feat: EBS Volume tags from annotations with mapping

charts/postgres-operator/crds/operatorconfigurations.yaml

@@ -68,6 +68,10 @@ spec:
                   enable_ebs_gp3_migration_max_size:
                     format: int64
                     type: integer
+                  ebs_volume_tags_from_annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
                   gcp_credentials:
                     type: string
                   kube_iam_role:

manifests/complete-postgres-manifest.yaml

@@ -9,6 +9,8 @@ metadata:
 #    "acid.zalan.do/controller": "second-operator"
 #    "delete-date": "2020-08-31"  # can only be deleted on that day if "delete-date "key is configured
 #    "delete-clustername": "acid-test-cluster"  # can only be deleted when name matches if "delete-clustername" key is configured
+#    "myorg.io/application": "my-app"
+#    "myorg.io/team": "my-team"
 spec:
   dockerImage: ghcr.io/zalando/spilo-18:4.1-p1
   teamId: "acid"

manifests/configmap.yaml

@@ -36,6 +36,7 @@ data:
   # delete_annotation_name_key: delete-clustername
   docker_image: ghcr.io/zalando/spilo-18:4.1-p1
   # downscaler_annotations: "deployment-time,downscaler/*"
+  # ebs_volume_tags_from_annotations: "application:myorg.io/application,team:myorg.io/team"
   enable_admin_role_for_users: "true"
   enable_crd_registration: "true"
   enable_cross_namespace_secret: "false"

manifests/operatorconfiguration.crd.yaml

@@ -64,6 +64,10 @@ spec:
                   aws_region:
                     default: eu-central-1
                     type: string
+                  ebs_volume_tags_from_annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
                   enable_ebs_gp3_migration:
                     type: boolean
                   enable_ebs_gp3_migration_max_size:

manifests/postgresql-operator-default-configuration.yaml

@@ -167,6 +167,9 @@ configuration:
     # additional_secret_mount: "some-secret-name"
     # additional_secret_mount_path: "/some/dir"
     aws_region: eu-central-1
+    # ebs_volume_tags_from_annotations:
+    #   application: "myorg.io/application"
+    #   team: "myorg.io/team"
     enable_ebs_gp3_migration: false
     # enable_ebs_gp3_migration_max_size: 1000
     # gcp_credentials: ""

pkg/apis/acid.zalan.do/v1/operator_configuration_type.go

@@ -247,16 +247,17 @@ type LoadBalancerConfiguration struct {
 type AWSGCPConfiguration struct {
 	WALES3Bucket string `json:"wal_s3_bucket,omitempty"`
 	// +kubebuilder:default=eu-central-1
-	AWSRegion                    string `json:"aws_region,omitempty"`
-	WALGSBucket                  string `json:"wal_gs_bucket,omitempty"`
-	GCPCredentials               string `json:"gcp_credentials,omitempty"`
-	WALAZStorageAccount          string `json:"wal_az_storage_account,omitempty"`
-	LogS3Bucket                  string `json:"log_s3_bucket,omitempty"`
-	KubeIAMRole                  string `json:"kube_iam_role,omitempty"`
-	AdditionalSecretMount        string `json:"additional_secret_mount,omitempty"`
-	AdditionalSecretMountPath    string `json:"additional_secret_mount_path,omitempty"`
-	EnableEBSGp3Migration        bool   `json:"enable_ebs_gp3_migration,omitempty"`
-	EnableEBSGp3MigrationMaxSize int64  `json:"enable_ebs_gp3_migration_max_size,omitempty"`
+	AWSRegion                    string            `json:"aws_region,omitempty"`
+	WALGSBucket                  string            `json:"wal_gs_bucket,omitempty"`
+	GCPCredentials               string            `json:"gcp_credentials,omitempty"`
+	WALAZStorageAccount          string            `json:"wal_az_storage_account,omitempty"`
+	LogS3Bucket                  string            `json:"log_s3_bucket,omitempty"`
+	KubeIAMRole                  string            `json:"kube_iam_role,omitempty"`
+	AdditionalSecretMount        string            `json:"additional_secret_mount,omitempty"`
+	AdditionalSecretMountPath    string            `json:"additional_secret_mount_path,omitempty"`
+	EnableEBSGp3Migration        bool              `json:"enable_ebs_gp3_migration,omitempty"`
+	EnableEBSGp3MigrationMaxSize int64             `json:"enable_ebs_gp3_migration_max_size,omitempty"`
+	EBSVolumeTagsFromAnnotations map[string]string `json:"ebs_volume_tags_from_annotations,omitempty"`
 }
 
 // OperatorDebugConfiguration defines options for the debug mode

pkg/apis/acid.zalan.do/v1/operatorconfiguration.crd.yaml

@@ -64,6 +64,10 @@ spec:
                   aws_region:
                     default: eu-central-1
                     type: string
+                  ebs_volume_tags_from_annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
                   enable_ebs_gp3_migration:
                     type: boolean
                   enable_ebs_gp3_migration_max_size:

pkg/cluster/volumes.go

@@ -37,6 +37,9 @@ func (c *Cluster) syncVolumes() error {
 		if err != nil {
 			c.logger.Errorf("populating EBS meta data failed, skipping potential adjustments: %v", err)
 		} else {
+			if err = c.tagEBSVolumes(); err != nil {
+				c.logger.Warningf("tagging EBS volumes failed: %v", err)
+			}
 			err = c.syncUnderlyingEBSVolume()
 			if err != nil {
 				c.logger.Errorf("errors occurred during EBS volume adjustments: %v", err)
@@ -56,6 +59,11 @@ func (c *Cluster) syncVolumes() error {
 		// TODO: handle the case of the cluster that is downsized and enlarged again
 		// (there will be a volume from the old pod for which we can't act before the
 		//  the statefulset modification is concluded)
+		if err = c.populateVolumeMetaData(); err != nil {
+			c.logger.Warningf("populating EBS meta data failed, skipping EBS volume tagging: %v", err)
+		} else if err = c.tagEBSVolumes(); err != nil {
+			c.logger.Warningf("tagging EBS volumes failed: %v", err)
+		}
 		if err = c.syncEbsVolumes(); err != nil {
 			err = fmt.Errorf("could not sync persistent volumes: %v", err)
 			return err
@@ -497,3 +505,80 @@ func (c *Cluster) executeEBSMigration() error {
 
 	return nil
 }
+
+// tagEBSVolumes tags EBS volumes based on the configured annotation-to-tag mappings
+// Only tags volumes that don't already have the desired tags
+func (c *Cluster) tagEBSVolumes() error {
+	if c.VolumeResizer == nil {
+		return fmt.Errorf("no volume resizer set for EBS volume tagging")
+	}
+
+	if len(c.OpConfig.EBSVolumeTagsFromAnnotations) == 0 {
+		c.logger.Debugf("no annotation-to-tag mappings configured, skipping EBS volume tagging")
+		return nil
+	}
+
+	if len(c.EBSVolumes) == 0 {
+		c.logger.Debugf("no EBS volumes found for tagging")
+		return nil
+	}
+
+	desiredTags := make(map[string]string)
+	for tagName, annotationKey := range c.OpConfig.EBSVolumeTagsFromAnnotations {
+		annotationValue, ok := c.ObjectMeta.Annotations[annotationKey]
+		if !ok || annotationValue == "" {
+			c.logger.Debugf("annotation %q not found or empty, skipping tag %q", annotationKey, tagName)
+			continue
+		}
+		desiredTags[tagName] = annotationValue
+	}
+
+	if len(desiredTags) == 0 {
+		c.logger.Debugf("no tags to apply from configured annotations")
+		return nil
+	}
+
+	// Filter volumes that need tagging
+	volumesToTag := make([]string, 0, len(c.EBSVolumes))
+	for volumeID, volumeProps := range c.EBSVolumes {
+		if c.tagsNeedUpdate(volumeProps.Tags, desiredTags) {
+			volumesToTag = append(volumesToTag, volumeID)
+		}
+	}
+
+	if len(volumesToTag) == 0 {
+		c.logger.Debugf("all EBS volumes already have the desired tags")
+		return nil
+	}
+
+	if !c.VolumeResizer.IsConnectedToProvider() {
+		err := c.VolumeResizer.ConnectToProvider()
+		if err != nil {
+			return fmt.Errorf("could not connect to volume provider for tagging: %v", err)
+		}
+		defer func() {
+			if err := c.VolumeResizer.DisconnectFromProvider(); err != nil {
+				c.logger.Errorf("disconnecting from volume provider failed: %v", err)
+			}
+		}()
+	}
+
+	err := c.VolumeResizer.TagVolumes(volumesToTag, desiredTags)
+	if err != nil {
+		return fmt.Errorf("could not tag EBS volumes: %v", err)
+	}
+
+	c.logger.Infof("successfully tagged %d EBS volumes with tags: %v", len(volumesToTag), desiredTags)
+	return nil
+}
+
+// tagsNeedUpdate checks if the desired tags differ from existing tags
+func (c *Cluster) tagsNeedUpdate(existingTags, desiredTags map[string]string) bool {
+	for key, desiredValue := range desiredTags {
+		existingValue, exists := existingTags[key]
+		if !exists || existingValue != desiredValue {
+			return true
+		}
+	}
+	return false
+}

pkg/controller/operator_config.go

@@ -193,6 +193,7 @@ func (c *Controller) importConfigurationFromCRD(fromCRD *acidv1.OperatorConfigur
 	result.AdditionalSecretMountPath = fromCRD.AWSGCP.AdditionalSecretMountPath
 	result.EnableEBSGp3Migration = fromCRD.AWSGCP.EnableEBSGp3Migration
 	result.EnableEBSGp3MigrationMaxSize = util.CoalesceInt64(fromCRD.AWSGCP.EnableEBSGp3MigrationMaxSize, 1000)
+	result.EBSVolumeTagsFromAnnotations = fromCRD.AWSGCP.EBSVolumeTagsFromAnnotations
 
 	// logical backup config
 	result.LogicalBackupSchedule = util.Coalesce(fromCRD.LogicalBackup.Schedule, "30 00 * * *")

pkg/util/config/config.go

@@ -201,6 +201,7 @@ type Config struct {
 	AdditionalSecretMountPath                string            `name:"additional_secret_mount_path"`
 	EnableEBSGp3Migration                    bool              `name:"enable_ebs_gp3_migration" default:"false"`
 	EnableEBSGp3MigrationMaxSize             int64             `name:"enable_ebs_gp3_migration_max_size" default:"1000"`
+	EBSVolumeTagsFromAnnotations             map[string]string `name:"ebs_volume_tags_from_annotations" default:""`
 	DebugLogging                             bool              `name:"debug_logging" default:"true"`
 	EnableDBAccess                           bool              `name:"enable_database_access" default:"true"`
 	EnableTeamsAPI                           bool              `name:"enable_teams_api" default:"true"`

pkg/util/filesystems/ext234.go

@@ -17,7 +17,7 @@ const (
 	resize2fs = "resize2fs"
 )
 
-//Ext234Resize implements the FilesystemResizer interface for the ext4/3/2fs.
+// Ext234Resize implements the FilesystemResizer interface for the ext4/3/2fs.
 type Ext234Resize struct {
 }