-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Filter annotation "annotation_kubectl_kubernetes_io_last_applied_configuration" #854
Comments
Also, annotations are an uncontrolled field, where anything can go, very few contraints are placed on them. Just exposing them across the board is a very bold move. |
Yes agreed, I am seeing those as well, we should filter the A full example of how the metric looks like with the
|
Just one example, if you hardcode a password in And there's probably no utility in having this field anyway other than to test the breaking point of Prometheus. |
Your concerns are valid @towolf. Here are some options that I can think of: I) Perhaps, we could disable annotation metrics by default in kube-state-metrics and provide users the knobs to enable the specific annotation metrics they need. One way of achieving this is the white black listing approach. ii) We could choose to only expose certain annotation metrics(create specific metric families) that are if significance to Kubernetes and useful to the users. |
I would say for now we filter out the As for the actual solution, it would probably end up in the next major release, I would go with something along the lines of number 2. What were you thinking, something similar to black/whitelist flag we have? Lets maybe open a new issue to discuss this. |
Sounds good @lilic . We can create the patch to filter that specific annotation metric out. |
Think we can close this, as the PR to remove the annotation metrics was merged. Thanks for the issue! |
Thanks for the fix :) |
Kube-state-metrics 1.7.1 adds new kube_*_annotations metrics.
I disabled most of them because that sounded really spammy.
--metric-blacklist="kube_[^i][a-z]+_annotations"
But I wanted to keep one exception:
kube_ingress_annotations
. There is no other way to capture the ingess class, than via the annotations: https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/We use
kubectl apply
in our CI/CD pipeline and now every_annotations
metric contains the full object itself in theannotation_kubectl_kubernetes_io_last_applied_configuration
label.Now, we don't store sensitive stuff in the objects, but I think this specific annotation should be excluded.
Is this a BUG REPORT or FEATURE REQUEST?:
/kind bug
What happened:
see above
...
The text was updated successfully, but these errors were encountered: