Bound the number of labels of all metrics

[dgrisonnet]

Is this a BUG REPORT or FEATURE REQUEST?:

/kind feature

This proposal is originating from this discussion #1102.

Motivation:

More and more users want to expose high cardinality metrics; however, it comes with great costs for the default configuration of kube-state-metrics.

#941
#1047

Moreover, some of these metrics (for example: Kubernetes labels or annotations) can generate an unbound amount of labels. Thus, it is possible for these metrics to produce an unlimited number of series leading to some severe security issues.

Goals:

Make it possible to safely register metrics having an unbound amount of labels.

Non-Goals:

Set the sane defaults

Proposal:

In order to safely register metrics having an unbound amount of labels, a feature gates mechanism where labels could be allowed per metrics can be used.

In order to bound the number of labels of all metrics, this gate will only allow labels instead of allowing and denying. The reason behind this is that a deny mechanism would mean that everything is allowed except what is specifically denied. In the case of metrics with an unbound number of labels that would still result in an unbound number of labels.

By default, sensitive metrics will have all their labels denied and it will be left to the users to specify which labels they want to use. This will allow to only expose metrics having a limited number of labels and thus prevent some security issues.

The gates will have the following pattern:

Metric	Default value
"_labels$"	[]
"_annotations$"	[]
others	[*]

Users will then be able to allow specific labels the following way:

--labels-allow-list="kube_job_labels=[label1,label2],kube_node_labels=[label1]"

[jw-s]

--labels-allow-list="kube_job_labels=[label1,label2],kube_node_labels=[label1]"
@dgrisonnet Do we already have a flag type defined for this?

[dgrisonnet]

As far as I know, we don't have such a type. The existing ones are defined here: types.go. Having a look into this file might help you write the new flag type.

[jw-s]

@dgrisonnet here is a rough wip of the solution #1125 , i'm not really happy with the flag. WDYT, any suggestions? Regex or tokenizer?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten