From 2f0cd5366f2ee3579998c769527dcd22b487ec3b Mon Sep 17 00:00:00 2001 From: modulitos Date: Wed, 27 Nov 2024 15:27:32 -0800 Subject: [PATCH] fix missingSACounter metric --- pkg/handler/handler.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkg/handler/handler.go b/pkg/handler/handler.go index a5df9809..0259da3a 100644 --- a/pkg/handler/handler.go +++ b/pkg/handler/handler.go @@ -433,9 +433,13 @@ func (m *Modifier) buildPodPatchConfig(pod *corev1.Pod) *podPatchConfig { } // Use the STS WebIdentity method if set + gracePeriodEnabled := m.saLookupGraceTime > 0 request := cache.Request{Namespace: pod.Namespace, Name: pod.Spec.ServiceAccountName, RequestNotification: true} response := m.Cache.Get(request) - if !response.FoundInCache && m.saLookupGraceTime > 0 { + if !response.FoundInCache && !gracePeriodEnabled { + missingSACounter.WithLabelValues().Inc() + } + if !response.FoundInCache && gracePeriodEnabled { klog.Warningf("Service account %s not found in the cache. Waiting up to %s to be notified", request.CacheKey(), m.saLookupGraceTime) select { case <-response.Notifier: @@ -443,10 +447,12 @@ func (m *Modifier) buildPodPatchConfig(pod *corev1.Pod) *podPatchConfig { response = m.Cache.Get(request) if !response.FoundInCache { klog.Warningf("Service account %s not found in the cache after being notified. Not mutating.", request.CacheKey()) + missingSACounter.WithLabelValues().Inc() return nil } case <-time.After(m.saLookupGraceTime): klog.Warningf("Service account %s not found in the cache after %s. Not mutating.", request.CacheKey(), m.saLookupGraceTime) + missingSACounter.WithLabelValues().Inc() return nil } } @@ -503,7 +509,6 @@ func (m *Modifier) MutatePod(ar *v1beta1.AdmissionReview) *v1beta1.AdmissionResp patchConfig := m.buildPodPatchConfig(&pod) if patchConfig == nil { - missingSACounter.WithLabelValues().Inc() klog.V(4).Infof("Pod was not mutated. Reason: "+ "Service account did not have the right annotations or was not found in the cache. %s", logContext(pod.Name, pod.GenerateName, pod.Spec.ServiceAccountName, pod.Namespace)) return &v1beta1.AdmissionResponse{