Add remaining VPCLattice resources and related examples by mirrajabi · Pull Request #1874 · crossplane-contrib/provider-upjet-aws

mirrajabi · 2025-10-01T15:32:28Z

Description of your changes

This PR adds the missing VPC Lattice resources and examples for each.

I have:

Read and followed Crossplane's contribution process.
Run make generate and committed the results (ideally in a separate commit).
Not made any manual changes to generated files, and verified this with make check-diff.

How has this code been tested

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi · 2025-10-01T15:37:56Z

Dear maintainers,

@turkenf
@mbbush
@jastang
@sergenyalcin

Could you review and trigger the tests for these resources, please?

aws_vpclattice_service_network_resource_association
aws_vpclattice_access_log_subscription
aws_vpclattice_auth_policy
aws_vpclattice_listener_rule
aws_vpclattice_resource_policy
aws_vpclattice_service_network_service_association
aws_vpclattice_service_network_vpc_association
aws_vpclattice_target_group_attachment

jeanduplessis · 2025-10-01T19:50:52Z

/test-examples="examples/vpclattice/cluster/v1beta1/accesslogsubscription.yaml"

jeanduplessis · 2025-10-01T19:51:13Z

/test-examples="examples/vpclattice/cluster/v1beta1/authpolicy.yaml"

jeanduplessis · 2025-10-01T19:51:20Z

/test-examples="examples/vpclattice/cluster/v1beta1/listenerrule.yaml"

jeanduplessis · 2025-10-01T19:51:25Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

jeanduplessis · 2025-10-01T19:51:32Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkresourceassociation.yaml"

jeanduplessis · 2025-10-01T19:51:36Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkserviceassociation.yaml"

jeanduplessis · 2025-10-01T19:51:41Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkvpcassociation.yaml"

jeanduplessis · 2025-10-01T19:51:44Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

jeanduplessis · 2025-10-06T13:21:54Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

jeanduplessis · 2025-10-06T13:22:02Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkvpcassociation.yaml"

jeanduplessis · 2025-10-06T13:22:11Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkserviceassociation.yaml"

jeanduplessis · 2025-10-06T13:22:16Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkresourceassociation.yaml"

jeanduplessis · 2025-10-06T13:22:27Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

jeanduplessis · 2025-10-06T13:22:34Z

/test-examples="examples/vpclattice/cluster/v1beta1/listenerrule.yaml"

jeanduplessis · 2025-10-06T13:22:39Z

/test-examples="examples/vpclattice/cluster/v1beta1/authpolicy.yaml"

jeanduplessis · 2025-10-06T13:22:45Z

/test-examples="examples/vpclattice/cluster/v1beta1/accesslogsubscription.yaml"

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi · 2025-10-06T15:20:57Z

@jeanduplessis Thanks for triggering the tests, I've tried a few blind fixes which I couldn't easily test locally myself. Could you please re-trigger them?

On some issues I have no idea tbh! Below aren't fixed yet. Any clues?

Are the runs completely isolated or is it possible that duplicate resources in two tests conflict and race against each other?

turkenf · 2025-10-08T19:03:54Z

/test-examples="examples/vpclattice/cluster/v1beta1/accesslogsubscription.yaml"

turkenf · 2025-10-08T19:04:08Z

/test-examples="examples/vpclattice/cluster/v1beta1/authpolicy.yaml"

turkenf · 2025-10-08T19:04:19Z

/test-examples="examples/vpclattice/cluster/v1beta1/listenerrule.yaml"

turkenf · 2025-10-08T19:04:35Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkresourceassociation.yaml"

turkenf · 2025-10-13T12:33:35Z

/test-examples="examples/vpclattice/cluster/v1beta1/listenerrule.yaml"

turkenf · 2025-10-13T12:33:42Z

/test-examples="examples/vpclattice/cluster/v1beta1/servicenetworkresourceassociation.yaml"

turkenf · 2025-10-13T12:33:48Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

turkenf · 2025-10-13T12:33:52Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi · 2025-10-13T13:32:22Z

@turkenf Could you retrigger for the following, please?

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"
/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"
/test-examples="examples/vpclattice/cluster/v1beta1/listenerrule.yaml"

Hopefully, this would be the last fix. Unfortunately, I haven't yet set up local testing yet which means I solely rely on CI test for now. I'll set that up before I start with next PRs.

jeanduplessis · 2025-10-19T14:22:33Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

jeanduplessis · 2025-10-19T14:22:39Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

jeanduplessis · 2025-10-19T14:22:44Z

/test-examples="examples/vpclattice/cluster/v1beta1/listenerrule.yaml"

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi · 2025-10-19T16:26:38Z

@jeanduplessis @turkenf I believe 847b8c9 should fix the aws_vpclattice_resource_policy (could you retry that one, please?)

This leaves only the broken target-group-attachement failure which is beyond any reasoning. Could you have a look at this one, please? https://github.com/crossplane-contrib/provider-upjet-aws/actions/runs/18631722158/job/53117376685

I'm hitting a deadline so I might have to just ditch the TargetGroupAttachment in this PR if it's not easily fixable.

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

turkenf · 2025-10-20T09:01:33Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

turkenf · 2025-10-20T09:01:39Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

mirrajabi · 2025-10-20T09:23:59Z

@turkenf I think the pipelines are failing now due to AWS outage in us-east-1 region. https://health.aws.amazon.com/health/status 🤦

turkenf · 2025-10-20T10:22:19Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

turkenf · 2025-10-20T10:22:46Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

turkenf · 2025-10-21T19:56:01Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

…rkReadWrite Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

sergenyalcin · 2025-10-22T12:01:25Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

sergenyalcin · 2025-10-22T17:27:49Z

Hi @mirrajabi I just reviewed the PR and saw the failing tests for two resources. In locally, I have figured out the problems in the example manifests and one reference generation in the TargetGroupAttachment resource. Let me share my findings:

The successful example manifests for the ResourcePolicy is here. I changed the policy field:

Cluster-Scoped:

# SPDX-FileCopyrightText: 2025 The Crossplane Authors <https://crossplane.io>
#
# SPDX-License-Identifier: CC0-1.0

apiVersion: vpclattice.aws.upbound.io/v1beta1
kind: ResourcePolicy
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/resourcepolicy
  labels:
    testing.upbound.io/example-name: example
  name: example
spec:
  forProvider:
    policy: |
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal":{
              "AWS":"arn:aws:iam::153891904029:root"
            },
            "Action": [
              "vpc-lattice:GetServiceNetwork",
              "vpc-lattice:CreateServiceNetworkResourceAssociation",
              "vpc-lattice:CreateServiceNetworkServiceAssociation",
              "vpc-lattice:CreateServiceNetworkVpcAssociation",
              "vpc-lattice:CreateServiceNetworkVpcEndpointAssociation"
            ]
          }
        ]
      }
    region: us-west-1
    resourceArnSelector:
      matchLabels:
        testing.upbound.io/example-name: example

---

apiVersion: vpclattice.aws.upbound.io/v1beta1
kind: ServiceNetwork
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/resourcepolicy
  labels:
    testing.upbound.io/example-name: example
  name: example
spec:
  forProvider:
    name: example-vpclattice-service-network
    region: us-west-1

Namespaced:

# SPDX-FileCopyrightText: 2025 The Crossplane Authors <https://crossplane.io>
#
# SPDX-License-Identifier: CC0-1.0

apiVersion: vpclattice.aws.m.upbound.io/v1beta1
kind: ResourcePolicy
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/resourcepolicy
  labels:
    testing.upbound.io/example-name: example
  name: example
  namespace: upbound-system
spec:
  forProvider:
    policy: |
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal":{
              "AWS":"arn:aws:iam::153891904029:root"
            },
            "Action": [
              "vpc-lattice:GetServiceNetwork",
              "vpc-lattice:CreateServiceNetworkResourceAssociation",
              "vpc-lattice:CreateServiceNetworkServiceAssociation",
              "vpc-lattice:CreateServiceNetworkVpcAssociation",
              "vpc-lattice:CreateServiceNetworkVpcEndpointAssociation"
            ]
          }
        ]
      }
    region: us-west-1
    resourceArnSelector:
      matchLabels:
        testing.upbound.io/example-name: example

---

apiVersion: vpclattice.aws.m.upbound.io/v1beta1
kind: ServiceNetwork
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/resourcepolicy
  labels:
    testing.upbound.io/example-name: example
  name: example
  namespace: upbound-system
spec:
  forProvider:
    name: example-vpclattice-service-network
    region: us-west-1

For TargetGroupAttachment resource, firstly I have a comment about the refernced field target.id. upjet has an automated tool to catch refernce fields from TF registry examples. In TF side some fields can refer more than one kind like LB, Instance etc. Here we have the same situation. This target.id field can refer to more than one different resources like LB, Instance, Lambda. However the example in the TF registry contains the LB one: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpclattice_target_group_attachment#basic-usage

In these type of situations, in upjet-based providers, we are removing the reference generation/field since not connecting this field to just a one resource. An example:

provider-upjet-aws/config/cluster/ram/config.go

Line 14 in b101ed7

delete(r.References, "resource_arn")

So here is the correct convention removing the reference from this target.id field and the users directly pass the id of the corresponded resource to target.id field without use of reference. The configuration statement must be like:

delete(r.References, "target.id")

Let's continue with running example manifest. Since the generated example also refers to this one. If I understand correctly, for TargetGroupAttachment, first we need a ALB typed TargetGroup (not INSTANCE typed) and also refer to application LB resource. The configuration seems a bit complex for the LB usage.

So, I tried to make an attachment to a Instance field in my local and it worked:

Cluster-Scoped:

# SPDX-FileCopyrightText: 2025 The Crossplane Authors <https://crossplane.io>
#
# SPDX-License-Identifier: CC0-1.0

apiVersion: vpclattice.aws.upbound.io/v1beta1
kind: TargetGroupAttachment
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/targetgroupattachment
  labels:
    testing.upbound.io/example-name: example
  name: example
spec:
  forProvider:
    region: us-west-1
    target:
      id: i-04a354440b0289895 # long-running instance
      port: 80
    targetGroupIdentifierSelector:
      matchLabels:
        testing.upbound.io/example-name: example
---
apiVersion: vpclattice.aws.upbound.io/v1beta1
kind: TargetGroup
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/targetgroupattachment
  labels:
    testing.upbound.io/example-name: example
  name: example
spec:
  forProvider:
    config:
      port: 443
      protocol: HTTPS
      vpcIdentifier: vpc-0a388e462a64e3e56 # default VPC
    name: example
    region: us-west-1
    type: INSTANCE

Namespaced:

# SPDX-FileCopyrightText: 2025 The Crossplane Authors <https://crossplane.io>
#
# SPDX-License-Identifier: CC0-1.0

apiVersion: vpclattice.aws.m.upbound.io/v1beta1
kind: TargetGroupAttachment
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/targetgroupattachment
  labels:
    testing.upbound.io/example-name: example
  name: example
  namespace: upbound-system
spec:
  forProvider:
    region: us-west-1
    target:
      id: i-04a354440b0289895 # long-running instance
      port: 80
    targetGroupIdentifierSelector:
      matchLabels:
        testing.upbound.io/example-name: example
---
apiVersion: vpclattice.aws.m.upbound.io/v1beta1
kind: TargetGroup
metadata:
  annotations:
    meta.upbound.io/example-id: vpclattice/v1beta1/targetgroupattachment
  labels:
    testing.upbound.io/example-name: example
  name: example
  namespace: upbound-system
spec:
  forProvider:
    config:
      port: 443
      protocol: HTTPS
      vpcIdentifier: vpc-0a388e462a64e3e56 # default VPC
    name: example
    region: us-west-1
    type: INSTANCE

If there is any unclear point, please ping me. Thanks in advance for considering them.

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi · 2025-10-23T06:55:43Z

Thanks a lot @sergenyalcin for the clear explanation! I've committed your suggestions.

sergenyalcin · 2025-10-23T07:16:10Z

/test-examples="examples/vpclattice/cluster/v1beta1/resourcepolicy.yaml"

sergenyalcin · 2025-10-23T07:16:40Z

/test-examples="examples/vpclattice/cluster/v1beta1/targetgroupattachment.yaml"

sergenyalcin

@mirrajabi, Thank you very much for your effort on this PR, LGTM!

Add remaining VPCLattice resources and related examples

0146a12

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi requested review from jastang, mbbush, sergenyalcin and turkenf as code owners October 1, 2025 15:32

mirrajabi mentioned this pull request Oct 1, 2025

Request for VPC Lattice resources #1825

Closed

chore: attempt to fix broken examples

ba77dab

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

chore: second attempt to fix broken examples

85319fa

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

chore: fourth attempt to fix broken examples

2e59eb1

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

chore: fix resourcepolicy

847b8c9

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi added 2 commits October 19, 2025 23:44

Merge branch 'crossplane-contrib:main' into main

2d66c51

chore: run make generate after merging upstream main branch

ef3a27d

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

chore: desperate attempt to fix ResourcePolicy

fd8f72f

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

mirrajabi added 2 commits October 22, 2025 00:53

chore: another attempt to fix resourcepolicy.yaml 🤦

2e14d71

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

chore: use resourcepolicy from AWSRAMPermissionVpcLatticeServiceNetwo…

731c0bf

…rkReadWrite Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

chore: apply suggestions on failing resources

cca9f5c

Signed-off-by: Mad Mirrajabi <mohammadmirrajabi@gmail.com>

sergenyalcin approved these changes Oct 23, 2025

View reviewed changes

sergenyalcin merged commit 12b307a into crossplane-contrib:main Oct 23, 2025
16 of 17 checks passed

Uh oh!

Conversation

mirrajabi commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of your changes

How has this code been tested

Uh oh!

mirrajabi commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 1, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

jeanduplessis commented Oct 6, 2025

Uh oh!

mirrajabi commented Oct 6, 2025

Uh oh!

turkenf commented Oct 8, 2025

Uh oh!

turkenf commented Oct 8, 2025

Uh oh!

turkenf commented Oct 8, 2025

Uh oh!

turkenf commented Oct 8, 2025

Uh oh!

turkenf commented Oct 13, 2025

Uh oh!

turkenf commented Oct 13, 2025

Uh oh!

turkenf commented Oct 13, 2025

Uh oh!

turkenf commented Oct 13, 2025

Uh oh!

mirrajabi commented Oct 13, 2025

Uh oh!

jeanduplessis commented Oct 19, 2025

Uh oh!

jeanduplessis commented Oct 19, 2025

Uh oh!

jeanduplessis commented Oct 19, 2025

Uh oh!

mirrajabi commented Oct 19, 2025

Uh oh!

turkenf commented Oct 20, 2025

Uh oh!

turkenf commented Oct 20, 2025

Uh oh!

mirrajabi commented Oct 20, 2025

Uh oh!

turkenf commented Oct 20, 2025

Uh oh!

turkenf commented Oct 20, 2025

Uh oh!

mirrajabi commented Oct 1, 2025 •

edited

Loading

mirrajabi commented Oct 1, 2025 •

edited

Loading