Skip to content

CNTRLPLANE-3763: tag CLI and e2e AWS resources with infra-id, cluster-name, and source #8909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jul 15, 2026
Merged

CNTRLPLANE-3763: tag CLI and e2e AWS resources with infra-id, cluster-name, and source #8909

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 31 additions & 6 deletions cmd/bastion/aws/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
awsutil "github.com/openshift/hypershift/cmd/infra/aws/util"
"github.com/openshift/hypershift/cmd/log"
"github.com/openshift/hypershift/cmd/util"
supportawsutil "github.com/openshift/hypershift/support/awsutil"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/ec2"
Expand Down Expand Up @@ -157,18 +158,18 @@ func (o *CreateBastionOpts) Run(ctx context.Context, logger logr.Logger) (string
})

// Ensure security group exists
sgID, err := ensureBastionSecurityGroup(ctx, logger, ec2Client, infraID)
sgID, err := ensureBastionSecurityGroup(ctx, logger, ec2Client, infraID, o.Name)
if err != nil {
return "", "", fmt.Errorf("failed to ensure security group for bastion: %w", err)
}

// Ensure keypair exists
if err := ensureBastionKeyPair(ctx, logger, ec2Client, infraID, sshPublicKey); err != nil {
if err := ensureBastionKeyPair(ctx, logger, ec2Client, infraID, o.Name, sshPublicKey); err != nil {
return "", "", fmt.Errorf("failed to ensure bastion keypair: %w", err)
}

// Create ec2 instance
instanceID, err := runEC2BastionInstance(ctx, logger, ec2Client, sgID, infraID)
instanceID, err := runEC2BastionInstance(ctx, logger, ec2Client, sgID, infraID, o.Name)
if err != nil {
return "", "", fmt.Errorf("failed to run bastion machine instance: %w", err)
}
Expand All @@ -185,7 +186,7 @@ func (o *CreateBastionOpts) Run(ctx context.Context, logger logr.Logger) (string
return instanceID, publicIP, nil
}

func ensureBastionSecurityGroup(ctx context.Context, logger logr.Logger, ec2Client *ec2.Client, infraID string) (string, error) {
func ensureBastionSecurityGroup(ctx context.Context, logger logr.Logger, ec2Client *ec2.Client, infraID, clusterName string) (string, error) {
// find VPC
vpcID, err := existingVPC(ctx, ec2Client, infraID)
if err != nil {
Expand Down Expand Up @@ -218,6 +219,14 @@ func ensureBastionSecurityGroup(ctx context.Context, logger logr.Logger, ec2Clie
Key: aws.String("Name"),
Value: aws.String(name),
},
{
Key: aws.String(supportawsutil.HypershiftInfraIDTagKey),
Value: aws.String(infraID),
},
{
Key: aws.String(supportawsutil.HypershiftClusterNameTagKey),
Value: aws.String(clusterName),
},
},
},
},
Expand Down Expand Up @@ -340,7 +349,7 @@ func existingVPC(ctx context.Context, ec2Client *ec2.Client, infraID string) (st
return vpcID, nil
}

func ensureBastionKeyPair(ctx context.Context, logger logr.Logger, ec2Client *ec2.Client, infraID string, publicKey []byte) error {
func ensureBastionKeyPair(ctx context.Context, logger logr.Logger, ec2Client *ec2.Client, infraID, clusterName string, publicKey []byte) error {
keyPairID, err := existingKeyPair(ctx, ec2Client, infraID)
if err != nil {
return fmt.Errorf("failed to check for existing keypair: %w", err)
Expand All @@ -366,6 +375,14 @@ func ensureBastionKeyPair(ctx context.Context, logger logr.Logger, ec2Client *ec
Key: aws.String("Name"),
Value: aws.String(keyPairName(infraID)),
},
{
Key: aws.String(supportawsutil.HypershiftInfraIDTagKey),
Value: aws.String(infraID),
},
{
Key: aws.String(supportawsutil.HypershiftClusterNameTagKey),
Value: aws.String(clusterName),
},
},
},
},
Expand Down Expand Up @@ -437,7 +454,7 @@ func getLatestAmazonLinux2AMI(ctx context.Context, ec2Client *ec2.Client) (strin
return aws.ToString(latestAMI.ImageId), nil
}

func runEC2BastionInstance(ctx context.Context, logger logr.Logger, ec2Client *ec2.Client, sgID, infraID string) (string, error) {
func runEC2BastionInstance(ctx context.Context, logger logr.Logger, ec2Client *ec2.Client, sgID, infraID, clusterName string) (string, error) {
// find existing instance
instanceID, err := existingInstance(ctx, ec2Client, infraID)
if err != nil {
Expand Down Expand Up @@ -493,6 +510,14 @@ func runEC2BastionInstance(ctx context.Context, logger logr.Logger, ec2Client *e
Key: aws.String("Name"),
Value: aws.String(instanceName(infraID)),
},
{
Key: aws.String(supportawsutil.HypershiftInfraIDTagKey),
Value: aws.String(infraID),
},
{
Key: aws.String(supportawsutil.HypershiftClusterNameTagKey),
Value: aws.String(clusterName),
},
},
},
},
Expand Down
5 changes: 3 additions & 2 deletions cmd/cluster/aws/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
awsinfra "github.com/openshift/hypershift/cmd/infra/aws"
awsutil "github.com/openshift/hypershift/cmd/infra/aws/util"
"github.com/openshift/hypershift/cmd/util"
supportawsutil "github.com/openshift/hypershift/support/awsutil"

configv1 "github.com/openshift/api/config/v1"

Expand Down Expand Up @@ -555,7 +556,7 @@ func CreateInfraOptions(awsOpts *ValidatedCreateOptions, opts *core.CreateOption
BaseDomain: opts.BaseDomain,
BaseDomainPrefix: opts.BaseDomainPrefix,
RedactBaseDomain: opts.RedactBaseDomain,
AdditionalTags: awsOpts.AdditionalTags,
AdditionalTags: append(awsOpts.AdditionalTags, supportawsutil.HypershiftSourceTagKey+"=cli"),
Zones: awsOpts.Zones,
EnableProxy: awsOpts.EnableProxy,
EnableSecureProxy: awsOpts.EnableSecureProxy,
Expand All @@ -574,7 +575,7 @@ func CreateIAMOptions(awsOpts *ValidatedCreateOptions, infra *awsinfra.CreateInf
AWSCredentialsOpts: awsOpts.Credentials,
InfraID: infra.InfraID,
IssuerURL: awsOpts.IssuerURL,
AdditionalTags: awsOpts.AdditionalTags,
AdditionalTags: append(awsOpts.AdditionalTags, supportawsutil.HypershiftSourceTagKey+"=cli", supportawsutil.HypershiftClusterNameTagKey+"="+infra.Name),
PrivateZoneID: infra.PrivateZoneID,
PublicZoneID: infra.PublicZoneID,
LocalZoneID: infra.LocalZoneID,
Expand Down
21 changes: 21 additions & 0 deletions cmd/fix/dr_oidc_iam.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,18 +7,21 @@ import (
stderrors "errors"
"fmt"
"net/http"
"net/url"
"os"
"strings"
"time"

hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1"
awsutil "github.com/openshift/hypershift/cmd/infra/aws/util"
"github.com/openshift/hypershift/hypershift-operator/controllers/manifests"
supportawsutil "github.com/openshift/hypershift/support/awsutil"
"github.com/openshift/hypershift/support/infraid"
"github.com/openshift/hypershift/support/oidc"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/aws-sdk-go-v2/service/s3"
s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
"github.com/aws/smithy-go"
Expand Down Expand Up @@ -756,6 +759,19 @@ func (o *DrOidcIamOptions) ensureOIDCBucket(ctx context.Context, s3Client *s3.Cl
return fmt.Errorf("failed to create S3 bucket: %w", err)
}

_, err = s3Client.PutBucketTagging(ctx, &s3.PutBucketTaggingInput{
Bucket: aws.String(o.OIDCStorageProviderS3Bucket),
Tagging: &s3types.Tagging{
TagSet: []s3types.Tag{
{Key: aws.String(supportawsutil.HypershiftInfraIDTagKey), Value: aws.String(o.InfraID)},
{Key: aws.String(supportawsutil.HypershiftClusterNameTagKey), Value: aws.String(o.HostedClusterName)},
},
},
})
if err != nil {
return fmt.Errorf("failed to tag S3 bucket: %w", err)
}

return configureBucketPublicAccess(ctx, s3Client, o.OIDCStorageProviderS3Bucket)
}

Expand Down Expand Up @@ -798,6 +814,7 @@ func (o *DrOidcIamOptions) generateAndUploadOIDCDocuments(ctx context.Context, k
Key: aws.String(o.InfraID + path),
Body: bodyReader,
ContentType: aws.String("application/json"),
Tagging: aws.String(supportawsutil.HypershiftInfraIDTagKey + "=" + url.QueryEscape(o.InfraID) + "&" + supportawsutil.HypershiftClusterNameTagKey + "=" + url.QueryEscape(o.HostedClusterName)),
})
if err != nil {
return fmt.Errorf("failed to upload OIDC document %s: %w", path, err)
Expand Down Expand Up @@ -890,6 +907,10 @@ func (o *DrOidcIamOptions) createOIDCProvider(ctx context.Context, iamClient *ia
ThumbprintList: []string{
thumbprint,
},
Tags: []iamtypes.Tag{
{Key: aws.String(supportawsutil.HypershiftInfraIDTagKey), Value: aws.String(o.InfraID)},
{Key: aws.String(supportawsutil.HypershiftClusterNameTagKey), Value: aws.String(o.HostedClusterName)},
},
Url: aws.String(o.Issuer),
}

Expand Down
10 changes: 10 additions & 0 deletions cmd/infra/aws/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"github.com/openshift/hypershift/cmd/log"
"github.com/openshift/hypershift/cmd/util"
"github.com/openshift/hypershift/support/awsapi"
supportawsutil "github.com/openshift/hypershift/support/awsutil"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/ec2"
Expand Down Expand Up @@ -138,6 +139,7 @@ func NewCreateCommand() *cobra.Command {
if err = opts.Validate(); err != nil {
return err
}
opts.AdditionalTags = append(opts.AdditionalTags, supportawsutil.HypershiftSourceTagKey+"=cli")
if err := opts.Run(cmd.Context(), l); err != nil {
l.Error(err, "Failed to create infrastructure")
return err
Expand Down Expand Up @@ -675,6 +677,14 @@ func (o *CreateInfraOptions) shareSubnets(ctx context.Context, l logr.Logger, vp
Key: aws.String(clusterTag(o.InfraID)),
Value: aws.String(clusterTagValue),
},
{
Key: aws.String(supportawsutil.HypershiftInfraIDTagKey),
Value: aws.String(o.InfraID),
},
{
Key: aws.String(supportawsutil.HypershiftClusterNameTagKey),
Value: aws.String(o.Name),
},
},
}); err != nil {
return err
Expand Down
1 change: 1 addition & 0 deletions cmd/infra/aws/create_cli_role.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,7 @@ const (
"route53:CreateHostedZone",
"route53:ListHostedZones",
"route53:ChangeResourceRecordSets",
"route53:ChangeTagsForResource",
"route53:ListResourceRecordSets",
"route53:DeleteHostedZone",
"route53:AssociateVPCWithHostedZone",
Expand Down
8 changes: 8 additions & 0 deletions cmd/infra/aws/create_iam.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
awsutil "github.com/openshift/hypershift/cmd/infra/aws/util"
"github.com/openshift/hypershift/cmd/log"
"github.com/openshift/hypershift/cmd/util"
supportawsutil "github.com/openshift/hypershift/support/awsutil"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
Expand Down Expand Up @@ -115,6 +116,7 @@ func NewCreateIAMCommand() *cobra.Command {
logger.Error(err, "failed to create client")
return err
}
opts.AdditionalTags = append(opts.AdditionalTags, supportawsutil.HypershiftSourceTagKey+"=cli")
if err := opts.Run(cmd.Context(), client, logger); err != nil {
logger.Error(err, "Failed to create infrastructure")
return err
Expand Down Expand Up @@ -168,6 +170,12 @@ func (o *CreateIAMOptions) CreateIAM(ctx context.Context, client crclient.Client
if err = o.ParseAdditionalTags(); err != nil {
return nil, err
}
if len(o.InfraID) > 0 {
o.additionalIAMTags = append(o.additionalIAMTags, iamtypes.Tag{
Key: aws.String(supportawsutil.HypershiftInfraIDTagKey),
Value: aws.String(o.InfraID),
})
}
if o.OIDCStorageProviderS3BucketName == "" || o.OIDCStorageProviderS3Region == "" {
cm := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{Namespace: "kube-public", Name: "oidc-storage-provider-s3-config"},
Expand Down
1 change: 1 addition & 0 deletions cmd/infra/aws/delegatingclientgenerator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,6 +396,7 @@ var extendedAPIs = map[string][]string{
},
"route53": {
"AssociateVPCWithHostedZone",
"ChangeTagsForResource",
"CreateHostedZone",
"CreateVPCAssociationAuthorization",
"DeleteHostedZone",
Expand Down
41 changes: 17 additions & 24 deletions cmd/infra/aws/ec2.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (

"github.com/openshift/hypershift/cmd/util"
"github.com/openshift/hypershift/support/awsapi"
supportawsutil "github.com/openshift/hypershift/support/awsutil"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/ec2"
Expand Down Expand Up @@ -372,34 +373,15 @@ func (o *CreateInfraOptions) CreateNATGateway(ctx context.Context, l logr.Logger
}

eipResult, err := client.AllocateAddress(ctx, &ec2.AllocateAddressInput{
Domain: ec2types.DomainTypeVpc,
Domain: ec2types.DomainTypeVpc,
TagSpecifications: o.ec2TagSpecifications("elastic-ip", fmt.Sprintf("%s-eip-%s", o.InfraID, availabilityZone)),
})
if err != nil {
return "", fmt.Errorf("cannot allocate EIP for NAT gateway: %w", err)
}
allocationID := aws.ToString(eipResult.AllocationId)
l.Info("Created elastic IP for NAT gateway", "id", allocationID)

// NOTE: there's a potential to leak EIP addresses if the following tag operation fails, since we have no way of
// recognizing the EIP as belonging to the cluster
isRetriable := func(err error) bool {
var apiErr smithy.APIError
if errors.As(err, &apiErr) {
return strings.EqualFold(apiErr.ErrorCode(), invalidElasticIPNotFound)
}
return false
}
err = retry.OnError(retryBackoff, isRetriable, func() error {
_, err = client.CreateTags(ctx, &ec2.CreateTagsInput{
Resources: []string{allocationID},
Tags: append(ec2Tags(o.InfraID, fmt.Sprintf("%s-eip-%s", o.InfraID, availabilityZone)), o.additionalEC2Tags...),
})
return err
})
if err != nil {
return "", fmt.Errorf("cannot tag NAT gateway EIP: %w", err)
}

isNATGatewayRetriable := func(err error) bool {
var apiErr smithy.APIError
if errors.As(err, &apiErr) {
Expand Down Expand Up @@ -641,7 +623,7 @@ func (o *CreateInfraOptions) ec2TagSpecifications(resourceType, name string) []e
return []ec2types.TagSpecification{
{
ResourceType: ec2types.ResourceType(resourceType),
Tags: append(ec2Tags(o.InfraID, name), o.additionalEC2Tags...),
Tags: append(ec2Tags(o.InfraID, o.Name, name), o.additionalEC2Tags...),
},
}
}
Expand Down Expand Up @@ -680,19 +662,30 @@ func clusterTag(infraID string) string {
return fmt.Sprintf("kubernetes.io/cluster/%s", infraID)
}

func ec2Tags(infraID, name string) []ec2types.Tag {
func ec2Tags(infraID, clusterName, name string) []ec2types.Tag {
tags := []ec2types.Tag{
{
Key: aws.String(clusterTag(infraID)),
Value: aws.String(clusterTagValue),
},
}
if len(infraID) > 0 {
tags = append(tags, ec2types.Tag{
Key: aws.String(supportawsutil.HypershiftInfraIDTagKey),
Value: aws.String(infraID),
})
}
if len(clusterName) > 0 {
tags = append(tags, ec2types.Tag{
Key: aws.String(supportawsutil.HypershiftClusterNameTagKey),
Value: aws.String(clusterName),
})
}
if len(name) > 0 {
tags = append(tags, ec2types.Tag{
Key: aws.String("Name"),
Value: aws.String(name),
})
}
return tags

}
17 changes: 17 additions & 0 deletions cmd/infra/aws/route53.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"time"

"github.com/openshift/hypershift/support/awsapi"
supportawsutil "github.com/openshift/hypershift/support/awsutil"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/route53"
Expand Down Expand Up @@ -114,6 +115,22 @@ func (o *CreateInfraOptions) CreatePrivateZone(ctx context.Context, logger logr.
id = cleanZoneID(aws.ToString(res.HostedZone.Id))
logger.Info("Created private zone", "name", name, "id", id)

r53Tags := []route53types.Tag{
{Key: aws.String(clusterTag(o.InfraID)), Value: aws.String(clusterTagValue)},
{Key: aws.String(supportawsutil.HypershiftInfraIDTagKey), Value: aws.String(o.InfraID)},
{Key: aws.String(supportawsutil.HypershiftClusterNameTagKey), Value: aws.String(o.Name)},
}
for _, t := range o.additionalEC2Tags {
r53Tags = append(r53Tags, route53types.Tag{Key: t.Key, Value: t.Value})
}
if _, err := client.ChangeTagsForResource(ctx, &route53.ChangeTagsForResourceInput{
ResourceId: aws.String(id),
ResourceType: route53types.TagResourceTypeHostedzone,
AddTags: r53Tags,
}); err != nil {
return "", fmt.Errorf("failed to tag hosted zone: %w", err)
}

err = setSOAMinimum(ctx, client, id, name)
if err != nil {
return "", err
Expand Down
Loading