Add collector for csr

docs/README.md

@@ -65,6 +65,7 @@ Per group of metrics there is one file for each metrics. See each file for speci
 - [Secret Metrics](secret-metrics.md)
 - [ConfigMap Metrics](configmap-metrics.md)
 - [Ingress Metrics](ingress-metrics.md)
+- [CertificateSigningRequest Metrics](certificatessigningrequest-metrics.md)
 
 ## Join Metrics
 

docs/certificatessigningrequest-metrics.md

@@ -0,0 +1,8 @@
+# CertificateSigningRequest Metrics
+
+| Metric name| Metric type | Labels/tags | Status |
+| ---------- | ----------- | ----------- | ----------- |
+| kube_certificatesigningrequest_created| Gauge | `certificatesigningrequest`=<certificatesigningrequest-name>| STABLE |
+| kube_certificatesigningrequest_condition | Gauge | `certificatesigningrequest`=&lt;certificatesigningrequest-name&gt; <br> `condition`=&lt;approved\|denied&gt; | STABLE |
+| kube_certificatesigningrequest_labels | Gauge | `certificatesigningrequest`=&lt;certificatesigningrequest-name&gt;| STABLE |
+| kube_certificatesigningrequest_cert_length | Gauge | `certificatesigningrequest`=&lt;certificatesigningrequest-name&gt;| STABLE |

internal/collector/builder.go

@@ -27,6 +27,7 @@ import (
 	autoscaling "k8s.io/api/autoscaling/v2beta1"
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
+	certv1beta1 "k8s.io/api/certificates/v1beta1"
 	v1 "k8s.io/api/core/v1"
 	extensions "k8s.io/api/extensions/v1beta1"
 	policy "k8s.io/api/policy/v1beta1"
@@ -112,27 +113,28 @@ func (b *Builder) Build() []*coll.Collector {
 }
 
 var availableCollectors = map[string]func(f *Builder) *coll.Collector{
-	"configmaps":               func(b *Builder) *coll.Collector { return b.buildConfigMapCollector() },
-	"cronjobs":                 func(b *Builder) *coll.Collector { return b.buildCronJobCollector() },
-	"daemonsets":               func(b *Builder) *coll.Collector { return b.buildDaemonSetCollector() },
-	"deployments":              func(b *Builder) *coll.Collector { return b.buildDeploymentCollector() },
-	"endpoints":                func(b *Builder) *coll.Collector { return b.buildEndpointsCollector() },
-	"horizontalpodautoscalers": func(b *Builder) *coll.Collector { return b.buildHPACollector() },
-	"ingresses":                func(b *Builder) *coll.Collector { return b.buildIngressCollector() },
-	"jobs":                     func(b *Builder) *coll.Collector { return b.buildJobCollector() },
-	"limitranges":              func(b *Builder) *coll.Collector { return b.buildLimitRangeCollector() },
-	"namespaces":               func(b *Builder) *coll.Collector { return b.buildNamespaceCollector() },
-	"nodes":                    func(b *Builder) *coll.Collector { return b.buildNodeCollector() },
-	"persistentvolumeclaims":   func(b *Builder) *coll.Collector { return b.buildPersistentVolumeClaimCollector() },
-	"persistentvolumes":        func(b *Builder) *coll.Collector { return b.buildPersistentVolumeCollector() },
-	"poddisruptionbudgets":     func(b *Builder) *coll.Collector { return b.buildPodDisruptionBudgetCollector() },
-	"pods":                     func(b *Builder) *coll.Collector { return b.buildPodCollector() },
-	"replicasets":              func(b *Builder) *coll.Collector { return b.buildReplicaSetCollector() },
-	"replicationcontrollers":   func(b *Builder) *coll.Collector { return b.buildReplicationControllerCollector() },
-	"resourcequotas":           func(b *Builder) *coll.Collector { return b.buildResourceQuotaCollector() },
-	"secrets":                  func(b *Builder) *coll.Collector { return b.buildSecretCollector() },
-	"services":                 func(b *Builder) *coll.Collector { return b.buildServiceCollector() },
-	"statefulsets":             func(b *Builder) *coll.Collector { return b.buildStatefulSetCollector() },
+	"certificatesigningrequests": func(b *Builder) *coll.Collector { return b.buildCsrCollector() },
+	"configmaps":                 func(b *Builder) *coll.Collector { return b.buildConfigMapCollector() },
+	"cronjobs":                   func(b *Builder) *coll.Collector { return b.buildCronJobCollector() },
+	"daemonsets":                 func(b *Builder) *coll.Collector { return b.buildDaemonSetCollector() },
+	"deployments":                func(b *Builder) *coll.Collector { return b.buildDeploymentCollector() },
+	"endpoints":                  func(b *Builder) *coll.Collector { return b.buildEndpointsCollector() },
+	"horizontalpodautoscalers":   func(b *Builder) *coll.Collector { return b.buildHPACollector() },
+	"ingresses":                  func(b *Builder) *coll.Collector { return b.buildIngressCollector() },
+	"jobs":                       func(b *Builder) *coll.Collector { return b.buildJobCollector() },
+	"limitranges":                func(b *Builder) *coll.Collector { return b.buildLimitRangeCollector() },
+	"namespaces":                 func(b *Builder) *coll.Collector { return b.buildNamespaceCollector() },
+	"nodes":                      func(b *Builder) *coll.Collector { return b.buildNodeCollector() },
+	"persistentvolumeclaims":     func(b *Builder) *coll.Collector { return b.buildPersistentVolumeClaimCollector() },
+	"persistentvolumes":          func(b *Builder) *coll.Collector { return b.buildPersistentVolumeCollector() },
+	"poddisruptionbudgets":       func(b *Builder) *coll.Collector { return b.buildPodDisruptionBudgetCollector() },
+	"pods":                       func(b *Builder) *coll.Collector { return b.buildPodCollector() },
+	"replicasets":                func(b *Builder) *coll.Collector { return b.buildReplicaSetCollector() },
+	"replicationcontrollers":     func(b *Builder) *coll.Collector { return b.buildReplicationControllerCollector() },
+	"resourcequotas":             func(b *Builder) *coll.Collector { return b.buildResourceQuotaCollector() },
+	"secrets":                    func(b *Builder) *coll.Collector { return b.buildSecretCollector() },
+	"services":                   func(b *Builder) *coll.Collector { return b.buildServiceCollector() },
+	"statefulsets":               func(b *Builder) *coll.Collector { return b.buildStatefulSetCollector() },
 }
 
 func (b *Builder) buildConfigMapCollector() *coll.Collector {
@@ -450,6 +452,21 @@ func (b *Builder) buildPodCollector() *coll.Collector {
 	return coll.NewCollector(store)
 }
 
+func (b *Builder) buildCsrCollector() *coll.Collector {
+	filteredMetricFamilies := metric.FilterMetricFamilies(b.whiteBlackList, csrMetricFamilies)
+	composedMetricGenFuncs := metric.ComposeMetricGenFuncs(filteredMetricFamilies)
+
+	familyHeaders := metric.ExtractMetricFamilyHeaders(filteredMetricFamilies)
+
+	store := metricsstore.NewMetricsStore(
+		familyHeaders,
+		composedMetricGenFuncs,
+	)
+	reflectorPerNamespace(b.ctx, b.kubeClient, &certv1beta1.CertificateSigningRequest{}, store, b.namespaces, createCSRListWatch)
+
+	return coll.NewCollector(store)
+}
+
 // reflectorPerNamespace creates a Kubernetes client-go reflector with the given
 // listWatchFunc for each given namespace and registers it with the given store.
 func reflectorPerNamespace(

internal/collector/certificatesigningrequest.go

@@ -0,0 +1,152 @@
+/*
+Copyright 2019 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package collector
+
+import (
+	"k8s.io/kube-state-metrics/pkg/metric"
+
+	certv1beta1 "k8s.io/api/certificates/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+)
+
+var (
+	descCSRLabelsName          = "kube_certificatesigningrequest_labels"
+	descCSRLabelsHelp          = "Kubernetes labels converted to Prometheus labels."
+	descCSRLabelsDefaultLabels = []string{"certificatesigningrequest"}
+
+	csrMetricFamilies = []metric.FamilyGenerator{
+		{
+			Name: descCSRLabelsName,
+			Type: metric.Gauge,
+			Help: descCSRLabelsHelp,
+			GenerateFunc: wrapCSRFunc(func(j *certv1beta1.CertificateSigningRequest) *metric.Family {
+				labelKeys, labelValues := kubeLabelsToPrometheusLabels(j.Labels)
+				return &metric.Family{
+					Metrics: []*metric.Metric{
+						{
+							LabelKeys:   labelKeys,
+							LabelValues: labelValues,
+							Value:       1,
+						},
+					},
+				}
+			}),
+		},
+		{
+			Name: "kube_certificatesigningrequest_created",
+			Type: metric.Gauge,
+			Help: "Unix creation timestamp",
+			GenerateFunc: wrapCSRFunc(func(csr *certv1beta1.CertificateSigningRequest) *metric.Family {
+				ms := []*metric.Metric{}
+				if !csr.CreationTimestamp.IsZero() {
+					ms = append(ms, &metric.Metric{
+						LabelKeys:   []string{},
+						LabelValues: []string{},
+						Value:       float64(csr.CreationTimestamp.Unix()),
+					})
+				}
+
+				return &metric.Family{
+					Metrics: ms,
+				}
+			}),
+		},
+		{
+			Name: "kube_certificatesigningrequest_condition",
+			Type: metric.Gauge,
+			Help: "The number of each certificatesigningrequest condition",
+			GenerateFunc: wrapCSRFunc(func(csr *certv1beta1.CertificateSigningRequest) *metric.Family {
+				return &metric.Family{
+					Metrics: addCSRConditionMetrics(csr.Status),
+				}
+			}),
+		},
+		{
+			Name: "kube_certificatesigningrequest_cert_length",
+			Type: metric.Gauge,
+			Help: "Length of the issued cert",
+			GenerateFunc: wrapCSRFunc(func(csr *certv1beta1.CertificateSigningRequest) *metric.Family {
+				return &metric.Family{
+					Metrics: []*metric.Metric{
+						{
+							LabelKeys:   []string{},
+							LabelValues: []string{},
+							Value:       float64(len(csr.Status.Certificate)),
+						},
+					},
+				}
+			}),
+		},
+	}
+)
+
+func wrapCSRFunc(f func(*certv1beta1.CertificateSigningRequest) *metric.Family) func(interface{}) *metric.Family {
+	return func(obj interface{}) *metric.Family {
+		csr := obj.(*certv1beta1.CertificateSigningRequest)
+
+		metricFamily := f(csr)
+
+		for _, m := range metricFamily.Metrics {
+			m.LabelKeys = append(descCSRLabelsDefaultLabels, m.LabelKeys...)
+			m.LabelValues = append([]string{csr.Name}, m.LabelValues...)
+		}
+
+		return metricFamily
+	}
+}
+
+func createCSRListWatch(kubeClient clientset.Interface, ns string) cache.ListWatch {
+	return cache.ListWatch{
+		ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+			return kubeClient.CertificatesV1beta1().CertificateSigningRequests().List(opts)
+		},
+		WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+			return kubeClient.CertificatesV1beta1().CertificateSigningRequests().Watch(opts)
+		},
+	}
+}
+
+// addCSRConditionMetrics generates one metric for each possible csr condition status
+func addCSRConditionMetrics(cs certv1beta1.CertificateSigningRequestStatus) []*metric.Metric {
+	cApproved := 0
+	cDenied := 0
+	for _, s := range cs.Conditions {
+		if s.Type == certv1beta1.CertificateApproved {
+			cApproved++
+		}
+		if s.Type == certv1beta1.CertificateDenied {
+			cDenied++
+		}
+	}
+
+	return []*metric.Metric{
+		{
+			LabelValues: []string{"approved"},
+			Value:       float64(cApproved),
+			LabelKeys:   []string{"condition"},
+		},
+		{
+			LabelValues: []string{"denied"},
+			Value:       float64(cDenied),
+			LabelKeys:   []string{"condition"},
+		},
+	}
+}