Merge in Netflix/lemur main

[nlopez]

Summary

Merges upstream Netflix/lemur main (2178 commits) into the Datadog fork. Resolves 89 conflicts, recompiles pinned requirements, fixes a pre-existing missing dep, and ships a migration-tree audit doc. Tests: 864 passed, 18 skipped.

Commits (first-parent)

SHA	Description
c87a48, b02878	(pre-existing) Enable ACME issuer plugin in prod Docker image + hunk-header fix
304fa2	Merge upstream/main into wip-apr27 (89 conflicts resolved)
d32e2e	Lint + test env fixes (Dockerfile pip syntax, flake8 E203, blank lines, missing cachetools dep)
beb4ad	Recompile requirements{,-dev,-docs,-tests}.txt + add migration audit doc

Conflict resolution policy

• Kept ours for: requirements*.{in,txt} (FIPS pin cryptography==43.0.1), Dockerfile, Makefile, .github/workflows/*, CODEOWNERS, dependabot, local/src/lemur.conf.py, README, docs/administration.rst, tox.ini, setup.py, setup.cfg, lemur/plugins/lemur_azure_dest/plugin.py (Datadog plugin upstream removed).
• CHANGELOG.rst: combined — Datadog entries on top, upstream below.
• Code conflicts (~60 files): per-hunk merge preserving Datadog customizations. See "behavior changes" below for the meaningful semantic resolutions.

Behavior changes operators / on-call should know about

⚠️ Anything that runs differently after this PR lands.

CLI re-platformed: flask_script → click (FlaskGroup)

lemur/manage.py, lemur/certificates/cli.py, lemur/acme_providers/cli.py, lemur/notifications/cli.py, etc. moved from flask_script @manager.option to click. Invocation patterns like lemur ... <cmd> largely still work, but flag parsing and help output differ. Any runbooks or shell scripts invoking lemur ... subcommands need a smoke test before deploy. Datadog-only options preserved on lemur certificates ...: --region, source-based rotation, multi-cert-per-endpoint loop.

Auth / SSO: IDP_GROUPS_KEYS replaces hard-coded googleGroups

lemur/auth/views.py now reads group claims from a configurable list of keys (IDP_GROUPS_KEYS) rather than always looking at googleGroups. Verify the staging/commercial/government lemur.conf.py (in k8s-resources) sets IDP_GROUPS_KEYS = ["googleGroups"] (or whatever keys we use) before deploy — otherwise group-based authorization may break for SSO logins. The Datadog JWTAuthenticator Vault path is unchanged.

Private-key export: stacked validation

lemur/certificates/views.py keeps the Datadog break-glass requirement and now also runs upstream's new CERTIFICATE_EXPORT_KEY_REQUEST_VALIDATION hook if configured. Both apply (export must satisfy break-glass and the optional validator). No-op unless we set the new config.

AWS endpoint discovery: skip-region-on-failure

lemur/plugins/lemur_aws/plugin.py::get_endpoints now wraps per-region calls in try/except — a failure in one region no longer aborts the whole sync, the failed region is skipped and logged. Affects sandbox/commercial/government source-sync runs; previously an outage in one region's API would fail the entire job.

New AWS plugins available

Two new plugin classes from upstream are now registered: AWSACMSourcePlugin (ACM source) and ACMDestinationPlugin. Not enabled by default — only takes effect if listed in plugin config.

AWS STS role-scoping bug fix

lemur/plugins/lemur_aws/sts.py fixed a latent bug where role was referenced from outside the inner refresh closure. Took upstream. No expected user-visible change unless a refresh path was being silently broken.

ACME modernization

lemur/plugins/lemur_acme/acme_handlers.py switched to ClientV2.get_directory(...) and cryptography.x509.load_pem_x509_certificate for revocation. Functional parity expected; revocation paths should be smoke-tested.

New config callbacks (off unless set)

Upstream added several pluggable validators/filters. None are active without explicit config:

• ENABLE_AUTOROTATION_FILTER, REISSUE_FILTER, DISABLE_AUTOROTATION_FILTER
• CERTIFICATE_CREATE_REQUEST_VALIDATION, CERTIFICATE_UPDATE_REQUEST_VALIDATION, CERTIFICATE_EXPORT_KEY_REQUEST_VALIDATION
• ENABLE_AUTO_ROTATE_ALL_AUTHORITIES
• AWS_ELB_IGNORE_TAGS, AWS_CLOUDFRONT_IGNORE_TAGS, AWS_IAM_IGNORE_TAGS

New celery task: disable_autorotate_without_endpoint

Upstream added this. Default is no-op — its filter callback returns nothing unless we configure one. Verified the Datadog beat schedule in chart/config/lemur.conf.py (k8s-resources) does not need changes; this task is opt-in.

New API endpoint: PATCH /certificates/{id}/description

Lighter-weight description update — no need to PUT the full cert object. New endpoint; no existing endpoint changed.

Source-sync stays sequential

lemur/sources/cli.py preserved as ours — sequential iteration. Critical (per CLAUDE.md, ref commit 0ad9ef89); parallelizing floods the Celery queue. Source-sync behavior is unchanged.

Datadog SNI cert sync preserved

lemur/sources/service.py keeps the Datadog primary/SNI sync path. Upstream's get-by-name+hash fallback dropped — incompatible with our data shape.

Datadog ECCPRIME256V1 reissue preserved

lemur/certificates/service.py keeps the explicit ECCPRIME256V1 reissue block.

Dependency / runtime updates

• cryptography==43.0.1 pin preserved (FIPS — gov build will not break).
• requirements.txt recompiled — version bumps for acme, certbot, boto3/botocore, celery, google-cloud-*, msal, requests, werkzeug, etc. Critical security overrides preserved (urllib3>=2.5.0, jinja2>=3.1.6, python_ldap>=3.4.5, h11>=0.16.0).
• Added cachetools to requirements-datadog.in — pre-existing missing dep used by lemur/auth/vault_jwt_auth.py since Supporting Vault Implicit OIDC Flow for User UI Login #157 (4acbeb4), never declared. Tests previously couldn't collect without it; commercial/gov runtime worked only via transitive resolution at deploy time.
• Dockerfile: replaced deprecated pip URL syntax (pip install "file://...#egg=") with modern pip install -e ".[dev]" / [tests].
• pyproject.toml [tool.flake8] ignores E203 (matches setup.cfg; needed for upstream's black-formatted slices).

Upstream version + Python/Postgres support matrix

• Bumps __version__ to 1.3.dev0 (was 1.2.dev0).
• Upstream dropped support for Python 3.9, Ubuntu 20.04, Postgres 12 and 15. Datadog runs Python 3.10 / Ubuntu 22.04 — safe. RDS engine versions in cloud-inventory should be verified to be Postgres 13/14/16.
• Upstream gained Postgres 16 support.

Migration tree

Zero new schema migrations introduced by the merge. The previous Datadog maintainer kept the migration chain in sync with upstream pre-merge. The single Datadog-only migration (44d67c1988a2_.py, endpoints↔certificates m2m) remains the head, untouched.

Two migration-related files modified by upstream:

• lemur/migrations/versions/5770674184de_.py: cosmetic f-string conversion only. No DDL change.
• lemur/migrations/env.py: cleanups + drops compare_type=True for autogenerate. Only affects future lemur db migrate autogen accuracy on column-type changes — does not affect already-applied migrations or runtime. Behavior now matches upstream.

Full audit: docs/upstream-merge-migrations-2026-04-27.md.

CI / build infra

• .github/workflows/codeql-analysis.yml renamed to codeql.yml (upstream rename).
• setup.py / setup.cfg kept (upstream removed in favor of pure pyproject.toml); follow-up to migrate fully.
• .github/workflows/ci.yml kept (upstream removed in favor of newer workflows; ours is wired to Datadog CI).

Test plan

• make lint-python — clean
• make test-python — 864 passed, 18 skipped
• Apply lemur db upgrade against staging — should be a no-op (no new migrations)
• Smoke test CLI: lemur certificates rotate, lemur source sync, lemur acme dnsproviders — verify click-based invocation works
• Verify SSO login / group authorization in staging — confirm IDP_GROUPS_KEYS is set in k8s-resources lemur.conf.py
• Smoke test ACME issue + revoke (sandbox first)
• Verify per-region AWS source sync handles a deliberately-broken region without aborting the run
• Verify break-glass private-key export still requires Datadog gating
• Confirm RDS Postgres engine versions are not 12 or 15 in cloud-inventory

Follow-ups (not in this PR)

• Migrate fully off setup.py/setup.cfg to pyproject.toml (upstream did; we kept ours).
• Decide whether to re-add compare_type=True to env.py for stricter autogenerate (default: leave as upstream).
• aws-sam-translator flagged a pydantic resolver warning during recompile — not blocking lemur, but worth investigating if we use SAM elsewhere.

🤖 Generated with Claude Code