feat: configurable platform-wide tags (SpringClean, cost allocation, compliance)

[allamand]

Problem

Currently, adding AWS resource tags to platform-managed resources requires:

1. kro RGDs: Declaring each tag key individually in SimpleSchema and propagating one by one to each resource template
2. CDK stack: Hardcoding tag values in the CDK code
3. No single source of truth — tags must be duplicated across layers

This is brittle and doesn't scale for customers who need:

• SpringClean protection (auto-delete: no)
• Cost allocation (cost-center, team, project)
• Compliance tags (data-classification, environment)

Proposed Solution

Layer 1: CDK (infrastructure resources)

A platformTags map in config.local.yaml (or cdk.json context) that gets applied to all CDK resources via Tags.of(stack).add():

# config.local.yaml
platformTags:
  auto-delete: "no"
  cost-center: "platform-engineering"
  managed-by: "peeks"

Layer 2: kro RGDs (Kubernetes-managed AWS resources)

A generic spec.awsTags field (map[string]string) in RGD schemas that gets merged/spread into the tags section of all AWS resources:

spec:
  awsTags:
    auto-delete: "no"
    cost-center: "1234"

Layer 3: Single source of truth

Ideally, config.local.yaml defines tags once, and they propagate to:

• CDK via Tags.of()
• kro RGDs via instance values (ArgoCD injects from config)
• Helm charts via global values (for pod labels)

Current PR

PR #753 (feat(kro): add protectFromDeletion parameter) is a partial workaround that hardcodes a single auto-delete tag. It will be closed in favor of this more generic approach.

Tasks

• Design: decide on config format and propagation mechanism
• Verify kro CEL map spread capability (pending kro team response or SSAG)
• Implement CDK tag propagation from config.local.yaml
• Implement kro RGD awsTags field (if CEL supports it) or per-tag schema (if not)
• Document: how customers add custom tags

References

• PR feat(kro): add protectFromDeletion parameter to EksCluster and Vpc RGDs #753 (to be closed): feat(kro): add protectFromDeletion parameter to EksCluster and Vpc RGDs #753

[allamand]

Scope expansion: Crossplane resources

The same tag propagation need applies to resources managed by Crossplane providers (e.g. provider-aws). When Crossplane creates AWS resources (RDS, S3, IAM, etc.), they also need platform-wide tags for cost allocation and compliance.

The solution should cover all AWS resource creation paths:

• CDK — infrastructure stack resources
• kro RGDs — resources composed via ACK controllers
• Crossplane — resources managed by Crossplane providers
• Helm charts — Kubernetes labels/annotations

Ideally, a single platformTags config feeds all three paths through the GitOps pipeline.

[allamand]

Implementation plan (workaround)

Tested on kro v0.9.2 — generic map[string]string in SimpleSchema is not supported (see kro #1314 for details).

Workaround: 5-6 common tags via CEL map literal

Will implement with individual schema fields assembled via CEL map literal:

spec:
  schema:
    spec:
      tagAutoDelete:
        type: string
      tagCostCenter:
        type: string
      tagTeam:
        type: string
      tagEnvironment:
        type: string
      tagProject:
        type: string
      tagManagedBy:
        type: string
  resources:
    - id: ekscluster
      template:
        spec:
          tags: '${{
            "auto-delete": schema.spec.tagAutoDelete,
            "cost-center": schema.spec.tagCostCenter,
            "team": schema.spec.tagTeam,
            "environment": schema.spec.tagEnvironment,
            "project": schema.spec.tagProject,
            "managed-by": schema.spec.tagManagedBy
          }}'

Limitations:

• Not truly dynamic — adding a new tag requires updating every RGD
• Capped at the declared fields (customers can't add arbitrary tags)
• Same pattern needed on VPC, NAT GW, and other AWS resources

Blocked on kro for the ideal solution — tracking in kubernetes-sigs/kro#1314.

PR incoming.