Merge pull request #2474 from justinsb/subnet_tagging

Use explicit tag management in network tasks

pkg/model/context.go

@@ -29,7 +29,9 @@ import (
 	"k8s.io/kops/pkg/apis/kops/util"
 	"k8s.io/kops/pkg/featureflag"
 	"k8s.io/kops/pkg/model/components"
+	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/cloudup/awstasks"
+	"k8s.io/kops/upup/pkg/fi/cloudup/awsup"
 )
 
 var UseLegacyELBName = featureflag.New("UseLegacyELBName", featureflag.Bool(false))
@@ -189,6 +191,27 @@ func (m *KopsModelContext) CloudTagsForInstanceGroup(ig *kops.InstanceGroup) (ma
 	return labels, nil
 }
 
+// CloudTags computes the tags to apply to a normal cloud resource with the specified name
+func (m *KopsModelContext) CloudTags(name string, shared bool) map[string]string {
+	tags := make(map[string]string)
+
+	switch fi.CloudProviderID(m.Cluster.Spec.CloudProvider) {
+	case fi.CloudProviderAWS:
+		tags[awsup.TagClusterName] = m.Cluster.ObjectMeta.Name
+		if name != "" {
+			tags["Name"] = name
+		}
+
+		if shared {
+			tags["kubernetes.io/cluster/"+m.Cluster.ObjectMeta.Name] = "shared"
+		} else {
+			tags["kubernetes.io/cluster/"+m.Cluster.ObjectMeta.Name] = "owned"
+		}
+
+	}
+	return tags
+}
+
 func (m *KopsModelContext) UsesBastionDns() bool {
 	if m.Cluster.Spec.Topology.Bastion != nil && m.Cluster.Spec.Topology.Bastion.BastionPublicName != "" {
 		return true

pkg/model/network.go

@@ -40,13 +40,17 @@ func (b *NetworkModelBuilder) Build(c *fi.ModelBuilderContext) error {
 	}
 
 	sharedVPC := b.Cluster.SharedVPC()
+	vpcName := b.ClusterName()
 
 	// VPC that holds everything for the cluster
 	{
+		tags := b.CloudTags(vpcName, sharedVPC)
+
 		t := &awstasks.VPC{
-			Name:             s(b.ClusterName()),
+			Name:             s(vpcName),
 			Shared:           fi.Bool(sharedVPC),
 			EnableDNSSupport: fi.Bool(true),
+			Tags:             tags,
 		}
 
 		if sharedVPC && VersionGTE(kubernetesVersion, 1, 5) {
@@ -133,13 +137,16 @@ func (b *NetworkModelBuilder) Build(c *fi.ModelBuilderContext) error {
 	for i := range b.Cluster.Spec.Subnets {
 		subnetSpec := &b.Cluster.Spec.Subnets[i]
 		sharedSubnet := subnetSpec.ProviderID != ""
+		subnetName := subnetSpec.Name + "." + b.ClusterName()
+		tags := b.CloudTags(subnetName, sharedSubnet)
 
 		subnet := &awstasks.Subnet{
-			Name:             s(subnetSpec.Name + "." + b.ClusterName()),
+			Name:             s(subnetName),
 			VPC:              b.LinkToVPC(),
 			AvailabilityZone: s(subnetSpec.Zone),
 			CIDR:             s(subnetSpec.CIDR),
 			Shared:           fi.Bool(sharedSubnet),
+			Tags:             tags,
 		}
 
 		if subnetSpec.ProviderID != "" {

tests/integration/complex/kubernetes.tf

@@ -342,8 +342,9 @@ resource "aws_subnet" "us-test-1a-complex-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "complex.example.com"
-    Name              = "us-test-1a.complex.example.com"
+    KubernetesCluster                           = "complex.example.com"
+    Name                                        = "us-test-1a.complex.example.com"
+    "kubernetes.io/cluster/complex.example.com" = "owned"
   }
 }
 
@@ -353,8 +354,9 @@ resource "aws_vpc" "complex-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "complex.example.com"
-    Name              = "complex.example.com"
+    KubernetesCluster                           = "complex.example.com"
+    Name                                        = "complex.example.com"
+    "kubernetes.io/cluster/complex.example.com" = "owned"
   }
 }
 

tests/integration/ha/kubernetes.tf

@@ -512,8 +512,9 @@ resource "aws_subnet" "us-test-1a-ha-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "ha.example.com"
-    Name              = "us-test-1a.ha.example.com"
+    KubernetesCluster                      = "ha.example.com"
+    Name                                   = "us-test-1a.ha.example.com"
+    "kubernetes.io/cluster/ha.example.com" = "owned"
   }
 }
 
@@ -523,8 +524,9 @@ resource "aws_subnet" "us-test-1b-ha-example-com" {
   availability_zone = "us-test-1b"
 
   tags = {
-    KubernetesCluster = "ha.example.com"
-    Name              = "us-test-1b.ha.example.com"
+    KubernetesCluster                      = "ha.example.com"
+    Name                                   = "us-test-1b.ha.example.com"
+    "kubernetes.io/cluster/ha.example.com" = "owned"
   }
 }
 
@@ -534,8 +536,9 @@ resource "aws_subnet" "us-test-1c-ha-example-com" {
   availability_zone = "us-test-1c"
 
   tags = {
-    KubernetesCluster = "ha.example.com"
-    Name              = "us-test-1c.ha.example.com"
+    KubernetesCluster                      = "ha.example.com"
+    Name                                   = "us-test-1c.ha.example.com"
+    "kubernetes.io/cluster/ha.example.com" = "owned"
   }
 }
 
@@ -545,8 +548,9 @@ resource "aws_vpc" "ha-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "ha.example.com"
-    Name              = "ha.example.com"
+    KubernetesCluster                      = "ha.example.com"
+    Name                                   = "ha.example.com"
+    "kubernetes.io/cluster/ha.example.com" = "owned"
   }
 }
 

tests/integration/minimal-141/kubernetes.tf

@@ -342,8 +342,9 @@ resource "aws_subnet" "us-test-1a-minimal-141-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "minimal-141.example.com"
-    Name              = "us-test-1a.minimal-141.example.com"
+    KubernetesCluster                               = "minimal-141.example.com"
+    Name                                            = "us-test-1a.minimal-141.example.com"
+    "kubernetes.io/cluster/minimal-141.example.com" = "owned"
   }
 }
 
@@ -353,8 +354,9 @@ resource "aws_vpc" "minimal-141-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "minimal-141.example.com"
-    Name              = "minimal-141.example.com"
+    KubernetesCluster                               = "minimal-141.example.com"
+    Name                                            = "minimal-141.example.com"
+    "kubernetes.io/cluster/minimal-141.example.com" = "owned"
   }
 }
 

tests/integration/minimal/cloudformation.json

@@ -397,6 +397,10 @@
           {
             "Key": "Name",
             "Value": "us-test-1a.minimal.example.com"
+          },
+          {
+            "Key": "kubernetes.io/cluster/minimal.example.com",
+            "Value": "owned"
           }
         ]
       }
@@ -437,6 +441,10 @@
           {
             "Key": "Name",
             "Value": "minimal.example.com"
+          },
+          {
+            "Key": "kubernetes.io/cluster/minimal.example.com",
+            "Value": "owned"
           }
         ]
       }

tests/integration/minimal/kubernetes.tf

@@ -342,8 +342,9 @@ resource "aws_subnet" "us-test-1a-minimal-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "minimal.example.com"
-    Name              = "us-test-1a.minimal.example.com"
+    KubernetesCluster                           = "minimal.example.com"
+    Name                                        = "us-test-1a.minimal.example.com"
+    "kubernetes.io/cluster/minimal.example.com" = "owned"
   }
 }
 
@@ -353,8 +354,9 @@ resource "aws_vpc" "minimal-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "minimal.example.com"
-    Name              = "minimal.example.com"
+    KubernetesCluster                           = "minimal.example.com"
+    Name                                        = "minimal.example.com"
+    "kubernetes.io/cluster/minimal.example.com" = "owned"
   }
 }
 

tests/integration/privatecalico/kubernetes.tf

@@ -614,8 +614,9 @@ resource "aws_subnet" "us-test-1a-privatecalico-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatecalico.example.com"
-    Name              = "us-test-1a.privatecalico.example.com"
+    KubernetesCluster                                 = "privatecalico.example.com"
+    Name                                              = "us-test-1a.privatecalico.example.com"
+    "kubernetes.io/cluster/privatecalico.example.com" = "owned"
   }
 }
 
@@ -625,8 +626,9 @@ resource "aws_subnet" "utility-us-test-1a-privatecalico-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatecalico.example.com"
-    Name              = "utility-us-test-1a.privatecalico.example.com"
+    KubernetesCluster                                 = "privatecalico.example.com"
+    Name                                              = "utility-us-test-1a.privatecalico.example.com"
+    "kubernetes.io/cluster/privatecalico.example.com" = "owned"
   }
 }
 
@@ -636,8 +638,9 @@ resource "aws_vpc" "privatecalico-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "privatecalico.example.com"
-    Name              = "privatecalico.example.com"
+    KubernetesCluster                                 = "privatecalico.example.com"
+    Name                                              = "privatecalico.example.com"
+    "kubernetes.io/cluster/privatecalico.example.com" = "owned"
   }
 }
 

tests/integration/privatecanal/kubernetes.tf

@@ -605,8 +605,9 @@ resource "aws_subnet" "us-test-1a-privatecanal-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatecanal.example.com"
-    Name              = "us-test-1a.privatecanal.example.com"
+    KubernetesCluster                                = "privatecanal.example.com"
+    Name                                             = "us-test-1a.privatecanal.example.com"
+    "kubernetes.io/cluster/privatecanal.example.com" = "owned"
   }
 }
 
@@ -616,8 +617,9 @@ resource "aws_subnet" "utility-us-test-1a-privatecanal-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatecanal.example.com"
-    Name              = "utility-us-test-1a.privatecanal.example.com"
+    KubernetesCluster                                = "privatecanal.example.com"
+    Name                                             = "utility-us-test-1a.privatecanal.example.com"
+    "kubernetes.io/cluster/privatecanal.example.com" = "owned"
   }
 }
 
@@ -627,8 +629,9 @@ resource "aws_vpc" "privatecanal-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "privatecanal.example.com"
-    Name              = "privatecanal.example.com"
+    KubernetesCluster                                = "privatecanal.example.com"
+    Name                                             = "privatecanal.example.com"
+    "kubernetes.io/cluster/privatecanal.example.com" = "owned"
   }
 }
 

tests/integration/privatedns1/kubernetes.tf

@@ -610,8 +610,9 @@ resource "aws_subnet" "us-test-1a-privatedns1-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatedns1.example.com"
-    Name              = "us-test-1a.privatedns1.example.com"
+    KubernetesCluster                               = "privatedns1.example.com"
+    Name                                            = "us-test-1a.privatedns1.example.com"
+    "kubernetes.io/cluster/privatedns1.example.com" = "owned"
   }
 }
 
@@ -621,8 +622,9 @@ resource "aws_subnet" "utility-us-test-1a-privatedns1-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatedns1.example.com"
-    Name              = "utility-us-test-1a.privatedns1.example.com"
+    KubernetesCluster                               = "privatedns1.example.com"
+    Name                                            = "utility-us-test-1a.privatedns1.example.com"
+    "kubernetes.io/cluster/privatedns1.example.com" = "owned"
   }
 }
 
@@ -632,8 +634,9 @@ resource "aws_vpc" "privatedns1-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "privatedns1.example.com"
-    Name              = "privatedns1.example.com"
+    KubernetesCluster                               = "privatedns1.example.com"
+    Name                                            = "privatedns1.example.com"
+    "kubernetes.io/cluster/privatedns1.example.com" = "owned"
   }
 }
 

tests/integration/privatedns2/kubernetes.tf

@@ -596,8 +596,9 @@ resource "aws_subnet" "us-test-1a-privatedns2-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatedns2.example.com"
-    Name              = "us-test-1a.privatedns2.example.com"
+    KubernetesCluster                               = "privatedns2.example.com"
+    Name                                            = "us-test-1a.privatedns2.example.com"
+    "kubernetes.io/cluster/privatedns2.example.com" = "owned"
   }
 }
 
@@ -607,7 +608,8 @@ resource "aws_subnet" "utility-us-test-1a-privatedns2-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privatedns2.example.com"
-    Name              = "utility-us-test-1a.privatedns2.example.com"
+    KubernetesCluster                               = "privatedns2.example.com"
+    Name                                            = "utility-us-test-1a.privatedns2.example.com"
+    "kubernetes.io/cluster/privatedns2.example.com" = "owned"
   }
 }

tests/integration/privateflannel/kubernetes.tf

@@ -605,8 +605,9 @@ resource "aws_subnet" "us-test-1a-privateflannel-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privateflannel.example.com"
-    Name              = "us-test-1a.privateflannel.example.com"
+    KubernetesCluster                                  = "privateflannel.example.com"
+    Name                                               = "us-test-1a.privateflannel.example.com"
+    "kubernetes.io/cluster/privateflannel.example.com" = "owned"
   }
 }
 
@@ -616,8 +617,9 @@ resource "aws_subnet" "utility-us-test-1a-privateflannel-example-com" {
   availability_zone = "us-test-1a"
 
   tags = {
-    KubernetesCluster = "privateflannel.example.com"
-    Name              = "utility-us-test-1a.privateflannel.example.com"
+    KubernetesCluster                                  = "privateflannel.example.com"
+    Name                                               = "utility-us-test-1a.privateflannel.example.com"
+    "kubernetes.io/cluster/privateflannel.example.com" = "owned"
   }
 }
 
@@ -627,8 +629,9 @@ resource "aws_vpc" "privateflannel-example-com" {
   enable_dns_support   = true
 
   tags = {
-    KubernetesCluster = "privateflannel.example.com"
-    Name              = "privateflannel.example.com"
+    KubernetesCluster                                  = "privateflannel.example.com"
+    Name                                               = "privateflannel.example.com"
+    "kubernetes.io/cluster/privateflannel.example.com" = "owned"
   }
 }