Initial changes for supporting HostResourceGroupArn parameter in AWSMachine.Spec

punkwalker · punkwalker · commit 64fc535bf2b1 · 2025-11-12T18:52:24.000Z
Signed-off-by: Pankaj Walke &lt;punkwalker@gmail.com&gt;
diff --git a/api/v1beta1/awscluster_conversion.go b/api/v1beta1/awscluster_conversion.go
@@ -65,6 +65,7 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
 		dst.Status.Bastion.MarketType = restored.Status.Bastion.MarketType
 		dst.Status.Bastion.HostAffinity = restored.Status.Bastion.HostAffinity
 		dst.Status.Bastion.HostID = restored.Status.Bastion.HostID
+		dst.Status.Bastion.HostResourceGroupArn = restored.Status.Bastion.HostResourceGroupArn
 		dst.Status.Bastion.CapacityReservationPreference = restored.Status.Bastion.CapacityReservationPreference
 		dst.Status.Bastion.CPUOptions = restored.Status.Bastion.CPUOptions
 		if restored.Status.Bastion.DynamicHostAllocation != nil {
diff --git a/api/v1beta1/awsmachine_conversion.go b/api/v1beta1/awsmachine_conversion.go
@@ -45,6 +45,7 @@ func (src *AWSMachine) ConvertTo(dstRaw conversion.Hub) error {
 	dst.Spec.CapacityReservationID = restored.Spec.CapacityReservationID
 	dst.Spec.MarketType = restored.Spec.MarketType
 	dst.Spec.HostID = restored.Spec.HostID
+	dst.Spec.HostResourceGroupArn = restored.Spec.HostResourceGroupArn
 	dst.Spec.HostAffinity = restored.Spec.HostAffinity
 	dst.Spec.CapacityReservationPreference = restored.Spec.CapacityReservationPreference
 	dst.Spec.NetworkInterfaceType = restored.Spec.NetworkInterfaceType
@@ -117,6 +118,7 @@ func (r *AWSMachineTemplate) ConvertTo(dstRaw conversion.Hub) error {
 	dst.Spec.Template.Spec.CapacityReservationID = restored.Spec.Template.Spec.CapacityReservationID
 	dst.Spec.Template.Spec.MarketType = restored.Spec.Template.Spec.MarketType
 	dst.Spec.Template.Spec.HostID = restored.Spec.Template.Spec.HostID
+	dst.Spec.Template.Spec.HostResourceGroupArn = restored.Spec.Template.Spec.HostResourceGroupArn
 	dst.Spec.Template.Spec.HostAffinity = restored.Spec.Template.Spec.HostAffinity
 	dst.Spec.Template.Spec.CapacityReservationPreference = restored.Spec.Template.Spec.CapacityReservationPreference
 	dst.Spec.Template.Spec.NetworkInterfaceType = restored.Spec.Template.Spec.NetworkInterfaceType
diff --git a/api/v1beta1/zz_generated.conversion.go b/api/v1beta1/zz_generated.conversion.go
diff --git a/api/v1beta2/awsmachine_types.go b/api/v1beta2/awsmachine_types.go
@@ -250,6 +250,14 @@ type AWSMachineSpec struct {
 	// +optional
 	HostID *string `json:"hostID,omitempty"`
 
+	// HostResourceGroupArn specifies the Dedicated Host Resource Group ARN on which the instance must be started.
+	// This field is mutually exclusive with DynamicHostAllocation and HostID.
+	// Note: The instance's AMI licenses must match the licenses associated with the host resource group.
+	// If the host resource group has no associated licenses, ensure the AMI also has no special licensing requirements.
+	// +kubebuilder:validation:Pattern=`^arn:aws[a-z\-]*:resource-groups:[a-z0-9\-]+:[0-9]{12}:group/[a-zA-Z0-9\-_]+$`
+	// +optional
+	HostResourceGroupArn *string `json:"hostResourceGroupArn,omitempty"`
+
 	// HostAffinity specifies the dedicated host affinity setting for the instance.
 	// When HostAffinity is set to host, an instance started onto a specific host always restarts on the same host if stopped.
 	// When HostAffinity is set to default, and you stop and restart the instance, it can be restarted on any available host.
diff --git a/api/v1beta2/awsmachine_webhook.go b/api/v1beta2/awsmachine_webhook.go
@@ -477,12 +477,24 @@ func (r *AWSMachine) validateAdditionalSecurityGroups() field.ErrorList {
 func (r *AWSMachine) validateHostAllocation() field.ErrorList {
 	var allErrs field.ErrorList
 
-	// Check if both hostID and dynamicHostAllocation are specified
+	// Check if multiple host allocation options are specified
 	hasHostID := r.Spec.HostID != nil && len(*r.Spec.HostID) > 0
+	hasHostResourceGroupArn := r.Spec.HostResourceGroupArn != nil && len(*r.Spec.HostResourceGroupArn) > 0
 	hasDynamicHostAllocation := r.Spec.DynamicHostAllocation != nil
 
-	if hasHostID && hasDynamicHostAllocation {
-		allErrs = append(allErrs, field.Forbidden(field.NewPath("spec.hostID"), "hostID and dynamicHostAllocation are mutually exclusive"), field.Forbidden(field.NewPath("spec.dynamicHostAllocation"), "hostID and dynamicHostAllocation are mutually exclusive"))
+	count := 0
+	if hasHostID {
+		count++
+	}
+	if hasHostResourceGroupArn {
+		count++
+	}
+	if hasDynamicHostAllocation {
+		count++
+	}
+
+	if count > 1 {
+		allErrs = append(allErrs, field.Forbidden(field.NewPath("spec"), "hostID, hostResourceGroupArn, and dynamicHostAllocation are mutually exclusive"))
 	}
 
 	return allErrs
diff --git a/api/v1beta2/awsmachine_webhook_test.go b/api/v1beta2/awsmachine_webhook_test.go
@@ -596,6 +596,58 @@ func TestAWSMachineCreate(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "hostResourceGroupArn alone is valid",
+			machine: &AWSMachine{
+				Spec: AWSMachineSpec{
+					InstanceType:         "test",
+					HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "hostID and hostResourceGroupArn are mutually exclusive",
+			machine: &AWSMachine{
+				Spec: AWSMachineSpec{
+					InstanceType:         "test",
+					HostID:               aws.String("h-1234567890abcdef0"),
+					HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "hostResourceGroupArn and dynamicHostAllocation are mutually exclusive",
+			machine: &AWSMachine{
+				Spec: AWSMachineSpec{
+					InstanceType:         "test",
+					HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+					DynamicHostAllocation: &DynamicHostAllocationSpec{
+						Tags: map[string]string{
+							"Environment": "test",
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "all three host allocation options are mutually exclusive",
+			machine: &AWSMachine{
+				Spec: AWSMachineSpec{
+					InstanceType:         "test",
+					HostID:               aws.String("h-1234567890abcdef0"),
+					HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+					DynamicHostAllocation: &DynamicHostAllocationSpec{
+						Tags: map[string]string{
+							"Environment": "test",
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/api/v1beta2/awsmachinetemplate_webhook.go b/api/v1beta2/awsmachinetemplate_webhook.go
@@ -177,12 +177,24 @@ func (r *AWSMachineTemplate) validateHostAllocation() field.ErrorList {
 
 	spec := r.Spec.Template.Spec
 
-	// Check if both hostID and dynamicHostAllocation are specified
+	// Check if multiple host allocation options are specified
 	hasHostID := spec.HostID != nil && len(*spec.HostID) > 0
+	hasHostResourceGroupArn := spec.HostResourceGroupArn != nil && len(*spec.HostResourceGroupArn) > 0
 	hasDynamicHostAllocation := spec.DynamicHostAllocation != nil
 
-	if hasHostID && hasDynamicHostAllocation {
-		allErrs = append(allErrs, field.Forbidden(field.NewPath("spec.template.spec.hostID"), "hostID and dynamicHostAllocation are mutually exclusive"), field.Forbidden(field.NewPath("spec.template.spec.dynamicHostAllocation"), "hostID and dynamicHostAllocation are mutually exclusive"))
+	count := 0
+	if hasHostID {
+		count++
+	}
+	if hasHostResourceGroupArn {
+		count++
+	}
+	if hasDynamicHostAllocation {
+		count++
+	}
+
+	if count > 1 {
+		allErrs = append(allErrs, field.Forbidden(field.NewPath("spec.template.spec"), "hostID, hostResourceGroupArn, and dynamicHostAllocation are mutually exclusive"))
 	}
 
 	return allErrs
diff --git a/api/v1beta2/awsmachinetemplate_webhook_test.go b/api/v1beta2/awsmachinetemplate_webhook_test.go
@@ -100,6 +100,57 @@ func TestAWSMachineTemplateValidateCreate(t *testing.T) {
 			},
 			wantError: true,
 		},
+		{
+			name: "hostResourceGroupArn alone is valid",
+			inputTemplate: &AWSMachineTemplate{
+				ObjectMeta: metav1.ObjectMeta{},
+				Spec: AWSMachineTemplateSpec{
+					Template: AWSMachineTemplateResource{
+						Spec: AWSMachineSpec{
+							InstanceType:         "test",
+							HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+						},
+					},
+				},
+			},
+			wantError: false,
+		},
+		{
+			name: "hostID and hostResourceGroupArn are mutually exclusive",
+			inputTemplate: &AWSMachineTemplate{
+				ObjectMeta: metav1.ObjectMeta{},
+				Spec: AWSMachineTemplateSpec{
+					Template: AWSMachineTemplateResource{
+						Spec: AWSMachineSpec{
+							InstanceType:         "test",
+							HostID:               aws.String("h-1234567890abcdef0"),
+							HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+						},
+					},
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "hostResourceGroupArn and dynamicHostAllocation are mutually exclusive",
+			inputTemplate: &AWSMachineTemplate{
+				ObjectMeta: metav1.ObjectMeta{},
+				Spec: AWSMachineTemplateSpec{
+					Template: AWSMachineTemplateResource{
+						Spec: AWSMachineSpec{
+							InstanceType:         "test",
+							HostResourceGroupArn: aws.String("arn:aws:resource-groups:us-west-2:123456789012:group/test-group"),
+							DynamicHostAllocation: &DynamicHostAllocationSpec{
+								Tags: map[string]string{
+									"Environment": "test",
+								},
+							},
+						},
+					},
+				},
+			},
+			wantError: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/api/v1beta2/types.go b/api/v1beta2/types.go
@@ -286,6 +286,11 @@ type Instance struct {
 	// +optional
 	HostID *string `json:"hostID,omitempty"`
 
+	// HostResourceGroupArn specifies the Dedicated Host Resource Group ARN on which the instance should be started.
+	// Note: The instance's AMI licenses must match the licenses associated with the host resource group.
+	// +optional
+	HostResourceGroupArn *string `json:"hostResourceGroupArn,omitempty"`
+
 	// DynamicHostAllocation enables automatic allocation of dedicated hosts.
 	// This field is mutually exclusive with HostID.
 	// +optional
diff --git a/api/v1beta2/zz_generated.deepcopy.go b/api/v1beta2/zz_generated.deepcopy.go
diff --git a/config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml b/config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml
@@ -1295,6 +1295,10 @@ spec:
                     description: HostID specifies the dedicated host on which the
                       instance should be started.
                     type: string
+                  hostResourceGroupArn:
+                    description: HostResourceGroupArn specifies the Dedicated Host
+                      Resource Group ARN on which the instance should be started.
+                    type: string
                   iamProfile:
                     description: The name of the IAM instance profile associated with
                       the instance, if applicable.
@@ -3583,6 +3587,10 @@ spec:
                     description: HostID specifies the dedicated host on which the
                       instance should be started.
                     type: string
+                  hostResourceGroupArn:
+                    description: HostResourceGroupArn specifies the Dedicated Host
+                      Resource Group ARN on which the instance should be started.
+                    type: string
                   iamProfile:
                     description: The name of the IAM instance profile associated with
                       the instance, if applicable.
diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml
@@ -2273,6 +2273,10 @@ spec:
                     description: HostID specifies the dedicated host on which the
                       instance should be started.
                     type: string
+                  hostResourceGroupArn:
+                    description: HostResourceGroupArn specifies the Dedicated Host
+                      Resource Group ARN on which the instance should be started.
+                    type: string
                   iamProfile:
                     description: The name of the IAM instance profile associated with
                       the instance, if applicable.
diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachines.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachines.yaml
@@ -777,6 +777,12 @@ spec:
                 maxLength: 19
                 pattern: ^h-[0-9a-f]{17}$
                 type: string
+              hostResourceGroupArn:
+                description: |-
+                  HostResourceGroupArn specifies the Dedicated Host Resource Group ARN on which the instance must be started.
+                  This field is mutually exclusive with DynamicHostAllocation and HostID.
+                pattern: ^arn:aws[a-z\-]*:resource-groups:[a-z0-9\-]+:[0-9]{12}:group/[a-zA-Z0-9\-_]+$
+                type: string
               iamInstanceProfile:
                 description: IAMInstanceProfile is a name of an IAM instance profile
                   to assign to the instance
diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachinetemplates.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachinetemplates.yaml
@@ -697,6 +697,12 @@ spec:
                         maxLength: 19
                         pattern: ^h-[0-9a-f]{17}$
                         type: string
+                      hostResourceGroupArn:
+                        description: |-
+                          HostResourceGroupArn specifies the Dedicated Host Resource Group ARN on which the instance must be started.
+                          This field is mutually exclusive with DynamicHostAllocation and HostID.
+                        pattern: ^arn:aws[a-z\-]*:resource-groups:[a-z0-9\-]+:[0-9]{12}:group/[a-zA-Z0-9\-_]+$
+                        type: string
                       iamInstanceProfile:
                         description: IAMInstanceProfile is a name of an IAM instance
                           profile to assign to the instance
diff --git a/pkg/cloud/services/ec2/instances.go b/pkg/cloud/services/ec2/instances.go
@@ -275,6 +275,7 @@ func (s *Service) CreateInstance(ctx context.Context, scope *scope.MachineScope,
 	} else {
 		// Use static host allocation if specified
 		input.HostID = scope.AWSMachine.Spec.HostID
+		input.HostResourceGroupArn = scope.AWSMachine.Spec.HostResourceGroupArn
 		input.HostAffinity = scope.AWSMachine.Spec.HostAffinity
 	}
 
@@ -729,10 +730,39 @@ func (s *Service) runInstance(role string, i *infrav1.Instance) (*infrav1.Instan
 			Affinity: i.HostAffinity,
 			HostId:   i.HostID,
 		}
+	} else if i.HostResourceGroupArn != nil {
+		if i.HostAffinity == nil {
+			i.HostAffinity = aws.String(string(types.AffinityHost))
+		}
+		if len(i.Tenancy) == 0 {
+			i.Tenancy = string(types.TenancyHost)
+		}
+		s.scope.Debug("Running instance with host resource group placement",
+			"hostResourceGroupArn", i.HostResourceGroupArn,
+			"affinity", i.HostAffinity)
+		if input.Placement != nil {
+			s.scope.Warn("Placement already set for instance, overwriting with host resource group placement",
+				"hostResourceGroupArn", i.HostResourceGroupArn,
+				"affinity", i.HostAffinity,
+				"placement", input.Placement)
+		}
+
+		input.Placement = &types.Placement{
+			Tenancy:              types.Tenancy(i.Tenancy),
+			Affinity:             i.HostAffinity,
+			HostResourceGroupArn: i.HostResourceGroupArn,
+		}
+		// input.LicenseSpecifications = &types.LicenseConfiguration{
+		// 	LicenseConfigurationArn: ,
+		// }
 	}
 
 	out, err := s.EC2Client.RunInstances(context.TODO(), input)
 	if err != nil {
+		// Provide more helpful error message for host resource group licensing issues
+		if strings.Contains(err.Error(), "host resource group") && strings.Contains(err.Error(), "licenses") {
+			return nil, errors.Wrap(err, "failed to run instance: AMI licenses must match the licenses associated with the host resource group. Ensure the AMI and host resource group have compatible licensing")
+		}
 		return nil, errors.Wrap(err, "failed to run instance")
 	}
 
