feat(KONFLUX-14971, kaexporter): use cfg file for tenant exclusions

[pacho-rh]

KAExporter has been updated per redhat-appstudio/o11y#1236 to read a configuration file for a list of tenants/namespace to exclude when collecting metrics. Defining the ConfigMap and patching the KAExporter deployment here to exclude tenants we can ignore.

[github-actions]

Kustomize Render Diff

Comparing 92fc8c2f3 → e076db9cf

Component	Environment	Changes
components/monitoring/exporters/kaexporter/staging/stone-stage-p01	staging	+46 -22
components/monitoring/exporters/kaexporter/staging/stone-stg-rh01	staging	+46 -22

Total: 2 components, +92 -44 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

[qodo-for-redhat-appstudio]

PR Summary by Qodo

kaexporter: configure excluded namespaces via ConfigMap-backed config file

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Add a KAExporter config file defining namespaces/tenants to exclude from metrics collection.
• Generate a stable ConfigMap and mount it into the KAExporter Deployment.
• Bump KAExporter base/image ref to the upstream version that supports config-file exclusions.

Diagram

graph TD
A["Staging base kustomization"] --> B["configs/kustomization.yaml"] --> C[("ConfigMap: kaexporter-config")] --> D["/etc/kaexporter/kaexporter-config.yaml"] --> E["KAExporter container"]
A --> F["kaexporter-deployment-patch.yaml"] --> G["kaexporter Deployment"] --> E

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Inline exclusions as env var list (no file mount)

• ➕ Avoids adding a volume/volumeMount
• ➕ Slightly simpler manifest surface area
• ➖ Harder to manage/extend as the list grows
• ➖ More error-prone quoting/escaping for patterns like managed-*
• ➖ Ties configuration to deployment spec instead of a config artifact

2. Patch upstream base to include optional config support by default

• ➕ Reduces overlay-specific patches across environments
• ➕ Keeps config plumbing centralized in one base
• ➖ Requires coordinating changes in the upstream o11y config repo
• ➖ May be undesirable if not all consumers want the mount/env wiring

Recommendation: Current approach (generate a stable ConfigMap and patch the Deployment to mount it + set KA_CONFIG_FILE) is the best fit: it cleanly separates configuration from the Deployment, supports glob patterns, and aligns with the upstream KAExporter capability without requiring image rebuilds. Alternatives were considered but are either less maintainable (env var list) or require broader coordination (upstream base changes).

Files changed (4) +43 / -2

Enhancement (1) +6 / -2

kustomization.yamlWire configs into staging base and bump upstream kaexporter ref +6/-2

Wire configs into staging base and bump upstream kaexporter ref

• Adds the new configs resource and applies the Deployment patch. Updates the upstream o11y base reference and the image tag to a revision that supports reading exclusions from a config file.

components/monitoring/exporters/kaexporter/staging/base/kustomization.yaml

Other (3) +37 / -0

kaexporter-config.yamlDefine excluded namespaces/tenants for KAExporter +6/-0

Define excluded namespaces/tenants for KAExporter

• Adds a KAExporter config file specifying excludeNamespaces, including both explicit namespaces and glob-style patterns. This list is intended to filter out tenants/namespaces that should not be scraped for metrics.

components/monitoring/exporters/kaexporter/staging/base/configs/kaexporter-config.yaml

kaexporter-deployment-patch.yamlPatch KAExporter Deployment to mount config and set KA_CONFIG_FILE +21/-0

Patch KAExporter Deployment to mount config and set KA_CONFIG_FILE

• Introduces a Deployment patch that adds a ConfigMap-backed volume and mounts it at /etc/kaexporter. Sets the KA_CONFIG_FILE environment variable to point KAExporter at the mounted config file.

components/monitoring/exporters/kaexporter/staging/base/configs/kaexporter-deployment-patch.yaml

kustomization.yamlGenerate stable kaexporter-config ConfigMap via Kustomize +10/-0

Generate stable kaexporter-config ConfigMap via Kustomize

• Adds a configs kustomization that uses configMapGenerator to create a kaexporter-config ConfigMap from kaexporter-config.yaml. Disables the name suffix hash to keep the ConfigMap name stable for the Deployment mount.

components/monitoring/exporters/kaexporter/staging/base/configs/kustomization.yaml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.11%. Comparing base (784d224) to head (6b47a32).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13057   +/-   ##
=======================================
  Coverage   57.11%   57.11%           
=======================================
  Files          23       23           
  Lines        1455     1455           
=======================================
  Hits          831      831           
  Misses        548      548           
  Partials       76       76           

Flag	Coverage Δ
go	57.11% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[raks-tt]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pacho-rh, raks-tt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• components/monitoring/OWNERS [pacho-rh,raks-tt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-for-redhat-appstudio]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 3 rules

1. Patch namespace mismatch risk 🐞 Bug ≡ Correctness

Description

The KAExporter Deployment strategic-merge patch hard-codes metadata.namespace, but the parent
kustomization doesn’t set a namespace and KAExporter resources in this repo commonly omit
metadata.namespace (namespace comes from ArgoCD destination). If the upstream/base Deployment is
also namespace-less, Kustomize may not match/apply this patch, so KA_CONFIG_FILE and the ConfigMap
mount won’t be added and exclusions will be ignored.

Code

components/monitoring/exporters/kaexporter/staging/base/configs/kaexporter-deployment-patch.yaml[R3-6]

+metadata:
+  name: kaexporter-deployment
+  namespace: konflux-o11y-exporters
+spec:

Relevance

⭐⭐⭐ High

Team previously fixed silent kustomize patch non-matches causing misconfig/ArgoCD issues (PRs
#10176, #10610).

PR-#10176
PR-#10610

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The patch explicitly sets a namespace, while the staging base kustomization does not define a
namespace: transformer. The KAExporter manifests in this repo are applied to
konflux-o11y-exporters via ArgoCD destination namespace, and local KAExporter resources omit
metadata.namespace, so a namespace-qualified patch introduces a real risk of not matching an
upstream namespace-less Deployment.

components/monitoring/exporters/kaexporter/staging/base/configs/kaexporter-deployment-patch.yaml[1-6]
components/monitoring/exporters/kaexporter/staging/base/kustomization.yaml[1-13]
components/monitoring/exporters/kaexporter/staging/base/external-secrets/ka-kubearchive-credentials.yaml[1-5]
components/monitoring/exporters/kaexporter/staging/base/rbac/kaexporter-maintainers.yaml[1-5]
argo-cd-apps/base/member/infra-deployments/monitoring-konflux-o11y-exporters/monitoring-workload-konflux-o11y-exporters.yaml[45-51]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The KAExporter Deployment patch includes `metadata.namespace: konflux-o11y-exporters`. Kustomize patch matching for namespaced resources is sensitive to namespace, so if the upstream/base Deployment does not set `metadata.namespace`, the patch can be skipped and the config file won’t be mounted/used.

### Issue Context
In this repo, KAExporter resources under `components/monitoring/exporters/kaexporter/**` typically omit `metadata.namespace`, and ArgoCD sets the destination namespace to `konflux-o11y-exporters`.

### Fix (choose one robust approach)
1) Prefer: add `namespace: konflux-o11y-exporters` to the parent kustomization so all resources (including the upstream remote base Deployment) are consistently namespaced during kustomize processing, and remove per-resource namespace fields.

2) Or: convert the patch to a targeted patch (`patches` entry with `target: {kind: Deployment, name: ...}`) and remove `metadata.namespace` from the patch so it matches regardless of whether the upstream sets namespace.

### Fix Focus Areas
- components/monitoring/exporters/kaexporter/staging/base/kustomization.yaml[1-13]
- components/monitoring/exporters/kaexporter/staging/base/configs/kaexporter-deployment-patch.yaml[1-6]
- components/monitoring/exporters/kaexporter/staging/base/configs/kustomization.yaml[1-10]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---