Add Harness and HarnessEndpoint resources

[rdoshi1]

Issue: aws-controllers-k8s/community#2900

Summary

Add generated ACK resources for the Bedrock AgentCore Harness and HarnessEndpoint APIs introduced in bedrock-agentcorecontrol SDK v1.47.0.

The resources support ACK-managed create, read, update, and delete; asynchronous readiness and terminal-state handling; tag reconciliation; Harness execution-role and HarnessEndpoint-to-Harness references; and status observation for ARN, IDs, versions, failure reasons, timestamps, and the managed AgentRuntime identity.

This PR is ready for review, but final regeneration and verify-code-gen depend on pkg #50 being merged, released, and consumed by code-generator.

Reviewer map

Review the small pkg PR first. For this PR, the principal handwritten files are:

• generator.yaml — resource selection, field mappings, references, lifecycle gates, and hook registration.
• templates/hooks/harness/** — observe the managed AgentRuntime and tags; synchronize tags; construct the SDK's optional-value wrappers for Harness updates.
• templates/hooks/harnessendpoint/** — observe and synchronize tags.
• pkg/resource/harness/hooks.go and pkg/resource/harness_endpoint/hooks.go — helpers called by those templates.
• pkg/resource/harness/hooks_test.go and pkg/resource/harness_endpoint/hooks_test.go — focused unit coverage for handwritten helpers.
• test/e2e/resources/harness*.yaml and test/e2e/tests/test_harness*.py — ACK create/read/update/delete, status, references, tags, and terminal-error coverage.

The API types, reconcilers, reference resolvers, CRDs, RBAC, Helm output, and registration changes are generated output. They should be verified by regeneration, compilation, tests, and the CRD compatibility check rather than reviewed as independently handwritten code.

Generation

Current output was generated from code-generator v0.62.0 with a local module replacement to pkg PR #50 and release version v1.12.1:

cd /path/to/code-generator
git checkout v0.62.0
go mod edit -replace github.com/aws-controllers-k8s/pkg=/absolute/path/to/pkg-pr-50
make build-ack-generate

RELEASE_VERSION=v1.12.1 \
RUNTIME_CRD_DIR=/path/to/runtime-v0.62.0/config \
RUNTIME_DIR=/path/to/runtime-v0.62.0 \
TEMPLATES_DIR=/path/to/code-generator/templates \
SERVICE_CONTROLLER_SOURCE_PATH=/path/to/bedrockagentcorecontrol-controller \
make SERVICE=bedrockagentcorecontrol build-controller

The generation metadata reports v0.62.0-dirty only because of that temporary local replacement; the replacement is not committed here. Once #50 is released and consumed by code-generator, this branch must be regenerated from the released dependency.

Review feedback incorporated

• Added generated references for the Harness KMS encryption key, Browser, CodeInterpreter, and Gateway fields.
• Corrected the HarnessTool.type JSON tag.
• Replaced custom Harness version-pinning and HarnessEndpoint live-version workarounds with the SDK/model mappings supported by code-generator v0.62.0.
• Added the Harness execution role to standard ACK E2E bootstrap resources and use the standard Nova Lite model.
• Use acktest.aws.identity.get_account_id() rather than a custom expected-account fixture.
• Kept the upstream E2E suite focused on controller behavior; model invocation, controller-restart recovery, generic out-of-band drift behavior, and deletion of the service-managed AgentRuntime are outside this controller PR's upstream E2E scope.

The nested managed-memory field is named only arn in the service model. Code-generator v0.62.0 cannot derive a *Ref field name from a bare identifier suffix and has no nested-shape rename override, so a Memory reference is not generated in this PR. Direct ARN input remains supported.

Intentional first-pass exclusions

• Provider-specific additionalParams and inline-function inputSchema fields use Smithy document, which ACK v0.62.0 cannot represent directly.
• remoteMcp.headers may contain credentials and is excluded until it can use secret-backed values rather than plain CR fields.

Validation on the current head

go test ./...
go vet -composites=false ./...

ack-generate crd-compat-check --base-ref=origin/main \
  --crd-paths=config/crd/bases,helm/crds

AWS_PROFILE=<non-production-profile> \
AWS_DEFAULT_REGION=us-west-2 \
PYTHONPATH=test \
pytest --collect-only -q \
  test/e2e/tests/test_harness.py \
  test/e2e/tests/test_harness_endpoint.py

• All Go tests and go vet pass.
• All five updated E2E tests collect with the repository's pinned acktest dependency.
• Repeating generation produces the same diff apart from the expected metadata build timestamp.
• The compatibility check reports every existing CRD unchanged and only Harness and HarnessEndpoint as new.
• No AWS or Payne resources were changed while addressing this review.

Upstream CI still needs an organization member to run /ok-to-test (or the individual test commands) after this update.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[ack-prow]

Hi @rdoshi1. Thanks for your PR.

I'm waiting for a aws-controllers-k8s member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[knottnt]

/test all

[knottnt]

Thanks @rdoshi1. Left a few comments.

[knottnt]

It looks like this could reference a Memory CR. In order to support that I think we'll need to rename this field to something like memoryArn to give the code-generator a prefix it can append the "Ref" suffix to.

[rdoshi1]

I investigated this during regeneration. With code-generator v0.62.0, a nested field named only Arn cannot produce a stable Ref name because Arn is entirely an identifier suffix, and the generator has no nested-shape rename override. Direct ARN input remains supported, and I documented this limitation in the PR description. Would you prefer to defer this optional reference, or handle the needed nested rename support as a separate code-generator change?

[knottnt]

Hmm we do have an open code-generator PR to add nested rename support. Will see if we can get that merged in the near term.

[rdoshi1]

Given that code-generator #721 is still unapproved and has failing required checks, I propose deferring this optional Memory CR reference for this PR. Direct ARN input remains supported, and the minimal Harness use case does not require a Memory CR. If #721 lands before final regeneration, I can add the nested rename/reference then; otherwise this can follow separately.

[rdoshi1]

Review feedback is addressed on rebased head 1b55bb4. I regenerated with code-generator v0.62.0 plus pkg #50, ran all Go tests and vet, confirmed deterministic generation and CRD compatibility, and collected all five updated E2E tests with the pinned acktest dependency. I replied to and resolved the addressed threads; the managed-memory ARN reference thread remains open because v0.62.0 cannot derive a Ref name from a nested field named only Arn. The PR description now maps handwritten versus generated files and reflects the narrower upstream E2E scope. When the patch looks reasonable, please add /ok-to-test or run the individual jobs. The verify-code-gen job remains dependent on pkg #50 being merged, released, and consumed by code-generator.

[rdoshi1]

/retest-required

[ack-prow]

@rdoshi1: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest-required

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[knottnt]

/test all

[knottnt]

Hmm we do have an open code-generator PR to add nested rename support. Will see if we can get that merged in the near term.

[knottnt]

/test all

[knottnt]

/lgtm

[ack-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: knottnt, rdoshi1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [knottnt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ack-prow]

@rdoshi1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
bedrockagentcorecontrol-verify-attribution	509f0e1	link	false	/test bedrockagentcorecontrol-verify-attribution

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.