add parameters to specify resource tracking configuration

controllers/ingress/group_controller.go

@@ -34,12 +34,13 @@ import (
 )
 
 const (
-	ingressTagPrefix = "ingress.k8s.aws"
-	controllerName   = "ingress"
+	controllerName = "ingress"
 
 	// the groupVersion of used Ingress & IngressClass resource.
 	ingressResourcesGroupVersion = "networking.k8s.io/v1"
 	ingressClassKind             = "IngressClass"
+	clusterTagPrefix             = "elbv2.k8s.aws"
+	ingressTagPrefix             = "ingress.k8s.aws"
 )
 
 // NewGroupReconciler constructs new GroupReconciler
@@ -53,7 +54,7 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
 	authConfigBuilder := ingress.NewDefaultAuthConfigBuilder(annotationParser)
 	enhancedBackendBuilder := ingress.NewDefaultEnhancedBackendBuilder(k8sClient, annotationParser, authConfigBuilder, controllerConfig.IngressConfig.TolerateNonExistentBackendService, controllerConfig.IngressConfig.TolerateNonExistentBackendAction)
 	referenceIndexer := ingress.NewDefaultReferenceIndexer(enhancedBackendBuilder, authConfigBuilder, logger)
-	trackingProvider := tracking.NewDefaultProvider(ingressTagPrefix, controllerConfig.ClusterName)
+	trackingProvider := tracking.NewDefaultProvider(clusterTagPrefix, ingressTagPrefix, controllerConfig.ClusterName)
 	modelBuilder := ingress.NewDefaultModelBuilder(k8sClient, eventRecorder,
 		cloud.EC2(), cloud.ELBV2(), cloud.ACM(),
 		annotationParser, subnetsResolver,
@@ -63,7 +64,7 @@ func NewGroupReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder
 		controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, controllerConfig.IngressConfig.AllowedCertificateAuthorityARNs, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), logger)
 	stackMarshaller := deploy.NewDefaultStackMarshaller()
 	stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, elbv2TaggingManager,
-		controllerConfig, ingressTagPrefix, logger)
+		controllerConfig, clusterTagPrefix, ingressTagPrefix, logger)
 	classLoader := ingress.NewDefaultClassLoader(k8sClient, true)
 	classAnnotationMatcher := ingress.NewDefaultClassAnnotationMatcher(controllerConfig.IngressConfig.IngressClass)
 	manageIngressesWithoutIngressClass := controllerConfig.IngressConfig.IngressClass == ""

controllers/service/service_controller.go

@@ -29,9 +29,11 @@ import (
 
 const (
 	serviceFinalizer        = "service.k8s.aws/resources"
-	serviceTagPrefix        = "service.k8s.aws"
 	serviceAnnotationPrefix = "service.beta.kubernetes.io"
 	controllerName          = "service"
+
+	clusterTagPrefix = "elbv2.k8s.aws"
+	serviceTagPrefix = "service.k8s.aws"
 )
 
 func NewServiceReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorder record.EventRecorder,
@@ -41,14 +43,14 @@ func NewServiceReconciler(cloud aws.Cloud, k8sClient client.Client, eventRecorde
 	backendSGProvider networking.BackendSGProvider, sgResolver networking.SecurityGroupResolver, logger logr.Logger) *serviceReconciler {
 
 	annotationParser := annotations.NewSuffixAnnotationParser(serviceAnnotationPrefix)
-	trackingProvider := tracking.NewDefaultProvider(serviceTagPrefix, controllerConfig.ClusterName)
+	trackingProvider := tracking.NewDefaultProvider(clusterTagPrefix, serviceTagPrefix, controllerConfig.ClusterName)
 	serviceUtils := service.NewServiceUtils(annotationParser, serviceFinalizer, controllerConfig.ServiceConfig.LoadBalancerClass, controllerConfig.FeatureGates)
 	modelBuilder := service.NewDefaultModelBuilder(annotationParser, subnetsResolver, vpcInfoProvider, cloud.VpcID(), trackingProvider,
 		elbv2TaggingManager, cloud.EC2(), controllerConfig.FeatureGates, controllerConfig.ClusterName, controllerConfig.DefaultTags, controllerConfig.ExternalManagedTags,
 		controllerConfig.DefaultSSLPolicy, controllerConfig.DefaultTargetType, controllerConfig.FeatureGates.Enabled(config.EnableIPTargetType), serviceUtils,
 		backendSGProvider, sgResolver, controllerConfig.EnableBackendSecurityGroup, controllerConfig.DisableRestrictedSGRules, logger)
 	stackMarshaller := deploy.NewDefaultStackMarshaller()
-	stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, elbv2TaggingManager, controllerConfig, serviceTagPrefix, logger)
+	stackDeployer := deploy.NewDefaultStackDeployer(cloud, k8sClient, networkingSGManager, networkingSGReconciler, elbv2TaggingManager, controllerConfig, clusterTagPrefix, serviceTagPrefix, logger)
 	return &serviceReconciler{
 		k8sClient:         k8sClient,
 		eventRecorder:     eventRecorder,

main.go

@@ -53,6 +53,11 @@ import (
 	// +kubebuilder:scaffold:imports
 )
 
+const (
+	clusterSgRuleLabelPrefix = "elbv2.k8s.aws"
+	clusterTagPrefix         = "elbv2.k8s.aws"
+)
+
 var (
 	scheme   = k8sruntime.NewScheme()
 	setupLog = ctrl.Log.WithName("setup")
@@ -115,9 +120,9 @@ func main() {
 	tgbResManager := targetgroupbinding.NewDefaultResourceManager(mgr.GetClient(), cloud.ELBV2(), cloud.EC2(),
 		podInfoRepo, sgManager, sgReconciler, vpcInfoProvider, multiClusterManager,
 		cloud.VpcID(), controllerCFG.ClusterName, controllerCFG.FeatureGates.Enabled(config.EndpointsFailOpen), controllerCFG.EnableEndpointSlices, controllerCFG.DisableRestrictedSGRules,
-		controllerCFG.ServiceTargetENISGTags, mgr.GetEventRecorderFor("targetGroupBinding"), ctrl.Log)
+		controllerCFG.ServiceTargetENISGTags, clusterSgRuleLabelPrefix, mgr.GetEventRecorderFor("targetGroupBinding"), ctrl.Log)
 	backendSGProvider := networking.NewBackendSGProvider(controllerCFG.ClusterName, controllerCFG.BackendSecurityGroup,
-		cloud.VpcID(), cloud.EC2(), mgr.GetClient(), controllerCFG.DefaultTags, ctrl.Log.WithName("backend-sg-provider"))
+		cloud.VpcID(), cloud.EC2(), mgr.GetClient(), clusterTagPrefix, controllerCFG.DefaultTags, ctrl.Log.WithName("backend-sg-provider"))
 	sgResolver := networking.NewDefaultSecurityGroupResolver(cloud.EC2(), cloud.VpcID())
 	elbv2TaggingManager := elbv2deploy.NewDefaultTaggingManager(cloud.ELBV2(), cloud.VpcID(), controllerCFG.FeatureGates, cloud.RGT(), ctrl.Log)
 	ingGroupReconciler := ingress.NewGroupReconciler(cloud, mgr.GetClient(), mgr.GetEventRecorderFor("ingress"),

pkg/config/controller_config.go

@@ -13,9 +13,10 @@ import (
 )
 
 const (
-	flagLogLevel                                     = "log-level"
-	flagK8sClusterName                               = "cluster-name"
-	flagDefaultTags                                  = "default-tags"
+	flagLogLevel       = "log-level"
+	flagK8sClusterName = "cluster-name"
+	flagDefaultTags    = "default-tags"
+	//flagResourceTrackingConfiguration                = "resource-tracking-configuration"
 	flagDefaultTargetType                            = "default-target-type"
 	flagExternalManagedTags                          = "external-managed-tags"
 	flagServiceTargetENISGTags                       = "service-target-eni-security-group-tags"
@@ -27,24 +28,14 @@ const (
 	flagBackendSecurityGroup                         = "backend-security-group"
 	flagEnableEndpointSlices                         = "enable-endpoint-slices"
 	flagDisableRestrictedSGRules                     = "disable-restricted-sg-rules"
-	defaultLogLevel                                  = "info"
-	defaultMaxConcurrentReconciles                   = 3
-	defaultMaxExponentialBackoffDelay                = time.Second * 1000
-	defaultSSLPolicy                                 = "ELBSecurityPolicy-2016-08"
-	defaultEnableBackendSG                           = true
-	defaultEnableEndpointSlices                      = false
-	defaultDisableRestrictedSGRules                  = false
-)
 
-var (
-	trackingTagKeys = sets.NewString(
-		"elbv2.k8s.aws/cluster",
-		"elbv2.k8s.aws/resource",
-		"ingress.k8s.aws/stack",
-		"ingress.k8s.aws/resource",
-		"service.k8s.aws/stack",
-		"service.k8s.aws/resource",
-	)
+	defaultLogLevel                   = "info"
+	defaultMaxConcurrentReconciles    = 3
+	defaultMaxExponentialBackoffDelay = time.Second * 1000
+	defaultSSLPolicy                  = "ELBSecurityPolicy-2016-08"
+	defaultEnableBackendSG            = true
+	defaultEnableEndpointSlices       = false
+	defaultDisableRestrictedSGRules   = false
 )
 
 // ControllerConfig contains the controller configuration
@@ -69,6 +60,9 @@ type ControllerConfig struct {
 	// Default AWS Tags that will be applied to all AWS resources managed by this controller.
 	DefaultTags map[string]string
 
+	// ResourceTrackingConfiguration provides tracking prefix for resource tags, backend SG name and worker node SG rules label.
+	ResourceTrackingConfiguration map[string]string
+
 	// Default target type for Ingress and Service objects
 	DefaultTargetType string
 
@@ -134,10 +128,10 @@ func (cfg *ControllerConfig) BindFlags(fs *pflag.FlagSet) {
 		"Disable the usage of restricted security group rules")
 	fs.StringToStringVar(&cfg.ServiceTargetENISGTags, flagServiceTargetENISGTags, nil,
 		"AWS Tags, in addition to cluster tags, for finding the target ENI security group to which to add inbound rules from NLBs")
+
 	cfg.FeatureGates.BindFlags(fs)
 	cfg.AWSConfig.BindFlags(fs)
 	cfg.RuntimeConfig.BindFlags(fs)
-
 	cfg.PodWebhookConfig.BindFlags(fs)
 	cfg.IngressConfig.BindFlags(fs)
 	cfg.AddonsConfig.BindFlags(fs)
@@ -150,10 +144,19 @@ func (cfg *ControllerConfig) Validate() error {
 		return errors.New("kubernetes cluster name must be specified")
 	}
 
-	if err := cfg.validateDefaultTagsCollisionWithTrackingTags(); err != nil {
+	trackingTagKeys := sets.New[string](
+		"elbv2.k8s.aws/cluster",
+		"elbv2.k8s.aws/resource",
+		"ingress.k8s.aws/stack",
+		"ingress.k8s.aws/resource",
+		"service.k8s.aws/stack",
+		"service.k8s.aws/resource",
+	)
+
+	if err := cfg.validateDefaultTagsCollisionWithTrackingTags(trackingTagKeys); err != nil {
 		return err
 	}
-	if err := cfg.validateExternalManagedTagsCollisionWithTrackingTags(); err != nil {
+	if err := cfg.validateExternalManagedTagsCollisionWithTrackingTags(trackingTagKeys); err != nil {
 		return err
 	}
 	if err := cfg.validateExternalManagedTagsCollisionWithDefaultTags(); err != nil {
@@ -168,7 +171,7 @@ func (cfg *ControllerConfig) Validate() error {
 	return nil
 }
 
-func (cfg *ControllerConfig) validateDefaultTagsCollisionWithTrackingTags() error {
+func (cfg *ControllerConfig) validateDefaultTagsCollisionWithTrackingTags(trackingTagKeys sets.Set[string]) error {
 	for tagKey := range cfg.DefaultTags {
 		if trackingTagKeys.Has(tagKey) {
 			return errors.Errorf("tag key %v cannot be specified in %v flag", tagKey, flagDefaultTags)
@@ -177,7 +180,7 @@ func (cfg *ControllerConfig) validateDefaultTagsCollisionWithTrackingTags() erro
 	return nil
 }
 
-func (cfg *ControllerConfig) validateExternalManagedTagsCollisionWithTrackingTags() error {
+func (cfg *ControllerConfig) validateExternalManagedTagsCollisionWithTrackingTags(trackingTagKeys sets.Set[string]) error {
 	for _, tagKey := range cfg.ExternalManagedTags {
 		if trackingTagKeys.Has(tagKey) {
 			return errors.Errorf("tag key %v cannot be specified in %v flag", tagKey, flagExternalManagedTags)

pkg/config/controller_config_test.go

@@ -3,6 +3,7 @@ package config
 import (
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"testing"
 )
 
@@ -46,7 +47,15 @@ func TestControllerConfig_validateDefaultTagsCollisionWithTrackingTags(t *testin
 			cfg := &ControllerConfig{
 				DefaultTags: tt.fields.DefaultTags,
 			}
-			err := cfg.validateDefaultTagsCollisionWithTrackingTags()
+			trackingTagKeys := sets.New[string](
+				"elbv2.k8s.aws/cluster",
+				"elbv2.k8s.aws/resource",
+				"ingress.k8s.aws/stack",
+				"ingress.k8s.aws/resource",
+				"service.k8s.aws/stack",
+				"service.k8s.aws/resource",
+			)
+			err := cfg.validateDefaultTagsCollisionWithTrackingTags(trackingTagKeys)
 			if tt.wantErr != nil {
 				assert.EqualError(t, err, tt.wantErr.Error())
 			} else {
@@ -92,7 +101,15 @@ func TestControllerConfig_validateExternalManagedTagsCollisionWithTrackingTags(t
 			cfg := &ControllerConfig{
 				ExternalManagedTags: tt.fields.ExternalManagedTags,
 			}
-			err := cfg.validateExternalManagedTagsCollisionWithTrackingTags()
+			trackingTagKeys := sets.New[string](
+				"elbv2.k8s.aws/cluster",
+				"elbv2.k8s.aws/resource",
+				"ingress.k8s.aws/stack",
+				"ingress.k8s.aws/resource",
+				"service.k8s.aws/stack",
+				"service.k8s.aws/resource",
+			)
+			err := cfg.validateExternalManagedTagsCollisionWithTrackingTags(trackingTagKeys)
 			if tt.wantErr != nil {
 				assert.EqualError(t, err, tt.wantErr.Error())
 			} else {

pkg/deploy/stack_deployer.go

@@ -26,9 +26,9 @@ type StackDeployer interface {
 func NewDefaultStackDeployer(cloud aws.Cloud, k8sClient client.Client,
 	networkingSGManager networking.SecurityGroupManager, networkingSGReconciler networking.SecurityGroupReconciler,
 	elbv2TaggingManager elbv2.TaggingManager,
-	config config.ControllerConfig, tagPrefix string, logger logr.Logger) *defaultStackDeployer {
+	config config.ControllerConfig, clusterTagPrefix string, resourceTagPrefix string, logger logr.Logger) *defaultStackDeployer {
 
-	trackingProvider := tracking.NewDefaultProvider(tagPrefix, config.ClusterName)
+	trackingProvider := tracking.NewDefaultProvider(clusterTagPrefix, resourceTagPrefix, config.ClusterName)
 	ec2TaggingManager := ec2.NewDefaultTaggingManager(cloud.EC2(), networkingSGManager, cloud.VpcID(), logger)
 
 	return &defaultStackDeployer{

pkg/deploy/tracking/provider.go

@@ -32,9 +32,6 @@ import (
 //    * `service.k8s.aws/stack-namespace: namespace`
 //    * `service.k8s.aws/stack-name: serviceName`
 
-// AWS TagKey for cluster resources.
-const clusterNameTagKey = "elbv2.k8s.aws/cluster"
-
 // Legacy AWS TagKey for cluster resources, which is used by AWSALBIngressController(v1.1.3+)
 const clusterNameTagKeyLegacy = "ingress.k8s.aws/cluster"
 
@@ -63,30 +60,32 @@ type Provider interface {
 }
 
 // NewDefaultProvider constructs defaultProvider
-func NewDefaultProvider(tagPrefix string, clusterName string) *defaultProvider {
+func NewDefaultProvider(clusterTagPrefix string, resourceTagPrefix string, clusterName string) *defaultProvider {
 	return &defaultProvider{
-		tagPrefix:   tagPrefix,
-		clusterName: clusterName,
+		clusterTagPrefix:  clusterTagPrefix,
+		resourceTagPrefix: resourceTagPrefix,
+		clusterName:       clusterName,
 	}
 }
 
 var _ Provider = &defaultProvider{}
 
 // defaultImplementation for Provider
 type defaultProvider struct {
-	tagPrefix   string
-	clusterName string
+	clusterTagPrefix  string
+	resourceTagPrefix string
+	clusterName       string
 }
 
 func (p *defaultProvider) ResourceIDTagKey() string {
-	return p.prefixedTrackingKey("resource")
+	return p.prefixedTrackingKey(p.resourceTagPrefix, "resource")
 }
 
 func (p *defaultProvider) StackTags(stack core.Stack) map[string]string {
 	stackID := stack.StackID()
 	return map[string]string{
-		clusterNameTagKey:              p.clusterName,
-		p.prefixedTrackingKey("stack"): stackID.String(),
+		p.prefixedTrackingKey(p.clusterTagPrefix, "cluster"): p.clusterName,
+		p.prefixedTrackingKey(p.resourceTagPrefix, "stack"):  stackID.String(),
 	}
 }
 
@@ -102,20 +101,20 @@ func (p *defaultProvider) StackLabels(stack core.Stack) map[string]string {
 	stackID := stack.StackID()
 	if stackID.Namespace == "" {
 		return map[string]string{
-			p.prefixedTrackingKey("stack"): stackID.Name,
+			p.prefixedTrackingKey(p.resourceTagPrefix, "stack"): stackID.Name,
 		}
 	}
 	return map[string]string{
-		p.prefixedTrackingKey("stack-namespace"): stackID.Namespace,
-		p.prefixedTrackingKey("stack-name"):      stackID.Name,
+		p.prefixedTrackingKey(p.resourceTagPrefix, "stack-namespace"): stackID.Namespace,
+		p.prefixedTrackingKey(p.resourceTagPrefix, "stack-name"):      stackID.Name,
 	}
 }
 
 func (p *defaultProvider) StackTagsLegacy(stack core.Stack) map[string]string {
 	stackID := stack.StackID()
 	return map[string]string{
-		clusterNameTagKeyLegacy:        p.clusterName,
-		p.prefixedTrackingKey("stack"): stackID.String(),
+		clusterNameTagKeyLegacy:                             p.clusterName,
+		p.prefixedTrackingKey(p.resourceTagPrefix, "stack"): stackID.String(),
 	}
 }
 
@@ -131,6 +130,6 @@ func (p *defaultProvider) LegacyTagKeys() []string {
 	}
 }
 
-func (p *defaultProvider) prefixedTrackingKey(tag string) string {
-	return fmt.Sprintf("%v/%v", p.tagPrefix, tag)
+func (p *defaultProvider) prefixedTrackingKey(prefix string, tag string) string {
+	return fmt.Sprintf("%v/%v", prefix, tag)
 }