.name}: {e}")
+            e.write_logs_to_logger(logging.error)
+            return False
+        return True

reconcile/aws_account_manager/README.md

@@ -0,0 +1,5 @@
+# AWS Account Manager
+
+The AWS Account Manager integration creates and manages AWS accounts.
+
+See [aws-account-manager in app-interface](https://gitlab.cee.redhat.com/service/app-interface/-/blob/master/docs/app-sre/aws-account-manager.md) for more information.