Skip to content

✨ Tag Controller for Assignment of Tags to VMs - #1807

Open
aniket-deole wants to merge 1 commit into
vmware-tanzu:mainfrom
aniket-deole:aniketd/tag-controller-changes
Open

✨ Tag Controller for Assignment of Tags to VMs#1807
aniket-deole wants to merge 1 commit into
vmware-tanzu:mainfrom
aniket-deole:aniketd/tag-controller-changes

Conversation

@aniket-deole

@aniket-deole aniket-deole commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

What does this PR do, and why is it needed?

Introduces a new namespace-scoped Tag CRD (vsphere.policy.vmware.com/v1alpha1) and a Tag controller to drive vCenter Tag-based VM affinity/anti-affinity. Today, labels are only converted to vCenter Tags for a VM that itself declares spec.affinity referencing them, and only at create time — so a VM carrying a participating label but no affinity of its own is never tagged and can't be targeted by another VM's affinity rule.
This change tracks which label key/value pairs currently participate in affinity and which VMs own that participation, then tags every VM in the namespace carrying a participating label (not just affinity-declaring VMs), re-converging on every reconcile rather than only at create.

This PR is part of a 4 part change
This PR includes:

  • New Tag CRD + controller (controllers/vspherepolicy/tag/) and feature spec

Other parts:

Which issue(s) is/are addressed by this PR? (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):

Fixes #

Are there any special notes for your reviewer:

Please add a release note if necessary:

NA

@github-actions github-actions Bot added the size/XXL Denotes a PR that changes 1000+ lines. label Aug 11, 2026
@aniket-deole
aniket-deole force-pushed the aniketd/tag-controller-changes branch from 73befc8 to f1b293a Compare August 14, 2026 07:18
@aniket-deole aniket-deole added the ai-review-requested Mark the PR as ready for the AI Review bot using a standard model label Aug 14, 2026
@aniket-deole
aniket-deole force-pushed the aniketd/tag-controller-changes branch 2 times, most recently from d3bf323 to 1bb601c Compare August 17, 2026 18:17
@aniket-deole
aniket-deole marked this pull request as ready for review August 17, 2026 21:50
@aniket-deole
aniket-deole requested review from a team and faisalabujabal as code owners August 17, 2026 21:50
@svc-vmop-bot

Copy link
Copy Markdown

📝 CL Summary:

This PR introduces a new namespace-scoped Tag CRD and a corresponding controller to manage vCenter Tag-based VM affinity and anti-affinity. It addresses a limitation where VMs were only tagged if they explicitly declared affinity at creation, which prevented label-only VMs from being targeted by other workloads' affinity rules. The new system tracks participating label pairs and ensures all VMs carrying those labels are tagged and re-converged during every reconcile. The feature is gated by the TaggingAPI flag and includes comprehensive validation webhooks and RBAC to restrict Tag resource management to privileged accounts.

Comment thread .sdd/INDEX.md Outdated
Comment thread .sdd/specs/006-tag-controller-for-affinity/model.md
Comment thread .sdd/specs/006-tag-controller-for-affinity/model.md
Comment thread .sdd/specs/006-tag-controller-for-affinity/spec.md

vCenter Tags are identified by name **and** category, and are unique across that combination. Every vCenter Tag backing this feature uses the **namespace name** as its Tag Category, derived from the `Tag`'s own namespace — the category is not a separate user-settable field.

Attributes:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium: The use of 'ownerReferences' for Tag ownership may hit Kubernetes object size limits (1.5MB) in namespaces with a very large number of VMs (thousands) referencing the same common label (e.g., 'env=prod'). Each reference consumes metadata space; consider a more scalable ownership tracking mechanism if high-density namespaces are a target use case.

Comment thread pkg/providers/vsphere/virtualmachine/vmtags_test.go
Comment thread webhooks/vspherepolicy/tag/validation/tag_validator.go
Comment thread webhooks/vspherepolicy/tag/validation/tag_validator.go Outdated
Comment thread webhooks/vspherepolicy/tag/validation/tag_validator_test.go
Comment thread webhooks/vspherepolicy/tag/webhooks.go Outdated
Comment thread .sdd/INDEX.md Outdated
Comment thread .sdd/specs/006-tag-controller-for-affinity/model.md
Comment thread .sdd/specs/006-tag-controller-for-affinity/model.md
Comment thread .sdd/specs/006-tag-controller-for-affinity/spec.md
Comment thread .sdd/specs/006-tag-controller-for-affinity/spec.md
Comment thread pkg/providers/vsphere/virtualmachine/vmtags_test.go
Comment thread webhooks/vspherepolicy/tag/validation/tag_validator.go
Comment thread webhooks/vspherepolicy/tag/validation/tag_validator.go Outdated
Comment thread webhooks/vspherepolicy/tag/validation/tag_validator_test.go
Comment thread webhooks/vspherepolicy/tag/webhooks.go Outdated
@svc-vmop-bot svc-vmop-bot added the ai-reviewed This PR has been reviewed by the AI review bot label Aug 17, 2026
@faisalabujabal faisalabujabal removed the ai-review-requested Mark the PR as ready for the AI Review bot using a standard model label Aug 17, 2026
@aniket-deole
aniket-deole force-pushed the aniketd/tag-controller-changes branch from 1bb601c to 8f85dd3 Compare August 18, 2026 05:24
@github-actions

Copy link
Copy Markdown

Code Coverage

Package Line Rate Health
github.com/vmware-tanzu/vm-operator/controllers/configtarget 74%
github.com/vmware-tanzu/vm-operator/controllers/contentlibrary/clustercontentlibraryitem 67%
github.com/vmware-tanzu/vm-operator/controllers/contentlibrary/contentlibraryitem 67%
github.com/vmware-tanzu/vm-operator/controllers/contentlibrary/utils 85%
github.com/vmware-tanzu/vm-operator/controllers/infra/capability/configmap 92%
github.com/vmware-tanzu/vm-operator/controllers/infra/capability/crd 100%
github.com/vmware-tanzu/vm-operator/controllers/infra/configmap 75%
github.com/vmware-tanzu/vm-operator/controllers/infra/node 77%
github.com/vmware-tanzu/vm-operator/controllers/infra/secret 76%
github.com/vmware-tanzu/vm-operator/controllers/infra/validatingwebhookconfiguration 87%
github.com/vmware-tanzu/vm-operator/controllers/infra/workloadnetworkconfig 86%
github.com/vmware-tanzu/vm-operator/controllers/infra/zone 80%
github.com/vmware-tanzu/vm-operator/controllers/storage/storageclass 93%
github.com/vmware-tanzu/vm-operator/controllers/storage/storagepolicy 96%
github.com/vmware-tanzu/vm-operator/controllers/storage/storagepolicyquota 91%
github.com/vmware-tanzu/vm-operator/controllers/storage/volumeattributesclass 93%
github.com/vmware-tanzu/vm-operator/controllers/util/encoding 73%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachine/storagepolicyusage 96%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachine/virtualmachine 65%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachine/volume 86%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachine/volumebatch 89%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachineclass 73%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachineconfigoptions 87%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinegroup 90%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinegrouppublishrequest 88%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachineimagecache 89%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinepublishrequest 84%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinereplicaset 68%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachineservice 90%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachineservice/providers 93%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinesetresourcepolicy 81%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinesnapshot 91%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinewebconsolerequest 72%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinewebconsolerequest/v1alpha1 72%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinewebconsolerequest/v1alpha1/conditions 88%
github.com/vmware-tanzu/vm-operator/controllers/virtualmachinewebconsolerequest/v1alpha1/patch 78%
github.com/vmware-tanzu/vm-operator/controllers/vspherepolicy/policyevaluation 85%
github.com/vmware-tanzu/vm-operator/controllers/vspherepolicy/tag 78%
github.com/vmware-tanzu/vm-operator/pkg/bitmask 100%
github.com/vmware-tanzu/vm-operator/pkg/builder 89%
github.com/vmware-tanzu/vm-operator/pkg/conditions 90%
github.com/vmware-tanzu/vm-operator/pkg/config 100%
github.com/vmware-tanzu/vm-operator/pkg/config/capabilities 97%
github.com/vmware-tanzu/vm-operator/pkg/config/env 100%
github.com/vmware-tanzu/vm-operator/pkg/context 37%
github.com/vmware-tanzu/vm-operator/pkg/context/generic 100%
github.com/vmware-tanzu/vm-operator/pkg/context/operation 100%
github.com/vmware-tanzu/vm-operator/pkg/crd 77%
github.com/vmware-tanzu/vm-operator/pkg/errors 74%
github.com/vmware-tanzu/vm-operator/pkg/exit 100%
github.com/vmware-tanzu/vm-operator/pkg/log 100%
github.com/vmware-tanzu/vm-operator/pkg/mem 100%
github.com/vmware-tanzu/vm-operator/pkg/patch 78%
github.com/vmware-tanzu/vm-operator/pkg/prober 89%
github.com/vmware-tanzu/vm-operator/pkg/prober/probe 90%
github.com/vmware-tanzu/vm-operator/pkg/prober/worker 77%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere 74%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/clustermodules 73%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/config 88%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/contentlibrary 75%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/credentials 100%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/network 83%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/placement 70%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/session 60%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/storage 44%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/upgrade/virtualmachine 96%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/upgrade/virtualmachine/backfill 96%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/vcenter 86%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/virtualmachine 85%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/virtualmachine/extraconfig 91%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/virtualmachine/networkextraconfig 75%
github.com/vmware-tanzu/vm-operator/pkg/providers/vsphere/vmlifecycle 79%
github.com/vmware-tanzu/vm-operator/pkg/record 84%
github.com/vmware-tanzu/vm-operator/pkg/topology 91%
github.com/vmware-tanzu/vm-operator/pkg/util 79%
github.com/vmware-tanzu/vm-operator/pkg/util/cloudinit 89%
github.com/vmware-tanzu/vm-operator/pkg/util/cloudinit/validate 91%
github.com/vmware-tanzu/vm-operator/pkg/util/image 100%
github.com/vmware-tanzu/vm-operator/pkg/util/kube 91%
github.com/vmware-tanzu/vm-operator/pkg/util/kube/cource 100%
github.com/vmware-tanzu/vm-operator/pkg/util/kube/internal 100%
github.com/vmware-tanzu/vm-operator/pkg/util/kube/networksettings 100%
github.com/vmware-tanzu/vm-operator/pkg/util/kube/proxyaddr 73%
github.com/vmware-tanzu/vm-operator/pkg/util/kube/spq 99%
github.com/vmware-tanzu/vm-operator/pkg/util/linuxprep 97%
github.com/vmware-tanzu/vm-operator/pkg/util/netplan 100%
github.com/vmware-tanzu/vm-operator/pkg/util/nil 100%
github.com/vmware-tanzu/vm-operator/pkg/util/ovfcache 75%
github.com/vmware-tanzu/vm-operator/pkg/util/ovfcache/internal 100%
github.com/vmware-tanzu/vm-operator/pkg/util/paused 100%
github.com/vmware-tanzu/vm-operator/pkg/util/ptr 100%
github.com/vmware-tanzu/vm-operator/pkg/util/resize 98%
github.com/vmware-tanzu/vm-operator/pkg/util/sysprep 98%
github.com/vmware-tanzu/vm-operator/pkg/util/vmopv1 88%
github.com/vmware-tanzu/vm-operator/pkg/util/volumes 100%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/client 66%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/datastore 100%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/fault 100%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/library 95%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/storage 82%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/task 100%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/vm 78%
github.com/vmware-tanzu/vm-operator/pkg/util/vsphere/watcher 85%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig 95%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/anno2extraconfig 100%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/bootoptions 88%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/cdrom 88%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/crypto 92%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/diskpromo 100%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/extraconfig 100%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/networkextraconfig 79%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/policy 97%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/virtualcontroller 93%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/volumes/unmanaged/backfill 98%
github.com/vmware-tanzu/vm-operator/pkg/vmconfig/volumes/unmanaged/register 92%
github.com/vmware-tanzu/vm-operator/pkg/webconsolevalidation 100%
github.com/vmware-tanzu/vm-operator/services/vm-watcher 85%
github.com/vmware-tanzu/vm-operator/webhooks/common 98%
github.com/vmware-tanzu/vm-operator/webhooks/configtarget/validation 87%
github.com/vmware-tanzu/vm-operator/webhooks/persistentvolumeclaim/validation 95%
github.com/vmware-tanzu/vm-operator/webhooks/unifiedstoragequota/validation 89%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachine/mutation 86%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachine/validation 96%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachineclass/mutation 62%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachineclass/validation 89%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachineconfigoptions/validation 88%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinegroup/mutation 87%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinegroup/validation 93%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinegrouppublishrequest/mutation 86%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinegrouppublishrequest/validation 88%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachineguestoptions/validation 88%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinepublishrequest/validation 90%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinereplicaset/validation 90%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachineservice/mutation 67%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachineservice/validation 92%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinesetresourcepolicy/validation 89%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinesnapshot/mutation 86%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinesnapshot/validation 91%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinewebconsolerequest/v1alpha1/validation 92%
github.com/vmware-tanzu/vm-operator/webhooks/virtualmachinewebconsolerequest/validation 92%
github.com/vmware-tanzu/vm-operator/webhooks/vspherepolicy/tag/validation 92%
Summary 84% (21799 / 25804)

Minimum allowed line rate is 79%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-reviewed This PR has been reviewed by the AI review bot size/XXL Denotes a PR that changes 1000+ lines.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants