Add collector for csr

Documentation/README.md

@@ -62,7 +62,7 @@ Per group of metrics there is one file for each metrics. See each file for speci
 * [Secret Metrics](secret-metrics.md)
 * [ConfigMap Metrics](configmap-metrics.md)
 * [Ingress Metrics](ingress-metrics.md)
-
+* [CSR Metrics](csr-metrics.md)
 
 ## Join Metrics
 When an additional, not provided by default label is needed, a [Prometheus matching operator](https://prometheus.io/docs/prometheus/latest/querying/operators/#vector-matching) 

Documentation/csr-metrics.md

@@ -0,0 +1,7 @@
+# CSR Metrics
+
+| Metric name| Metric type | Labels/tags | Status |
+| ---------- | ----------- | ----------- | ----------- |
+| kube_csr_created| Gauge | `csr`=<csr-name>| STABLE |
+| kube_csr_condition | Gauge | `csr`=&lt;csr-name&gt; <br> `csr_condition`=&lt;pending\|issued\|approved\|denied&gt; | STABLE |
+| kube_csr_labels | Gauge | `csr`=&lt;csr-name&gt;| STABLE |

internal/collector/builder.go

@@ -26,6 +26,7 @@ import (
 	autoscaling "k8s.io/api/autoscaling/v2beta1"
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
+	certv1beta1 "k8s.io/api/certificates/v1beta1"
 	"k8s.io/api/core/v1"
 	extensions "k8s.io/api/extensions/v1beta1"
 	policy "k8s.io/api/policy/v1beta1"
@@ -134,6 +135,7 @@ var availableCollectors = map[string]func(f *Builder) *coll.Collector{
 	"secrets":                  func(b *Builder) *coll.Collector { return b.buildSecretCollector() },
 	"services":                 func(b *Builder) *coll.Collector { return b.buildServiceCollector() },
 	"statefulsets":             func(b *Builder) *coll.Collector { return b.buildStatefulSetCollector() },
+	"csr":                      func(b *Builder) *coll.Collector { return b.buildCsrCollector() },
 }
 
 func (b *Builder) buildConfigMapCollector() *coll.Collector {
@@ -451,6 +453,21 @@ func (b *Builder) buildPodCollector() *coll.Collector {
 	return coll.NewCollector(store)
 }
 
+func (b *Builder) buildCsrCollector() *coll.Collector {
+	filteredMetricFamilies := metric.FilterMetricFamilies(b.whiteBlackList, csrMetricFamilies)
+	composedMetricGenFuncs := metric.ComposeMetricGenFuncs(filteredMetricFamilies)
+
+	familyHeaders := metric.ExtractMetricFamilyHeaders(filteredMetricFamilies)
+
+	store := metricsstore.NewMetricsStore(
+		familyHeaders,
+		composedMetricGenFuncs,
+	)
+	reflectorPerNamespace(b.ctx, b.kubeClient, &certv1beta1.CertificateSigningRequest{}, store, b.namespaces, createCSRListWatch)
+
+	return coll.NewCollector(store)
+}
+
 // reflectorPerNamespace creates a Kubernetes client-go reflector with the given
 // listWatchFunc for each given namespace and registers it with the given store.
 func reflectorPerNamespace(

internal/collector/csr.go

@@ -0,0 +1,146 @@
+/*
+Copyright 2019 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package collector
+
+import (
+	"k8s.io/kube-state-metrics/pkg/metric"
+
+	certv1beta1 "k8s.io/api/certificates/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+)
+
+var (
+	descCSRLabelsName          = "kube_csr_labels"
+	descCSRLabelsHelp          = "Kubernetes labels converted to Prometheus labels."
+	descCSRLabelsDefaultLabels = []string{"csr"}
+
+	csrMetricFamilies = []metric.FamilyGenerator{
+		{
+			Name: descCSRLabelsName,
+			Type: metric.MetricTypeGauge,
+			Help: descCSRLabelsHelp,
+			GenerateFunc: wrapCSRFunc(func(j *certv1beta1.CertificateSigningRequest) *metric.Family {
+				labelKeys, labelValues := kubeLabelsToPrometheusLabels(j.Labels)
+				return &metric.Family{
+					Metrics: []*metric.Metric{
+						{
+							LabelKeys:   labelKeys,
+							LabelValues: labelValues,
+							Value:       1,
+						},
+					},
+				}
+			}),
+		},
+		{
+			Name: "kube_csr_created",
+			Type: metric.MetricTypeGauge,
+			Help: "Unix creation timestamp",
+			GenerateFunc: wrapCSRFunc(func(csr *certv1beta1.CertificateSigningRequest) *metric.Family {
+				ms := []*metric.Metric{}
+				if !csr.CreationTimestamp.IsZero() {
+					ms = append(ms, &metric.Metric{
+						LabelKeys:   []string{},
+						LabelValues: []string{},
+						Value:       float64(csr.CreationTimestamp.Unix()),
+					})
+				}
+
+				return &metric.Family{
+					Metrics: ms,
+				}
+			}),
+		},
+		{
+			Name: "kube_csr_condition",
+			Type: metric.MetricTypeGauge,
+			Help: "Condition of the csr",
+			GenerateFunc: wrapCSRFunc(func(csr *certv1beta1.CertificateSigningRequest) *metric.Family {
+				return &metric.Family{
+					Metrics: addCSRConditionMetrics(csr.Status),
+				}
+			}),
+		},
+	}
+)
+
+func wrapCSRFunc(f func(*certv1beta1.CertificateSigningRequest) *metric.Family) func(interface{}) *metric.Family {
+	return func(obj interface{}) *metric.Family {
+		csr := obj.(*certv1beta1.CertificateSigningRequest)
+
+		metricFamily := f(csr)
+
+		for _, m := range metricFamily.Metrics {
+			m.LabelKeys = append(descCSRLabelsDefaultLabels, m.LabelKeys...)
+			m.LabelValues = append([]string{csr.Name}, m.LabelValues...)
+		}
+
+		return metricFamily
+	}
+}
+
+func createCSRListWatch(kubeClient clientset.Interface, ns string) cache.ListWatch {
+	return cache.ListWatch{
+		ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+			return kubeClient.CertificatesV1beta1().CertificateSigningRequests().List(opts)
+		},
+		WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+			return kubeClient.CertificatesV1beta1().CertificateSigningRequests().Watch(opts)
+		},
+	}
+}
+
+// addCSRConditionMetrics generates one metric for each possible csr condition status
+func addCSRConditionMetrics(cs certv1beta1.CertificateSigningRequestStatus) []*metric.Metric {
+	approved := false
+	denied := false
+	for _, s := range cs.Conditions {
+		if s.Type == certv1beta1.CertificateApproved {
+			approved = true
+		}
+		if s.Type == certv1beta1.CertificateDenied {
+			denied = true
+		}
+	}
+
+	return []*metric.Metric{
+		&metric.Metric{
+			LabelValues: []string{"issued"},
+			Value:       boolFloat64(len(cs.Certificate) > 0),
+			LabelKeys:   []string{"csr_condition"},
+		},
+		&metric.Metric{
+			LabelValues: []string{"pending"},
+			Value:       boolFloat64(!(approved || denied)),
+			LabelKeys:   []string{"csr_condition"},
+		},
+		&metric.Metric{
+			LabelValues: []string{"approved"},
+			Value:       boolFloat64(approved),
+			LabelKeys:   []string{"csr_condition"},
+		},
+		&metric.Metric{
+			LabelValues: []string{"denied"},
+			Value:       boolFloat64(denied),
+			LabelKeys:   []string{"csr_condition"},
+		},
+	}
+}

internal/collector/csr_test.go

@@ -0,0 +1,187 @@
+/*
+Copyright 2019 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package collector
+
+import (
+	"testing"
+	"time"
+
+	certv1beta1 "k8s.io/api/certificates/v1beta1"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kube-state-metrics/pkg/metric"
+)
+
+func TestCsrCollector(t *testing.T) {
+	const metadata = `
+		# HELP kube_csr_labels Kubernetes labels converted to Prometheus labels.
+		# TYPE kube_csr_labels gauge
+		# HELP kube_csr_created Unix creation timestamp
+		# TYPE kube_csr_created gauge
+		# HELP kube_csr_condition Condition of the csr
+		# TYPE kube_csr_condition gauge
+	`
+	cases := []generateMetricsTestCase{
+		{
+			Obj: &certv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "certificate-test",
+					Generation: 1,
+					Labels: map[string]string{
+						"cert": "test",
+					},
+					CreationTimestamp: metav1.Time{Time: time.Unix(1500000000, 0)},
+				},
+				Status: certv1beta1.CertificateSigningRequestStatus{},
+				Spec:   certv1beta1.CertificateSigningRequestSpec{},
+			},
+			Want: `
+				kube_csr_created{csr="certificate-test"} 1.5e+09
+				kube_csr_condition{csr="certificate-test",csr_condition="issued"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="pending"} 1
+				kube_csr_condition{csr="certificate-test",csr_condition="approved"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="denied"} 0
+				kube_csr_labels{csr="certificate-test",label_cert="test"} 1
+`,
+			MetricNames: []string{"kube_csr_created", "kube_csr_condition", "kube_csr_labels"},
+		},
+		{
+			Obj: &certv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "certificate-test",
+					Generation: 1,
+					Labels: map[string]string{
+						"cert": "test",
+					},
+					CreationTimestamp: metav1.Time{Time: time.Unix(1500000000, 0)},
+				},
+				Status: certv1beta1.CertificateSigningRequestStatus{
+					Conditions: []certv1beta1.CertificateSigningRequestCondition{
+						{
+							Type: certv1beta1.CertificateDenied,
+						},
+					},
+				},
+				Spec: certv1beta1.CertificateSigningRequestSpec{},
+			},
+			Want: `
+				kube_csr_created{csr="certificate-test"} 1.5e+09
+				kube_csr_condition{csr="certificate-test",csr_condition="issued"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="pending"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="approved"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="denied"} 1
+				kube_csr_labels{csr="certificate-test",label_cert="test"} 1
+`,
+			MetricNames: []string{"kube_csr_created", "kube_csr_condition", "kube_csr_labels"},
+		},
+		{
+			Obj: &certv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "certificate-test",
+					Generation: 1,
+					Labels: map[string]string{
+						"cert": "test",
+					},
+					CreationTimestamp: metav1.Time{Time: time.Unix(1500000000, 0)},
+				},
+				Status: certv1beta1.CertificateSigningRequestStatus{
+					Conditions: []certv1beta1.CertificateSigningRequestCondition{
+						{
+							Type: certv1beta1.CertificateApproved,
+						},
+					},
+				},
+				Spec: certv1beta1.CertificateSigningRequestSpec{},
+			},
+			Want: `
+				kube_csr_created{csr="certificate-test"} 1.5e+09
+				kube_csr_condition{csr="certificate-test",csr_condition="issued"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="pending"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="approved"} 1
+				kube_csr_condition{csr="certificate-test",csr_condition="denied"} 0
+				kube_csr_labels{csr="certificate-test",label_cert="test"} 1
+`,
+			MetricNames: []string{"kube_csr_created", "kube_csr_condition", "kube_csr_labels"},
+		},
+		{
+			Obj: &certv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "certificate-test",
+					Generation: 1,
+					Labels: map[string]string{
+						"cert": "test",
+					},
+					CreationTimestamp: metav1.Time{Time: time.Unix(1500000000, 0)},
+				},
+				Status: certv1beta1.CertificateSigningRequestStatus{
+					Certificate: []byte("just for test"),
+					Conditions: []certv1beta1.CertificateSigningRequestCondition{
+						{
+							Type: certv1beta1.CertificateApproved,
+						},
+					},
+				},
+			},
+			Want: `
+				kube_csr_created{csr="certificate-test"} 1.5e+09
+				kube_csr_condition{csr="certificate-test",csr_condition="issued"} 1
+				kube_csr_condition{csr="certificate-test",csr_condition="pending"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="approved"} 1
+				kube_csr_condition{csr="certificate-test",csr_condition="denied"} 0
+				kube_csr_labels{csr="certificate-test",label_cert="test"} 1
+`,
+			MetricNames: []string{"kube_csr_created", "kube_csr_condition", "kube_csr_labels"},
+		},
+		{
+			Obj: &certv1beta1.CertificateSigningRequest{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "certificate-test",
+					Generation: 1,
+					Labels: map[string]string{
+						"cert": "test",
+					},
+					CreationTimestamp: metav1.Time{Time: time.Unix(1500000000, 0)},
+				},
+				Status: certv1beta1.CertificateSigningRequestStatus{
+					Conditions: []certv1beta1.CertificateSigningRequestCondition{
+						{
+							Type: certv1beta1.CertificateApproved,
+						},
+						{
+							Type: certv1beta1.CertificateDenied,
+						},
+					},
+				},
+			},
+			Want: `
+				kube_csr_created{csr="certificate-test"} 1.5e+09
+				kube_csr_condition{csr="certificate-test",csr_condition="issued"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="pending"} 0
+				kube_csr_condition{csr="certificate-test",csr_condition="approved"} 1
+				kube_csr_condition{csr="certificate-test",csr_condition="denied"} 1
+				kube_csr_labels{csr="certificate-test",label_cert="test"} 1
+`,
+			MetricNames: []string{"kube_csr_created", "kube_csr_condition", "kube_csr_labels"},
+		},
+	}
+	for i, c := range cases {
+		c.Func = metric.ComposeMetricGenFuncs(csrMetricFamilies)
+		if err := c.run(); err != nil {
+			t.Errorf("unexpected collecting result in %vth run:\n%s", i, err)
+		}
+	}
+}

pkg/options/collector.go

@@ -44,5 +44,6 @@ var (
 		"secrets":                  struct{}{},
 		"configmaps":               struct{}{},
 		"ingress":                  struct{}{},
+		"csr":                      struct{}{},
 	}
 )