Skip to content

Commit 870aa6b

Browse files
committed
Included user-defined labels and tags for GCP.
1 parent 9364192 commit 870aa6b

5 files changed

+182
-0
lines changed

installing/installing_gcp/installing-gcp-customizations.adoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,15 @@ include::modules/cco-ccoctl-configuring.adoc[leveloffset=+2]
4040
//Task part 2: Creating the required GCP resources
4141
include::modules/cco-ccoctl-creating-at-once.adoc[leveloffset=+2]
4242

43+
include::modules/installing-gcp-user-defined-labels-and-tags.adoc[leveloffset=+1]
44+
45+
//Configuring user-defined labels and tags for GCP
46+
include::modules/installing-gcp-cluster-creation.adoc[leveloffset=+2]
47+
48+
//Querying user-defined labels and tags for GCP
49+
include::modules/installing-gcp-querying-labels-tags-gcp.adoc[leveloffset=+2]
50+
51+
4352
include::modules/installation-initializing.adoc[leveloffset=+1]
4453

4554
[role="_additional-resources"]
Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Module included in the following assemblies:
2+
// * installing/installing_gcp/installing-gcp-customizations.adoc
3+
4+
:_content-type: PROCEDURE
5+
[id="installing-gcp-cluster-creation_{context}"]
6+
= Configuring user-defined labels and tags for GCP
7+
8+
.Prerequisites
9+
10+
* The installation program requires that a service account includes a `TagUser` role, so that the program can create the {product-title} cluster with defined tags at both organization and project levels.
11+
12+
.Procedure
13+
14+
* Update the `install-config.yaml` file to define the list of desired labels and tags.
15+
+
16+
[NOTE]
17+
====
18+
Labels and tags are defined during the `install-config.yaml` creation phase, and cannot be modified or updated with new labels and tags after cluster creation.
19+
====
20+
+
21+
.Sample `install-config.yaml` file
22+
+
23+
[source,yaml]
24+
----
25+
apiVersion: v1
26+
featureSet: TechPreviewNoUpgrade
27+
platform:
28+
gcp:
29+
userLabels: <1>
30+
- key: <label_key><2>
31+
value: <label_value><3>
32+
userTags: <4>
33+
- parentID: <OrganizationID/ProjectID><5>
34+
key: <tag_key_short_name>
35+
value: <tag_value_short_name>
36+
----
37+
<1> Adds keys and values as labels to the resources created on GCP.
38+
<2> Defines the label name.
39+
<3> Defines the label content.
40+
<4> Adds keys and values as tags to the resources created on GCP.
41+
<5> The ID of the hierarchical resource where the tags are defined, at the organization or the project level.
42+
43+
The following are the requirements for user-defined labels:
44+
45+
* A label key and value must have a minimum of 1 character and can have a maximum of 63 characters.
46+
* A label key and value must contain only lowercase letters, numeric characters, underscore (`_`), and dash (`-`).
47+
* A label key must start with a lowercase letter.
48+
* You can configure a maximum of 32 labels per resource. Each resource can have a maximum of 64 labels, and 32 labels are reserved for internal use by {product-title}.
49+
50+
The following are the requirements for user-defined tags:
51+
52+
* Tag key and tag value must already exist. {product-title} does not create the key and the value.
53+
* A tag `parentID` can be either `OrganizationID` or `ProjectID`:
54+
** `OrganizationID` must consist of decimal numbers without leading zeros.
55+
** `ProjectID` must be 6 to 30 characters in length, that includes only lowercase letters, numbers, and hyphens.
56+
** `ProjectID` must start with a letter, and cannot end with a hyphen.
57+
* A tag key must contain only uppercase and lowercase alphanumeric characters, hyphen (`-`), underscore (`_`), and period (`.`).
58+
* A tag value must contain only uppercase and lowercase alphanumeric characters, hyphen (`-`), underscore (`_`), period (`.`), at sign (`@`), percent sign (`%`), equals sign (`=`), plus (`+`), colon (`:`), comma (`,`), asterisk (`*`), pound sign (`$`), ampersand (`&`), parentheses (`()`), square braces (`[]`), curly braces (`{}`), and space.
59+
* A tag key and value must begin and end with an alphanumeric character.
60+
* Tag value must be one of the pre-defined values for the key.
61+
* You can configure a maximum of 50 tags.
62+
* There should be no tag key defined with the same value as any of the existing tag keys that will be inherited from the parent resource.
Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Module included in the following assemblies:
2+
// * installing/installing_gcp/installing-gcp-customizations.adoc
3+
4+
:_content-type: REFERENCE
5+
[id="installing-gcp-querying-labels-tags-gcp_{context}"]
6+
= Querying user-defined labels and tags for GCP
7+
8+
After creating the {product-title} cluster, you can access the list of the labels and tags defined for the GCP resources in the `infrastructures.config.openshift.io/cluster` object as shown in the following sample `infrastructure.yaml` file.
9+
10+
.Sample `infrastructure.yaml` file
11+
[source,yaml]
12+
----
13+
apiVersion: config.openshift.io/v1
14+
kind: Infrastructure
15+
metadata:
16+
name: cluster
17+
spec:
18+
platformSpec:
19+
type: GCP
20+
status:
21+
infrastructureName: <cluster_id><1>
22+
platform: GCP
23+
platformStatus:
24+
gcp:
25+
resourceLabels:
26+
- key: <label_key>
27+
value: <label_value>
28+
resourceTags:
29+
- key: <tag_key_short_name>
30+
parentID: <OrganizationID/ProjectID>
31+
value: <tag_value_short_name>
32+
type: GCP
33+
----
34+
<1> The cluster ID that is generated during cluster installation.
35+
36+
Along with the user-defined labels, resources have a label defined by the {product-title}. The format of the {product-title} labels is `kubernetes-io-cluster-<cluster_id>:owned`.
Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Module included in the following assemblies:
2+
// * installing/installing_gcp/installing-gcp-customizations.adoc
3+
4+
:_content-type: CONCEPT
5+
[id="installing-gcp-user-defined-labels-and-tags_{context}"]
6+
= Managing user-defined labels and tags for GCP
7+
8+
:FeatureName: Support for user-defined labels and tags for GCP
9+
include::snippets/technology-preview.adoc[]
10+
11+
Google Cloud Platform (GCP) provides labels and tags that help to identify and organize the resources created for a specific {product-title} cluster, making them easier to manage.
12+
13+
You can define labels and tags for each GCP resource only during {product-title} cluster installation.
14+
15+
[IMPORTANT]
16+
====
17+
User-defined labels and tags are not supported for {product-title} clusters upgraded to {product-title} 4.14 version.
18+
====
19+
20+
.User-defined labels
21+
22+
User-defined labels and {product-title} specific labels are applied only to resources created by {product-title} installation program and its core components such as:
23+
24+
* GCP filestore CSI Driver Operator
25+
* GCP PD CSI Driver Operator
26+
* Image Registry Operator
27+
* Machine API provider for GCP
28+
29+
User-defined labels and {product-title} specific labels are not applied on the resources created by any other operators or the Kubernetes in-tree components that create resources, for example, the Ingress load balancers.
30+
31+
User-defined labels and {product-title} labels are available on the following GCP resources:
32+
33+
* Compute disk
34+
* Compute instance
35+
* Compute image
36+
* Compute forwarding rule
37+
* DNS managed zone
38+
* Filestore instance
39+
* Storage bucket
40+
41+
.Limitations to user-defined labels
42+
43+
* Labels for `ComputeAddress` are supported in the GCP beta version. {product-title} does not add labels to the resource.
44+
45+
.User-defined tags
46+
47+
User-defined tags are attached to resources created by the {product-title} Image Registry Operator and not on the resources created by any other Operators or the Kubernetes in-tree components.
48+
49+
User-defined tags are available on on the following GCP resources:
50+
* Storage bucket
51+
52+
.Limitations to the user-defined tags
53+
54+
* Tags will not be attached to the following items:
55+
** Control plane instances and storage buckets created by the installation program
56+
** Compute instances created by the Machine API provider for GCP
57+
** Filestore instance resources created by the GCP filestore CSI driver Operator
58+
** Compute disk and compute image resources created by the GCP PD CSI driver Operator
59+
* Tags are not supported for buckets located in the following regions:
60+
** `us-east2`
61+
** `us-east3`
62+
* Image Registry Operator does not throw any error but skips processing tags when the buckets are created in the tags unsupported region.
63+
* Tags must not be restricted to particular service accounts, because Operators create and use service accounts with minimal roles.
64+
* {product-title} does not create any key and value resources of the tag.
65+
* {product-title} specific tags are not added to any resource.
66+
67+
68+
[role="_additional-resources"]
69+
.Additional resources
70+
71+
* For more information about identifying the `OrganizationID`, see: link:https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id[OrganizationID]
72+
* For more information about identifying the `ProjectID`, see: link:https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects[ProjectID]
73+
* For more information about labels, see link:https://cloud.google.com/resource-manager/docs/labels-overview[Labels Overview].
74+
* For more information about tags, see link:https://cloud.google.com/resource-manager/docs/tags/tags-overview[Tags Overview].

modules/minimum-required-permissions-ipi-gcp.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ If your organization’s security policies require a more restrictive set of per
9595
* `compute.disks.create`
9696
* `compute.disks.get`
9797
* `compute.disks.list`
98+
* `compute.disks.setLabels`
9899
* `compute.instanceGroups.create`
99100
* `compute.instanceGroups.delete`
100101
* `compute.instanceGroups.get`

0 commit comments

Comments
 (0)