Filter gke-clusters by labels

[dbarranco]

Hello folks!

I am working on adding support for the "delete" operation for the gcp.gke-cluster resource and before starting coding the delete function I did some tests to filter GKE clusters in one of my Google Cloud Projects.

All of the clusters I'm interested in contain the following Google Cloud labels:

But when I try to filter some of them by adding policies like:

policies:
- name: bkpr-delete-gke-clusters
  resource: gcp.gke-cluster
  comment: |
    Clean-up temporary R53 hosted zones created by Jenkins-BKPR
    for its continuous integration tests
  filters:
    - 'tag:created_by': 'jenkins-bkpr'

I see that none of them got filtered.
I also have tried with some variations, like:

  filters:
    - type: value
      key: Name
      op: eq
      value: "<. . .>"

or

  filters:
    - type: value
      label: 'created_by'
      op: eq
      value: 'jenkins-bkpr'

But still, it doesn't work.
Am I missing something here?

Thanks in advance.

[dbarranco]

cc/ @kapilt

[rockhowse]

@dbarranco I ran into this today while attempting to do something similar

sample policy file:

vars:
    sample-tag-filters: &sample-tag-filters
          - "tag:env": present

  policies:
  - name: gke-cluster-sample
    resource: gcp.gke-cluster
    filters:
      - and: *sample-tag-filters

As expected, the list of clusters was empty, even with the env label set on the cluster.

If you examine the raw data output from the cloud-custodian run, the actual key in the gke-cluster JSON isn't one of the normal ones tags, Tags or labels, it's a new and exciting key named resourceLabels

[
  {
    "name": "cluster-name",
    ...
    "resourceLabels": {
      "env": "test",
    },
    ...
  }
]

And if we examine the code that is currently being used to filter on the tag like varients, that key isn't currently being considered:

https://github.com/cloud-custodian/cloud-custodian/blob/master/c7n/filters/core.py#L230-L257

Although it looks like there might be a capacity to use a more advanced or different filter to accomplish the filtering. I am relatively new to cloud-custodian so I can't provide the exact override but I am going to try a couple things and report back.

I will also take a stab at putting up a PR to add resourceLabels to the list of expected normalized keys so that the expected use of tags:filter-value will work in a similar fashion to how the existing GCP + labels is done.

[rockhowse]

Ok, looks like you can work around this by using Generic Filters:

There's not a deep link to the section but here it is:

For my use case, I was able to successfully update the policy file:

vars:
  sample-tag-filters: &sample-tag-filters
    - resourceLabels.env: present

  policies:
  - name: gke-cluster-sample
    resource: gcp.gke-cluster
    filters:
      - and: *sample-tag-filters

Note that I changed it from a string, to a non-string value. This format takes advantage of the JSMEPath format as shown in the Generic Filters docs.

[thisisshi]

Thanks for the details @rockhowse I've opened a PR to address that: #7534

[dbarranco]

awesome, thanks @thisisshi and thanks @rockhowse for the detailed answer!!

[ajkerrigan]

Just came across this today while looking for open GKE labeling issues/discussions. FWIW the value filter docs do have a special values section now that will hopefully make this sort of thing easier to find in the future. Doc updates/improvements always welcome of course!