def build_desired_state_vpc_single_cluster(cluster_info, ocm: OCM, awsapi: AWSApi): desired_state = [] peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] cluster = cluster_info['name'] for peer_connection in peer_connections: # We only care about account-vpc peering providers peer_connection_provider = peer_connection['provider'] if not peer_connection_provider == 'account-vpc': continue # requester is the cluster's AWS account requester = { 'cidr_block': cluster_info['network']['vpc'], 'region': cluster_info['spec']['region'] } connection_name = peer_connection['name'] peer_vpc = peer_connection['vpc'] # accepter is the peered AWS account accepter = { 'vpc_id': peer_vpc['vpc_id'], 'cidr_block': peer_vpc['cidr_block'], 'region': peer_vpc['region'] } account = peer_vpc['account'] # assume_role is the role to assume to provision the peering # connection request, through the accepter AWS account. account['assume_role'] = \ ocm.get_aws_infrastructure_access_terraform_assume_role( cluster, peer_vpc['account']['uid'], peer_vpc['account']['terraformUsername'] ) account['assume_region'] = requester['region'] account['assume_cidr'] = requester['cidr_block'] requester_vpc_id, requester_route_table_ids, _ = \ awsapi.get_cluster_vpc_details( account, route_tables=peer_connection.get('manageRoutes') ) if requester_vpc_id is None: raise BadTerraformPeeringState( f'[{cluster} could not find VPC ID for cluster') requester['vpc_id'] = requester_vpc_id requester['route_table_ids'] = requester_route_table_ids requester['account'] = account accepter['account'] = account item = { 'connection_provider': peer_connection_provider, 'connection_name': connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } desired_state.append(item) return desired_state
def build_desired_state_tgw_attachments(clusters, ocm_map: OCMMap, awsapi: AWSApi): """ Fetch state for TGW attachments between a cluster and all TGWs in an account in the same region as the cluster """ desired_state = [] error = False for cluster_info in clusters: cluster = cluster_info["name"] ocm = ocm_map.get(cluster) peering_info = cluster_info["peering"] peer_connections = peering_info["connections"] for peer_connection in peer_connections: # We only care about account-tgw peering providers peer_connection_provider = peer_connection["provider"] if not peer_connection_provider == "account-tgw": continue # accepter is the cluster's AWS account cluster_region = cluster_info["spec"]["region"] cluster_cidr_block = cluster_info["network"]["vpc"] accepter = { "cidr_block": cluster_cidr_block, "region": cluster_region } account = peer_connection["account"] # assume_role is the role to assume to provision the # peering connection request, through the accepter AWS account. provided_assume_role = peer_connection.get("assumeRole") # if an assume_role is provided, it means we don't need # to get the information from OCM. it likely means that # there is no OCM at all. if provided_assume_role: account["assume_role"] = provided_assume_role else: account[ "assume_role"] = ocm.get_aws_infrastructure_access_terraform_assume_role( cluster, account["uid"], account["terraformUsername"]) account["assume_region"] = accepter["region"] account["assume_cidr"] = accepter["cidr_block"] ( accepter_vpc_id, accepter_route_table_ids, accepter_subnets_id_az, ) = awsapi.get_cluster_vpc_details( account, route_tables=peer_connection.get("manageRoutes"), subnets=True, ) if accepter_vpc_id is None: logging.error(f"[{cluster} could not find VPC ID for cluster") error = True continue accepter["vpc_id"] = accepter_vpc_id accepter["route_table_ids"] = accepter_route_table_ids accepter["subnets_id_az"] = accepter_subnets_id_az accepter["account"] = account account_tgws = awsapi.get_tgws_details( account, cluster_region, cluster_cidr_block, tags=json.loads(peer_connection.get("tags") or "{}"), route_tables=peer_connection.get("manageRoutes"), security_groups=peer_connection.get("manageSecurityGroups"), ) for tgw in account_tgws: tgw_id = tgw["tgw_id"] connection_name = (f"{peer_connection['name']}_" + f"{account['name']}-{tgw_id}") requester = { "tgw_id": tgw_id, "tgw_arn": tgw["tgw_arn"], "region": tgw["region"], "routes": tgw.get("routes"), "rules": tgw.get("rules"), "cidr_block": peer_connection.get("cidrBlock"), "account": account, } item = { "connection_provider": peer_connection_provider, "connection_name": connection_name, "requester": requester, "accepter": accepter, "deleted": peer_connection.get("delete", False), } desired_state.append(item) return desired_state, error
def build_desired_state_tgw_attachments(clusters, ocm_map, settings): """ Fetch state for TGW attachments between a cluster and all TGWs in an account in the same region as the cluster """ desired_state = [] error = False for cluster_info in clusters: cluster = cluster_info['name'] ocm = ocm_map.get(cluster) peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] for peer_connection in peer_connections: # We only care about account-tgw peering providers peer_connection_provider = peer_connection['provider'] if not peer_connection_provider == 'account-tgw': continue # accepter is the cluster's AWS account cluster_region = cluster_info['spec']['region'] cluster_cidr_block = cluster_info['network']['vpc'] accepter = { 'cidr_block': cluster_cidr_block, 'region': cluster_region } account = peer_connection['account'] # assume_role is the role to assume to provision the # peering connection request, through the accepter AWS account. account['assume_role'] = \ ocm.get_aws_infrastructure_access_terraform_assume_role( cluster, account['uid'], account['terraformUsername'] ) account['assume_region'] = accepter['region'] account['assume_cidr'] = accepter['cidr_block'] aws_api = AWSApi(1, [account], settings=settings) accepter_vpc_id, accepter_route_table_ids, \ accepter_subnets_id_az = \ aws_api.get_cluster_vpc_details( account, route_tables=peer_connection.get('manageRoutes'), subnets=True, ) if accepter_vpc_id is None: logging.error(f'[{cluster} could not find VPC ID for cluster') error = True continue accepter['vpc_id'] = accepter_vpc_id accepter['route_table_ids'] = accepter_route_table_ids accepter['subnets_id_az'] = accepter_subnets_id_az accepter['account'] = account account_tgws = \ aws_api.get_tgws_details( account, cluster_region, cluster_cidr_block, tags=json.loads(peer_connection.get('tags') or {}), route_tables=peer_connection.get('manageRoutes'), security_groups=peer_connection.get( 'manageSecurityGroups'), ) for tgw in account_tgws: tgw_id = tgw['tgw_id'] connection_name = \ f"{peer_connection['name']}_" + \ f"{account['name']}-{tgw_id}" requester = { 'tgw_id': tgw_id, 'tgw_arn': tgw['tgw_arn'], 'region': tgw['region'], 'routes': tgw.get('routes'), 'rules': tgw.get('rules'), 'cidr_block': peer_connection.get('cidrBlock'), 'account': account, } item = { 'connection_provider': peer_connection_provider, 'connection_name': connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } desired_state.append(item) return desired_state, error
def build_desired_state_cluster(clusters, ocm_map, settings): """ Fetch state for VPC peerings between two OCM clusters """ desired_state = [] error = False for cluster_info in clusters: cluster_name = cluster_info['name'] # Find an aws account with the "network-mgmt" access level on the # requester cluster and use that as the account for the requester req_aws = aws_account_from_infrastructure_access( cluster_info, 'network-mgmt', ocm_map) if not req_aws: msg = f"could not find an AWS account with the " \ f"'network-mgmt' access level on the cluster {cluster_name}" logging.error(msg) error = True continue req_aws['assume_region'] = cluster_info['spec']['region'] req_aws['assume_cidr'] = cluster_info['network']['vpc'] peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] for peer_connection in peer_connections: # We only care about cluster-vpc-requester peering providers peer_connection_provider = peer_connection['provider'] if not peer_connection_provider == 'cluster-vpc-requester': continue peer_connection_name = peer_connection['name'] peer_cluster = peer_connection['cluster'] peer_cluster_name = peer_cluster['name'] requester_manage_routes = peer_connection.get('manageRoutes') # Ensure we have a matching peering connection peer_info = find_matching_peering(cluster_info, peer_connection, peer_cluster, 'cluster-vpc-accepter') if not peer_info: msg = f"could not find a matching peering connection for " \ f"cluster {cluster_name}, " \ f"connection {peer_connection_name}" logging.error(msg) error = True continue accepter_manage_routes = peer_info.get('manageRoutes') aws_api = AWSApi(1, [req_aws], settings=settings) requester_vpc_id, requester_route_table_ids, _ = \ aws_api.get_cluster_vpc_details( req_aws, route_tables=requester_manage_routes ) if requester_vpc_id is None: msg = f'[{cluster_name} could not find VPC ID for cluster' logging.error(msg) error = True continue requester = { 'cidr_block': cluster_info['network']['vpc'], 'region': cluster_info['spec']['region'], 'vpc_id': requester_vpc_id, 'route_table_ids': requester_route_table_ids, 'account': req_aws } # Find an aws account with the "network-mgmt" access level on the # peer cluster and use that as the account for the accepter acc_aws = aws_account_from_infrastructure_access( peer_cluster, 'network-mgmt', ocm_map) if not acc_aws: msg = "could not find an AWS account with the " \ "'network-mgmt' access level on the cluster" logging.error(msg) error = True continue acc_aws['assume_region'] = peer_cluster['spec']['region'] acc_aws['assume_cidr'] = peer_cluster['network']['vpc'] aws_api = AWSApi(1, [acc_aws], settings=settings) accepter_vpc_id, accepter_route_table_ids, _ = \ aws_api.get_cluster_vpc_details( acc_aws, route_tables=accepter_manage_routes ) if accepter_vpc_id is None: msg = f'[{peer_cluster_name} could not find VPC ID for cluster' logging.error(msg) error = True continue requester['peer_owner_id'] = acc_aws['assume_role'].split(':')[4] accepter = { 'cidr_block': peer_cluster['network']['vpc'], 'region': peer_cluster['spec']['region'], 'vpc_id': accepter_vpc_id, 'route_table_ids': accepter_route_table_ids, 'account': acc_aws } item = { 'connection_provider': peer_connection_provider, 'connection_name': peer_connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } desired_state.append(item) return desired_state, error
def build_desired_state_vpc(clusters, ocm_map, settings): """ Fetch state for VPC peerings between a cluster and a VPC (account) """ desired_state = [] error = False for cluster_info in clusters: cluster = cluster_info['name'] ocm = ocm_map.get(cluster) peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] for peer_connection in peer_connections: # We only care about account-vpc peering providers peer_connection_provider = peer_connection['provider'] if not peer_connection_provider == 'account-vpc': continue # requester is the cluster's AWS account requester = { 'cidr_block': cluster_info['network']['vpc'], 'region': cluster_info['spec']['region'] } connection_name = peer_connection['name'] peer_vpc = peer_connection['vpc'] # accepter is the peered AWS account accepter = { 'vpc_id': peer_vpc['vpc_id'], 'cidr_block': peer_vpc['cidr_block'], 'region': peer_vpc['region'] } account = peer_vpc['account'] # assume_role is the role to assume to provision the # peering connection request, through the accepter AWS account. account['assume_role'] = \ ocm.get_aws_infrastructure_access_terraform_assume_role( cluster, peer_vpc['account']['uid'], peer_vpc['account']['terraformUsername'] ) account['assume_region'] = requester['region'] account['assume_cidr'] = requester['cidr_block'] aws_api = AWSApi(1, [account], settings=settings) requester_vpc_id, requester_route_table_ids, _ = \ aws_api.get_cluster_vpc_details( account, route_tables=peer_connection.get('manageRoutes') ) if requester_vpc_id is None: logging.error(f'[{cluster} could not find VPC ID for cluster') error = True continue requester['vpc_id'] = requester_vpc_id requester['route_table_ids'] = requester_route_table_ids requester['account'] = account accepter['account'] = account item = { 'connection_provider': peer_connection_provider, 'connection_name': connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } desired_state.append(item) return desired_state, error
def build_desired_state_vpc_single_cluster(cluster_info, ocm: Optional[OCM], awsapi: AWSApi): desired_state = [] peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] cluster = cluster_info['name'] for peer_connection in peer_connections: # We only care about account-vpc peering providers peer_connection_provider = peer_connection['provider'] if not peer_connection_provider == 'account-vpc': continue # requester is the cluster's AWS account requester = { 'cidr_block': cluster_info['network']['vpc'], 'region': cluster_info['spec']['region'] } connection_name = peer_connection['name'] peer_vpc = peer_connection['vpc'] # accepter is the peered AWS account accepter = { 'vpc_id': peer_vpc['vpc_id'], 'cidr_block': peer_vpc['cidr_block'], 'region': peer_vpc['region'] } account = peer_vpc['account'] # assume_role is the role to assume to provision the peering # connection request, through the accepter AWS account. provided_assume_role = peer_connection.get('assumeRole') # if an assume_role is provided, it means we don't need # to get the information from OCM. it likely means that # there is no OCM at all. if provided_assume_role: account['assume_role'] = provided_assume_role elif ocm is not None: account['assume_role'] = \ ocm.get_aws_infrastructure_access_terraform_assume_role( cluster, peer_vpc['account']['uid'], peer_vpc['account']['terraformUsername'] ) else: raise KeyError( f'[{cluster}] peering connection ' f'{connection_name} must either specify assumeRole ' 'or ocm should be defined to obtain role to assume') account['assume_region'] = requester['region'] account['assume_cidr'] = requester['cidr_block'] requester_vpc_id, requester_route_table_ids, _ = \ awsapi.get_cluster_vpc_details( account, route_tables=peer_connection.get('manageRoutes') ) if requester_vpc_id is None: raise BadTerraformPeeringState( f'[{cluster}] could not find VPC ID for cluster' ) requester['vpc_id'] = requester_vpc_id requester['route_table_ids'] = requester_route_table_ids requester['account'] = account accepter['account'] = account item = { 'connection_provider': peer_connection_provider, 'connection_name': connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } desired_state.append(item) return desired_state
def build_desired_state_single_cluster(cluster_info, ocm: OCM, awsapi: AWSApi): cluster_name = cluster_info['name'] peerings = [] peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] for peer_connection in peer_connections: # We only care about cluster-vpc-requester peering providers peer_connection_provider = peer_connection['provider'] if peer_connection_provider != 'cluster-vpc-requester': continue peer_connection_name = peer_connection['name'] peer_cluster = peer_connection['cluster'] peer_cluster_name = peer_cluster['name'] requester_manage_routes = peer_connection.get('manageRoutes') # Ensure we have a matching peering connection peer_info = find_matching_peering(cluster_info, peer_cluster, 'cluster-vpc-accepter') if not peer_info: raise BadTerraformPeeringState( "[no_matching_peering] could not find a matching peering " f"connection for cluster {cluster_name}, connection " f"{peer_connection_name}" ) accepter_manage_routes = peer_info.get('manageRoutes') req_aws, acc_aws = aws_assume_roles_for_cluster_vpc_peering( cluster_info, peer_info, peer_cluster, ocm ) requester_vpc_id, requester_route_table_ids, _ = \ awsapi.get_cluster_vpc_details( req_aws, route_tables=requester_manage_routes ) if requester_vpc_id is None: raise BadTerraformPeeringState( f'[{cluster_name}] could not find VPC ID for cluster' ) requester = { 'cidr_block': cluster_info['network']['vpc'], 'region': cluster_info['spec']['region'], 'vpc_id': requester_vpc_id, 'route_table_ids': requester_route_table_ids, 'account': req_aws } accepter_vpc_id, accepter_route_table_ids, _ = \ awsapi.get_cluster_vpc_details( acc_aws, route_tables=accepter_manage_routes ) if accepter_vpc_id is None: raise BadTerraformPeeringState( f'[{peer_cluster_name}] could not find VPC ID for cluster' ) requester['peer_owner_id'] = acc_aws['assume_role'].split(':')[4] accepter = { 'cidr_block': peer_cluster['network']['vpc'], 'region': peer_cluster['spec']['region'], 'vpc_id': accepter_vpc_id, 'route_table_ids': accepter_route_table_ids, 'account': acc_aws } item = { 'connection_provider': peer_connection_provider, 'connection_name': peer_connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } peerings.append(item) return peerings
def build_desired_state_single_cluster(cluster_info, ocm_map: OCMMap, awsapi: AWSApi): cluster_name = cluster_info['name'] peerings = [] # Find an aws account with the "network-mgmt" access level on the # requester cluster and use that as the account for the requester req_aws = aws_account_from_infrastructure_access(cluster_info, 'network-mgmt', ocm_map) if not req_aws: raise BadTerraformPeeringState( "could not find an AWS account with the " f"'network-mgmt' access level on the cluster {cluster_name}") peering_info = cluster_info['peering'] peer_connections = peering_info['connections'] for peer_connection in peer_connections: # We only care about cluster-vpc-requester peering providers peer_connection_provider = peer_connection['provider'] if peer_connection_provider != 'cluster-vpc-requester': continue peer_connection_name = peer_connection['name'] peer_cluster = peer_connection['cluster'] peer_cluster_name = peer_cluster['name'] requester_manage_routes = peer_connection.get('manageRoutes') # Ensure we have a matching peering connection peer_info = find_matching_peering(cluster_info, peer_connection, peer_cluster, 'cluster-vpc-accepter') if not peer_info: raise BadTerraformPeeringState( "could not find a matching peering connection for " f"cluster {cluster_name}, connection {peer_connection_name}") accepter_manage_routes = peer_info.get('manageRoutes') requester_vpc_id, requester_route_table_ids, _ = \ awsapi.get_cluster_vpc_details( req_aws, route_tables=requester_manage_routes ) if requester_vpc_id is None: raise BadTerraformPeeringState( f'[{cluster_name} could not find VPC ID for cluster') requester = { 'cidr_block': cluster_info['network']['vpc'], 'region': cluster_info['spec']['region'], 'vpc_id': requester_vpc_id, 'route_table_ids': requester_route_table_ids, 'account': req_aws } # Find an aws account with the "network-mgmt" access level on # the peer cluster and use that as the account for the # accepter acc_aws = aws_account_from_infrastructure_access( peer_cluster, 'network-mgmt', ocm_map) if not acc_aws: raise BadTerraformPeeringState( "could not find an AWS account with the " f"'network-mgmt' access level on cluster {cluster_name}, " f"peering {peer_connection_name}") accepter_vpc_id, accepter_route_table_ids, _ = \ awsapi.get_cluster_vpc_details( acc_aws, route_tables=accepter_manage_routes ) if accepter_vpc_id is None: raise BadTerraformPeeringState( f'{peer_cluster_name} could not find VPC ID for cluster') requester['peer_owner_id'] = acc_aws['assume_role'].split(':')[4] accepter = { 'cidr_block': peer_cluster['network']['vpc'], 'region': peer_cluster['spec']['region'], 'vpc_id': accepter_vpc_id, 'route_table_ids': accepter_route_table_ids, 'account': acc_aws } item = { 'connection_provider': peer_connection_provider, 'connection_name': peer_connection_name, 'requester': requester, 'accepter': accepter, 'deleted': peer_connection.get('delete', False) } peerings.append(item) return peerings