Validate read replica has matching desired config as replica source instance (#139)

hemslo · web-flow · commit 9652a8a69f6b · 2025-04-09T11:55:35.000+10:00
* feat: use full blue_green_deployment object in replica_source
* feat: validate engine_version for read replica
* chore: bump version to 0.6.8

Signed-off-by: Di Wang &lt;dwan@redhat.com&gt;
diff --git a/Dockerfile b/Dockerfile
@@ -1,6 +1,6 @@
 FROM quay.io/redhat-services-prod/app-sre-tenant/er-base-terraform-main/er-base-terraform-main:tf-1.6.6-py-3.12-v0.3.4-1@sha256:1579e58702182a02b55a0841254d188a6b99ff42c774279890567338c863a31b AS base
 # keep in sync with pyproject.toml
-LABEL konflux.additional-tags="0.6.7"
+LABEL konflux.additional-tags="0.6.8"
 
 FROM base AS builder
 COPY --from=ghcr.io/astral-sh/uv:0.6.13@sha256:0b6dc79013b689f3bc0cbf12807cb1c901beaafe80f2ee10a1d76aa3842afb92 /uv /bin/uv
diff --git a/er_aws_rds/input.py b/er_aws_rds/input.py
@@ -65,14 +65,6 @@ class ParameterGroup(BaseModel):
     parameters: list[Parameter] | None = Field(default=None)
 
 
-class ReplicaSource(BaseModel):
-    "AppInterface ReplicaSource"
-
-    region: str
-    identifier: str
-    blue_green_deployment_enabled: bool
-
-
 class BlueGreenDeploymentTarget(BaseModel):
     "AppInterface BlueGreenDeployment.Target"
 
@@ -95,6 +87,14 @@ class BlueGreenDeployment(BaseModel):
     target: BlueGreenDeploymentTarget | None = None
 
 
+class ReplicaSource(BaseModel):
+    "AppInterface ReplicaSource"
+
+    region: str
+    identifier: str
+    blue_green_deployment: BlueGreenDeployment | None = None
+
+
 class DBInstanceTimeouts(BaseModel):
     "DBInstance timeouts"
 
@@ -335,7 +335,25 @@ def _validate_blue_green_update(self) -> Self:
 
     @model_validator(mode="after")
     def _validate_blue_green_deployment_for_replica(self) -> Self:
-        if self.replica_source and self.replica_source.blue_green_deployment_enabled:
+        """
+        Validate the blue_green_deployment for read replicas
+
+        * blue_green_deployment is not supported for read replica instance (only supported for primary instance)
+        * If the replica_source has blue_green_deployment enabled
+          * parameter_group must be None
+          * deletion_protection must be False
+          * region must match replica_source region
+          * engine_version must match replica_source engine_version if specified in target after switchover and delete,
+            note only engine_version is applied to all instances,
+            instance-class is supposed to be applied to all instances but actually only applied to primary instance,
+            so we only validate engine_version.
+            doc: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/blue-green-deployments-creating.html#create-blue-green-settings
+        """
+        if (
+            self.replica_source
+            and (blue_green_deployment := self.replica_source.blue_green_deployment)
+            and blue_green_deployment.enabled
+        ):
             if self.parameter_group:
                 raise ValueError(
                     "parameter_group is not supported when replica_source has blue_green_deployment enabled"
@@ -348,6 +366,19 @@ def _validate_blue_green_deployment_for_replica(self) -> Self:
                 raise ValueError(
                     "Cross-region read replicas are not currently supported for Blue Green Deployments"
                 )
+            if (
+                blue_green_deployment.switchover
+                and blue_green_deployment.delete
+                and blue_green_deployment.target
+                and (engine_version := blue_green_deployment.target.engine_version)
+                and engine_version != self.engine_version
+            ):
+                not_matched = {
+                    "engine_version": engine_version,
+                }
+                raise ValueError(
+                    f"desired config not match replica_source blue_green_deployment.target, update: {not_matched}"
+                )
         if self.is_read_replica and self.blue_green_deployment:
             raise ValueError(
                 "blue_green_deployment is not supported for replica instance"
diff --git a/hooks/utils/blue_green_deployment_manager.py b/hooks/utils/blue_green_deployment_manager.py
@@ -54,8 +54,10 @@ def __init__(
     def run(self) -> State:
         """Run Blue/Green Deployment Manager"""
         if (
-            replica_source := self.app_interface_input.data.replica_source
-        ) and replica_source.blue_green_deployment_enabled:
+            (replica_source := self.app_interface_input.data.replica_source)
+            and replica_source.blue_green_deployment
+            and replica_source.blue_green_deployment.enabled
+        ):
             self.logger.info("blue_green_deployment in replica_source enabled.")
             return State.REPLICA_SOURCE_ENABLED
 
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "er-aws-rds"
-version = "0.6.7"
+version = "0.6.8"
 description = "ERv2 module for managing AWS rds instances"
 authors = [{ name = "AppSRE", email = "sd-app-sre@redhat.com" }]
 license = { text = "Apache 2.0" }
diff --git a/tests/test_blue_green_deployment_manager.py b/tests/test_blue_green_deployment_manager.py
@@ -1121,7 +1121,9 @@ def test_run_for_read_replica_has_blue_green_deployment_enabled(
             "replica_source": {
                 "identifier": "test-rds-source",
                 "region": "us-east-1",
-                "blue_green_deployment_enabled": True,
+                "blue_green_deployment": {
+                    "enabled": True,
+                },
             },
             "parameter_group": None,
         }
diff --git a/tests/test_input_validation.py b/tests/test_input_validation.py
@@ -240,7 +240,9 @@ def test_validate_blue_green_deployment_for_replica_with_parameter_group() -> No
             "replica_source": {
                 "identifier": "test-rds-source",
                 "region": "us-east-1",
-                "blue_green_deployment_enabled": True,
+                "blue_green_deployment": {
+                    "enabled": True,
+                },
             },
             "parameter_group": DEFAULT_PARAMETER_GROUP,
         }
@@ -259,7 +261,9 @@ def test_validate_blue_green_deployment_for_replica_with_deletion_protection() -
             "replica_source": {
                 "identifier": "test-rds-source",
                 "region": "us-east-1",
-                "blue_green_deployment_enabled": True,
+                "blue_green_deployment": {
+                    "enabled": True,
+                },
             },
             "parameter_group": None,
             "deletion_protection": True,
@@ -272,14 +276,45 @@ def test_validate_blue_green_deployment_for_replica_with_deletion_protection() -
         AppInterfaceInput.model_validate(mod_input)
 
 
+def test_validate_blue_green_deployment_for_replica_when_desired_config_not_match_target() -> (
+    None
+):
+    """Test replica desired config match target"""
+    mod_input = input_data({
+        "data": {
+            "replica_source": {
+                "identifier": "test-rds-source",
+                "region": "us-east-1",
+                "blue_green_deployment": {
+                    "enabled": True,
+                    "switchover": True,
+                    "delete": True,
+                    "target": DEFAULT_TARGET,
+                },
+            },
+            "parameter_group": None,
+        }
+    })
+    expected_not_matched = {
+        "engine_version": "15.7",
+    }
+    with pytest.raises(
+        ValidationError,
+        match=rf".*desired config not match replica_source blue_green_deployment.target, update: {expected_not_matched}.*",
+    ):
+        AppInterfaceInput.model_validate(mod_input)
+
+
 def test_validate_blue_green_deployment_for_replica() -> None:
     """Test that blue_green_deployment is not supported for replica instance"""
     mod_input = input_data({
         "data": {
             "replica_source": {
                 "identifier": "test-rds-source",
                 "region": "us-east-1",
-                "blue_green_deployment_enabled": False,
+                "blue_green_deployment": {
+                    "enabled": False,
+                },
             },
             "blue_green_deployment": {
                 "enabled": False,
@@ -302,7 +337,9 @@ def test_validate_blue_green_deployment_for_cross_region_replica() -> None:
             "replica_source": {
                 "identifier": "test-rds-source",
                 "region": "us-east-1",
-                "blue_green_deployment_enabled": True,
+                "blue_green_deployment": {
+                    "enabled": True,
+                },
             },
             "region": "us-west-2",
             "db_subnet_group_name": "test-subnet-group",
@@ -332,6 +369,6 @@ def test_validate_blue_green_deployment_when_desired_config_not_match_target_aft
     })
     with pytest.raises(
         ValidationError,
-        match=r".*desired config not match blue_green_deployment.target after delete.*",
+        match=r".*desired config not match blue_green_deployment.target after delete, update: .*",
     ):
         AppInterfaceInput.model_validate(mod_input)
diff --git a/uv.lock b/uv.lock
