Implement export for CertificateManagerCertificateMap (#10631)

This PR implements export support for `CertificateManagerCertificateMap`
direct controller.

### Changes:
- Implemented `AdapterForURL` in `certificatemap_controller.go` to parse
the external GCP URL into a `CertificateManagerCertificateMapIdentity`.
- Updated `Export` in `certificatemap_controller.go` to set `ResourceID`
in Spec, metadata name to short name, and set standard metadata
(project-id, labels).
- Registered `CertificateManagerCertificateMap` in `tests/e2e/export.go`
using `resolveCAISURI`.
- Generated and verified `_exported.yaml` for the
`certificatemanagercertificatemap` basic test fixture.

Fixes #10624

Author: justinsb

.gemini/skills/add-export-support/journal/certificatemanagercertificatemap.md

@@ -0,0 +1,25 @@
+# CertificateManagerCertificateMap Export Journal
+
+## Observations & Implementation Details
+
+1. **Standard Metadata & Annotations**:
+   - `CertificateManagerCertificateMap` maps to `google.cloud.certificatemanager.v1.CertificateMap`.
+   - Instead of setting the `cnrm.cloud.google.com/project-id` annotation (which uses `export.SetProjectID`), resources with `spec.projectRef` in their KRM schema should have `spec.projectRef.external` set to the GCP project ID, and no annotation set.
+   
+2. **Project Reference Behavior & `SetProjectRef`**:
+   - Introduced a new helper `export.SetProjectRef(u, projectID)` under `pkg/export/helpers.go`.
+   - This helper sets the `spec.projectRef.external` path directly on the unstructured representation of exported resources.
+   - For `CertificateManagerCertificateMap`, `spec.projectRef` in `_exported.yaml` is now correctly exported as:
+     ```yaml
+     projectRef:
+       external: ${projectId}
+     ```
+     and the `cnrm.cloud.google.com/project-id` annotation is omitted entirely.
+
+3. **Short-Name and ResourceID Mapping**:
+   - The GCP actual `Name` returns the full resource path (`projects/{project}/locations/global/certificateMaps/{certificatemap}`).
+   - It is crucial to use the parsed short name `a.id.CertificateMap` when calling `u.SetName` to generate valid KRM metadata.
+   - Set `obj.Spec.ResourceID = direct.LazyPtr(a.id.CertificateMap)` explicitly since identity fields are not automatically converted from proto.
+
+4. **Isolated E2E Testing**:
+   - When running the unified E2E test runner, specify the exact regex `^TestAllInSeries/fixtures/certificatemanagercertificatemap$` to prevent other tests (e.g., `certificatemanagercertificatemapentry`) from being executed and writing undesired golden output diffs.

pkg/controller/direct/certificatemanager/certificatemap_controller.go

@@ -21,12 +21,14 @@ import (
 	gcp "cloud.google.com/go/certificatemanager/apiv1"
 	pb "cloud.google.com/go/certificatemanager/apiv1/certificatemanagerpb"
 	krm "github.com/GoogleCloudPlatform/k8s-config-connector/apis/certificatemanager/v1beta1"
+	refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/config"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct/common"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct/directbase"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct/registry"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct/tags"
+	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/export"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/label"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/mappers"
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/structuredreporting"
@@ -102,8 +104,21 @@ func (m *certificateMapModel) AdapterForObject(ctx context.Context, op *directba
 }
 
 func (m *certificateMapModel) AdapterForURL(ctx context.Context, url string) (directbase.Adapter, error) {
-	// TODO: Support URLs
-	return nil, nil
+	id := &krm.CertificateManagerCertificateMapIdentity{}
+	if err := id.FromExternal(url); err != nil {
+		// Not recognized
+		return nil, nil
+	}
+
+	gcpClient, err := m.client(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CertificateMapAdapter{
+		id:        id,
+		gcpClient: gcpClient,
+	}, nil
 }
 
 type CertificateMapAdapter struct {
@@ -216,14 +231,20 @@ func (a *CertificateMapAdapter) Export(ctx context.Context) (*unstructured.Unstr
 		return nil, mapCtx.Err()
 	}
 
+	obj.Spec.ResourceID = direct.LazyPtr(a.id.CertificateMap)
+	obj.Spec.ProjectRef = refs.ProjectRef{External: a.id.Project}
+
 	uObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
 	if err != nil {
 		return nil, err
 	}
 
 	u.Object = uObj
-	u.SetName(a.actual.Name)
+	u.SetName(a.id.CertificateMap)
 	u.SetGroupVersionKind(krm.CertificateManagerCertificateMapGVK)
+
+	export.SetLabels(u, a.actual.Labels)
+
 	return u, nil
 }
 

pkg/test/resourcefixture/testdata/basic/certificatemanager/v1beta1/certificatemanagercertificatemap/_exported.yaml

@@ -0,0 +1,13 @@
+apiVersion: certificatemanager.cnrm.cloud.google.com/v1beta1
+kind: CertificateManagerCertificateMap
+metadata:
+  labels:
+    cnrm-test: "true"
+    managed-by-cnrm: "true"
+    value: cert-map-2
+  name: certificatemanagercertificatemap${uniqueId}
+spec:
+  description: updated sample certificate map
+  projectRef:
+    external: ${projectId}
+  resourceID: certificatemanagercertificatemap${uniqueId}

tests/e2e/export.go

@@ -72,6 +72,9 @@ func exportResource(h *create.Harness, obj *unstructured.Unstructured, options *
 	case schema.GroupKind{Group: "certificatemanager.cnrm.cloud.google.com", Kind: "CertificateManagerCertificateIssuanceConfig"}:
 		exportURI = resolveCAISURI(h, obj)
 
+	case schema.GroupKind{Group: "certificatemanager.cnrm.cloud.google.com", Kind: "CertificateManagerCertificateMap"}:
+		exportURI = resolveCAISURI(h, obj)
+
 	case schema.GroupKind{Group: "serviceusage.cnrm.cloud.google.com", Kind: "Service"}:
 		exportURI = "//serviceusage.googleapis.com/projects/" + projectID + "/services/" + resourceID