qontract-reconcile 0.9.1rc298__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/external_resources/integration.py

@@ -0,0 +1,194 @@
+import logging
+from collections.abc import Callable
+from typing import Any
+
+from reconcile.external_resources.manager import (
+    ExternalResourcesInventory,
+    ExternalResourcesManager,
+    setup_factories,
+)
+from reconcile.external_resources.meta import (
+    QONTRACT_INTEGRATION,
+    QONTRACT_INTEGRATION_VERSION,
+)
+from reconcile.external_resources.model import load_module_inventory
+from reconcile.external_resources.reconciler import K8sExternalResourcesReconciler
+from reconcile.external_resources.secrets_sync import (
+    build_incluster_secrets_reconciler,
+)
+from reconcile.external_resources.state import ExternalResourcesStateDynamoDB
+from reconcile.gql_definitions.external_resources.aws_accounts import (
+    query as aws_accounts_query,
+)
+from reconcile.typed_queries.app_interface_vault_settings import (
+    get_app_interface_vault_settings,
+)
+from reconcile.typed_queries.external_resources import (
+    get_modules,
+    get_namespaces,
+    get_settings,
+)
+from reconcile.utils import gql
+from reconcile.utils.aws_api_typed.api import AWSApi, AWSStaticCredentials
+from reconcile.utils.external_resources import publish_metrics
+from reconcile.utils.jobcontroller.controller import (
+    build_job_controller,
+)
+from reconcile.utils.oc import (
+    OCCli,
+)
+from reconcile.utils.openshift_resource import OpenshiftResource, ResourceInventory
+from reconcile.utils.secret_reader import SecretReaderBase, create_secret_reader
+
+
+def fetch_current_state(
+    ri: ResourceInventory, oc: OCCli, cluster: str, namespace: str
+) -> None:
+    for item in oc.get_items("Job", namespace=namespace):
+        r = OpenshiftResource(item, QONTRACT_INTEGRATION, QONTRACT_INTEGRATION_VERSION)
+        ri.add_current(cluster, namespace, "Job", r.name, r)
+
+
+def get_aws_api(
+    query_func: Callable,
+    account_name: str,
+    region: str,
+    secret_reader: SecretReaderBase,
+) -> AWSApi:
+    accounts = (
+        aws_accounts_query(
+            query_func, variables={"filter": {"name": account_name}}
+        ).accounts
+        or []
+    )
+    if not accounts:
+        raise Exception(
+            "External Resources configured AWS account does not exist or can not be found"
+        )
+    account = accounts[0]
+    automation_token = secret_reader.read_all_secret(account.automation_token)
+    aws_credentials = AWSStaticCredentials(
+        access_key_id=automation_token["aws_access_key_id"],
+        secret_access_key=automation_token["aws_secret_access_key"],
+        region=region,
+    )
+    return AWSApi(aws_credentials)
+
+
+def create_er_manager(
+    aws_api: AWSApi,
+    workers_cluster: str | None,
+    workers_namespace: str | None,
+    thread_pool_size: int,
+    dry_run: bool,
+    dry_run_job_suffix: str,
+) -> ExternalResourcesManager:
+    vault_settings = get_app_interface_vault_settings()
+    secret_reader = create_secret_reader(use_vault=vault_settings.vault)
+    er_settings = get_settings()
+    m_inventory = load_module_inventory(get_modules())
+    namespaces = [ns for ns in get_namespaces() if ns.external_resources]
+    er_inventory = ExternalResourcesInventory(namespaces)
+
+    if not workers_cluster:
+        workers_cluster = er_settings.workers_cluster.name
+    if not workers_namespace:
+        workers_namespace = er_settings.workers_namespace.name
+
+    return ExternalResourcesManager(
+        thread_pool_size=thread_pool_size,
+        settings=er_settings,
+        secret_reader=secret_reader,
+        factories=setup_factories(
+            er_settings, m_inventory, er_inventory, secret_reader
+        ),
+        er_inventory=er_inventory,
+        module_inventory=m_inventory,
+        state_manager=ExternalResourcesStateDynamoDB(
+            aws_api=aws_api,
+            table_name=er_settings.state_dynamodb_table,
+        ),
+        reconciler=K8sExternalResourcesReconciler(
+            controller=build_job_controller(
+                integration=QONTRACT_INTEGRATION,
+                integration_version=QONTRACT_INTEGRATION_VERSION,
+                cluster=workers_cluster,
+                namespace=workers_namespace,
+                secret_reader=secret_reader,
+                dry_run=dry_run,
+            ),
+            dry_run=dry_run,
+            dry_run_job_suffix=dry_run_job_suffix,
+        ),
+        secrets_reconciler=build_incluster_secrets_reconciler(
+            workers_cluster,
+            workers_namespace,
+            secret_reader,
+            vault_path=er_settings.vault_secrets_path,
+            thread_pool_size=thread_pool_size,
+            dry_run=dry_run,
+        ),
+    )
+
+
+def run(
+    dry_run: bool,
+    dry_run_job_suffix: str,
+    thread_pool_size: int,
+    workers_cluster: str | None = None,
+    workers_namespace: str | None = None,
+) -> None:
+    vault_settings = get_app_interface_vault_settings()
+    secret_reader = create_secret_reader(use_vault=vault_settings.vault)
+    er_settings = get_settings()
+
+    if not workers_cluster:
+        workers_cluster = er_settings.workers_cluster.name
+    if not workers_namespace:
+        workers_namespace = er_settings.workers_namespace.name
+
+    with get_aws_api(
+        query_func=gql.get_api().query,
+        account_name=er_settings.state_dynamodb_account.name,
+        region=er_settings.state_dynamodb_region,
+        secret_reader=secret_reader,
+    ) as aws_api:
+        er_mgr = create_er_manager(
+            aws_api,
+            workers_cluster,
+            workers_namespace,
+            thread_pool_size,
+            dry_run,
+            dry_run_job_suffix,
+        )
+        if dry_run:
+            er_mgr.handle_dry_run_resources()
+            if er_mgr.errors:
+                logging.error("Validation Errors:")
+                for k, e in er_mgr.errors.items():
+                    logging.error("ExternalResourceKey: %s, Error: %s" % (k, e))
+        else:
+            publish_metrics(er_mgr.er_inventory, QONTRACT_INTEGRATION)
+            er_mgr.handle_resources()
+
+
+def early_exit_desired_state(*args: Any, **kwargs: Any) -> dict[str, Any]:
+    vault_settings = get_app_interface_vault_settings()
+    secret_reader = create_secret_reader(use_vault=vault_settings.vault)
+    er_settings = get_settings()
+
+    with get_aws_api(
+        query_func=gql.get_api().query,
+        account_name=er_settings.state_dynamodb_account.name,
+        region=er_settings.state_dynamodb_region,
+        secret_reader=secret_reader,
+    ) as aws_api:
+        er_mgr = create_er_manager(
+            aws_api,
+            workers_cluster=kwargs["workers_cluster"],
+            workers_namespace=kwargs["workers_namespace"],
+            thread_pool_size=kwargs["thread_pool_size"],
+            dry_run=True,
+            dry_run_job_suffix=kwargs["dry_run_job_suffix"],
+        )
+        return er_mgr.get_all_reconciliations()

reconcile/external_resources/integration_secrets_sync.py

@@ -0,0 +1,47 @@
+from reconcile.external_resources.model import (
+    ExternalResourcesInventory,
+    load_module_inventory,
+)
+from reconcile.external_resources.secrets_sync import VaultSecretsReconciler
+from reconcile.typed_queries.app_interface_vault_settings import (
+    get_app_interface_vault_settings,
+)
+from reconcile.typed_queries.external_resources import (
+    get_modules,
+    get_namespaces,
+    get_settings,
+)
+from reconcile.utils.openshift_resource import ResourceInventory
+from reconcile.utils.secret_reader import create_secret_reader
+from reconcile.utils.semver_helper import make_semver
+
+QONTRACT_INTEGRATION = "external_resources_secrets_sync"
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+
+
+def run(dry_run: bool, thread_pool_size: int) -> None:
+    """Integration that syncs External Resources Outputs Secrets from Vault into
+    the target clusters
+    """
+    vault_settings = get_app_interface_vault_settings()
+    secret_reader = create_secret_reader(use_vault=vault_settings.vault)
+    er_settings = get_settings()
+
+    namespaces = [ns for ns in get_namespaces() if ns.external_resources]
+    er_inventory = ExternalResourcesInventory(namespaces)
+    m_inventory = load_module_inventory(get_modules())
+
+    to_sync_specs = [
+        spec
+        for key, spec in er_inventory.items()
+        if m_inventory.get_from_external_resource_key(key).outputs_secret_sync
+    ]
+
+    reconciler = VaultSecretsReconciler(
+        ri=ResourceInventory(),
+        secrets_reader=secret_reader,
+        vault_path=er_settings.vault_secrets_path,
+        thread_pool_size=thread_pool_size,
+        dry_run=dry_run,
+    )
+    reconciler.sync_secrets(to_sync_specs)

reconcile/external_resources/manager.py

@@ -0,0 +1,405 @@
+import logging
+from collections.abc import Iterable
+from datetime import UTC, datetime
+
+from sretoolbox.utils import threaded
+
+from reconcile.external_resources.factories import (
+    AWSExternalResourceFactory,
+    ExternalResourceFactory,
+    ModuleProvisionDataFactory,
+    ObjectFactory,
+    TerraformModuleProvisionDataFactory,
+    setup_aws_resource_factories,
+)
+from reconcile.external_resources.metrics import publish_metrics
+from reconcile.external_resources.model import (
+    Action,
+    ExternalResource,
+    ExternalResourceKey,
+    ExternalResourceModuleConfiguration,
+    ExternalResourceOrphanedResourcesError,
+    ExternalResourcesInventory,
+    ExternalResourceValidationError,
+    ModuleInventory,
+    ReconcileAction,
+    Reconciliation,
+    ReconciliationStatus,
+)
+from reconcile.external_resources.reconciler import (
+    ExternalResourcesReconciler,
+)
+from reconcile.external_resources.secrets_sync import InClusterSecretsReconciler
+from reconcile.external_resources.state import (
+    ExternalResourcesStateDynamoDB,
+    ExternalResourceState,
+    ReconcileStatus,
+    ResourceStatus,
+)
+from reconcile.gql_definitions.external_resources.external_resources_settings import (
+    ExternalResourcesSettingsV1,
+)
+from reconcile.utils.external_resource_spec import (
+    ExternalResourceSpec,
+)
+from reconcile.utils.secret_reader import SecretReaderBase
+
+
+def setup_factories(
+    settings: ExternalResourcesSettingsV1,
+    module_inventory: ModuleInventory,
+    er_inventory: ExternalResourcesInventory,
+    secret_reader: SecretReaderBase,
+) -> ObjectFactory[ExternalResourceFactory]:
+    tf_factory = TerraformModuleProvisionDataFactory(settings=settings)
+
+    aws_provision_factories = ObjectFactory[ModuleProvisionDataFactory]()
+    aws_provision_factories.register_factory("terraform", tf_factory)
+    aws_provision_factories.register_factory("cdktf", tf_factory)
+
+    of = ObjectFactory[ExternalResourceFactory]()
+    of.register_factory(
+        "aws",
+        AWSExternalResourceFactory(
+            module_inventory=module_inventory,
+            er_inventory=er_inventory,
+            secret_reader=secret_reader,
+            provision_factories=aws_provision_factories,
+            resource_factories=setup_aws_resource_factories(
+                er_inventory, secret_reader
+            ),
+        ),
+    )
+    return of
+
+
+class ExternalResourcesManager:
+    def __init__(
+        self,
+        state_manager: ExternalResourcesStateDynamoDB,
+        settings: ExternalResourcesSettingsV1,
+        module_inventory: ModuleInventory,
+        reconciler: ExternalResourcesReconciler,
+        secret_reader: SecretReaderBase,
+        er_inventory: ExternalResourcesInventory,
+        factories: ObjectFactory[ExternalResourceFactory],
+        secrets_reconciler: InClusterSecretsReconciler,
+        thread_pool_size: int,
+    ) -> None:
+        self.state_mgr = state_manager
+        self.settings = settings
+        self.module_inventory = module_inventory
+        self.reconciler = reconciler
+        self.er_inventory = er_inventory
+        self.factories = factories
+        self.secret_reader = secret_reader
+        self.secrets_reconciler = secrets_reconciler
+        self.errors: dict[ExternalResourceKey, ExternalResourceValidationError] = {}
+        self.thread_pool_size = thread_pool_size
+
+    def _get_reconcile_action(
+        self, reconciliation: Reconciliation, state: ExternalResourceState
+    ) -> ReconcileAction:
+        if reconciliation.action == Action.APPLY:
+            match state.resource_status:
+                case ResourceStatus.RECONCILIATION_REQUESTED:
+                    return ReconcileAction.APPLY_USER_REQUESTED
+                case ResourceStatus.NOT_EXISTS:
+                    return ReconcileAction.APPLY_NOT_EXISTS
+                case ResourceStatus.ERROR:
+                    return ReconcileAction.APPLY_ERROR
+                case ResourceStatus.CREATED | ResourceStatus.PENDING_SECRET_SYNC:
+                    if (
+                        reconciliation.resource_hash
+                        != state.reconciliation.resource_hash
+                    ):
+                        return ReconcileAction.APPLY_SPEC_CHANGED
+                    elif (
+                        (datetime.now(state.ts.tzinfo) - state.ts).total_seconds()
+                        > reconciliation.module_configuration.reconcile_drift_interval_minutes
+                        * 60
+                    ):
+                        return ReconcileAction.APPLY_DRIFT_DETECTION
+        elif reconciliation.action == Action.DESTROY:
+            match state.resource_status:
+                case ResourceStatus.CREATED:
+                    return ReconcileAction.DESTROY_CREATED
+                case ResourceStatus.ERROR:
+                    return ReconcileAction.DESTROY_ERROR
+
+        return ReconcileAction.NOOP
+
+    def _resource_needs_reconciliation(
+        self,
+        reconciliation: Reconciliation,
+        state: ExternalResourceState,
+    ) -> bool:
+        reconcile_action = self._get_reconcile_action(reconciliation, state)
+        if reconcile_action == ReconcileAction.NOOP:
+            return False
+
+        logging.info(
+            "Reconciling: Status: [%s], Action: [%s], reason: [%s], key:[%s]",
+            state.resource_status.value,
+            reconciliation.action.value,
+            reconcile_action.value,
+            reconciliation.key,
+        )
+        return True
+
+    def get_all_reconciliations(self) -> dict[str, set[Reconciliation]]:
+        """Returns all reconciliations in a dict. Useful to return all data
+        from app-interface to make comparisions (early-exit)"""
+        return {
+            "desired": self._get_desired_objects_reconciliations(),
+            "deleted": self._get_deleted_objects_reconciliations(),
+        }
+
+    def _get_desired_objects_reconciliations(self) -> set[Reconciliation]:
+        r: set[Reconciliation] = set()
+        for key, spec in self.er_inventory.items():
+            if spec.marked_to_delete:
+                continue
+            module = self.module_inventory.get_from_spec(spec)
+            try:
+                resource = self._build_external_resource(spec)
+            except ExternalResourceValidationError as e:
+                self.errors[key] = e
+                continue
+
+            reconciliation = Reconciliation(
+                key=key,
+                resource_hash=resource.hash(),
+                input=resource.json(),
+                action=Action.APPLY,
+                module_configuration=ExternalResourceModuleConfiguration.resolve_configuration(
+                    module, spec, self.settings
+                ),
+                linked_resources=self._find_linked_resources(spec),
+            )
+            r.add(reconciliation)
+        return r
+
+    def _get_deleted_objects_reconciliations(self) -> set[Reconciliation]:
+        to_reconcile: set[Reconciliation] = set()
+        deleted_keys = (k for k, v in self.er_inventory.items() if v.marked_to_delete)
+        for key in deleted_keys:
+            state = self.state_mgr.get_external_resource_state(key)
+            if state.resource_status == ResourceStatus.NOT_EXISTS:
+                logging.debug("Resource has already been removed. key: %s", key)
+                continue
+
+            r = Reconciliation(
+                key=key,
+                resource_hash=state.reconciliation.resource_hash,
+                module_configuration=state.reconciliation.module_configuration,
+                input=state.reconciliation.input,
+                action=Action.DESTROY,
+            )
+            to_reconcile.add(r)
+        return to_reconcile
+
+    def _check_orphaned_objects(self) -> None:
+        state_keys = self.state_mgr.get_all_resource_keys()
+        inventory_keys = set(self.er_inventory.keys())
+        orphans = state_keys - inventory_keys
+        if len(orphans) > 0:
+            raise ExternalResourceOrphanedResourcesError(orphans)
+
+    def _get_reconciliation_status(
+        self,
+        r: Reconciliation,
+        state: ExternalResourceState,
+    ) -> ReconciliationStatus:
+        """Gets the reconciliation job status and returns a ReconciliationStatus object with the new
+        resource status and other reconciliation data.
+        :param r: Reconciliation object
+        :param state: State object
+        :return: ReconciliationStatus
+        """
+
+        reconciliation_status = ReconciliationStatus(
+            resource_status=state.resource_status
+        )
+
+        if not state.resource_status.is_in_progress:
+            return reconciliation_status
+
+        logging.info(
+            "Reconciliation In progress. Action: %s, Key:%s",
+            state.reconciliation.action,
+            state.reconciliation.key,
+        )
+
+        match self.reconciler.get_resource_reconcile_status(state.reconciliation):
+            case ReconcileStatus.SUCCESS:
+                logging.info(
+                    "Reconciliation ended SUCCESSFULLY. Action: %s, key:%s",
+                    r.action.value,
+                    r.key,
+                )
+                if r.action == Action.APPLY:
+                    reconciliation_status.resource_status = (
+                        ResourceStatus.PENDING_SECRET_SYNC
+                    )
+                elif r.action == Action.DESTROY:
+                    reconciliation_status.resource_status = ResourceStatus.DELETED
+                reconciliation_status.reconcile_time = (
+                    self.reconciler.get_resource_reconcile_duration(r) or 0
+                )
+            case ReconcileStatus.ERROR:
+                logging.info(
+                    "Reconciliation ended with ERROR: Action:%s, Key:%s",
+                    r.action.value,
+                    r.key,
+                )
+                reconciliation_status.resource_status = ResourceStatus.ERROR
+            case ReconcileStatus.NOT_EXISTS:
+                logging.info(
+                    "Reconciliation should exist but it doesn't. Marking as ERROR to retrigger: Action:%s, Key:%s",
+                    r.action.value,
+                    r.key,
+                )
+                reconciliation_status.resource_status = ResourceStatus.ERROR
+            case ReconcileStatus.IN_PROGRESS:
+                logging.debug("Reconciliation still in progress ...")
+
+        return reconciliation_status
+
+    def _update_resource_state(
+        self,
+        r: Reconciliation,
+        state: ExternalResourceState,
+        reconciliation_status: ReconciliationStatus,
+    ) -> None:
+        if not state.reconciliation_needs_state_update(reconciliation_status):
+            logging.debug("Reconciliation does not need a state update.")
+            return
+
+        if reconciliation_status.resource_status == ResourceStatus.DELETED:
+            self.state_mgr.del_external_resource_state(r.key)
+        else:
+            state.update_resource_status(reconciliation_status)
+            self.state_mgr.set_external_resource_state(state)
+
+            if r.linked_resources:
+                for lr in r.linked_resources:
+                    lrs = self.state_mgr.get_external_resource_state(lr)
+                    if not lrs.resource_status.is_in_progress:
+                        lrs.resource_status = ResourceStatus.RECONCILIATION_REQUESTED
+                        self.state_mgr.set_external_resource_state(lrs)
+
+    def _set_resource_reconciliation_in_progress(
+        self, r: Reconciliation, state: ExternalResourceState
+    ) -> None:
+        state.ts = datetime.now(UTC)
+        if r.action == Action.APPLY:
+            state.resource_status = ResourceStatus.IN_PROGRESS
+        elif r.action == Action.DESTROY:
+            state.resource_status = ResourceStatus.DELETE_IN_PROGRESS
+        state.reconciliation = r
+        self.state_mgr.set_external_resource_state(state)
+
+    def _need_secret_sync(
+        self, r: Reconciliation, state: ExternalResourceState
+    ) -> bool:
+        return (
+            r.action == Action.APPLY and state.resource_status == ResourceStatus.CREATED
+        )
+
+    def _sync_secrets(
+        self,
+        to_sync_keys: Iterable[ExternalResourceKey],
+    ) -> None:
+        specs = [
+            spec for key in set(to_sync_keys) if (spec := self.er_inventory.get(key))
+        ]
+
+        sync_error_spec_keys = {
+            ExternalResourceKey.from_spec(spec)
+            for spec in self.secrets_reconciler.sync_secrets(specs=specs)
+        }
+
+        for key in to_sync_keys:
+            if key in sync_error_spec_keys:
+                logging.error(
+                    "Outputs secret for key can not be reconciled. Key: %s", key
+                )
+            else:
+                logging.debug(
+                    "Outputs secret for key has been reconciled. Marking resource as %s. Key: %s",
+                    ResourceStatus.CREATED,
+                    key,
+                )
+                self.state_mgr.update_resource_status(key, ResourceStatus.CREATED)
+
+    def _build_external_resource(self, spec: ExternalResourceSpec) -> ExternalResource:
+        f = self.factories.get_factory(spec.provision_provider)
+        resource = f.create_external_resource(spec)
+        f.validate_external_resource(resource)
+        return resource
+
+    def _find_linked_resources(
+        self, spec: ExternalResourceSpec
+    ) -> set[ExternalResourceKey]:
+        f = self.factories.get_factory(spec.provision_provider)
+        return f.find_linked_resources(spec)
+
+    def handle_resources(self) -> None:
+        desired_r = self._get_desired_objects_reconciliations()
+        deleted_r = self._get_deleted_objects_reconciliations()
+        to_sync_keys: set[ExternalResourceKey] = set()
+        for r in desired_r.union(deleted_r):
+            state = self.state_mgr.get_external_resource_state(r.key)
+            reconciliation_status = self._get_reconciliation_status(r, state)
+            self._update_resource_state(r, state, reconciliation_status)
+
+            if reconciliation_status.resource_status.needs_secret_sync:
+                to_sync_keys.add(r.key)
+
+            if self._resource_needs_reconciliation(reconciliation=r, state=state):
+                self.reconciler.reconcile_resource(reconciliation=r)
+                self._set_resource_reconciliation_in_progress(r, state)
+
+            if spec := self.er_inventory.get(r.key):
+                publish_metrics(r, spec, reconciliation_status)
+
+        pending_sync_keys = self.state_mgr.get_keys_by_status(
+            ResourceStatus.PENDING_SECRET_SYNC
+        )
+
+        if to_sync_keys or pending_sync_keys:
+            self._sync_secrets(to_sync_keys=to_sync_keys | pending_sync_keys)
+
+    def handle_dry_run_resources(self) -> None:
+        self._check_orphaned_objects()
+        desired_r = self._get_desired_objects_reconciliations()
+        deleted_r = self._get_deleted_objects_reconciliations()
+        reconciliations = desired_r.union(deleted_r)
+        triggered: set[Reconciliation] = set()
+
+        for r in reconciliations:
+            state = self.state_mgr.get_external_resource_state(key=r.key)
+            if (
+                r.action == Action.APPLY
+                and state.reconciliation.resource_hash != r.resource_hash
+            ) or (
+                r.action == Action.DESTROY and not state.resource_status.is_in_progress
+            ):
+                triggered.add(r)
+
+        threaded.run(
+            self.reconciler.reconcile_resource,
+            triggered,
+            thread_pool_size=self.thread_pool_size,
+        )
+
+        results = self.reconciler.wait_for_reconcile_list_completion(
+            triggered, check_interval_seconds=10, timeout_seconds=-1
+        )
+
+        for r in triggered:
+            self.reconciler.get_resource_reconcile_logs(reconciliation=r)
+
+        if ReconcileStatus.ERROR in list(results.values()):
+            raise Exception("Some Resources have reconciliation errors.")

reconcile/external_resources/meta.py

@@ -0,0 +1,17 @@
+from reconcile.utils.semver_helper import make_semver
+
+QONTRACT_INTEGRATION = "external_resources"
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+
+
+SECRET_ANN_PREFIX = "external-resources"
+SECRET_ANN_PROVISION_PROVIDER = SECRET_ANN_PREFIX + "/provision_provider"
+SECRET_ANN_PROVISIONER = SECRET_ANN_PREFIX + "/provisioner_name"
+SECRET_ANN_PROVIDER = SECRET_ANN_PREFIX + "/provider"
+SECRET_ANN_IDENTIFIER = SECRET_ANN_PREFIX + "/identifier"
+SECRET_UPDATED_AT = SECRET_ANN_PREFIX + "/updated_at"
+SECRET_UPDATED_AT_TIMEFORMAT = "%Y-%m-%dT%H:%M:%SZ"
+
+FLAG_RESOURCE_MANAGED_BY_ERV2 = "managed_by_erv2"
+FLAG_DELETE_RESOURCE = "delete"
+MODULE_OVERRIDES = "module_overrides"