rosacontrolplane: support a separate billing account

Signed-off-by: Steve Kuznetsov <[email protected]>

Author: stevekuznetsov

config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml

@@ -51,6 +51,17 @@ spec:
                 items:
                   type: string
                 type: array
+              billingAccount:
+                description: BillingAccount is an optional AWS account to use for
+                  billing the subscription fees for ROSA clusters. The cost of running
+                  each ROSA cluster will be billed to the infrastructure account in
+                  which the cluster is running.
+                type: string
+                x-kubernetes-validations:
+                - message: billingAccount is immutable
+                  rule: self == oldSelf
+                - message: billingAccount must be a valid AWS account ID
+                  rule: self.matches('^[0-9]{12}$')
               controlPlaneEndpoint:
                 description: ControlPlaneEndpoint represents the endpoint used to
                   communicate with the control plane.

controlplane/rosa/api/v1beta2/rosacontrolplane_types.go

@@ -68,6 +68,16 @@ type RosaControlPlaneSpec struct { //nolint: maligned
 	SupportRoleARN   *string `json:"supportRoleARN"`
 	WorkerRoleARN    *string `json:"workerRoleARN"`
 
+	// +immutable
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="billingAccount is immutable"
+	// +kubebuilder:validation:XValidation:rule="self.matches('^[0-9]{12}$')", message="billingAccount must be a valid AWS account ID"
+
+	// BillingAccount is an optional AWS account to use for billing the subscription fees for ROSA clusters.
+	// The cost of running each ROSA cluster will be billed to the infrastructure account in which the cluster
+	// is running.
+	BillingAccount string `json:"billingAccount,omitempty"`
+
 	// CredentialsSecretRef references a secret with necessary credentials to connect to the OCM API.
 	// The secret should contain the following data keys:
 	// - ocmToken: eyJhbGciOiJIUzI1NiIsI....

controlplane/rosa/controllers/rosacontrolplane_controller.go

@@ -200,7 +200,7 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
 	}
 
 	if validationMessage, validationError := validateControlPlaneSpec(ocmClient, rosaScope); validationError != nil {
-		return ctrl.Result{}, fmt.Errorf("validate ROSAControlPlane.spec: %w", err)
+		return ctrl.Result{}, fmt.Errorf("validate ROSAControlPlane.spec: %w", validationError)
 	} else if validationMessage != "" {
 		rosaScope.ControlPlane.Status.FailureMessage = ptr.To(validationMessage)
 		// dont' requeue because input is invalid and manual intervention is needed.
@@ -268,14 +268,21 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
 		rosaScope.Error(err, "rosacontrolplane.spec.machineCIDR invalid")
 	}
 
+	billingAccount := *rosaScope.Identity.Account
+	if rosaScope.ControlPlane.Spec.BillingAccount != "" {
+		billingAccount = rosaScope.ControlPlane.Spec.BillingAccount
+	}
+
 	spec := ocm.Spec{
+		DryRun:                    ptr.To(false),
 		Name:                      rosaScope.RosaClusterName(),
 		Region:                    *rosaScope.ControlPlane.Spec.Region,
 		MultiAZ:                   true,
 		Version:                   ocm.CreateVersionID(rosaScope.ControlPlane.Spec.Version, ocm.DefaultChannelGroup),
 		ChannelGroup:              "stable",
 		Expiration:                time.Now().Add(1 * time.Hour),
 		DisableWorkloadMonitoring: ptr.To(true),
+		DefaultIngress:            ocm.NewDefaultIngressSpec(), // n.b. this is a no-op when it's set to the default value
 
 		SubnetIds:         rosaScope.ControlPlane.Spec.Subnets,
 		AvailabilityZones: rosaScope.ControlPlane.Spec.AvailabilityZones,
@@ -332,7 +339,7 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
 		Hypershift: ocm.Hypershift{
 			Enabled: true,
 		},
-		BillingAccount: *rosaScope.Identity.Account,
+		BillingAccount: billingAccount,
 		AWSCreator:     creator,
 	}