qontract-reconcile 0.9.1rc298__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/queries.py

@@ -5,10 +5,7 @@ import shlex
 from collections.abc import Mapping
 from dataclasses import dataclass
 from textwrap import indent
-from typing import (
-    Any,
-    Optional,
-)
+from typing import Any
 
 from jinja2 import Template
 
@@ -25,7 +22,7 @@ SECRET_READER_SETTINGS = """
 """
 
 
-def get_secret_reader_settings() -> Optional[Mapping[str, Any]]:
+def get_secret_reader_settings() -> Mapping[str, Any] | None:
     """Returns SecretReader settings"""
     gqlapi = gql.get_api()
     settings = gqlapi.query(SECRET_READER_SETTINGS)["settings"]
@@ -42,7 +39,6 @@ APP_INTERFACE_SETTINGS_QUERY = """
     vault
     kubeBinary
     mergeRequestGateway
-    saasDeployJobTemplate
     hashLength
     smtp {
       mailAddress
@@ -106,6 +102,13 @@ APP_INTERFACE_SETTINGS_QUERY = """
       readTimeout
       connectTimeout
     }
+    terraformResourcesProviderExclusions {
+      provider
+      excludeProvisioners {
+        name
+      }
+      excludeAllProvisioners
+    }
   }
 }
 """
@@ -285,13 +288,12 @@ INTEGRATIONS_QUERY = """
         successfulJobHistoryLimit
         failedJobHistoryLimit
         imageRef
+        enablePushgateway
       }
     }
   }
 }
-""" % (
-    indent(JUMPHOST_FIELDS, 12 * " "),
-)
+""" % (indent(JUMPHOST_FIELDS, 12 * " "),)
 
 
 def get_integrations(managed=False):
@@ -313,7 +315,6 @@ JENKINS_INSTANCES_QUERY = """
       format
     }
     previousUrls
-    plugins
     deleteMethod
     managedProjects
     buildsCleanupRules {
@@ -324,7 +325,15 @@ JENKINS_INSTANCES_QUERY = """
     workerFleets {
       account
       identifier
-      credentialsId
+      sshConnector {
+        credentialsId
+        jvmOptions
+        launchTimeoutSeconds
+        maxNumRetries
+        port
+        retryWaitTime
+        sshHostKeyVerificationStrategy
+      }
       fsRoot
       labelString
       numExecutors
@@ -535,6 +544,22 @@ AWS_ACCOUNTS_QUERY = """
       }
     }
     {% endif %}
+    {% if cleanup %}
+    cleanup {
+      provider
+      ... on AWSAccountCleanupOptionCloudWatch_v1 {
+        regex
+        retention_in_days
+        delete_empty_log_group
+        region
+      }
+      ... on AWSAccountCleanupOptionAMI_v1 {
+        regex
+        age
+        region
+      }
+    }
+    {% endif %}
   }
 }
 """
@@ -547,6 +572,7 @@ def get_aws_accounts(
     sharing=False,
     terraform_state=False,
     ecrs=True,
+    cleanup=False,
 ):
     """Returns all AWS accounts"""
     gqlapi = gql.get_api()
@@ -559,6 +585,7 @@ def get_aws_accounts(
         sharing=sharing,
         terraform_state=terraform_state,
         ecrs=ecrs,
+        cleanup=cleanup,
     )
     return gqlapi.query(query)["accounts"]
 
@@ -571,11 +598,11 @@ def get_state_aws_accounts(reset_passwords=False):
 
 def get_queue_aws_accounts():
     """Returns AWS accounts to use for queue management"""
-    uid = os.environ["gitlab_pr_submitter_queue_url"].split("/")[3]
+    uid = os.environ["gitlab_pr_submitter_queue_url"].split("/")[3]  # noqa: SIM112
     return get_aws_accounts(uid=uid)
 
 
-def get_jumphosts(hostname: Optional[str] = None) -> JumphostsQueryData:
+def get_jumphosts(hostname: str | None = None) -> JumphostsQueryData:
     """Returns all jumphosts"""
     variables = {}
     # The dictionary must be empty if no hostname is set.
@@ -619,6 +646,32 @@ CLUSTER_FILTER_QUERY = """
 {% endif %}
 """
 
+AWS_INFRASTRUCTURE_ACCESS_QUERY = """
+{% if aws_infrastructure_access %}
+awsInfrastructureAccess {
+  awsGroup {
+    account {
+      name
+      uid
+      terraformUsername
+      automationToken {
+        path
+        field
+        version
+        format
+      }
+    }
+    roles {
+      users {
+        org_username
+      }
+    }
+  }
+  accessLevel
+}
+{% endif %}
+"""
+
 CLUSTERS_QUERY = """
 {
   clusters: clusters_v1
@@ -628,7 +681,6 @@ CLUSTERS_QUERY = """
     name
     serverUrl
     consoleUrl
-    kibanaUrl
     elbFQDN
     prometheusUrl
     managedGroups
@@ -652,6 +704,7 @@ CLUSTERS_QUERY = """
     ocm {
       name
       environment {
+        name
         url
         accessTokenClientId
         accessTokenUrl
@@ -671,10 +724,16 @@ CLUSTERS_QUERY = """
         format
         version
       }
+      allowedClusterExternalConfigLabels
       blockedVersions
       inheritVersionData {
         name
+        orgId
+        environment {
+          name
+        }
         publishVersionData {
+          orgId
           name
         }
       }
@@ -685,27 +744,7 @@ CLUSTERS_QUERY = """
         }
       }
     }
-    awsInfrastructureAccess {
-      awsGroup {
-        account {
-          name
-          uid
-          terraformUsername
-          automationToken {
-            path
-            field
-            version
-            format
-          }
-        }
-        roles {
-          users {
-            org_username
-          }
-        }
-      }
-      accessLevel
-    }
+    %s
     %s
     spec {
       product
@@ -717,8 +756,18 @@ CLUSTERS_QUERY = """
       ... on ClusterSpecROSA_v1 {
         subnet_ids
         availability_zones
+        oidc_endpoint_url
         account {
+          name
           uid
+          terraformUsername
+          resourcesDefaultRegion
+          automationToken {
+            path
+            field
+            version
+            format
+          }
           rosa {
             ocm_environments {
               ocm {
@@ -731,6 +780,9 @@ CLUSTERS_QUERY = """
               worker_role_arn
             }
           }
+          billingAccount {
+            uid
+          }
         }
       }
       id
@@ -741,14 +793,8 @@ CLUSTERS_QUERY = """
       version
       initial_version
       multi_az
-      nodes
-      instance_type
       private
       provision_shard_id
-      autoscale {
-        min_replicas
-        max_replicas
-      }
       disable_user_workload_monitoring
     }
     externalConfiguration {
@@ -777,6 +823,10 @@ CLUSTERS_QUERY = """
       id
       instance_type
       replicas
+      autoscale {
+        min_replicas
+        max_replicas
+      }
       labels
       taints {
         key
@@ -837,6 +887,7 @@ CLUSTERS_QUERY = """
           }
           tags
           cidrBlock
+          cidrBlocks
           manageSecurityGroups
           assumeRole
         }
@@ -907,6 +958,12 @@ CLUSTERS_QUERY = """
       version
       format
     }
+    clusterAdminAutomationToken {
+      path
+      field
+      version
+      format
+    }
     clusterAdmin
     internal
     disable {
@@ -917,6 +974,7 @@ CLUSTERS_QUERY = """
 """ % (
     indent(CLUSTER_FILTER_QUERY, 2 * " "),
     indent(JUMPHOST_FIELDS, 6 * " "),
+    indent(AWS_INFRASTRUCTURE_ACCESS_QUERY, 4 * " "),
     indent(AWS_INFRA_MANAGEMENT_ACCOUNT, 4 * " "),
     indent(AWS_INFRA_MANAGEMENT_ACCOUNT, 12 * " "),
 )
@@ -930,7 +988,6 @@ CLUSTERS_MINIMAL_QUERY = """
     name
     serverUrl
     consoleUrl
-    kibanaUrl
     prometheusUrl
     insecureSkipTLSVerify
     jumpHost {
@@ -974,12 +1031,13 @@ CLUSTERS_MINIMAL_QUERY = """
 )
 
 
-def get_clusters(minimal=False):
+def get_clusters(minimal: bool = False, aws_infrastructure_access: bool = False):
     """Returns all Clusters"""
     gqlapi = gql.get_api()
     tmpl = CLUSTERS_MINIMAL_QUERY if minimal else CLUSTERS_QUERY
     query = Template(tmpl).render(
         filter=None,
+        aws_infrastructure_access=aws_infrastructure_access,
     )
     return gqlapi.query(query)["clusters"]
 
@@ -993,6 +1051,7 @@ CLUSTER_PEERING_QUERY = """
     ocm {
       name
       environment {
+        name
         url
         accessTokenClientId
         accessTokenUrl
@@ -1032,7 +1091,23 @@ CLUSTER_PEERING_QUERY = """
     }
 
     spec {
+      id
       region
+      private
+      hypershift
+      ... on ClusterSpecROSA_v1 {
+        account {
+          name
+          uid
+          terraformUsername
+          automationToken {
+            path
+            field
+            version
+            format
+          }
+        }
+      }
     }
     network {
       vpc
@@ -1076,6 +1151,7 @@ CLUSTER_PEERING_QUERY = """
             }
           }
           tags
+          assumeRole
         }
         ... on ClusterPeeringConnectionAccountTGW_v1 {
           account {
@@ -1102,7 +1178,23 @@ CLUSTER_PEERING_QUERY = """
               vpc
             }
             spec {
+              id
               region
+              private
+              hypershift
+              ... on ClusterSpecROSA_v1 {
+                account {
+                  name
+                  uid
+                  terraformUsername
+                  automationToken {
+                    path
+                    field
+                    version
+                    format
+                  }
+                }
+              }
             }
             awsInfrastructureManagementAccounts {
               account {
@@ -1130,7 +1222,23 @@ CLUSTER_PEERING_QUERY = """
                   name
                   cluster {
                     name
+                    spec {
+                      ... on ClusterSpecROSA_v1 {
+                        account {
+                          name
+                          uid
+                          terraformUsername
+                          automationToken {
+                            path
+                            field
+                            version
+                            format
+                          }
+                        }
+                      }
+                    }
                   }
+                  assumeRole
                   awsInfrastructureManagementAccount {
                     name
                     uid
@@ -1146,6 +1254,7 @@ CLUSTER_PEERING_QUERY = """
               }
             }
           }
+          assumeRole
         }
       }
     }
@@ -1183,7 +1292,9 @@ OCM_QUERY = """
     path
     name
     environment {
+      name
       url
+      labels
       accessTokenClientId
       accessTokenUrl
       accessTokenClientSecret {
@@ -1287,68 +1398,6 @@ def get_openshift_cluster_managers() -> list[dict[str, Any]]:
     return gql.get_api().query(OCM_QUERY)["instances"]
 
 
-KAFKA_CLUSTERS_QUERY = """
-{
-  clusters: kafka_clusters_v1 {
-    name
-    ocm {
-      name
-      environment {
-        url
-        accessTokenClientId
-        accessTokenUrl
-        accessTokenClientSecret {
-          path
-          field
-          format
-          version
-        }
-      }
-      orgId
-      accessTokenClientId
-      accessTokenUrl
-      accessTokenClientSecret {
-        path
-        field
-        format
-        version
-      }
-    }
-    spec {
-      provider
-      region
-      multi_az
-    }
-    namespaces {
-      name
-      cluster {
-        name
-        serverUrl
-        insecureSkipTLSVerify
-        jumpHost {
-          %s
-        }
-        automationToken {
-          path
-          field
-          version
-          format
-        }
-      }
-    }
-  }
-}
-""" % (
-    indent(JUMPHOST_FIELDS, 10 * " "),
-)
-
-
-def get_kafka_clusters(minimal=False):
-    """Returns all Kafka Clusters"""
-    gqlapi = gql.get_api()
-    return gqlapi.query(KAFKA_CLUSTERS_QUERY)["clusters"]
-
-
 NAMESPACES_QUERY = """
 {
   namespaces: namespaces_v1 {
@@ -1473,9 +1522,7 @@ NAMESPACES_QUERY = """
     }
   }
 }
-""" % (
-    indent(JUMPHOST_FIELDS, 8 * " "),
-)
+""" % (indent(JUMPHOST_FIELDS, 8 * " "),)
 
 NAMESPACES_MINIMAL_QUERY = """
 {
@@ -1503,9 +1550,7 @@ NAMESPACES_MINIMAL_QUERY = """
     }
   }
 }
-""" % (
-    indent(JUMPHOST_FIELDS, 8 * " "),
-)
+""" % (indent(JUMPHOST_FIELDS, 8 * " "),)
 
 
 def get_namespaces(minimal=False):
@@ -1516,80 +1561,6 @@ def get_namespaces(minimal=False):
     return gqlapi.query(NAMESPACES_QUERY)["namespaces"]
 
 
-SA_TOKEN = """
-name
-namespace {
-  name
-  cluster {
-    name
-    serverUrl
-    insecureSkipTLSVerify
-    jumpHost {
-      %s
-    }
-    automationToken {
-      path
-      field
-      version
-      format
-    }
-    internal
-    disable {
-      integrations
-    }
-  }
-}
-serviceAccountName
-""" % (
-    indent(JUMPHOST_FIELDS, 6 * " "),
-)
-
-
-SERVICEACCOUNT_TOKENS_QUERY = """
-{
-  namespaces: namespaces_v1 {
-    name
-    cluster {
-      name
-      serverUrl
-      insecureSkipTLSVerify
-      jumpHost {
-        %s
-      }
-      automationToken {
-        path
-        field
-        version
-        format
-      }
-      internal
-      disable {
-        integrations
-      }
-    }
-    sharedResources {
-      openshiftServiceAccountTokens {
-        %s
-      }
-    }
-    openshiftServiceAccountTokens {
-      %s
-    }
-  }
-}
-""" % (
-    indent(JUMPHOST_FIELDS, 8 * " "),
-    indent(SA_TOKEN, 8 * " "),
-    indent(SA_TOKEN, 6 * " "),
-)
-
-
-def get_serviceaccount_tokens():
-    """Returns all namespaces with ServiceAccount tokens information"""
-    gqlapi = gql.get_api()
-    return gqlapi.query(SERVICEACCOUNT_TOKENS_QUERY)["namespaces"]
-
-
 PRODUCTS_QUERY = """
 {
   products: products_v1 {
@@ -1661,6 +1632,7 @@ APPS_QUERY = """
       showInReviewQueue
       gitlabRepoOwners {
         enabled
+        persistentLgtm
       }
       gitlabHousekeeping {
         enabled
@@ -1693,6 +1665,7 @@ CODE_COMPONENT_REPO_QUERY = """
   apps: apps_v1 {
     codeComponents {
       url
+      managePermissions
     }
   }
 }
@@ -1725,7 +1698,7 @@ def get_review_repos():
     ]
 
 
-def get_repos(server="") -> list[str]:
+def get_repos(server: str = "", exclude_manage_permissions: bool = False) -> list[str]:
     """Returns all repos defined under codeComponents
     Optional arguments:
     server: url of the server to return. for example: https://github.com
@@ -1735,6 +1708,8 @@ def get_repos(server="") -> list[str]:
     for a in apps:
         if a["codeComponents"] is not None:
             for c in a["codeComponents"]:
+                if exclude_manage_permissions and c.get("managePermissions") is False:
+                    continue
                 if c["url"].startswith(server):
                     repos.append(c["url"])
     return repos
@@ -1748,7 +1723,7 @@ def get_repos_gitlab_owner(server=""):
     """
     code_components = get_code_components()
     return [
-        c["url"]
+        {"url": c["url"], "gitlabRepoOwners": c["gitlabRepoOwners"]}
         for c in code_components
         if c["url"].startswith(server)
         and c["gitlabRepoOwners"]
@@ -1858,6 +1833,9 @@ USERS_QUERY = """
     gabi_instances {
       path
     }
+    schedules {
+      path
+    }
     {% endif %}
   }
 }
@@ -2018,6 +1996,7 @@ def get_external_users():
 APP_INTERFACE_SQL_QUERIES_QUERY = """
 {
   sql_queries: app_interface_sql_queries_v1 {
+    path
     name
     namespace
     {
@@ -2182,9 +2161,7 @@ PIPELINES_PROVIDERS_QUERY = """
     }
   }
 }
-""" % (
-    indent(JUMPHOST_FIELDS, 12 * " "),
-)
+""" % (indent(JUMPHOST_FIELDS, 12 * " "),)
 
 
 def get_pipelines_providers():
@@ -2215,6 +2192,7 @@ JIRA_BOARDS_QUERY = """
         format
       }
     }
+    {% if with_slack %}
     slack {
       workspace {
         name
@@ -2243,15 +2221,17 @@ JIRA_BOARDS_QUERY = """
       }
       channel
     }
+    {% endif %}
   }
 }
 """
 
 
-def get_jira_boards():
+def get_jira_boards(with_slack: bool | None = True):
     """Returns Jira boards resources defined in app-interface"""
     gqlapi = gql.get_api()
-    return gqlapi.query(JIRA_BOARDS_QUERY)["jira_boards"]
+    query = Template(JIRA_BOARDS_QUERY).render(with_slack=with_slack)
+    return gqlapi.query(query)["jira_boards"]
 
 
 # Use APATH as the place holder because Python formatting interferes
@@ -2420,9 +2400,7 @@ DNS_ZONES_QUERY = """
     }
   }
 }
-""" % (
-    indent(DNS_RECORD, 6 * " "),
-)
+""" % (indent(DNS_RECORD, 6 * " "),)
 
 
 def get_dns_zones(account_name=None):
@@ -2562,6 +2540,7 @@ GABI_INSTANCES_QUERY = """
     }
     users{
       github_username
+      org_username
     }
     instances{
       account
@@ -2607,9 +2586,7 @@ GABI_INSTANCES_QUERY = """
     expirationDate
   }
 }
-""" % (
-    indent(JUMPHOST_FIELDS, 12 * " "),
-)
+""" % (indent(JUMPHOST_FIELDS, 12 * " "),)
 
 
 def get_gabi_instances():
@@ -2754,3 +2731,91 @@ BLACKBOX_EXPORTER_MONITORING_PROVIDER = """
 def get_blackbox_exporter_monitoring_provider() -> dict:
     gqlapi = gql.get_api()
     return gqlapi.query(BLACKBOX_EXPORTER_MONITORING_PROVIDER)["providers"]
+
+
+JENKINS_CONFIGS = """
+{
+  jenkins_configs: jenkins_configs_v1 {
+    name
+    app {
+      name
+    }
+    instance {
+      name
+      serverUrl
+      token {
+        path
+        field
+        version
+        format
+      }
+      deleteMethod
+    }
+    type
+    config
+    config_path {
+      content
+    }
+  }
+}
+"""
+
+
+def get_jenkins_configs():
+    gqlapi = gql.get_api()
+    return gqlapi.query(JENKINS_CONFIGS)["jenkins_configs"]
+
+
+TF_RESOURCES_PROVIDER_EXCLUSIONS_BY_PROVISIONER = """
+{
+  tf_provider_exclusions: app_interface_settings_v1 {
+    terraformResourcesProviderExclusions {
+      provider
+      excludeProvisioners {
+        name
+      }
+      excludeAllProvisioners
+    }
+  }
+}
+"""
+
+
+def get_tf_resources_provider_exclusions_by_provisioner() -> (
+    list[dict[str, Any]] | None
+):
+    gqlapi = gql.get_api()
+    settings = gqlapi.query(TF_RESOURCES_PROVIDER_EXCLUSIONS_BY_PROVISIONER)[
+        "tf_provider_exclusions"
+    ]
+    if len(settings) == 1 and "terraformResourcesProviderExclusions" in settings[0]:
+        return settings[0]["terraformResourcesProviderExclusions"]
+    return None
+
+
+SCHEMAS_QUERY = """
+{
+  schemas: __schema {
+    types {
+      name
+      fields {
+        name
+        type {
+          kind
+          name
+          ofType {
+            kind
+            name
+          }
+        }
+      }
+    }
+  }
+}
+"""
+
+
+# TODO: replace with typed query following https://issues.redhat.com/browse/APPSRE-10983
+def get_schemas() -> dict:
+    gqlapi = gql.get_api()
+    return gqlapi.query(SCHEMAS_QUERY)["schemas"]