feat: Add api, fuzzer and mapper for TagsTagBinding

apis/tags/v1beta1/doc.go

@@ -0,0 +1,16 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +kcc:proto=google.cloud.resourcemanager.v3
+package v1beta1

apis/tags/v1beta1/generate.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd ${REPO_ROOT}/dev/tools/controllerbuilder
+
+go run . generate-types \
+  --service google.cloud.resourcemanager.v3 \
+  --api-version tags.cnrm.cloud.google.com/v1beta1  \
+  --resource TagsTagBinding:TagBinding
+
+go run . generate-mapper --service google.cloud.resourcemanager.v3 --api-version tags.cnrm.cloud.google.com/v1beta1
+
+cd ${REPO_ROOT}
+dev/tasks/generate-crds
+
+go run -mod=readonly golang.org/x/tools/cmd/goimports@latest -w  pkg/controller/direct/tags/

apis/tags/v1beta1/groupversion_info.go

@@ -0,0 +1,33 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +kubebuilder:object:generate=true
+// +groupName=tags.cnrm.cloud.google.com
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: "tags.cnrm.cloud.google.com", Version: "v1beta1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)

apis/tags/v1beta1/tagbinding_identity.go

@@ -0,0 +1,83 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1beta1
+
+import (
+	"context"
+	"fmt"
+
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// TagBindingIdentity defines the resource reference to TagsTagBinding, which "External" field
+// holds the GCP identifier for the KRM object.
+type TagBindingIdentity struct {
+	parent   string
+	tagValue string
+}
+
+func (i *TagBindingIdentity) String() string {
+	return fmt.Sprintf("tagBindings/%s/%s", i.parent, i.tagValue)
+}
+
+func (i *TagBindingIdentity) Parent() string {
+	return i.parent
+}
+
+func (i *TagBindingIdentity) TagValue() string {
+	return i.tagValue
+}
+
+// New builds a TagBindingIdentity from the Config Connector TagBinding object.
+func NewTagBindingIdentity(ctx context.Context, reader client.Reader, obj *TagsTagBinding) (*TagBindingIdentity, error) {
+	parent, err := resolveParent(ctx, reader, obj)
+	if err != nil {
+		return nil, err
+	}
+
+	tagValue, err := resolveTagValue(ctx, reader, obj)
+	if err != nil {
+		return nil, err
+	}
+
+	return &TagBindingIdentity{
+		parent:   parent,
+		tagValue: tagValue,
+	}, nil
+}
+
+func resolveParent(ctx context.Context, reader client.Reader, obj *TagsTagBinding) (string, error) {
+	if obj.Spec.ParentRef.External != "" {
+		return obj.Spec.ParentRef.External, nil
+	}
+	if obj.Spec.ParentRef.Name != "" {
+		// TODO: This is not quite right, we need to resolve the project number.
+		// For now, we will just use the name.
+		return fmt.Sprintf("//cloudresourcemanager.googleapis.com/projects/%s", obj.Spec.ParentRef.Name), nil
+	}
+	return "", fmt.Errorf("parentRef is required")
+}
+
+func resolveTagValue(ctx context.Context, reader client.Reader, obj *TagsTagBinding) (string, error) {
+	if obj.Spec.TagValueRef.External != "" {
+		return obj.Spec.TagValueRef.External, nil
+	}
+	if obj.Spec.TagValueRef.Name != "" {
+		// TODO: This is not quite right, we need to resolve the tag value name.
+		// For now, we will just use the name.
+		return fmt.Sprintf("tagValues/%s", obj.Spec.TagValueRef.Name), nil
+	}
+	return "", fmt.Errorf("tagValueRef is required")
+}

apis/tags/v1beta1/tagbinding_reference.go

@@ -0,0 +1,66 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1beta1
+
+import (
+	"context"
+	"fmt"
+
+	refsv1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
+	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/k8s"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var _ refsv1beta1.ExternalNormalizer = &TagsTagValueRef{}
+
+// NormalizedExternal provision the "External" value for other resource that depends on TagsTagValue.
+// If the "External" is given in the other resource's spec.TagsTagValueRef, the given value will be used.
+// Otherwise, the "Name" and "Namespace" will be used to query the actual TagsTagValue object from the cluster.
+func (r *TagsTagValueRef) NormalizedExternal(ctx context.Context, reader client.Reader, otherNamespace string) (string, error) {
+	if r.External != "" && r.Name != "" {
+		return "", fmt.Errorf("cannot specify both name and external on %s reference", "TagsTagValue")
+	}
+	// From given External
+	if r.External != "" {
+		return r.External, nil
+	}
+
+	// From the Config Connector object
+	if r.Namespace == "" {
+		r.Namespace = otherNamespace
+	}
+	key := types.NamespacedName{Name: r.Name, Namespace: r.Namespace}
+	u := &unstructured.Unstructured{}
+	u.SetGroupVersionKind(GroupVersion.WithKind("TagsTagValue"))
+	if err := reader.Get(ctx, key, u); err != nil {
+		if apierrors.IsNotFound(err) {
+			return "", k8s.NewReferenceNotFoundError(u.GroupVersionKind(), key)
+		}
+		return "", fmt.Errorf("reading referenced %s %s: %w", "TagsTagValue", key, err)
+	}
+	// Get external from status.selfLink. This is the most trustworthy place.
+	actualExternalRef, _, err := unstructured.NestedString(u.Object, "status", "selfLink")
+	if err != nil {
+		return "", fmt.Errorf("reading status.selfLink: %w", err)
+	}
+	if actualExternalRef == "" {
+		return "", k8s.NewReferenceNotReadyError(u.GroupVersionKind(), key)
+	}
+	r.External = actualExternalRef
+	return r.External, nil
+}

apis/tags/v1beta1/tagbinding_types.go

@@ -0,0 +1,111 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1beta1
+
+import (
+	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/apis/k8s/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+var TagsTagBindingGVK = GroupVersion.WithKind("TagsTagBinding")
+
+// TagsTagBindingSpec defines the desired state of TagsTagBinding
+// +kcc:spec:proto=google.cloud.resourcemanager.v3.TagBinding
+type TagsTagBindingSpec struct {
+	// +kcc:ref=Project
+	ParentRef *ParentRef `json:"parentRef"`
+
+	// +kcc:ref=TagsTagValue
+	TagValueRef *TagsTagValueRef `json:"tagValueRef"`
+
+	// The service-generated name of the resource. Used for acquisition only. Leave unset to create a new
+	// resource.
+	ResourceID *string `json:"resourceID,omitempty"`
+}
+
+// ParentRef is a reference to a parent resource.
+// +kcc:ref=Project
+type ParentRef struct {
+	// Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+	Name string `json:"name,omitempty"`
+
+	// Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+	Namespace string `json:"namespace,omitempty"`
+
+	// Allowed value: string of the format `//cloudresourcemanager.googleapis.com/projects/{{value}}`,
+	// where {{value}} is the `number` field of a `Project` resource.
+	External string `json:"external,omitempty"`
+}
+
+// TagsTagBindingStatus defines the config connector machine state of TagsTagBinding
+type TagsTagBindingStatus struct {
+	/* Conditions represent the latest available observations of the
+	   object's current state. */
+	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
+
+	// ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
+
+	// The generated id for the TagBinding. This is a string of the form: tagBindings/{full-resource-name}/{tag-value-name}.
+	Name *string `json:"name,omitempty"`
+
+	// A unique specifier for the TagsTagBinding resource in GCP.
+	ExternalRef *string `json:"externalRef,omitempty"`
+
+	// ObservedState is the state of the resource as most recently observed in GCP.
+	// ObservedState *TagsTagBindingObservedState `json:"observedState,omitempty"`
+}
+
+// TagsTagBindingObservedState is the state of the TagsTagBinding resource as most recently observed in GCP.
+// +kcc:observedstate:proto=google.cloud.resourcemanager.v3.TagBinding
+type TagsTagBindingObservedState struct {
+	// Output only. The name of the TagBinding. This is a String of the form:
+	// `tagBindings/{full-resource-name}/{tag-value-name}`
+	// (e.g. `tagBindings/%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2F123/tagValues/456`).
+	Name *string `json:"name,omitempty"`
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:categories=gcp,shortName=gcptagstagbinding;gcptagstagbindings
+// +kubebuilder:subresource:status
+// +kubebuilder:metadata:labels="cnrm.cloud.google.com/managed-by-kcc=true";"cnrm.cloud.google.com/stability-level=alpha";"cnrm.cloud.google.com/system=true";"cnrm.cloud.google.com/tf2crd=true"
+// +kubebuilder:printcolumn:name="Age",JSONPath=".metadata.creationTimestamp",type="date"
+// +kubebuilder:printcolumn:name="Ready",JSONPath=".status.conditions[?(@.type=='Ready')].status",type="string",description="When 'True', the most recent reconcile of the resource succeeded"
+// +kubebuilder:printcolumn:name="Status",JSONPath=".status.conditions[?(@.type=='Ready')].reason",type="string",description="The reason for the value in 'Ready'"
+// +kubebuilder:printcolumn:name="Status Age",JSONPath=".status.conditions[?(@.type=='Ready')].lastTransitionTime",type="date",description="The last transition time for the value in 'Status'"
+
+// TagsTagBinding is the Schema for the TagsTagBinding API
+// +k8s:openapi-gen=true
+type TagsTagBinding struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// +required
+	Spec   TagsTagBindingSpec   `json:"spec,omitempty"`
+	Status TagsTagBindingStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// TagsTagBindingList contains a list of TagsTagBinding
+type TagsTagBindingList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TagsTagBinding `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&TagsTagBinding{}, &TagsTagBindingList{})
+}

apis/tags/v1beta1/tagvalue_reference.go

@@ -0,0 +1,29 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1beta1
+
+// TagsTagValueRef is a reference to a TagsTagValue resource.
+// +kcc:ref=TagsTagValue
+type TagsTagValueRef struct {
+	// Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+	Name string `json:"name,omitempty"`
+
+	// Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+	Namespace string `json:"namespace,omitempty"`
+
+	// Allowed value: string of the format `tagValues/{{value}}`,
+	// where {{value}} is the `name` field of a `TagsTagValue` resource.
+	External string `json:"external,omitempty"`
+}