fix: ignore tags passed on startup

With this change, ACK now ignores tags that are passed on startup.
On top of that it also valdidates ResourceTags on startup, instead of
doing so during reconcile.

Author: michaelhtm

mocks/pkg/types/aws_resource_manager.go

@@ -98,6 +98,7 @@ type Config struct {
 	AllowUnsafeEndpointURL          bool
 	LogLevel                        string
 	ResourceTags                    []string
+	ResourceTagKeys                 []string
 	WatchNamespace                  string
 	WatchSelectors                  string
 	EnableWebhookServer             bool
@@ -307,6 +308,15 @@ func (cfg *Config) SetAWSAccountID(ctx context.Context) error {
 
 // Validate ensures the options are valid
 func (cfg *Config) Validate(ctx context.Context, options ...Option) error {
+	cfg.ResourceTagKeys = []string{}
+	// parse resource tags
+	for _, tag := range cfg.ResourceTags {
+		split := strings.Split(tag, "=")
+		if len(split) != 2 {
+			return fmt.Errorf("invalid resource tag: %s", tag)
+		}
+		cfg.ResourceTagKeys = append(cfg.ResourceTagKeys, split[0])
+	}
 	merged := mergeOptions(options)
 	if len(merged.gvks) > 0 {
 		err := cfg.validateReconcileConfigResources(merged.gvks)

pkg/config/config.go

@@ -591,7 +591,7 @@ func (r *resourceReconciler) Sync(
 			return latest, err
 		}
 	} else if adoptionPolicy == AdoptionPolicy_Adopt {
-		rm.FilterSystemTags(latest)
+		rm.FilterSystemTags(latest, r.cfg.ResourceTagKeys)
 		if err = r.setResourceManagedAndAdopted(ctx, rm, latest); err != nil {
 			return latest, err
 		}

pkg/runtime/reconciler.go

@@ -120,6 +120,7 @@ func reconcilerMocks(
 			featuregate.ReadOnlyResources: {Enabled: true},
 			featuregate.ResourceAdoption:  {Enabled: true},
 		},
+		ResourceTagKeys: []string{},
 	}
 	metrics := ackmetrics.NewMetrics("bookstore")
 
@@ -393,7 +394,7 @@ func TestReconcilerAdoptResource(t *testing.T) {
 	rd.On("Delta", latest, latest).Return(ackcompare.NewDelta())
 
 	r, kc, scmd := reconcilerMocks(rmf)
-	rm.On("FilterSystemTags", latest).Return()
+	rm.On("FilterSystemTags", latest, []string{})
 	rd.On("MarkAdopted", latest).Return()
 	rm.On("EnsureTags", ctx, desired, scmd).Return(nil)
 	statusWriter := &ctrlrtclientmock.SubResourceWriter{}
@@ -783,7 +784,7 @@ func TestReconcilerUpdate(t *testing.T) {
 	rm.On("ReadOne", ctx, desired).Return(
 		latest, nil,
 	)
-	rm.On("FilterSystemTags", latest)
+	rm.On("FilterSystemTags", latest, []string{})
 	rm.On("Update", ctx, desired, latest, delta).Return(
 		latest, nil,
 	)
@@ -1851,6 +1852,7 @@ func TestReconcile_AccountDrifted(t *testing.T) {
 
 	// Create caches with the k8s client
 	caches := ackrtcache.New(fakeLogger, ackrtcache.Config{}, featuregate.FeatureGates{})
+	irscaches := iamroleselector.NewCache(fakeLogger)
 
 	// Run the caches
 	stopCh := make(chan struct{})
@@ -1891,6 +1893,7 @@ func TestReconcile_AccountDrifted(t *testing.T) {
 			log:       fakeLogger,
 			cfg:       ackcfg.Config{AccountID: "333333333333"},
 			carmCache: caches,
+			irsCache:  irscaches,
 			metrics:   ackmetrics.NewMetrics("test"),
 		},
 		rmf: rmf,

pkg/runtime/reconciler_test.go

@@ -90,7 +90,7 @@ type AWSResourceManager interface {
 	// and this function will remove them before adoption.
 	// Eg. resources created with cloudformation have tags that cannot be
 	//removed by an ACK controller
-	FilterSystemTags(AWSResource)
+	FilterSystemTags(AWSResource, []string)
 }
 
 // AWSResourceManagerFactory returns an AWSResourceManager that can be used to