qontract-reconcile 0.9.1rc298__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/openshift_cluster_bots.py

@@ -0,0 +1,344 @@
+import base64
+import json
+import logging
+import subprocess
+import sys
+import tempfile
+import urllib.request
+from typing import cast
+from urllib.error import URLError
+
+from pydantic import BaseModel
+from sretoolbox.utils import retry
+
+import reconcile.gql_definitions.openshift_cluster_bots.clusters as clusters_gql
+from reconcile import mr_client_gateway, queries
+from reconcile.gql_definitions.openshift_cluster_bots.clusters import ClusterV1
+from reconcile.status import ExitCodes
+from reconcile.utils import gql
+from reconcile.utils.disabled_integrations import integration_is_enabled
+from reconcile.utils.mr import clusters_updates
+from reconcile.utils.ocm import OCM, OCMMap
+from reconcile.utils.openshift_resource import (
+    QONTRACT_ANNOTATION_INTEGRATION,
+    QONTRACT_ANNOTATION_INTEGRATION_VERSION,
+)
+from reconcile.utils.semver_helper import make_semver
+from reconcile.utils.vault import VaultClient, _VaultClient
+
+QONTRACT_INTEGRATION = "openshift-cluster-bots"
+QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
+
+
+class Config(BaseModel):
+    gitlab_project_id: str
+    vault_creds_path: str
+    dedicated_admin_ns: str
+    dedicated_admin_sa: str
+    cluster_admin_ns: str
+    cluster_admin_sa: str
+    dry_run: bool
+
+
+def cluster_misses_bot_tokens(cluster: ClusterV1) -> bool:
+    return cluster.automation_token is None or (
+        cluster.cluster_admin is True and cluster.cluster_admin_automation_token is None
+    )
+
+
+def cluster_is_reachable(cluster: ClusterV1) -> bool:
+    if not cluster.server_url:
+        return False
+    # https://kubernetes.io/docs/reference/using-api/health-checks/
+    url = f"{cluster.server_url}/readyz"
+    try:
+        res = urllib.request.urlopen(url, timeout=10)
+        return res is not None and res.getcode() == 200
+    except URLError as e:
+        logging.debug(f"[{cluster.name}] API URL unreachable: {e.reason}")
+        return False
+
+
+def vault_secret(
+    cluster: ClusterV1, config: Config, cluster_admin: bool = False
+) -> dict[str, str]:
+    secret_key = f"{config.vault_creds_path}/{cluster.name}"
+    if cluster_admin:
+        secret_key = f"{secret_key}-cluster-admin"
+    return {
+        "path": secret_key,
+        "field": "token",
+    }
+
+
+def vault_data(
+    cluster: ClusterV1, config: Config, token: str, cluster_admin: bool
+) -> dict[str, str]:
+    username = f"{config.dedicated_admin_ns}/{config.dedicated_admin_sa} # not used by automation"
+    if cluster_admin:
+        username = f"{config.cluster_admin_ns}/{config.cluster_admin_sa} # not used by automation"
+    return {
+        "server": cluster.server_url,
+        "token": token,
+        "username": username,
+    }
+
+
+# We're not using the generic OC classes here because we use a kubeconfig instead of a token
+# Since that is very exceptional and should be done only in this context, it is preferable to
+# not update the generic client implementations.
+def oc(
+    kubeconfig: str, namespace: str, command: list[str], stdin: bytes | None = None
+) -> dict | None:
+    ret = subprocess.run(
+        ["oc", "--kubeconfig", kubeconfig, "-n", namespace, "-o", "json", *command],
+        input=stdin,
+        check=True,
+        capture_output=True,
+    )
+    if not ret.stdout:
+        return None
+    return json.loads(ret.stdout.decode())
+
+
+def oc_apply(kubeconfig: str, namespace: str, items: list[dict]) -> None:
+    for item in items:
+        stdin = json.dumps(item).encode()
+        oc(kubeconfig, namespace, ["apply", "-f", "-"], stdin)
+
+
+def sa_secret_name(sa: str) -> str:
+    return f"{sa}-token"
+
+
+class TokenNotReadyException(Exception):
+    pass
+
+
+# retry allows to let the kube API the time to generate the token and fill the secret
+@retry()
+def retrieve_token(kubeconfig: str, namespace: str, sa: str) -> str:
+    secret = oc(kubeconfig, namespace, ["get", "secret", sa_secret_name(sa)])
+    if not secret or "token" not in secret.get("data", {}):
+        raise TokenNotReadyException()
+    b64_token = secret["data"]["token"]
+    return base64.b64decode(b64_token).decode()
+
+
+def create_sa(
+    kubeconfig: str,
+    namespace: str,
+    sa: str,
+    create_namespace: bool = False,
+    cluster_admin: bool = False,
+) -> str:
+    items: list[dict] = []
+    if create_namespace:
+        items.append({
+            "apiVersion": "v1",
+            "kind": "Namespace",
+            "metadata": {"name": namespace},
+        })
+    items.extend([
+        {
+            "apiVersion": "v1",
+            "kind": "ServiceAccount",
+            "metadata": {
+                "annotations": {
+                    QONTRACT_ANNOTATION_INTEGRATION: QONTRACT_INTEGRATION,
+                    QONTRACT_ANNOTATION_INTEGRATION_VERSION: QONTRACT_INTEGRATION_VERSION,
+                },
+                "name": sa,
+            },
+        },
+        {
+            "apiVersion": "v1",
+            "kind": "Secret",
+            "metadata": {
+                "annotations": {
+                    "kubernetes.io/service-account.name": sa,
+                    QONTRACT_ANNOTATION_INTEGRATION: QONTRACT_INTEGRATION,
+                    QONTRACT_ANNOTATION_INTEGRATION_VERSION: QONTRACT_INTEGRATION_VERSION,
+                },
+                "name": sa_secret_name(sa),
+            },
+            "type": "kubernetes.io/service-account-token",
+        },
+    ])
+    if cluster_admin:
+        items.append({
+            "apiVersion": "rbac.authorization.k8s.io/v1",
+            "kind": "ClusterRoleBinding",
+            "metadata": {
+                "name": f"{namespace}-{sa}",
+            },
+            "roleRef": {
+                "apiGroup": "rbac.authorization.k8s.io",
+                "kind": "ClusterRole",
+                "name": "cluster-admin",
+            },
+            "subjects": [
+                {
+                    "kind": "ServiceAccount",
+                    "name": sa,
+                    "namespace": namespace,
+                }
+            ],
+        })
+
+    oc_apply(kubeconfig, namespace, items)
+    token = retrieve_token(kubeconfig, namespace, sa)
+    return token
+
+
+def create_cluster_bots(
+    cluster: ClusterV1, ocm: OCM, config: Config
+) -> tuple[str | None, str | None]:
+    kubeconfig_content = ocm.get_kubeconfig(cluster.name)
+    if not kubeconfig_content:
+        logging.error(
+            f"[{cluster.name}] Could not get cluster credentials from OCM (kubeconfig)"
+        )
+        return None, None
+
+    token = None
+    admin_token = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w+", encoding="locale", delete=True
+        ) as kc:
+            kc.write(kubeconfig_content)
+            kc.flush()
+            logging.info(
+                f"[{cluster.name}] create {config.dedicated_admin_sa} service account"
+            )
+            if not config.dry_run:
+                token = create_sa(
+                    kc.name, config.dedicated_admin_ns, config.dedicated_admin_sa
+                )
+            if cluster.cluster_admin:
+                logging.info(
+                    f"[{cluster.name}] create {config.cluster_admin_sa} service account"
+                )
+                if not config.dry_run:
+                    admin_token = create_sa(
+                        kc.name,
+                        config.cluster_admin_ns,
+                        config.cluster_admin_sa,
+                        create_namespace=True,
+                        cluster_admin=True,
+                    )
+    except subprocess.CalledProcessError as e:
+        logging.error(e.stderr)
+        raise e
+
+    return token, admin_token
+
+
+def update_vault(
+    cluster: ClusterV1, config: Config, token: str, admin_token: str | None
+) -> None:
+    vault = cast(_VaultClient, VaultClient())
+    vault.write(
+        {
+            "path": vault_secret(cluster, config, cluster_admin=False)["path"],
+            "data": vault_data(cluster, config, token, cluster_admin=False),
+        },
+        decode_base64=False,
+    )
+    if cluster.cluster_admin and admin_token:
+        vault.write(
+            {
+                "path": vault_secret(cluster, config, cluster_admin=True)["path"],
+                "data": vault_data(cluster, config, admin_token, cluster_admin=True),
+            },
+            decode_base64=False,
+        )
+
+
+def submit_mr(clusters: list[ClusterV1], config: Config) -> None:
+    cluster_updates: dict[str, dict] = {}
+    for cluster in clusters:
+        root = {"automationToken": vault_secret(cluster, config, cluster_admin=False)}
+        if cluster.cluster_admin:
+            root["clusterAdminAutomationToken"] = vault_secret(
+                cluster, config, cluster_admin=True
+            )
+        cluster_updates[cluster.name] = {
+            "path": "data" + cluster.path,
+            "root": root,
+            "spec": {},
+        }
+    mr = clusters_updates.CreateClustersUpdates(cluster_updates)
+    with mr_client_gateway.init(gitlab_project_id=config.gitlab_project_id) as mr_cli:
+        mr.submit(cli=mr_cli)
+
+
+def create_all_bots(
+    clusters: list[ClusterV1],
+    ocm_map: OCMMap,
+    config: Config,
+) -> None:
+    for cluster in clusters:
+        ocm = ocm_map.get(cluster.name)
+        token, admin_token = create_cluster_bots(cluster, ocm, config)
+        if token and not config.dry_run:
+            update_vault(cluster, config, token, admin_token)
+    if not config.dry_run:
+        submit_mr(clusters, config)
+
+
+def filter_clusters(clusters: list[ClusterV1]) -> list[ClusterV1]:
+    return [
+        cluster
+        for cluster in clusters
+        if integration_is_enabled(QONTRACT_INTEGRATION, cluster)
+        and cluster.ocm is not None
+        and cluster_misses_bot_tokens(cluster)
+        and cluster_is_reachable(cluster)
+    ]
+
+
+def get_ocm_map(clusters: list[ClusterV1]) -> OCMMap:
+    settings = queries.get_app_interface_settings()
+    clusters_info = [c.dict(by_alias=True) for c in clusters]
+    return OCMMap(
+        settings=settings,
+        clusters=clusters_info,
+        integration=QONTRACT_INTEGRATION,
+    )
+
+
+def run(
+    dry_run: bool,
+    gitlab_project_id: str,
+    vault_creds_path: str,
+    dedicated_admin_ns: str,
+    dedicated_admin_sa: str,
+    cluster_admin_ns: str,
+    cluster_admin_sa: str,
+) -> None:
+    config = Config(
+        gitlab_project_id=gitlab_project_id,
+        vault_creds_path=vault_creds_path,
+        dedicated_admin_ns=dedicated_admin_ns,
+        dedicated_admin_sa=dedicated_admin_sa,
+        cluster_admin_ns=cluster_admin_ns,
+        cluster_admin_sa=cluster_admin_sa,
+        dry_run=dry_run,
+    )
+
+    query_func = gql.get_api().query
+    clusters = clusters_gql.query(query_func=query_func).clusters
+    if not clusters:
+        logging.debug("No cluster definitions found in app-interface")
+        sys.exit(ExitCodes.SUCCESS)
+
+    clusters = filter_clusters(clusters)
+    if not clusters:
+        logging.debug("Nothing to do")
+        sys.exit(ExitCodes.SUCCESS)
+
+    ocm_map = get_ocm_map(clusters)
+
+    create_all_bots(clusters, ocm_map, config)

reconcile/openshift_clusterrolebindings.py

@@ -1,3 +1,4 @@
+import contextlib
 import sys
 
 import reconcile.openshift_base as ob
@@ -70,7 +71,6 @@ def construct_sa_oc_resource(role, namespace, sa_name):
         "subjects": [
             {"kind": "ServiceAccount", "name": sa_name, "namespace": namespace}
         ],
-        "userNames": [f"system:serviceaccount:{namespace}:{sa_name}"],
     }
     return (
         OR(
@@ -90,7 +90,7 @@ def fetch_desired_state(ri, oc_map):
         permissions = [
             {"cluster": a["cluster"], "cluster_role": a["clusterRole"]}
             for a in role["access"] or []
-            if None not in [a["cluster"], a["clusterRole"]]
+            if a["cluster"] and a["clusterRole"]
         ]
         if not permissions:
             continue
@@ -119,18 +119,17 @@ def fetch_desired_state(ri, oc_map):
                     oc_resource, resource_name = construct_user_oc_resource(
                         permission["cluster_role"], username
                     )
-                    try:
+                    with contextlib.suppress(ResourceKeyExistsError):
+                        # a user may have a Role assigned to them
+                        # from multiple app-interface roles
                         ri.add_desired(
                             cluster,
                             namespace_cluster_scope,
-                            "ClusterRoleBinding",
+                            "ClusterRoleBinding.rbac.authorization.k8s.io",
                             resource_name,
                             oc_resource,
                         )
-                    except ResourceKeyExistsError:
-                        # a user may have a Role assigned to them
-                        # from multiple app-interface roles
-                        pass
+
             for sa in service_accounts:
                 if ri is None:
                     continue
@@ -138,18 +137,17 @@ def fetch_desired_state(ri, oc_map):
                 oc_resource, resource_name = construct_sa_oc_resource(
                     permission["cluster_role"], namespace, sa_name
                 )
-                try:
+
+                with contextlib.suppress(ResourceKeyExistsError):
+                    # a ServiceAccount may have a Role assigned to it
+                    # from multiple app-interface roles
                     ri.add_desired(
                         cluster,
                         namespace_cluster_scope,
-                        "ClusterRoleBinding",
+                        "ClusterRoleBinding.rbac.authorization.k8s.io",
                         resource_name,
                         oc_resource,
                     )
-                except ResourceKeyExistsError:
-                    # a ServiceAccount may have a Role assigned to it
-                    # from multiple app-interface roles
-                    pass
 
     return users_desired_state
 
@@ -160,18 +158,20 @@ def run(dry_run, thread_pool_size=10, internal=None, use_jump_host=True, defer=N
         cluster_info
         for cluster_info in queries.get_clusters()
         if cluster_info.get("managedClusterRoles")
+        and cluster_info.get("automationToken")
     ]
     ri, oc_map = ob.fetch_current_state(
         clusters=clusters,
         thread_pool_size=thread_pool_size,
         integration=QONTRACT_INTEGRATION,
         integration_version=QONTRACT_INTEGRATION_VERSION,
-        override_managed_types=["ClusterRoleBinding"],
+        override_managed_types=["ClusterRoleBinding.rbac.authorization.k8s.io"],
         internal=internal,
         use_jump_host=use_jump_host,
     )
     defer(oc_map.cleanup)
     fetch_desired_state(ri, oc_map)
+    ob.publish_metrics(ri, QONTRACT_INTEGRATION)
     ob.realize_data(dry_run, oc_map, ri, thread_pool_size)
 
     if ri.has_error_registered():

reconcile/openshift_groups.py

@@ -5,10 +5,7 @@ from collections.abc import (
     Iterable,
     Mapping,
 )
-from typing import (
-    Any,
-    Optional,
-)
+from typing import Any
 
 from sretoolbox.utils import threaded
 
@@ -34,6 +31,7 @@ from reconcile.utils.oc_map import (
     OCMap,
     init_oc_map_from_clusters,
 )
+from reconcile.utils.ocm.base import OCMClusterGroupId
 from reconcile.utils.secret_reader import create_secret_reader
 from reconcile.utils.sharding import is_in_shard
 
@@ -53,9 +51,7 @@ def get_cluster_state(
     try:
         group = oc.get_group_if_exists(group_name)
     except Exception as e:
-        msg = ("could not get group state for cluster/group combination: {}/{}").format(
-            cluster, group_name
-        )
+        msg = f"could not get group state for cluster/group combination: {cluster}/{group_name}"
         logging.error(msg)
         raise e
     if group is None:
@@ -84,8 +80,8 @@ def create_groups_list(
 
 
 def fetch_current_state(
-    thread_pool_size: int, internal: Optional[bool], use_jump_host: bool
-) -> tuple[OCMap, list[dict[str, str]], list[str]]:
+    thread_pool_size: int, internal: bool | None, use_jump_host: bool
+) -> tuple[OCMap, list[dict[str, str]], list[str], list[dict[str, str]]]:
     clusters = [c for c in get_clusters() if is_in_shard(c.name)]
     ocm_clusters = [c.name for c in clusters if c.ocm is not None]
     vault_settings = get_app_interface_vault_settings()
@@ -106,11 +102,11 @@ def fetch_current_state(
     )
 
     current_state = list(itertools.chain.from_iterable(results))
-    return oc_map, current_state, ocm_clusters
+    return oc_map, current_state, ocm_clusters, groups_list
 
 
 def fetch_desired_state(
-    oc_map: Optional[ClusterMap], enforced_user_keys: Optional[list[str]] = None
+    clusters: list[str], enforced_user_keys: list[str] | None = None
 ) -> list[dict[str, str]]:
     gqlapi = gql.get_api()
     roles = expiration.filter(query_managed_roles(query_func=gqlapi.query).roles or [])
@@ -120,7 +116,7 @@ def fetch_desired_state(
         for a in r.access or []:
             if not a.cluster or not a.group:
                 continue
-            if oc_map and a.cluster.name not in oc_map.clusters():
+            if clusters and a.cluster.name not in clusters:
                 continue
 
             user_keys = ob.determine_user_keys_for_access(
@@ -133,13 +129,11 @@ def fetch_desired_state(
                     if username is None:
                         continue
 
-                    desired_state.append(
-                        {
-                            "cluster": a.cluster.name,
-                            "group": a.group,
-                            "user": username,
-                        }
-                    )
+                    desired_state.append({
+                        "cluster": a.cluster.name,
+                        "group": a.group,
+                        "user": username,
+                    })
 
     return desired_state
 
@@ -147,8 +141,8 @@ def fetch_desired_state(
 def calculate_diff(
     current_state: Iterable[Mapping[str, str]],
     desired_state: Iterable[Mapping[str, str]],
-) -> list[dict[str, Optional[str]]]:
-    diff: list[dict[str, Optional[str]]] = []
+) -> list[dict[str, str | None]]:
+    diff: list[dict[str, str | None]] = []
     users_to_add = subtract_states(
         desired_state, current_state, "add_user_to_group", "create_group"
     )
@@ -166,8 +160,8 @@ def subtract_states(
     subtract_state: Iterable[Mapping[str, str]],
     user_action: str,
     group_action: str,
-) -> list[dict[str, Optional[str]]]:
-    result: list[dict[str, Optional[str]]] = []
+) -> list[dict[str, str | None]]:
+    result: list[dict[str, str | None]] = []
 
     for f_user in from_state:
         found = False
@@ -191,26 +185,24 @@ def subtract_states(
                 }
                 if item not in result:
                     result.append(item)
-            result.append(
-                {
-                    "action": user_action,
-                    "cluster": f_user["cluster"],
-                    "group": f_user["group"],
-                    "user": f_user["user"],
-                }
-            )
+            result.append({
+                "action": user_action,
+                "cluster": f_user["cluster"],
+                "group": f_user["group"],
+                "user": f_user["user"],
+            })
 
     return result
 
 
-def validate_diffs(diffs: Iterable[Mapping[str, Optional[str]]]) -> None:
+def validate_diffs(diffs: Iterable[Mapping[str, str | None]]) -> None:
     gqlapi = gql.get_api()
     clusters_query = query_managed_groups(query_func=gqlapi.query).clusters or []
 
     desired_combos = [
         {"cluster": diff["cluster"], "group": diff["group"]} for diff in diffs
     ]
-    desired_combos_unique: list[dict[str, Optional[str]]] = []
+    desired_combos_unique: list[dict[str, str | None]] = []
     for combo in desired_combos:
         if combo in desired_combos_unique:
             continue
@@ -236,13 +228,13 @@ def validate_diffs(diffs: Iterable[Mapping[str, Optional[str]]]) -> None:
         raise RuntimeError(msg)
 
 
-def sort_diffs(diff: Mapping[str, Optional[str]]) -> int:
-    if diff["action"] in ["create_group", "del_user_from_group"]:
+def sort_diffs(diff: Mapping[str, str | None]) -> int:
+    if diff["action"] in {"create_group", "del_user_from_group"}:
         return 1
     return 2
 
 
-def act(diff: Mapping[str, Optional[str]], oc_map: ClusterMap) -> None:
+def act(diff: Mapping[str, str | None], oc_map: ClusterMap) -> None:
     cluster = diff.get("cluster") or ""
     group = diff["group"]
     user = diff["user"]
@@ -261,37 +253,42 @@ def act(diff: Mapping[str, Optional[str]], oc_map: ClusterMap) -> None:
     elif action == "delete_group":
         logging.debug("skipping group deletion")
     else:
-        raise Exception("invalid action: {}".format(action))
+        raise Exception(f"invalid action: {action}")
 
 
 @defer
 def run(
     dry_run: bool,
     thread_pool_size: int = 10,
-    internal: Optional[bool] = None,
+    internal: bool | None = None,
     use_jump_host: bool = True,
-    defer: Optional[Callable] = None,
+    defer: Callable | None = None,
 ) -> None:
-
-    oc_map, current_state, ocm_clusters = fetch_current_state(
+    oc_map, current_state, ocm_clusters, groups_list = fetch_current_state(
         thread_pool_size, internal, use_jump_host
     )
     if defer:
         defer(oc_map.cleanup)
-    desired_state = fetch_desired_state(oc_map)
+    desired_state = fetch_desired_state(oc_map.clusters())
 
-    # we only manage dedicated-admins via OCM
     current_state = [
         s
         for s in current_state
-        if not (s["cluster"] in ocm_clusters and s["group"] == "dedicated-admins")
+        if not (
+            s["cluster"] in ocm_clusters and s["group"] in OCMClusterGroupId.values()
+        )
     ]
     desired_state = [
         s
         for s in desired_state
-        if not (s["cluster"] in ocm_clusters and s["group"] == "dedicated-admins")
+        if not (
+            s["cluster"] in ocm_clusters and s["group"] in OCMClusterGroupId.values()
+        )
     ]
 
+    ob.publish_cluster_desired_metrics_from_state(
+        groups_list, QONTRACT_INTEGRATION, "Group"
+    )
     diffs = calculate_diff(current_state, desired_state)
     validate_diffs(diffs)
     diffs.sort(key=sort_diffs)

reconcile/openshift_limitranges.py

@@ -113,6 +113,7 @@ def run(
     defer(oc_map.cleanup)
 
     add_desired_state(namespaces, ri, oc_map)
+    ob.publish_metrics(ri, QONTRACT_INTEGRATION)
     ob.realize_data(dry_run, oc_map, ri, thread_pool_size, take_over=take_over)
 
     if ri.has_error_registered():