fix: unify labels and tags via resource_labels by davidbolet · Pull Request #327 · openkcm/cmk

davidbolet · 2026-07-13T19:50:38Z

Summary

Introduce unified resource_labels model/table for labels and key-configuration tags.
Migrate existing key labels and tags into resource_labels with new tenant migrations.
Update managers, authz repo resource types/policies, and affected tests to use the new storage.

Test plan

go test ./... (integration tests may require local container/runtime setup)

Copilot

Pull request overview

This PR introduces a unified resource_labels storage model to consolidate key labels and key-configuration tags into a single table, updates managers/wiring/authz to use it, and refactors tests accordingly.

Changes:

Add resource_labels table + ResourceLabel model and ResourceLabelManager, and adapt existing Label/Tag managers to delegate to it.
Add tenant migrations intended to move existing key labels and tags into resource_labels.
Update authz resource types/policies and a broad set of unit/integration tests to use the new storage paths.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/integration/tenant-manager/provisioning_test.go	Wires TagManager through ResourceLabelManager in integration suite setup.
migrations/tenant/schema/00016_add_resource_labels_table.sql	Adds `resource_labels` table and indexes/uniqueness constraints.
migrations/tenant/schema/00017_migrate_labels_and_tags_data.sql	Migrates existing label/tag data into `resource_labels`.
internal/repo/query.go	Adds query fields needed for resource-label filtering (`resource_type`, `value`).
internal/operator/operator_test.go	Updates operator test wiring to use ResourceLabelManager-backed TagManager.
internal/model/resource_label.go	Introduces `ResourceLabel` model, resource type constants, and `system.tag` key constant.
internal/manager/resource_label.go	Implements unified label/tag CRUD via `ResourceLabelManager`.
internal/manager/resource_label_test.go	Adds unit tests for ResourceLabelManager label/tag behavior.
internal/manager/tag.go	Refactors TagManager into an adapter over ResourceLabelManager.
internal/manager/tag_test.go	Updates tag manager tests to assert against `resource_labels` storage.
internal/manager/key_label.go	Refactors LabelManager into an adapter over ResourceLabelManager.
internal/manager/key_label_test.go	Updates label manager tests to assert against `resource_labels`.
internal/manager/base.go	Updates main manager composition to construct and share ResourceLabelManager.
internal/manager/workflow_test.go	Updates workflow test wiring for new TagManager construction.
internal/manager/tenant_test.go	Updates tenant test wiring for new TagManager construction.
internal/manager/system_test.go	Updates system test wiring for new TagManager construction.
internal/manager/keyversion_test.go	Updates keyversion test wiring for new TagManager construction.
internal/manager/keyconfiguration_test.go	Updates key configuration tests to create/count tags via `resource_labels`.
internal/manager/key_test.go	Updates key tests to use ResourceLabelManager-backed TagManager.
internal/manager/errors.go	Adds/adjusts error sentinels used by the updated managers.
internal/controllers/cmk/keyconfiguration_tags_controller_test.go	Updates controller tests to create/verify tags via `resource_labels`.
internal/controllers/cmk/key_labels_controller_test.go	Updates controller tests to create/verify labels via `resource_labels`.
internal/constants/table-names.go	Adds `resource_labels` table name constant.
internal/authz/policies.go	Adds authz repo resource type for `resource_labels`.
internal/authz/repo_business_policies.go	Grants appropriate actions on `resource_labels` for business roles.
internal/authz/policy_tests/workflow_autoassign_test.go	Updates authz policy test wiring for TagManager changes.
internal/authz/policy_tests/keystore_pool_test.go	Updates authz policy test wiring for TagManager changes.
internal/authz/policy_tests/hyok_sync_test.go	Updates authz policy test wiring for TagManager changes.
internal/async/tasks/tenant/workflow_expiry_test.go	Updates async task test wiring for TagManager changes.
cmd/tenant-manager/main.go	Updates tenant-manager wiring for TagManager changes.
cmd/tenant-manager/main_test.go	Avoids fixed port collision by using an ephemeral listener for status address.
cmd/tenant-manager-cli/commands/commands.go	Updates CLI wiring for TagManager changes.
cmd/tenant-manager-cli/cli_test.go	Updates CLI test wiring for TagManager changes.
cmd/task-worker/main.go	Updates task worker wiring for TagManager changes.
charts/cmk/values-dev.yaml	Updates dev chart values (feature gates/http swagger/plugins block).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+-- Migrate existing key_configuration_tags to resource_labels
+-- Maps: key_configuration_tags + keyconfigurations_tags -> resource_labels
+-- with resource_type='KEY_CONFIG' and key='system.tag'
+DO $$
+BEGIN
+    -- These legacy tables may not exist on fresh installs (they are dropped in migration 00002).
+    IF to_regclass('public.keyconfigurations_tags') IS NOT NULL
+       AND to_regclass('public.key_configuration_tags') IS NOT NULL THEN
+        INSERT INTO resource_labels (id, resource_type, resource_id, key, value, created_at, updated_at)
+        SELECT
+            gen_random_uuid() AS id,  -- Generate new UUIDs for tag entries
+            'KEY_CONFIG' AS resource_type,
+            kt.key_configuration_id AS resource_id,
+            'system.tag' AS key,
+            t.value AS value,
+            CURRENT_TIMESTAMP AS created_at,
+            CURRENT_TIMESTAMP AS updated_at
+        FROM keyconfigurations_tags kt
+        JOIN key_configuration_tags t ON kt.key_configuration_tag_id = t.id
+        ON CONFLICT (resource_type, resource_id, key, value) DO NOTHING;
+    END IF;
+END $$;


+-- Enable combined filtering and enforce uniqueness per resource
+-- Prevents duplicate (resource_type, resource_id, key, value) combinations
+CREATE UNIQUE INDEX idx_resource_labels_unique
+    ON resource_labels(resource_type, resource_id, key, value);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP INDEX IF EXISTS idx_resource_labels_unique;
+DROP INDEX IF EXISTS idx_resource_labels_key;
+DROP INDEX IF EXISTS idx_resource_labels_resource_type_id;
+DROP TABLE IF EXISTS resource_labels;
+-- +goose StatementEnd


+	return m.r.Transaction(ctx, func(ctx context.Context) error {
+		for _, label := range labels {
+			// Ensure the label has correct resource type and ID
+			label.ResourceType = resourceType
+			label.ResourceID = resourceID
+


+	labels, count, err := repo.ListAndCount(ctx, m.r, pagination, model.ResourceLabel{}, query)
+	if err != nil {
+		return nil, 0, errs.Wrap(ErrQueryLabelList, err)
+	}


+		require.NoError(t, err)
+	})
+
+	t.Run("Should rollback on error in transaction", func(t *testing.T) {


Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 4 comments.

+-- Migrate existing key_configuration_tags to resource_labels
+-- Maps: key_configuration_tags + keyconfigurations_tags -> resource_labels
+-- with resource_type='KEY_CONFIG' and key='system.tag'
+DO $$
+BEGIN
+    -- These legacy tables may not exist on fresh installs (they are dropped in migration 00002).
+    IF to_regclass('public.keyconfigurations_tags') IS NOT NULL
+       AND to_regclass('public.key_configuration_tags') IS NOT NULL THEN
+        INSERT INTO resource_labels (id, resource_type, resource_id, key, value, created_at, updated_at)
+        SELECT
+            gen_random_uuid() AS id,  -- Generate new UUIDs for tag entries
+            'KEY_CONFIG' AS resource_type,
+            kt.key_configuration_id AS resource_id,
+            'system.tag' AS key,
+            t.value AS value,
+            CURRENT_TIMESTAMP AS created_at,
+            CURRENT_TIMESTAMP AS updated_at
+        FROM keyconfigurations_tags kt
+        JOIN key_configuration_tags t ON kt.key_configuration_tag_id = t.id
+        ON CONFLICT (resource_type, resource_id, key, value) DO NOTHING;
+    END IF;
+END $$;


+		// Create new tags
+		for _, tag := range tags {
+			if tag == "" {
+				continue // Skip empty tags
+			}
+
+			label := &model.ResourceLabel{
+				ID:           uuid.New(),
+				ResourceType: resourceType,
+				ResourceID:   resourceID,
+				Key:          model.SystemTagKey,
+				Value:        tag,
+			}
+
+			err = m.r.Create(ctx, label)
+			if err != nil {
+				return errs.Wrap(ErrCreateTag, err)
+			}
+		}


+		for _, label := range labels {
+			// Ensure the label has correct resource type and ID
+			label.ResourceType = resourceType
+			label.ResourceID = resourceID
+


+// Helper to marshal tags to JSON (for backwards compatibility if needed)
+func marshalTags(tags []string) (json.RawMessage, error) {


- Introduce unified resource_labels model/table (resource_type, resource_id, key, value) - Treat tags as labels with key=system.tag for KEY_CONFIG - Add tenant schema + data migrations (without dropping legacy tables) - Ensure cleanup on resource deletion via managers Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: David <davidbolet@gmail.com>

Signed-off-by: David <davidbolet@gmail.com>

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 3 comments.

+    IF to_regclass('public.keyconfigurations_tags') IS NOT NULL
+       AND to_regclass('public.key_configuration_tags') IS NOT NULL THEN


+	// Build composite key to filter by resource type and resource ID
+	ck := repo.NewCompositeKey().
+		Where(repo.ResourceTypeField, resourceType).
+		Where(repo.ResourceIDField, resourceID).
+		Where(repo.KeyField, model.SystemTagKey, repo.NotEq)
+


+		// Create new tags
+		for _, tag := range tags {
+			if tag == "" {
+				continue // Skip empty tags
+			}
+
+			label := &model.ResourceLabel{
+				ID:           uuid.New(),
+				ResourceType: resourceType,
+				ResourceID:   resourceID,
+				Key:          model.SystemTagKey,
+				Value:        tag,
+			}
+
+			err = m.r.Create(ctx, label)
+			if err != nil {
+				return errs.Wrap(ErrCreateTag, err)
+			}
+		}


Signed-off-by: David <davidbolet@gmail.com>

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 3 comments.

+-- Migrate existing key_configuration_tags to resource_labels
+-- Maps: key_configuration_tags + keyconfigurations_tags -> resource_labels
+-- with resource_type='KEY_CONFIG' and key='system.tag'
+DO $$
+BEGIN
+    -- These legacy tables may not exist on fresh installs (they are dropped in migration 00002).
+    IF to_regclass('public.keyconfigurations_tags') IS NOT NULL
+       AND to_regclass('public.key_configuration_tags') IS NOT NULL THEN
+        INSERT INTO resource_labels (id, resource_type, resource_id, key, value, created_at, updated_at)
+        SELECT
+            gen_random_uuid() AS id,  -- Generate new UUIDs for tag entries
+            'KEY_CONFIG' AS resource_type,
+            kt.key_configuration_id AS resource_id,
+            'system.tag' AS key,
+            t.value AS value,
+            CURRENT_TIMESTAMP AS created_at,
+            CURRENT_TIMESTAMP AS updated_at
+        FROM keyconfigurations_tags kt
+        JOIN key_configuration_tags t ON kt.key_configuration_tag_id = t.id
+        ON CONFLICT (resource_type, resource_id, key, value) DO NOTHING;
+    END IF;
+END $$;


+		// Create new tags
+		for _, tag := range tags {
+			if tag == "" {
+				continue // Skip empty tags
+			}
+
+			label := &model.ResourceLabel{
+				ID:           uuid.New(),
+				ResourceType: resourceType,
+				ResourceID:   resourceID,
+				Key:          model.SystemTagKey,
+				Value:        tag,
+			}
+
+			err = m.r.Create(ctx, label)
+			if err != nil {
+				return errs.Wrap(ErrCreateTag, err)
+			}
+		}


+	return m.r.Transaction(ctx, func(ctx context.Context) error {
+		for _, label := range labels {
+			// Ensure the label has correct resource type and ID
+			label.ResourceType = resourceType
+			label.ResourceID = resourceID
+
+			if err := m.upsertLabel(ctx, label); err != nil {
+				return err
+			}
+		}
+		return nil
+	})


Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 5 comments.

+		// Create new tags
+		for _, tag := range tags {
+			if tag == "" {
+				continue // Skip empty tags
+			}
+
+			label := &model.ResourceLabel{
+				ID:           uuid.New(),
+				ResourceType: resourceType,
+				ResourceID:   resourceID,
+				Key:          model.SystemTagKey,
+				Value:        tag,
+			}
+
+			err = m.r.Create(ctx, label)
+			if err != nil {
+				return errs.Wrap(ErrCreateTag, err)
+			}
+		}


+-- Enable combined filtering and enforce uniqueness per resource
+-- Prevents duplicate (resource_type, resource_id, key, value) combinations
+CREATE UNIQUE INDEX idx_resource_labels_unique
+    ON resource_labels(resource_type, resource_id, key, value);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP INDEX IF EXISTS idx_resource_labels_unique;
+DROP INDEX IF EXISTS idx_resource_labels_key;
+DROP INDEX IF EXISTS idx_resource_labels_resource_type_id;
+DROP TABLE IF EXISTS resource_labels;
+-- +goose StatementEnd


+-- Migrate existing key_configuration_tags to resource_labels
+-- Maps: key_configuration_tags + keyconfigurations_tags -> resource_labels
+-- with resource_type='KEY_CONFIG' and key='system.tag'
+DO $$
+BEGIN
+    -- These legacy tables may not exist on fresh installs (they are dropped in migration 00002).
+    IF to_regclass('public.keyconfigurations_tags') IS NOT NULL
+       AND to_regclass('public.key_configuration_tags') IS NOT NULL THEN
+        INSERT INTO resource_labels (id, resource_type, resource_id, key, value, created_at, updated_at)
+        SELECT
+            gen_random_uuid() AS id,  -- Generate new UUIDs for tag entries
+            'KEY_CONFIG' AS resource_type,
+            kt.key_configuration_id AS resource_id,
+            'system.tag' AS key,
+            t.value AS value,
+            CURRENT_TIMESTAMP AS created_at,
+            CURRENT_TIMESTAMP AS updated_at
+        FROM keyconfigurations_tags kt
+        JOIN key_configuration_tags t ON kt.key_configuration_tag_id = t.id
+        ON CONFLICT (resource_type, resource_id, key, value) DO NOTHING;
+    END IF;
+END $$;


+DELETE FROM resource_labels
+WHERE resource_type = 'KEY_CONFIG'
+AND key = 'system.tag';


+		require.NoError(t, err)
+	})
+
+	t.Run("Should rollback on error in transaction", func(t *testing.T) {


Copilot AI review requested due to automatic review settings July 13, 2026 19:50

push-tags-from-workflow Bot added tests helm-chart labels Jul 13, 2026

Copilot started reviewing on behalf of davidbolet July 13, 2026 19:51 View session

davidbolet force-pushed the task/resource-labels-pr branch from 83c3eff to 7f96c84 Compare July 13, 2026 19:56

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 19:58

Copilot started reviewing on behalf of davidbolet July 13, 2026 19:58 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

davidbolet force-pushed the task/resource-labels-pr branch from 7f96c84 to 2a156d8 Compare July 15, 2026 10:44

solved error checks

4de3bb8

Signed-off-by: David <davidbolet@gmail.com>

Copilot AI review requested due to automatic review settings July 17, 2026 10:24

Copilot started reviewing on behalf of davidbolet July 17, 2026 10:24 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

linter errors

f9aecf6

Signed-off-by: David <davidbolet@gmail.com>

Copilot AI review requested due to automatic review settings July 17, 2026 11:04

Copilot started reviewing on behalf of davidbolet July 17, 2026 11:04 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Merge branch 'main' into task/resource-labels-pr

3ed880e

Copilot AI review requested due to automatic review settings July 17, 2026 11:24

Copilot started reviewing on behalf of davidbolet July 17, 2026 11:25 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

openkcm deleted a comment from coderabbitai Bot Jul 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: unify labels and tags via resource_labels#327

fix: unify labels and tags via resource_labels#327
davidbolet wants to merge 4 commits into
mainfrom
task/resource-labels-pr

davidbolet commented Jul 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		// Helper to marshal tags to JSON (for backwards compatibility if needed)
		func marshalTags(tags []string) (json.RawMessage, error) {

		IF to_regclass('public.keyconfigurations_tags') IS NOT NULL
		AND to_regclass('public.key_configuration_tags') IS NOT NULL THEN

Uh oh!

Conversation

davidbolet commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

davidbolet commented Jul 13, 2026 •

edited

Loading