feat: support adding resource manager tags to gcp resources

Signed-off-by: Carlos Salas <carlos.salas@suse.com>

api/v1alpha4/gcpcluster_conversion.go

@@ -52,6 +52,10 @@ func (src *GCPCluster) ConvertTo(dstRaw conversion.Hub) error { // nolint
 		dst.Spec.CredentialsRef = restored.Spec.CredentialsRef.DeepCopy()
 	}
 
+	for _, restoredTag := range restored.Spec.ResourceManagerTags {
+		dst.Spec.ResourceManagerTags = append(dst.Spec.ResourceManagerTags, *restoredTag.DeepCopy())
+	}
+
 	return nil
 }
 

api/v1alpha4/gcpclustertemplate_conversion.go

@@ -54,6 +54,10 @@ func (src *GCPClusterTemplate) ConvertTo(dstRaw conversion.Hub) error { // nolin
 		dst.Spec.Template.Spec.CredentialsRef = restored.Spec.Template.Spec.CredentialsRef.DeepCopy()
 	}
 
+	for _, restoredTag := range restored.Spec.Template.Spec.ResourceManagerTags {
+		dst.Spec.Template.Spec.ResourceManagerTags = append(dst.Spec.Template.Spec.ResourceManagerTags, *restoredTag.DeepCopy())
+	}
+
 	return nil
 }
 

api/v1alpha4/gcpmachine_conversion.go

@@ -53,6 +53,10 @@ func (src *GCPMachine) ConvertTo(dstRaw conversion.Hub) error { // nolint
 		dst.Spec.ConfidentialCompute = restored.Spec.ConfidentialCompute
 	}
 
+	if restored.Spec.ResourceManagerTags != nil {
+		dst.Spec.ResourceManagerTags = restored.Spec.ResourceManagerTags
+	}
+
 	return nil
 }
 

api/v1alpha4/gcpmachinetemplate_conversion.go

@@ -54,6 +54,10 @@ func (src *GCPMachineTemplate) ConvertTo(dstRaw conversion.Hub) error { // nolin
 		dst.Spec.Template.Spec.ConfidentialCompute = restored.Spec.Template.Spec.ConfidentialCompute
 	}
 
+	if restored.Spec.Template.Spec.ResourceManagerTags != nil {
+		dst.Spec.Template.Spec.ResourceManagerTags = restored.Spec.Template.Spec.ResourceManagerTags
+	}
+
 	return nil
 }
 

api/v1beta1/gcpcluster_types.go

@@ -54,6 +54,12 @@ type GCPClusterSpec struct {
 	// +optional
 	AdditionalLabels Labels `json:"additionalLabels,omitempty"`
 
+	// ResourceManagerTags is an optional set of tags to apply to GCP resources managed
+	// by the GCP provider. GCP supports a maximum of 50 tags per resource.
+	// +maxItems=50
+	// +optional
+	ResourceManagerTags ResourceManagerTags `json:"resourceManagerTags,omitempty"`
+
 	// CredentialsRef is a reference to a Secret that contains the credentials to use for provisioning this cluster. If not
 	// supplied then the credentials of the controller will be used.
 	// +optional

api/v1beta1/gcpmachine_types.go

@@ -197,6 +197,12 @@ type GCPMachineSpec struct {
 	// +optional
 	AdditionalNetworkTags []string `json:"additionalNetworkTags,omitempty"`
 
+	// ResourceManagerTags is an optional set of tags to apply to GCP resources managed
+	// by the GCP provider. GCP supports a maximum of 50 tags per resource.
+	// +maxItems=50
+	// +optional
+	ResourceManagerTags ResourceManagerTags `json:"resourceManagerTags,omitempty"`
+
 	// RootDeviceSize is the size of the root volume in GB.
 	// Defaults to 30.
 	// +optional

api/v1beta1/tags.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+// ResourceManagerTags is an slice of ResourceManagerTag structs.
+type ResourceManagerTags []ResourceManagerTag
+
+// ResourceManagerTagsMap defines a map of key value pairs as expected by compute.InstanceParams.ResourceManagerTags.
+type ResourceManagerTagsMap map[string]string
+
+// ResourceManagerTag is a tag to apply to GCP resources managed by the GCP provider.
+type ResourceManagerTag struct {
+	// ParentID is the ID of the hierarchical resource where the tags are defined
+	// e.g. at the Organization or the Project level. To find the Organization or Project ID ref
+	// https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id
+	// https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects
+	// An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+	// A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters,
+	// numbers, and hyphens, and must start with a letter, and cannot end with a hyphen.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=32
+	// +kubebuilder:validation:Pattern=`(^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)`
+	ParentID string `json:"parentID"`
+
+	// Key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot
+	// be empty. Tag key must begin and end with an alphanumeric character, and must contain
+	// only uppercase, lowercase alphanumeric characters, and the following special
+	// characters `._-`.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$`
+	Key string `json:"key"`
+
+	// Value is the value part of the tag. A tag value can have a maximum of 63 characters and
+	// cannot be empty. Tag value must begin and end with an alphanumeric character, and must
+	// contain only uppercase, lowercase alphanumeric characters, and the following special
+	// characters `_-.@%=+:,*#&(){}[]` and spaces.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$`
+	Value string `json:"value"`
+}
+
+// Merge merges resource manager tags in receiver and other.
+func (t *ResourceManagerTags) Merge(other ResourceManagerTags) {
+	*t = append(*t, other...)
+}

cloud/interfaces.go

@@ -60,6 +60,7 @@ type ClusterGetter interface {
 	AdditionalLabels() infrav1.Labels
 	FailureDomains() clusterv1.FailureDomains
 	ControlPlaneEndpoint() clusterv1.APIEndpoint
+	ResourceManagerTags() infrav1.ResourceManagerTags
 }
 
 // ClusterSetter is an interface which can set cluster information.

cloud/scope/clients.go

@@ -24,6 +24,7 @@ import (
 	computerest "cloud.google.com/go/compute/apiv1"
 	container "cloud.google.com/go/container/apiv1"
 	credentials "cloud.google.com/go/iam/credentials/apiv1"
+	resourcemanager "cloud.google.com/go/resourcemanager/apiv3"
 	"github.com/GoogleCloudPlatform/k8s-cloud-provider/pkg/cloud"
 	"github.com/pkg/errors"
 	"google.golang.org/api/compute/v1"
@@ -143,3 +144,19 @@ func newInstanceGroupManagerClient(ctx context.Context, credentialsRef *infrav1.
 
 	return instanceGroupManagersClient, nil
 }
+
+func newTagBindingsClient(ctx context.Context, credentialsRef *infrav1.ObjectReference, crClient client.Client, location string) (*resourcemanager.TagBindingsClient, error) {
+	opts, err := defaultClientOptions(ctx, credentialsRef, crClient)
+	endpoint := fmt.Sprintf("%s-cloudresourcemanager.googleapis.com:443", location)
+	opts = append(opts, option.WithEndpoint(endpoint))
+	if err != nil {
+		return nil, fmt.Errorf("getting default gcp client options: %w", err)
+	}
+
+	client, err := resourcemanager.NewTagBindingsClient(ctx, opts...)
+	if err != nil {
+		return nil, errors.Errorf("failed to create gcp tag binding client: %v", err)
+	}
+
+	return client, nil
+}

cloud/scope/cluster.go

@@ -130,6 +130,15 @@ func (s *ClusterScope) AdditionalLabels() infrav1.Labels {
 	return s.GCPCluster.Spec.AdditionalLabels
 }
 
+// ResourceManagerTags returns ResourceManagerTags from the scope's GCPCluster. The returned value will never be nil.
+func (s *ClusterScope) ResourceManagerTags() infrav1.ResourceManagerTags {
+	if len(s.GCPCluster.Spec.ResourceManagerTags) == 0 {
+		s.GCPCluster.Spec.ResourceManagerTags = infrav1.ResourceManagerTags{}
+	}
+
+	return s.GCPCluster.Spec.ResourceManagerTags.DeepCopy()
+}
+
 // ControlPlaneEndpoint returns the cluster control-plane endpoint.
 func (s *ClusterScope) ControlPlaneEndpoint() clusterv1.APIEndpoint {
 	endpoint := s.GCPCluster.Spec.ControlPlaneEndpoint

cloud/scope/machine.go

@@ -35,6 +35,7 @@ import (
 	infrav1 "sigs.k8s.io/cluster-api-provider-gcp/api/v1beta1"
 	"sigs.k8s.io/cluster-api-provider-gcp/cloud"
 	"sigs.k8s.io/cluster-api-provider-gcp/cloud/providerid"
+	"sigs.k8s.io/cluster-api-provider-gcp/cloud/services/shared"
 	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 	"sigs.k8s.io/cluster-api/controllers/noderefutil"
 	capierrors "sigs.k8s.io/cluster-api/errors"
@@ -239,9 +240,10 @@ func (m *MachineScope) InstanceImageSpec() *compute.AttachedDisk {
 		AutoDelete: true,
 		Boot:       true,
 		InitializeParams: &compute.AttachedDiskInitializeParams{
-			DiskSizeGb:  m.GCPMachine.Spec.RootDeviceSize,
-			DiskType:    path.Join("zones", m.Zone(), "diskTypes", string(diskType)),
-			SourceImage: sourceImage,
+			DiskSizeGb:          m.GCPMachine.Spec.RootDeviceSize,
+			DiskType:            path.Join("zones", m.Zone(), "diskTypes", string(diskType)),
+			ResourceManagerTags: shared.ResourceTagConvert(context.TODO(), m.GCPMachine.Spec.ResourceManagerTags),
+			SourceImage:         sourceImage,
 		},
 	}
 }
@@ -253,8 +255,9 @@ func (m *MachineScope) InstanceAdditionalDiskSpec() []*compute.AttachedDisk {
 		additionalDisk := &compute.AttachedDisk{
 			AutoDelete: true,
 			InitializeParams: &compute.AttachedDiskInitializeParams{
-				DiskSizeGb: pointer.Int64Deref(disk.Size, 30),
-				DiskType:   path.Join("zones", m.Zone(), "diskTypes", string(*disk.DeviceType)),
+				DiskSizeGb:          pointer.Int64Deref(disk.Size, 30),
+				DiskType:            path.Join("zones", m.Zone(), "diskTypes", string(*disk.DeviceType)),
+				ResourceManagerTags: shared.ResourceTagConvert(context.TODO(), m.GCPMachine.Spec.ResourceManagerTags),
 			},
 		}
 		if strings.HasSuffix(additionalDisk.InitializeParams.DiskType, string(infrav1.LocalSsdDiskType)) {
@@ -338,6 +341,9 @@ func (m *MachineScope) InstanceSpec(log logr.Logger) *compute.Instance {
 				m.ClusterGetter.Name(),
 			),
 		},
+		Params: &compute.InstanceParams{
+			ResourceManagerTags: shared.ResourceTagConvert(context.TODO(), m.ResourceManagerTags()),
+		},
 		Labels: infrav1.Build(infrav1.BuildParams{
 			ClusterName: m.ClusterGetter.Name(),
 			Lifecycle:   infrav1.ResourceLifecycleOwned,
@@ -428,3 +434,16 @@ func (m *MachineScope) PatchObject() error {
 func (m *MachineScope) Close() error {
 	return m.PatchObject()
 }
+
+// ResourceManagerTags merges ResourceManagerTags from the scope's GCPCluster and GCPMachine. If the same key is present in both,
+// the value from GCPMachine takes precedence. The returned ResourceManagerTags will never be nil.
+func (m *MachineScope) ResourceManagerTags() infrav1.ResourceManagerTags {
+	tags := infrav1.ResourceManagerTags{}
+
+	// Start with the cluster-wide tags...
+	tags.Merge(m.ClusterGetter.ResourceManagerTags())
+	// ... and merge in the Machine's
+	tags.Merge(m.GCPMachine.Spec.ResourceManagerTags)
+
+	return tags
+}

cloud/scope/managedcluster.go

@@ -133,6 +133,15 @@ func (s *ManagedClusterScope) AdditionalLabels() infrav1.Labels {
 	return s.GCPManagedCluster.Spec.AdditionalLabels
 }
 
+// ResourceManagerTags returns ResourceManagerTags from cluster. The returned value will never be nil.
+func (s *ManagedClusterScope) ResourceManagerTags() infrav1.ResourceManagerTags {
+	if len(s.GCPManagedCluster.Spec.ResourceManagerTags) == 0 {
+		s.GCPManagedCluster.Spec.ResourceManagerTags = infrav1.ResourceManagerTags{}
+	}
+
+	return s.GCPManagedCluster.Spec.ResourceManagerTags.DeepCopy()
+}
+
 // ControlPlaneEndpoint returns the cluster control-plane endpoint.
 func (s *ManagedClusterScope) ControlPlaneEndpoint() clusterv1.APIEndpoint {
 	endpoint := s.GCPManagedCluster.Spec.ControlPlaneEndpoint