Cloud Resource Optimizer

apiVersion: cost.example.com/v1
kind: CostPolicy
meta
  name: aws-cost-optimization
spec:
  region: ap-south-1
  scanSchedule: "0 */6 * * *"
  orphanedVolumes:
    enabled: true
    maxAgeDays: 7
  idleInstances:
    enabled: true
    cpuThreshold: 5.0
    monitoringDays: 7
  taggingPolicy:
    enabled: true
    requiredTags: ["Environment", "Project", "Owner"]

func (r *CostPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
    // 1. Fetch CostPolicy resource with proper error handling
    var costPolicy costv1.CostPolicy
    if err := r.Get(ctx, req.NamespacedName, &costPolicy); err != nil {
        return ctrl.Result{}, client.IgnoreNotFound(err)
    }

    // 2. Initialize AWS scanner with region configuration
    scanner, err := aws.NewScanner(costPolicy.Spec.Region)
    if err != nil {
        r.updateStatusWithError(ctx, &costPolicy, err)
        return ctrl.Result{RequeueAfter: 10 * time.Minute}, nil
    }

    // 3. Update status to indicate scanning in progress
    costPolicy.Status.Phase = "Scanning"
    _ = r.Status().Update(ctx, &costPolicy)

    // 4. Perform resource scanning with proper error handling
    results, err := r.scanResources(ctx, scanner, &costPolicy)
    if err != nil {
        r.updateStatusWithError(ctx, &costPolicy, err)
        return ctrl.Result{RequeueAfter: 5 * time.Minute}, nil
    }
    
    // 5. Update status with findings
    r.updateStatusWithResults(ctx, &costPolicy, results)
    
    return ctrl.Result{RequeueAfter: time.Hour * 6}, nil
}

func (s *Scanner) ScanOrphanedVolumes(ctx context.Context) ([]types.Volume, error) {
    input := &ec2.DescribeVolumesInput{
        Filters: []types.Filter{
            {
                Name:   aws.String("status"),  // Fixed: was "state"
                Values: []string{"available"},
            },
        },
    }

    result, err := s.ec2Client.DescribeVolumes(ctx, input)
    if err != nil {
        return nil, fmt.Errorf("failed to describe volumes: %w", err)
    }

    log.Info("Scan completed", "region", s.region, "volumes", len(result.Volumes))
    return result.Volumes, nil
}

func (s *Scanner) ScanIdleInstances(ctx context.Context) ([]types.Instance, error) {
    input := &ec2.DescribeInstancesInput{
        Filters: []types.Filter{
            {
                Name:   aws.String("instance-state-name"),
                Values: []string{"running"},
            },
        },
    }

    result, err := s.ec2Client.DescribeInstances(ctx, input)
    if err != nil {
        return nil, err
    }

    var instances []types.Instance
    for _, reservation := range result.Reservations {
        instances = append(instances, reservation.Instances...)
    }

    return instances, nil
}

func (s *Scanner) ScanUntaggedResources(ctx context.Context, requiredTags []string) (int, error) {
    instances, err := s.ScanIdleInstances(ctx)
    if err != nil {
        return 0, err
    }

    untagged := 0
    for _, instance := range instances {
        tagMap := make(map[string]string)
        for _, tag := range instance.Tags {
            if tag.Key != nil && tag.Value != nil {
                tagMap[*tag.Key] = *tag.Value
            }
        }

        for _, requiredTag := range requiredTags {
            if _, exists := tagMap[requiredTag]; !exists {
                untagged++
                break
            }
        }
    }

    return untagged, nil
}

kubectl apply -f costpolicy.yaml
           ↓
┌─────────────────────────┐
│   Kubernetes API        │
│                         │
│  costpolicy.yaml ────→  │
│  └─ region: ap-south-1  │
│  └─ orphaned: enabled   │
│  └─ tagging: required   │
└─────────────────────────┘
           ↓
┌─────────────────────────┐
│   Controller Manager    │
│                         │
│  • Reconcile() loop     │
│  • AWS Scanner init     │
│  • Status updates       │
│  • Error handling       │
└─────────────────────────┘
           ↓
┌─────────────────────────┐
│      AWS APIs           │
│                         │
│  ec2.DescribeVolumes()  │
│  ec2.DescribeInstances()│
│  └─ Results: 3,2,1      │
└─────────────────────────┘
           ↓
┌─────────────────────────┐
│   Kubernetes Status     │
│                         │
│  orphanedVolumes: 3     │
│  idleInstances: 2       │  
│  untaggedResources: 1   │
│  phase: "Ready"         │
└─────────────────────────┘
           ↓
     kubectl get costpolicy

status:
  orphanedVolumes: 3
  idleInstances: 2
  untaggedResources: 1
  phase: "Ready"
  message: "Scan completed successfully"
  lastScanTime: "2025-09-27T05:22:37Z"
  region: "ap-south-1"

# Verify CRD installation and status subresource
kubectl get crd costpolicies.cost.example.com -o yaml | grep -A 5 subresources

# Check controller permissions
kubectl auth can-i get costpolicies --as=system:serviceaccount:default:cost-operator-sa
kubectl auth can-i update costpolicies/status --as=system:serviceaccount:default:cost-operator-sa

# Real-time status monitoring
kubectl get costpolicy aws-cost-optimization -w -o yaml

# AWS connectivity validation
aws sts get-caller-identity
aws ec2 describe-volumes --region ap-south-1 --filters "Name=status,Values=available" --max-items 1

# Time synchronization (critical for AWS API signatures)
sudo ntpdate -s time.nist.gov
date && date -u

# Schema validation
kubectl explain costpolicy.spec.orphanedVolumes
kubectl explain costpolicy.status