feat: support adding ResourceManagerTags to compute instances

.github/workflows/pr-gh-workflow-approve.yaml

@@ -0,0 +1,40 @@
+name: PR approve GH Workflows
+
+on:
+  pull_request_target:
+    types:
+      - edited
+      - labeled
+      - reopened
+      - synchronize
+
+jobs:
+  approve:
+    name: Approve ok-to-test
+    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Update PR
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const result = await github.rest.actions.listWorkflowRunsForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: "pull_request",
+              status: "action_required",
+              head_sha: context.payload.pull_request.head.sha,
+              per_page: 100
+            });
+
+            for (var run of result.data.workflow_runs) {
+              await github.rest.actions.approveWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: run.id
+              });
+            }

Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM golang:1.20.6@sha256:b6c53162b13ec2ac1c725078671dbff289d9e723c045c27d73eacf0a50893598 as builder
+FROM golang:1.20.10@sha256:098d628490c97d4419ed44a23d893f37b764f3bea06e0827183e8af4120e19be as builder
 WORKDIR /workspace
 
 # Run this with docker build --build_arg $(go env GOPROXY) to override the goproxy
@@ -38,7 +38,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} \
     -o manager .
 
 # Copy the controller-manager into a thin image
-FROM gcr.io/distroless/static:latest
+FROM cgr.dev/chainguard/static:latest
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER nobody

Makefile

@@ -87,12 +87,12 @@ RELEASE_NOTES_VER := v0.11.0
 RELEASE_NOTES_BIN := release-notes
 RELEASE_NOTES := $(TOOLS_BIN_DIR)/$(RELEASE_NOTES_BIN)-$(RELEASE_NOTES_VER)
 
-GINKGO_VER := v2.11.0
+GINKGO_VER := v2.13.0
 GINKGO_BIN := ginkgo
 GINKGO := $(TOOLS_BIN_DIR)/$(GINKGO_BIN)-$(GINKGO_VER)
 GINKGO_PKG := github.com/onsi/ginkgo/v2/ginkgo
 
-KUBECTL_VER := v1.25.10
+KUBECTL_VER := v1.27.3
 KUBECTL_BIN := kubectl
 KUBECTL := $(TOOLS_BIN_DIR)/$(KUBECTL_BIN)-$(KUBECTL_VER)
 
@@ -140,7 +140,7 @@ endif
 # Build time versioning details.
 LDFLAGS := $(shell hack/version.sh)
 
-GOLANG_VERSION := 1.20.6
+GOLANG_VERSION := 1.20.8
 
 # CI
 CAPG_WORKER_CLUSTER_KUBECONFIG ?= "/tmp/kubeconfig"
@@ -473,7 +473,7 @@ create-management-cluster: $(KUSTOMIZE) $(ENVSUBST) $(KIND) $(KUBECTL)
 	./hack/install-cert-manager.sh
 
 	# Deploy CAPI
-	curl --retry $(CURL_RETRIES) -sSL https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.5.0/cluster-api-components.yaml | $(ENVSUBST) | $(KUBECTL) apply -f -
+	curl --retry $(CURL_RETRIES) -sSL https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.5.3/cluster-api-components.yaml | $(ENVSUBST) | $(KUBECTL) apply -f -
 
 	# Deploy CAPG
 	$(KIND) load docker-image $(CONTROLLER_IMG)-$(ARCH):$(TAG) --name=clusterapi

Tiltfile

@@ -18,9 +18,9 @@ settings = {
     "deploy_cert_manager": True,
     "preload_images_for_kind": True,
     "kind_cluster_name": "capg",
-    "capi_version": "v1.5.0",
+    "capi_version": "v1.5.3",
     "cert_manager_version": "v1.11.0",
-    "kubernetes_version": "v1.26.1",
+    "kubernetes_version": "v1.27.3",
 }
 
 keys = ["GCP_B64ENCODED_CREDENTIALS"]

api/v1alpha4/gcpcluster_conversion.go

@@ -52,6 +52,10 @@ func (src *GCPCluster) ConvertTo(dstRaw conversion.Hub) error { // nolint
 		dst.Spec.CredentialsRef = restored.Spec.CredentialsRef.DeepCopy()
 	}
 
+	for _, restoredTag := range restored.Spec.ResourceManagerTags {
+		dst.Spec.ResourceManagerTags = append(dst.Spec.ResourceManagerTags, *restoredTag.DeepCopy())
+	}
+
 	return nil
 }
 

api/v1alpha4/gcpclustertemplate_conversion.go

@@ -54,6 +54,10 @@ func (src *GCPClusterTemplate) ConvertTo(dstRaw conversion.Hub) error { // nolin
 		dst.Spec.Template.Spec.CredentialsRef = restored.Spec.Template.Spec.CredentialsRef.DeepCopy()
 	}
 
+	for _, restoredTag := range restored.Spec.Template.Spec.ResourceManagerTags {
+		dst.Spec.Template.Spec.ResourceManagerTags = append(dst.Spec.Template.Spec.ResourceManagerTags, *restoredTag.DeepCopy())
+	}
+
 	return nil
 }
 

api/v1alpha4/gcpmachine_conversion.go

@@ -53,6 +53,10 @@ func (src *GCPMachine) ConvertTo(dstRaw conversion.Hub) error { // nolint
 		dst.Spec.ConfidentialCompute = restored.Spec.ConfidentialCompute
 	}
 
+	if restored.Spec.ResourceManagerTags != nil {
+		dst.Spec.ResourceManagerTags = restored.Spec.ResourceManagerTags
+	}
+
 	return nil
 }
 

api/v1alpha4/gcpmachinetemplate_conversion.go

@@ -54,6 +54,10 @@ func (src *GCPMachineTemplate) ConvertTo(dstRaw conversion.Hub) error { // nolin
 		dst.Spec.Template.Spec.ConfidentialCompute = restored.Spec.Template.Spec.ConfidentialCompute
 	}
 
+	if restored.Spec.Template.Spec.ResourceManagerTags != nil {
+		dst.Spec.Template.Spec.ResourceManagerTags = restored.Spec.Template.Spec.ResourceManagerTags
+	}
+
 	return nil
 }
 

api/v1beta1/gcpcluster_types.go

@@ -54,6 +54,12 @@ type GCPClusterSpec struct {
 	// +optional
 	AdditionalLabels Labels `json:"additionalLabels,omitempty"`
 
+	// ResourceManagerTags is an optional set of tags to apply to GCP resources managed
+	// by the GCP provider. GCP supports a maximum of 50 tags per resource.
+	// +maxItems=50
+	// +optional
+	ResourceManagerTags ResourceManagerTags `json:"resourceManagerTags,omitempty"`
+
 	// CredentialsRef is a reference to a Secret that contains the credentials to use for provisioning this cluster. If not
 	// supplied then the credentials of the controller will be used.
 	// +optional

api/v1beta1/gcpmachine_types.go

@@ -197,6 +197,12 @@ type GCPMachineSpec struct {
 	// +optional
 	AdditionalNetworkTags []string `json:"additionalNetworkTags,omitempty"`
 
+	// ResourceManagerTags is an optional set of tags to apply to GCP resources managed
+	// by the GCP provider. GCP supports a maximum of 50 tags per resource.
+	// +maxItems=50
+	// +optional
+	ResourceManagerTags ResourceManagerTags `json:"resourceManagerTags,omitempty"`
+
 	// RootDeviceSize is the size of the root volume in GB.
 	// Defaults to 30.
 	// +optional

api/v1beta1/tags.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+// ResourceManagerTags is an slice of ResourceManagerTag structs.
+type ResourceManagerTags []ResourceManagerTag
+
+// ResourceManagerTagsMap defines a map of key value pairs as expected by compute.InstanceParams.ResourceManagerTags.
+type ResourceManagerTagsMap map[string]string
+
+// ResourceManagerTag is a tag to apply to GCP resources managed by the GCP provider.
+type ResourceManagerTag struct {
+	// ParentID is the ID of the hierarchical resource where the tags are defined
+	// e.g. at the Organization or the Project level. To find the Organization or Project ID ref
+	// https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id
+	// https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects
+	// An OrganizationID must consist of decimal numbers, and cannot have leading zeroes.
+	// A ProjectID must be 6 to 30 characters in length, can only contain lowercase letters,
+	// numbers, and hyphens, and must start with a letter, and cannot end with a hyphen.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=32
+	// +kubebuilder:validation:Pattern=`(^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)`
+	ParentID string `json:"parentID"`
+
+	// Key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot
+	// be empty. Tag key must begin and end with an alphanumeric character, and must contain
+	// only uppercase, lowercase alphanumeric characters, and the following special
+	// characters `._-`.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$`
+	Key string `json:"key"`
+
+	// Value is the value part of the tag. A tag value can have a maximum of 63 characters and
+	// cannot be empty. Tag value must begin and end with an alphanumeric character, and must
+	// contain only uppercase, lowercase alphanumeric characters, and the following special
+	// characters `_-.@%=+:,*#&(){}[]` and spaces.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\[\]{}\-\s]{0,61}[a-zA-Z0-9])?$`
+	Value string `json:"value"`
+}
+
+// Merge merges resource manager tags in receiver and other.
+func (t *ResourceManagerTags) Merge(other ResourceManagerTags) {
+	*t = append(*t, other...)
+}

cloud/interfaces.go

@@ -60,6 +60,7 @@ type ClusterGetter interface {
 	AdditionalLabels() infrav1.Labels
 	FailureDomains() clusterv1.FailureDomains
 	ControlPlaneEndpoint() clusterv1.APIEndpoint
+	ResourceManagerTags() infrav1.ResourceManagerTags
 }
 
 // ClusterSetter is an interface which can set cluster information.

cloud/scope/clients.go

@@ -24,6 +24,7 @@ import (
 	computerest "cloud.google.com/go/compute/apiv1"
 	container "cloud.google.com/go/container/apiv1"
 	credentials "cloud.google.com/go/iam/credentials/apiv1"
+	resourcemanager "cloud.google.com/go/resourcemanager/apiv3"
 	"github.com/GoogleCloudPlatform/k8s-cloud-provider/pkg/cloud"
 	"github.com/pkg/errors"
 	"google.golang.org/api/compute/v1"
@@ -143,3 +144,19 @@ func newInstanceGroupManagerClient(ctx context.Context, credentialsRef *infrav1.
 
 	return instanceGroupManagersClient, nil
 }
+
+func newTagBindingsClient(ctx context.Context, credentialsRef *infrav1.ObjectReference, crClient client.Client, location string) (*resourcemanager.TagBindingsClient, error) {
+	opts, err := defaultClientOptions(ctx, credentialsRef, crClient)
+	endpoint := fmt.Sprintf("%s-cloudresourcemanager.googleapis.com:443", location)
+	opts = append(opts, option.WithEndpoint(endpoint))
+	if err != nil {
+		return nil, fmt.Errorf("getting default gcp client options: %w", err)
+	}
+
+	client, err := resourcemanager.NewTagBindingsClient(ctx, opts...)
+	if err != nil {
+		return nil, errors.Errorf("failed to create gcp tag binding client: %v", err)
+	}
+
+	return client, nil
+}