Describe the feature
The EC2 controller's generator.yaml currently sets RunInstancesInput.TagSpecifications to ignore (ref: generator.yaml#L110). This prevents users from specifying TagSpecifications in the Instance CR, meaning tags cannot be applied to sub-resources (e.g., EBS volumes, network interfaces) at instance launch time.
Why is this needed?
Many organizations enforce tag-based Service Control Policies (SCPs) via AWS Organizations that require specific tags to be present at resource creation time using aws:RequestTag conditions. For example:
{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Null": {
"aws:RequestTag/kubernetes.io/created-for/pvc/name": "true"
}
}
}Since ACK does not include TagSpecifications in the RunInstances API call, the SCP denies the operation with:
UnauthorizedOperation: ec2:RunInstances on resource: volume/* with an explicit deny in a service control policy
Post-creation tagging via CreateTags does NOT satisfy SCP conditions, because SCP evaluates aws:RequestTag only at resource creation time.
Proposed Solution
Remove the ignore directive on RunInstancesInput.TagSpecifications in generator.yaml and expose it as a field in the Instance CR spec. This would allow users to pass TagSpecifications at instance launch time, enabling:
- Tag-based SCP compliance for EBS volumes, ENIs, etc. created with the instance
- Cost allocation tags applied at creation
- Compliance with organizational tagging policies
Environment
- EC2 Controller Version: v1.15.0
- Kubernetes Version: 1.28+
Additional Context
Describe the feature
The EC2 controller's
generator.yamlcurrently setsRunInstancesInput.TagSpecificationstoignore(ref: generator.yaml#L110). This prevents users from specifyingTagSpecificationsin theInstanceCR, meaning tags cannot be applied to sub-resources (e.g., EBS volumes, network interfaces) at instance launch time.Why is this needed?
Many organizations enforce tag-based Service Control Policies (SCPs) via AWS Organizations that require specific tags to be present at resource creation time using
aws:RequestTagconditions. For example:{ "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:volume/*", "Condition": { "Null": { "aws:RequestTag/kubernetes.io/created-for/pvc/name": "true" } } }Since ACK does not include
TagSpecificationsin theRunInstancesAPI call, the SCP denies the operation with:Post-creation tagging via
CreateTagsdoes NOT satisfy SCP conditions, because SCP evaluatesaws:RequestTagonly at resource creation time.Proposed Solution
Remove the
ignoredirective onRunInstancesInput.TagSpecificationsingenerator.yamland expose it as a field in theInstanceCR spec. This would allow users to passTagSpecificationsat instance launch time, enabling:Environment
Additional Context