Add robot account management#5184

Open

esron wants to merge 32 commits intoapp-sre:masterfrom

esron:add-robot-account-management

Contributor

esron commented Aug 21, 2025 •

edited

Loading

JIRA: APPSRE-11883

This adds a new integration that handles robot account management.

I decided to go with this approach because quay-permissions integration already has a complex state management that when mixed with the robot accounts needs of managing teams and repository relationships gets really messy.

This approach also let's robot-accounts be more independent and clear to the user, since it relies on a single file where all relationships are defined.

Also I am getting inspiration from the original script where the robot accounts for quay are defined.

We still need to decide how are we going to migrate existent robot accounts to app-interface and deal with the permissions needed by qontract-reconcile to manage robot-account for private teams and repos.

In the current state, if you dry-run this integration locally it will show some delete actions for already defined robot accounts outside app-interface.

Also we don't heave full read access for robot-account in some of the Quay orgs defined in app-interface.

How to test this?

Create an integration file in app-interface. Here is a snippet, you can copy other integrations file if you get validations errors and edit:

$schema: /app-sre/integration-1.yml

labels: {}

name: quay-robot-accounts

description: Manage Quay Robot Accounts

upstream: https://github.com/app-sre/qontract-reconcile

pr_check:
  disabled: true
  cmd: quay-robot-accounts

# Copy this from other integrations
managed: 
- ...


schemas:
- /access/quay-robot-1.yml
- /app-interface/app-interface-settings-1.yml
- /app-sre/integration-1.yml
- /aws/account-1.yml
- /dependencies/dependency-1.yml
- /dependencies/quay-instance-1.yml
- /dependencies/quay-org-1.yml

Create a new robot-account-1.yml

---
$schema: /access/quay-robot-1.yml

labels: {}

name: app-sre-redhat-services-prod-robot-account
quay_username: appsre_pull # redhat-services-prod+appsre_pull

quay_org:
  $ref: /dependencies/quay/redhat-services-prod.yml

teams:
- devs

Set your local qontract-schemas to the branch on this PR

when you run

qontract-reconcile --log-level INFO --config config.toml --dry-run quay-robot-accounts

You should see a list of actions, the first one should be to create the robot account that we defined on the yaml file above.

Drop a comment if you have any question, issue or need help testing this.

esron changed the title ~~Add robot account management~~ Draft: Add robot account management

esron marked this pull request as draft

August 21, 2025 20:53

esron force-pushed the add-robot-account-management branch from a5be134 to cfd474c Compare

August 25, 2025 14:18

esron changed the title ~~Draft: Add robot account management~~ Add robot account management

esron marked this pull request as ready for review

August 25, 2025 18:20

esron force-pushed the add-robot-account-management branch 2 times, most recently from c55830a to c6f4be4 Compare

August 26, 2025 18:14

esron force-pushed the add-robot-account-management branch from c6f4be4 to 8e8f83f Compare

October 8, 2025 16:30

Contributor Author

esron commented Oct 8, 2025

/retest

hemslo reviewed

View reviewed changes

reconcile/test/utils/test_quay_api.py Outdated Show resolved Hide resolved

reconcile/test/test_quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/utils/quay_api.py Outdated Show resolved Hide resolved

reconcile/utils/quay_api.py Outdated Show resolved Hide resolved

reconcile/utils/quay_api.py Outdated Show resolved Hide resolved

reconcile/quay_robot_accounts.py

Comment on lines +132 to +135

+                          repositories = {}
+                          repo_permissions = robot_data.get("repositories", [])
+                          for repo_perm in repo_permissions:
+                              repositories[repo_perm["name"]] = repo_perm["role"]

Contributor

hemslo Oct 9, 2025

similar here, why not directly let robot_data returns dict name -> role?

reconcile/quay_robot_accounts.py

+                  actions = []
+                  # Find robots to create
+                  for key, desired in desired_state.items():

Contributor

hemslo Oct 9, 2025

can use diff_mappings to diff

Member

chassing Oct 9, 2025

^this

reconcile/quay_robot_accounts.py

Comment on lines +255 to +265

+                  # Find robots to delete (robots in current state but not in desired state)
+                  for key, current in current_state.items():
+                      if key not in desired_state:
+                          actions.append(
+                              RobotAccountAction(
+                                  action="delete",
+                                  robot_name=current.name,
+                                  org_name=current.org_name,
+                                  instance_name=current.instance_name,
+                              )
+                          )

Contributor

hemslo Oct 9, 2025

how about introduce delete: true on robot account so we only delete account marked as delete, no accidentally delete accounts not managed by this integration

reconcile/quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/quay_robot_accounts.py Outdated Show resolved Hide resolved

chassing reviewed

View reviewed changes

reconcile/test/test_quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/test/test_quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/test/test_quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/test/test_quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/test/test_quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/quay_robot_accounts.py

+                  actions = []
+                  # Find robots to create
+                  for key, desired in desired_state.items():

Member

chassing Oct 9, 2025

^this

reconcile/quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/quay_robot_accounts.py Outdated Show resolved Hide resolved

reconcile/quay_robot_accounts.py Outdated Show resolved Hide resolved

esron force-pushed the add-robot-account-management branch 3 times, most recently from 44d5a34 to 7b13f24 Compare

December 18, 2025 19:33

esron mentioned this pull request

Refactor QuayApi to extend ApiBase #5353

Merged

esron force-pushed the add-robot-account-management branch 6 times, most recently from ffe97e7 to 51bbceb Compare

January 20, 2026 15:03

esron added 9 commits

January 27, 2026 06:06


          Test list_robot_accounts

55c5034


          Test list_robot_accounts raises for ther status

41ab5ff


          Test create_robot_account

679f209


          Test creat_robot_account raises for other status

9325d74


          Test delete robot_account

e386e46


          Test delete robot account raises for other status

5d3ede3


          Format

684d9fe


          Add tests for repo permissions methods

7c0d4a2


          Add robot-accounts query

edc1acc

esron added 23 commits

January 27, 2026 06:06


          Add robot accounts integration file

c6bab81


          Add robot accounts integration tests

c696f28


          Add quay robot accounts to cli

8808c32


          Fix typing for quay_robot_accounts

5421d01


          Fix typting for quay_api tests

20fcbdd


          Fix typing for quay_robot_accounts tests

fd2e204


          Remove test for message checking

8da2f4c


          Use robot short name to get robot account details

b79e278


          make gql-introspection

e3b5d5d


          remove duplicate get response

a54e19b


          Use create autospect

b29b1e3


          Add RobotAccountDetails type

632ea56


          Adapt quay api tests to be session based

1e7f726


          fix quay_mirror account that depend on QuayApiStore

1b0f6df


          Update test_quay_robot_accounts to use QuayApiStore

4409d5d


          Adds robot account methods based on new Api class

50c8d33


          Fix get_quay_api_store return type

a9c77b4


          Fix integration to use QuayApiStore

ea1aae0


          Fix: change logging messages to debug

c35f217


          Fix: remove unwanted expection handling

06a3753


          Fix: removes unecessarie type definitions

e4f0d94


          Fix: use enum on RobotAccountActions

0c21c94


          Fix: use mock_quay_api as a fixture to improve tests

457ed70

esron force-pushed the add-robot-account-management branch from 51bbceb to 457ed70 Compare

January 27, 2026 09:06

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet