Skip to content

feat: add OpenTelemetry metrics for validation result cache - #1936

Open
nissessenap wants to merge 3 commits into
sigstore:mainfrom
nissessenap:metrics
Open

nissessenap wants to merge 3 commits into
sigstore:mainfrom
nissessenap:metrics

Conversation

@nissessenap

@nissessenap nissessenap commented Feb 17, 2026 •

Copy link
Copy Markdown

Summary

Depends on #1933, which this branch is stacked on. Only the top commit belongs to this PR.

Adds OpenTelemetry metrics so operators can check that the validation result cache is doing something. They use the global MeterProvider that knative sharedmain sets up. Instrumentation scope is github.com/sigstore/policy-controller/pkg/webhook.

Metric Type Attributes
policy_controller.cache.operations counter result: hit / miss
policy_controller.cache.writes counter result: stored / skipped
policy_controller.cache.entries observable gauge none
policy_controller.cache.evictions counter reason: purge

Notes:

  • Lookups are counted per (image, policy) pair, not per admission request.
  • entries is read from the cache at collection time and leaves out expired entries.
  • evictions only counts entries dropped by a config-change purge. LRUExpireCache has no callback for entries evicted because the cache is full.
  • Instrument creation errors go to otel.Handle.

Since #2044, knative's metrics-protocol defaults to none, so /metrics on :9090 is empty unless config-observability sets metrics-protocol: prometheus. Verified in kind with that set: policy_controller_cache_operations_total{result="hit"}, policy_controller_cache_entries and the other metrics showed up and matched the admissions made.

Release Note

Added OpenTelemetry metrics for the validation result cache: policy_controller.cache.operations, .writes, .entries and .evictions.

Documentation

NONE

🤖 Generated with Claude Code

@nissessenap
nissessenap force-pushed the metrics branch 2 times, most recently from 24f35dd to c2a9cc6 Compare November 9, 2026 18:33
@nissessenap nissessenap changed the title feat: add LRU validation cache with OpenTelemetry metrics feat: add OpenTelemetry metrics for validation result cache Nov 9, 2026
nissessenap and others added 3 commits November 9, 2026 19:58
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Edvin Norling <edvin.norling@kognic.com>
Add a package-level newResultCache func var in cmd/webhook so the
admission test can wrap the real LRUCache with a spy that counts cache
hits and misses, replacing the zap observer that grepped the
"cache hit"/"cache miss" debug logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Edvin Norling <edvin.norling@kognic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Edvin Norling <edvin.norling@kognic.com>
@nissessenap
nissessenap marked this pull request as ready for review November 9, 2026 19:31
@nissessenap
nissessenap requested a review from a team as a code owner November 9, 2026 19:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant