feat: EBS Volumes tags inherit from labels

charts/postgres-operator/crds/operatorconfigurations.yaml

@@ -66,6 +66,10 @@ spec:
                   aws_region:
                     default: eu-central-1
                     type: string
+                  ebs_tags_inherit_labels:
+                    items:
+                      type: string
+                    type: array
                   enable_ebs_gp3_migration:
                     type: boolean
                   enable_ebs_gp3_migration_max_size:

manifests/configmap.yaml

@@ -41,6 +41,7 @@ data:
   enable_cross_namespace_secret: "false"
   enable_finalizers: "false"
   enable_database_access: "true"
+  # ebs_tags_inherit_labels: "application,team"
   enable_ebs_gp3_migration: "false"
   enable_ebs_gp3_migration_max_size: "1000"
   enable_init_containers: "true"

manifests/operatorconfiguration.crd.yaml

@@ -66,6 +66,10 @@ spec:
                   aws_region:
                     default: eu-central-1
                     type: string
+                  ebs_tags_inherit_labels:
+                    items:
+                      type: string
+                    type: array
                   enable_ebs_gp3_migration:
                     type: boolean
                   enable_ebs_gp3_migration_max_size:

manifests/postgresql-operator-default-configuration.yaml

@@ -167,6 +167,9 @@ configuration:
     # additional_secret_mount: "some-secret-name"
     # additional_secret_mount_path: "/some/dir"
     aws_region: eu-central-1
+    # ebs_tags_inherit_labels:
+    #   - application
+    #   - team
     enable_ebs_gp3_migration: false
     # enable_ebs_gp3_migration_max_size: 1000
     # gcp_credentials: ""

pkg/apis/acid.zalan.do/v1/operator_configuration_type.go

@@ -246,16 +246,17 @@ type LoadBalancerConfiguration struct {
 type AWSGCPConfiguration struct {
 	WALES3Bucket string `json:"wal_s3_bucket,omitempty"`
 	// +kubebuilder:default=eu-central-1
-	AWSRegion                    string `json:"aws_region,omitempty"`
-	WALGSBucket                  string `json:"wal_gs_bucket,omitempty"`
-	GCPCredentials               string `json:"gcp_credentials,omitempty"`
-	WALAZStorageAccount          string `json:"wal_az_storage_account,omitempty"`
-	LogS3Bucket                  string `json:"log_s3_bucket,omitempty"`
-	KubeIAMRole                  string `json:"kube_iam_role,omitempty"`
-	AdditionalSecretMount        string `json:"additional_secret_mount,omitempty"`
-	AdditionalSecretMountPath    string `json:"additional_secret_mount_path,omitempty"`
-	EnableEBSGp3Migration        bool   `json:"enable_ebs_gp3_migration,omitempty"`
-	EnableEBSGp3MigrationMaxSize int64  `json:"enable_ebs_gp3_migration_max_size,omitempty"`
+	AWSRegion                    string   `json:"aws_region,omitempty"`
+	WALGSBucket                  string   `json:"wal_gs_bucket,omitempty"`
+	GCPCredentials               string   `json:"gcp_credentials,omitempty"`
+	WALAZStorageAccount          string   `json:"wal_az_storage_account,omitempty"`
+	LogS3Bucket                  string   `json:"log_s3_bucket,omitempty"`
+	KubeIAMRole                  string   `json:"kube_iam_role,omitempty"`
+	AdditionalSecretMount        string   `json:"additional_secret_mount,omitempty"`
+	AdditionalSecretMountPath    string   `json:"additional_secret_mount_path,omitempty"`
+	EnableEBSGp3Migration        bool     `json:"enable_ebs_gp3_migration,omitempty"`
+	EnableEBSGp3MigrationMaxSize int64    `json:"enable_ebs_gp3_migration_max_size,omitempty"`
+	EBSTagsInheritLabels         []string `json:"ebs_tags_inherit_labels,omitempty"`
 }
 
 // OperatorDebugConfiguration defines options for the debug mode

pkg/apis/acid.zalan.do/v1/operatorconfiguration.crd.yaml

@@ -66,6 +66,10 @@ spec:
                   aws_region:
                     default: eu-central-1
                     type: string
+                  ebs_tags_inherit_labels:
+                    items:
+                      type: string
+                    type: array
                   enable_ebs_gp3_migration:
                     type: boolean
                   enable_ebs_gp3_migration_max_size:

pkg/cluster/volumes.go

@@ -37,6 +37,9 @@ func (c *Cluster) syncVolumes() error {
 		if err != nil {
 			c.logger.Errorf("populating EBS meta data failed, skipping potential adjustments: %v", err)
 		} else {
+			if err = c.tagEBSVolumes(); err != nil {
+				c.logger.Warningf("tagging EBS volumes failed: %v", err)
+			}
 			err = c.syncUnderlyingEBSVolume()
 			if err != nil {
 				c.logger.Errorf("errors occurred during EBS volume adjustments: %v", err)
@@ -56,6 +59,11 @@ func (c *Cluster) syncVolumes() error {
 		// TODO: handle the case of the cluster that is downsized and enlarged again
 		// (there will be a volume from the old pod for which we can't act before the
 		//  the statefulset modification is concluded)
+		if err = c.populateVolumeMetaData(); err != nil {
+			c.logger.Warningf("populating EBS meta data failed, skipping EBS volume tagging: %v", err)
+		} else if err = c.tagEBSVolumes(); err != nil {
+			c.logger.Warningf("tagging EBS volumes failed: %v", err)
+		}
 		if err = c.syncEbsVolumes(); err != nil {
 			err = fmt.Errorf("could not sync persistent volumes: %v", err)
 			return err
@@ -497,3 +505,100 @@ func (c *Cluster) executeEBSMigration() error {
 
 	return nil
 }
+
+// tagEBSVolumes propagates labels (by name) from the PostgreSQL CR to EBS volumes as tags.
+func (c *Cluster) tagEBSVolumes() error {
+	if c.VolumeResizer == nil {
+		return fmt.Errorf("no volume resizer set for EBS volume tagging")
+	}
+
+	if len(c.OpConfig.EBSTagsInheritLabels) == 0 {
+		c.logger.Debugf("no label keys configured for EBS tag inheritance, skipping")
+		return nil
+	}
+
+	if len(c.EBSVolumes) == 0 {
+		c.logger.Debugf("no EBS volumes found for tagging")
+		return nil
+	}
+
+	desiredTags := make(map[string]string)
+	for _, labelKey := range c.OpConfig.EBSTagsInheritLabels {
+		labelValue, ok := c.ObjectMeta.Labels[labelKey]
+		if !ok || labelValue == "" {
+			c.logger.Debugf("label %q not found or empty on CR, skipping", labelKey)
+			continue
+		}
+		desiredTags[labelKey] = labelValue
+	}
+
+	// Compute keys to delete once — keys in EBSTagsInheritLabels not present in desiredTags.
+	keysToDelete := make([]string, 0, len(c.OpConfig.EBSTagsInheritLabels))
+	for _, labelKey := range c.OpConfig.EBSTagsInheritLabels {
+		if _, wanted := desiredTags[labelKey]; !wanted {
+			keysToDelete = append(keysToDelete, labelKey)
+		}
+	}
+
+	volumesToTag := make([]string, 0, len(c.EBSVolumes))
+	volumesToUntag := make(map[string]bool)
+
+	for volumeID, volumeProps := range c.EBSVolumes {
+		if len(desiredTags) > 0 && c.tagsNeedUpdate(volumeProps.Tags, desiredTags) {
+			volumesToTag = append(volumesToTag, volumeID)
+		}
+		for _, labelKey := range keysToDelete {
+			if _, exists := volumeProps.Tags[labelKey]; exists {
+				volumesToUntag[volumeID] = true
+				break
+			}
+		}
+	}
+
+	if len(volumesToTag) == 0 && len(volumesToUntag) == 0 {
+		c.logger.Debugf("all EBS volumes already have the desired tags")
+		return nil
+	}
+
+	if !c.VolumeResizer.IsConnectedToProvider() {
+		if err := c.VolumeResizer.ConnectToProvider(); err != nil {
+			return fmt.Errorf("could not connect to volume provider for tagging: %v", err)
+		}
+		defer func() {
+			if err := c.VolumeResizer.DisconnectFromProvider(); err != nil {
+				c.logger.Errorf("disconnecting from volume provider failed: %v", err)
+			}
+		}()
+	}
+
+	if len(volumesToTag) > 0 {
+		if err := c.VolumeResizer.TagVolumes(volumesToTag, desiredTags); err != nil {
+			return fmt.Errorf("could not tag EBS volumes: %v", err)
+		}
+		c.logger.Infof("successfully tagged %d EBS volumes with labels: %v", len(volumesToTag), desiredTags)
+	}
+
+	if len(volumesToUntag) > 0 {
+		untagIDs := make([]string, 0, len(volumesToUntag))
+		for id := range volumesToUntag {
+			untagIDs = append(untagIDs, id)
+		}
+		if err := c.VolumeResizer.UntagVolumes(untagIDs, keysToDelete); err != nil {
+			c.logger.Warningf("could not remove stale EBS tags %v: %v", keysToDelete, err)
+		} else {
+			c.logger.Infof("removed stale tags %v from %d EBS volumes", keysToDelete, len(untagIDs))
+		}
+	}
+
+	return nil
+}
+
+// tagsNeedUpdate returns true if any desired tag is missing or has a different value.
+func (c *Cluster) tagsNeedUpdate(existingTags, desiredTags map[string]string) bool {
+	for key, desiredValue := range desiredTags {
+		if existingTags[key] != desiredValue {
+			return true
+		}
+	}
+	return false
+}

pkg/controller/operator_config.go

@@ -182,6 +182,7 @@ func (c *Controller) importConfigurationFromCRD(fromCRD *acidv1.OperatorConfigur
 	result.AdditionalSecretMountPath = fromCRD.AWSGCP.AdditionalSecretMountPath
 	result.EnableEBSGp3Migration = fromCRD.AWSGCP.EnableEBSGp3Migration
 	result.EnableEBSGp3MigrationMaxSize = util.CoalesceInt64(fromCRD.AWSGCP.EnableEBSGp3MigrationMaxSize, 1000)
+	result.EBSTagsInheritLabels = fromCRD.AWSGCP.EBSTagsInheritLabels
 
 	// logical backup config
 	result.LogicalBackupSchedule = util.Coalesce(fromCRD.LogicalBackup.Schedule, "30 00 * * *")

pkg/util/config/config.go

@@ -201,6 +201,7 @@ type Config struct {
 	AdditionalSecretMountPath                string            `name:"additional_secret_mount_path"`
 	EnableEBSGp3Migration                    bool              `name:"enable_ebs_gp3_migration" default:"false"`
 	EnableEBSGp3MigrationMaxSize             int64             `name:"enable_ebs_gp3_migration_max_size" default:"1000"`
+	EBSTagsInheritLabels                     []string          `name:"ebs_tags_inherit_labels" default:""`
 	DebugLogging                             bool              `name:"debug_logging" default:"true"`
 	EnableDBAccess                           bool              `name:"enable_database_access" default:"true"`
 	EnableTeamsAPI                           bool              `name:"enable_teams_api" default:"true"`

pkg/util/filesystems/ext234.go

@@ -17,7 +17,7 @@ const (
 	resize2fs = "resize2fs"
 )
 
-//Ext234Resize implements the FilesystemResizer interface for the ext4/3/2fs.
+// Ext234Resize implements the FilesystemResizer interface for the ext4/3/2fs.
 type Ext234Resize struct {
 }