opendefensecloud / artifact-conduit / 35592011123

86%

Build Type

push

github

Committed by web-flow

Commit Message

feat(chart): scrape ARC and ship the reference dashboard (#480)

## What

Scraping for the metrics #471 added, plus the reference dashboard which
closes #316:

<img width="2758" height="1820" alt="image"
src="https://github.com/user-attachments/assets/27d7e950-c97c-46b9-b98a-36905a6049a3"
/>


- `honorLabels` on the controller ServiceMonitor, new one for the API
Server, both off by default
- `{release}-apiserver-metrics-reader` ClusterRole, created but unbound,
and `system:auth-delegator` bound to the API Server SA when the monitor
is on
- `targetLabels` so every ARC series carries `part-of` and `component`
- the dashboard itself, 14 panels in 4 sections, shipped as a ConfigMap
for the Grafana sidecar, `dashboards.enabled`, off by default
- a test that fails if a panel queries a metric ARC does not emit
- `observability.md` rewritten, it still claimed ARC has no custom
metrics
- `.dockerignore`, unrelated but it was blocking local image builds

## Why

ARC metrics carry a `namespace` label for the Order's namespace.
Prometheus Operator attaches its own for the install namespace and
renames the scraped one to `exported_namespace` -> every dashboard
filter on `namespace` matches nothing, so `honorLabels` goes on. The API
Server already served `/metrics` and nothing collected it.
`targetLabels` matters more than it looks: `apiserver_request_total` and
`workqueue_depth` are emitted by the control plane too, and in the test
cluster that is 24 ARC series out of 397, and 6 out of 39. Unfiltered
those panels quietly average ARC together with kube-controller-manager.

A scrape hits the Service directly, not through the aggregation layer,
so the API Server authenticates the token itself. Our ClusterRole had
`subjectaccessreviews` but no `tokenreviews` -> auth just failed. Gated
on the monitor, nothing widens by default. TLS verifies against the
cert-manager issued CA by default, `serverName` and `caSecret` resolve
on their own, and rendering fails with a clear ... (continued)

Coverage Stats

50 of 54 new or added lines in 4 files covered. (92.59%)

4 existing lines in 2 files now uncovered.

1596 of 1848 relevant lines covered (86.36%)

3036.71 hits per line