Change:
Change encryption config controller reload metrics to be consistent with other places (Authn, Authz) xref: Combine and into a single metric with with an enum value of and . /sig auth /triage accepted
cc
We probably should keep the existing metrics for some time to allow folks to migrate to the new one.
Ah I was thinking about this as well! Looking at "may be deleted at any time", I was leaning towards just removing it. If the common approach is to keep it for a release before removing, we could do that. I believe we can set a for the 2 metrics we want to remove.
I don't have a good sense of metrics stability because they tend to stay alpha forever and folks don't go back to update them. Since the associated feature set is GA, I think we should be conservative with the changes we make. Perhaps SIG instrumentation folks can provide some guidance here?
As part of the PR, I was going to ask when is the right time to graduate these metrics do you have thoughts on to take while deleting an alpha metric metrics should be graduated from alpha to beta and stable?

Discussion:
# HELP apiserver_encryption_config_controller_automatic_reload_success_total [ALPHA] Total number of successful automatic reloads of encryption configuration split by apiserver identity. # TYPE apiserver_encryption_config_controller_automatic_reload_success_total counter apiserver_encryption_config_controller_automatic_reload_success_total{apiserver_id_hash="sha256:cd8a60cec6134082e9f37e7a4146b4bc14a0bf8a863237c36ec8fdb658c3e027"} 1 <ins> # HELP apiserver_encryption_config_controller_automatic_reloads_total [ALPHA] Total number of reload successes and failures of encryption configuration split by apiserver identity. # TYPE apiserver_encryption_config_controller_automatic_reloads_total counter apiserver_encryption_config_controller_automatic_reloads_total{apiserver_id_hash="sha256:cd8a60cec6134082e9f37e7a4146b4bc14a0bf8a863237c36ec8fdb658c3e027",status="success"} 1 </ins> ` const expectedFailureMetricValue = ` # HELP apiserver_encryption_config_controller_automatic_reload_failures_total [ALPHA] Total number of failed automatic reloads of encryption configuration split by apiserver identity. # TYPE apiserver_encryption_config_controller_automatic_reload_failures_total counter apiserver_encryption_config_controller_automatic_reload_failures_total{apiserver_id_hash="sha256:cd8a60cec6134082e9f37e7a4146b4bc14a0bf8a863237c36ec8fdb658c3e027"} 1 <ins> # HELP apiserver_encryption_config_controller_automatic_reloads_total [ALPHA] Total number of reload successes and failures of encryption configuration split by apiserver identity. # TYPE apiserver_encryption_config_controller_automatic_reloads_total counter apiserver_encryption_config_controller_automatic_reloads_total{apiserver_id_hash="sha256:cd8a60cec6134082e9f37e7a4146b4bc14a0bf8a863237c36ec8fdb658c3e027",status="failure"} 1 </ins> ` tests := []struct {

if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(test.wantMetrics), "apiserver_encryption_config_controller_automatic_reload_success_total", "apiserver_encryption_config_controller_automatic_reload_failures_total", <ins> "apiserver_encryption_config_controller_automatic_reloads_total", </ins> ); err != nil { t.Errorf("failed to validate metrics: %v", err) }

) var ( <del> encryptionConfigAutomaticReloadFailureTotal = metrics.NewCounterVec( </del> <ins> encryptionConfigAutomaticReloadsTotal = metrics.NewCounterVec( </ins> &metrics.CounterOpts{ Namespace:      namespace, Subsystem:      subsystem, <del> Name:           "automatic_reload_failures_total", Help:           "Total number of failed automatic reloads of encryption configuration split by apiserver identity.", </del> <ins> Name:           "automatic_reloads_total", Help:           "Total number of reload successes and failures of encryption configuration split by apiserver identity.", </ins> StabilityLevel: metrics.ALPHA, }, <ins> []string{"status", "apiserver_id_hash"}, ) // deprecatedEncryptionConfigAutomaticReloadFailureTotal has been deprecated in 1.30.0 // use encryptionConfigAutomaticReloadsTotal instead deprecatedEncryptionConfigAutomaticReloadFailureTotal = metrics.NewCounterVec( &metrics.CounterOpts{ Namespace:         namespace, Subsystem:         subsystem, Name:              "automatic_reload_failures_total", Help:              "Total number of failed automatic reloads of encryption configuration split by apiserver identity.", StabilityLevel:    metrics.ALPHA, DeprecatedVersion: "1.30.0", }, </ins> []string{"apiserver_id_hash"}, ) <del> encryptionConfigAutomaticReloadSuccessTotal = metrics.NewCounterVec( </del> <ins> // deprecatedEncryptionConfigAutomaticReloadSuccessTotal has been deprecated in 1.30.0 // use encryptionConfigAutomaticReloadsTotal instead deprecatedEncryptionConfigAutomaticReloadSuccessTotal = metrics.NewCounterVec( </ins> &metrics.CounterOpts{ <del> Namespace:      namespace, Subsystem:      subsystem, Name:           "automatic_reload_success_total", Help:           "Total number of successful automatic reloads of encryption configuration split by apiserver identity.", StabilityLevel: metrics.ALPHA, </del> <ins> Namespace:         namespace, Subsystem:         subsystem, Name:              "automatic_reload_success_total", Help:              "Total number of successful automatic reloads of encryption configuration split by apiserver identity.", StabilityLevel:    metrics.ALPHA, DeprecatedVersion: "1.30.0", </ins> }, []string{"apiserver_id_hash"}, )

return sha256.New() }, } <del> legacyregistry.MustRegister(encryptionConfigAutomaticReloadFailureTotal) legacyregistry.MustRegister(encryptionConfigAutomaticReloadSuccessTotal) </del> <ins> legacyregistry.MustRegister(encryptionConfigAutomaticReloadsTotal) legacyregistry.MustRegister(deprecatedEncryptionConfigAutomaticReloadFailureTotal) legacyregistry.MustRegister(deprecatedEncryptionConfigAutomaticReloadSuccessTotal) </ins> legacyregistry.MustRegister(encryptionConfigAutomaticReloadLastTimestampSeconds) }) } func RecordEncryptionConfigAutomaticReloadFailure(apiServerID string) { apiServerIDHash := getHash(apiServerID) <del> encryptionConfigAutomaticReloadFailureTotal.WithLabelValues(apiServerIDHash).Inc() </del> <ins> encryptionConfigAutomaticReloadsTotal.WithLabelValues("failure", apiServerIDHash).Inc() deprecatedEncryptionConfigAutomaticReloadFailureTotal.WithLabelValues(apiServerIDHash).Inc() </ins> recordEncryptionConfigAutomaticReloadTimestamp("failure", apiServerIDHash) } func RecordEncryptionConfigAutomaticReloadSuccess(apiServerID string) { apiServerIDHash := getHash(apiServerID) <del> encryptionConfigAutomaticReloadSuccessTotal.WithLabelValues(apiServerIDHash).Inc() </del> <ins> encryptionConfigAutomaticReloadsTotal.WithLabelValues("success", apiServerIDHash).Inc() deprecatedEncryptionConfigAutomaticReloadSuccessTotal.WithLabelValues(apiServerIDHash).Inc() </ins> recordEncryptionConfigAutomaticReloadTimestamp("success", apiServerIDHash) }

"strings" "testing" <del> "k8s.io/component-base/metrics/legacyregistry" </del> <ins> "k8s.io/component-base/metrics" </ins> "k8s.io/component-base/metrics/testutil" )

testAPIServerIDHash = "sha256:14f9d63e669337ac6bfda2e2162915ee6a6067743eddd4e5c374b572f951ff37" ) <ins> func testMetricsRegistry(t *testing.T) metrics.KubeRegistry { // setting the version to 1.30.0 to test deprecation // of deprecatedEncryptionConfigAutomaticReloadFailureTotal and deprecatedEncryptionConfigAutomaticReloadSuccessTotal registry := testutil.NewFakeKubeRegistry("1.30.0") registry.MustRegister(encryptionConfigAutomaticReloadsTotal) registry.MustRegister(deprecatedEncryptionConfigAutomaticReloadFailureTotal) registry.MustRegister(deprecatedEncryptionConfigAutomaticReloadSuccessTotal) registry.MustRegister(encryptionConfigAutomaticReloadLastTimestampSeconds) t.Cleanup(func() { registry.Reset() }) return registry } </ins> func TestRecordEncryptionConfigAutomaticReloadFailure(t *testing.T) { <ins> registry := testMetricsRegistry(t) </ins> expectedValue := ` <del> # HELP apiserver_encryption_config_controller_automatic_reload_failures_total [ALPHA] Total number of failed automatic reloads of encryption configuration split by apiserver identity. </del> <ins> # HELP apiserver_encryption_config_controller_automatic_reload_failures_total [ALPHA] (Deprecated since 1.30.0) Total number of failed automatic reloads of encryption configuration split by apiserver identity. </ins> # TYPE apiserver_encryption_config_controller_automatic_reload_failures_total counter apiserver_encryption_config_controller_automatic_reload_failures_total {apiserver_id_hash="sha256:14f9d63e669337ac6bfda2e2162915ee6a6067743eddd4e5c374b572f951ff37"} 1 <ins> # HELP apiserver_encryption_config_controller_automatic_reloads_total [ALPHA] Total number of reload successes and failures of encryption configuration split by apiserver identity. # TYPE apiserver_encryption_config_controller_automatic_reloads_total counter apiserver_encryption_config_controller_automatic_reloads_total {apiserver_id_hash="sha256:14f9d63e669337ac6bfda2e2162915ee6a6067743eddd4e5c374b572f951ff37",status="failure"} 1 </ins> ` <del> metrics := []string{ </del> <ins> metricNames := []string{ </ins> namespace + "_" + subsystem + "_automatic_reload_failures_total", <ins> namespace + "_" + subsystem + "_automatic_reloads_total", </ins> } <del> encryptionConfigAutomaticReloadFailureTotal.Reset() </del> <ins> deprecatedEncryptionConfigAutomaticReloadFailureTotal.Reset() encryptionConfigAutomaticReloadsTotal.Reset() </ins> RegisterMetrics() RecordEncryptionConfigAutomaticReloadFailure(testAPIServerID) <del> if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil { </del> <ins> if err := testutil.GatherAndCompare(registry, strings.NewReader(expectedValue), metricNames...); err != nil { </ins> t.Fatal(err) } } func TestRecordEncryptionConfigAutomaticReloadSuccess(t *testing.T) { <ins> registry := testMetricsRegistry(t) </ins> expectedValue := ` <del> # HELP apiserver_encryption_config_controller_automatic_reload_success_total [ALPHA] Total number of successful automatic reloads of encryption configuration split by apiserver identity. </del> <ins> # HELP apiserver_encryption_config_controller_automatic_reload_success_total [ALPHA] (Deprecated since 1.30.0) Total number of successful automatic reloads of encryption configuration split by apiserver identity. </ins> # TYPE apiserver_encryption_config_controller_automatic_reload_success_total counter apiserver_encryption_config_controller_automatic_reload_success_total {apiserver_id_hash="sha256:14f9d63e669337ac6bfda2e2162915ee6a6067743eddd4e5c374b572f951ff37"} 1 <ins> # HELP apiserver_encryption_config_controller_automatic_reloads_total [ALPHA] Total number of reload successes and failures of encryption configuration split by apiserver identity. # TYPE apiserver_encryption_config_controller_automatic_reloads_total counter apiserver_encryption_config_controller_automatic_reloads_total {apiserver_id_hash="sha256:14f9d63e669337ac6bfda2e2162915ee6a6067743eddd4e5c374b572f951ff37",status="success"} 1 </ins> ` <del> metrics := []string{ </del> <ins> metricNames := []string{ </ins> namespace + "_" + subsystem + "_automatic_reload_success_total", <ins> namespace + "_" + subsystem + "_automatic_reloads_total", </ins> } <del> encryptionConfigAutomaticReloadSuccessTotal.Reset() </del> <ins> deprecatedEncryptionConfigAutomaticReloadSuccessTotal.Reset() encryptionConfigAutomaticReloadsTotal.Reset() </ins> RegisterMetrics() RecordEncryptionConfigAutomaticReloadSuccess(testAPIServerID) <del> if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil { </del> <ins> if err := testutil.GatherAndCompare(registry, strings.NewReader(expectedValue), metricNames...); err != nil { </ins> t.Fatal(err) } }

}, } <del> metrics := []string{ </del> <ins> metricNames := []string{ </ins> namespace + "_" + subsystem + "_automatic_reload_last_timestamp_seconds", } RegisterMetrics() for _, tc := range testCases { <ins> registry := testMetricsRegistry(t) </ins> encryptionConfigAutomaticReloadLastTimestampSeconds.Reset() encryptionConfigAutomaticReloadLastTimestampSeconds.WithLabelValues(tc.resultLabel, testAPIServerIDHash).Set(float64(tc.timestamp)) <del> if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(tc.expectedValue), metrics...); err != nil { </del> <ins> if err := testutil.GatherAndCompare(registry, strings.NewReader(tc.expectedValue), metricNames...); err != nil { </ins> t.Fatal(err) } }

wantMetricStrings := []string{ `apiserver_encryption_config_controller_automatic_reload_last_timestamp_seconds{apiserver_id_hash="sha256:3c607df3b2bf22c9d9f01d5314b4bbf411c48ef43ff44ff29b1d55b41367c795",status="success"} FP`, `apiserver_encryption_config_controller_automatic_reload_success_total{apiserver_id_hash="sha256:3c607df3b2bf22c9d9f01d5314b4bbf411c48ef43ff44ff29b1d55b41367c795"} 2`, <ins> `apiserver_encryption_config_controller_automatic_reloads_total{apiserver_id_hash="sha256:3c607df3b2bf22c9d9f01d5314b4bbf411c48ef43ff44ff29b1d55b41367c795",status="success"} 2`, </ins> } test.secret, err = test.createSecret(testSecret, testNamespace)