chore(controller/reporting): init, setup prometheus basics, setup tracing event propagation

.cargo/config.toml

@@ -0,0 +1,9 @@
+[build]
+rustflags = ["--cfg=has_std", "-Zthreads=6", "-Clink-arg=-fdebug-types-section"]
+
+[target.x86_64-unknown-linux-gnu]
+rustflags = [
+   "-Ctarget-feature=+sse,+sse2,+sse3,+sse4.1,+sse4.2,+aes,+avx,+avx2,+bmi1,+bmi2,+popcnt,+pclmulqdq,+rdrand,+rdseed,+fma,+lzcnt,+sha",
+   "-Csplit-debuginfo=unpacked",
+   "-Clink-arg=-fuse-ld=mold",
+]

.cargo/container-release.toml

@@ -0,0 +1,6 @@
+[build]
+rustflags = ["-Zlocation-detail=none"]
+target = ["x86_64-unknown-linux-gnu"]
+
+[unstable]
+build-std = ["std", "panic_abort", "core", "alloc"]

Cargo.toml

@@ -0,0 +1,86 @@
+[workspace]
+resolver = "3"
+members = ["kuyaseg-controller"]
+
+[workspace.package]
+version = "0.0.1"
+edition = "2024"
+rust-version = "1.97"
+license = "MIT"
+license-file = "LICENSE"
+authors = ["Svyatoslav Pushkarev <spushk@spushk.ru>"]
+repository = "https://source.spushk.ru/kubeworks/kube-yaseg"
+publish = false
+
+[workspace.dependencies]
+## Rt
+mimalloc.version = "^0.1"
+mimalloc.features = ["secure"]
+tokio.version = "^1"
+tokio.features = ["macros", "rt-multi-thread"]
+axum.version = "^0.8"
+## Tracing
+tracing.version = "^0.1"
+tracing.features = ["max_level_trace", "release_max_level_info"]
+tracing-subscriber.version = "^0.3"
+tracing-opentelemetry.version = "^0.32"
+opentelemetry.version = "^0.31"
+opentelemetry.features = ["trace"]
+opentelemetry-otlp.version = "^0.31"
+opentelemetry-otlp.features = ["grpc-tonic", "reqwest-rustls"]
+opentelemetry_sdk.version = "^0.31"
+opentelemetry_sdk.features = ["rt-tokio"]
+## Utils
+jiff.version = "^0.2"
+scopeguard.version = "^1"
+smallvec.version = "^1"
+## Marshal
+schemars.version = "^1"
+base64.version = "^0.22"
+serde.version = "^1"
+serde.features = ["derive"]
+serde_json.version = "^1"
+serde_yaml.version = "^0.9"
+## k8s
+kube.version = "^3"
+kube.features = ["derive"]
+k8s-openapi.version = "^0.27"
+k8s-openapi.features = ["latest", "schemars"]
+prometheus-client.version = "^0.24"
+## Codegen
+thiserror.version = "^2"
+anyhow.version = "^1"
+## Crypto
+aws-lc-rs.version = "^1"
+aws-lc-rs.features = ["fips", "bindgen"]
+rand.version = "^0.10"
+ssh-key.version = "^0.7.0-rc"
+rand_hc.version = "^0.5"
+blake3.version = "^1"
+blake3.features = ["zeroize"]
+zeroize.version = "^1"
+zeroize.features = ["derive"]
+
+[profile.dev]
+opt-level = 0
+lto = "off"
+codegen-units = 256
+panic = "unwind"
+debug = "line-tables-only"
+
+[profile.dev.package."*"]
+opt-level = 2
+
+[profile.dev.package.aws-lc-fips-sys] # TODO: won't build, catches .data section ???, minimal pefr impact
+opt-level = 0
+
+[profile.release]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
+panic = "unwind"  # scopeguard
+debug = "none"
+strip = "symbols"
+
+[profile.release.package.aws-lc-fips-sys] # TODO: won't build, catches .data section ???, minimal pefr impact
+opt-level = 0

LICENSE

@@ -0,0 +1,7 @@
+Copyright © 2026 Svyatoslav Pushkarev <spushk at spushk dot ru>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile.toml

@@ -0,0 +1 @@
+[tasks.format]

deny.toml

@@ -0,0 +1,57 @@
+[graph]
+targets = [
+    {triple = "x86_64-unknown-linux-gnu"},
+]
+all-features = false
+no-default-features = false
+
+[output]
+feature-depth = 1
+
+[advisories]
+db-urls = ["https://github.com/rustsec/advisory-db"]
+ignore = []
+
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "Unlicense",
+    "BSL-1.0",
+    "ISC",
+    "Unicode-3.0",
+    "Zlib",
+    "OpenSSL"
+]
+confidence-threshold = 0.8
+exceptions = []
+
+[licenses.private]
+ignore = true
+registries = []
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+highlight = "simplest-path"
+workspace-default-features = "allow"
+external-default-features = "allow"
+allow = []
+allow-workspace = false
+deny = []
+skip-tree = []
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
+
+[sources.allow-org]
+github = []
+gitlab = []
+bitbucket = []

kuyaseg-controller/Cargo.toml

@@ -0,0 +1,55 @@
+[package]
+name = "kuyaseg-controller"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+license-file.workspace = true
+authors.workspace = true
+repository.workspace = true
+publish.workspace = true
+
+[[bin]]
+doc = false
+name = "generate_crds"
+path = "src/bin/generate_crds.rs"
+
+[dependencies]
+## Rt
+mimalloc.workspace = true
+tokio.workspace = true
+axum.workspace = true
+## Tracing
+tracing.workspace = true
+tracing-subscriber.workspace = true
+tracing-subscriber.features = ["env-filter"]
+tracing-opentelemetry.workspace = true
+opentelemetry.workspace = true
+opentelemetry-otlp.workspace = true
+opentelemetry_sdk.workspace = true
+prometheus-client.workspace = true
+## Utils
+jiff.workspace = true
+scopeguard.workspace = true
+smallvec.workspace = true
+## Marshal
+schemars.workspace = true
+base64.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+serde_yaml.workspace = true
+## k8s
+kube.workspace = true
+kube.features = ["runtime", "client"]
+k8s-openapi.workspace = true
+## Codegen
+thiserror.workspace = true
+anyhow.workspace = true
+## Crypto
+aws-lc-rs.workspace = true
+rand.workspace = true
+ssh-key.workspace = true
+ssh-key.features = ["ed25519"]
+rand_hc.workspace = true
+blake3.workspace = true
+zeroize.workspace = true

kuyaseg-controller/src/bin/generate_crds.rs

@@ -0,0 +1 @@
+fn main() {}

kuyaseg-controller/src/lib.rs

@@ -0,0 +1,4 @@
+#![feature(sync_nonpoison, nonpoison_rwlock)]
+
+pub mod reporting;
+pub mod utils;

kuyaseg-controller/src/main.rs

@@ -0,0 +1,7 @@
+#[global_allocator]
+static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    todo!("WIP")
+}

kuyaseg-controller/src/reporting/mod.rs

@@ -0,0 +1,2 @@
+pub mod prometheus;
+pub mod tracing_evt;

kuyaseg-controller/src/reporting/prometheus.rs

@@ -0,0 +1,44 @@
+use prometheus_client::encoding::{
+    EncodeLabelSet,
+    EncodeLabelValue,
+};
+use prometheus_client::metrics::counter::Counter;
+use prometheus_client::metrics::family::Family;
+
+#[derive(Default, Clone)]
+pub struct ProMetrics {
+    k8s_metrics: Family<ProK8sLabel, Counter>,
+}
+
+impl ProMetrics {
+    pub fn measure(&self, label: &ProLabel) {
+        match label {
+            ProLabel::K8s(label) => {
+                self.k8s_metrics.get_or_create(label).inc();
+            }
+        }
+    }
+}
+
+pub enum ProLabel {
+    K8s(ProK8sLabel),
+}
+
+#[derive(Clone, Hash, PartialEq, Eq, EncodeLabelSet)]
+pub struct ProK8sLabel {
+    pub severity: ProK8sSeverity,
+    pub reason: String,
+    pub name: String,
+    pub kind: String,
+    pub namespace: Option<String>,
+}
+
+#[derive(Clone, Hash, PartialEq, Eq, EncodeLabelValue)]
+#[allow(non_camel_case_types)] // verbatim label value encoding must match k8s standard
+pub enum ProK8sSeverity {
+    critical,
+    error,
+    warning,
+    info,
+    debug,
+}

kuyaseg-controller/src/reporting/tracing_evt.rs

@@ -0,0 +1,293 @@
+use std::sync::nonpoison::RwLock;
+
+use k8s_openapi::api::core::v1::ObjectReference;
+use kube::runtime::events::{
+    Event,
+    EventType,
+};
+use tokio::sync::mpsc;
+use tracing::field::Visit;
+use tracing::span::Attributes;
+use tracing::{
+    Event as TracingEvent,
+    Id,
+    Subscriber,
+};
+use tracing_subscriber::Layer;
+use tracing_subscriber::layer::Context;
+use tracing_subscriber::registry::LookupSpan;
+
+use crate::reporting::prometheus::{
+    ProK8sLabel,
+    ProK8sSeverity,
+    ProLabel,
+    ProMetrics,
+};
+
+/// - k8s events are not automatically recorded
+/// - prometheus labels are recorded if metrics are set for layer
+pub enum TracingK8sEvent {
+    K8sEvent { reference: ObjectReference, event: Event },
+    ProLabel { label: ProLabel },
+}
+
+/// Watches for tracing events, containing information necessary to construst k8s events and write prometheus metrics.
+///
+/// - k8s native events you must record yourself - thats what `tx` is for.
+/// - prometheus metrics are written automatically (if metrics set), but labels are also send with `tx`.
+/// - k8s events are NOT rate-limited. K8s API rejects >10 events/object/min.
+///   Channel consumer must batch/dedup to avoid API errors.
+pub struct TracingK8sEventLayer {
+    tx: RwLock<mpsc::UnboundedSender<TracingK8sEvent>>,
+    metrics: RwLock<Option<ProMetrics>>,
+}
+
+impl TracingK8sEventLayer {
+    pub fn new(tx: mpsc::UnboundedSender<TracingK8sEvent>, metrics: Option<ProMetrics>) -> Self {
+        Self {
+            tx: RwLock::new(tx),
+            metrics: RwLock::new(metrics),
+        }
+    }
+
+    pub fn reload_tx(&self, tx: mpsc::UnboundedSender<TracingK8sEvent>) {
+        *self.tx.write() = tx;
+    }
+
+    pub fn reload_metrics(&self, metrics: Option<ProMetrics>) {
+        *self.metrics.write() = metrics;
+    }
+}
+
+impl<S> Layer<S> for TracingK8sEventLayer
+where
+    S: Subscriber + for<'a> LookupSpan<'a>,
+{
+    fn on_new_span(&self, attrs: &Attributes<'_>, id: &Id, ctx: Context<'_, S>) {
+        let mut fields = SpanFields::default();
+        attrs.record(&mut fields);
+
+        if fields.has_any_fields()
+            && let Some(span) = ctx.span(id)
+        {
+            if let Some(prev) = span.extensions_mut().get_mut::<SpanFields>() {
+                prev.under_owned(fields);
+            } else {
+                span.extensions_mut().insert(fields);
+            }
+        }
+    }
+
+    fn on_event(&self, event: &TracingEvent<'_>, ctx: Context<'_, S>) {
+        let scope = match ctx.event_scope(event) {
+            Some(s) => s,
+            None => return,
+        };
+
+        // construct & check event fields
+        let mut span_fields = SpanFields::default();
+        for span in scope.from_root() {
+            if let Some(fields) = span.extensions().get::<SpanFields>() {
+                span_fields.under(fields);
+            }
+        }
+        if !span_fields.check_fields() {
+            return;
+        }
+
+        // construct & check pro fields
+        let mut event_fields = EventFields::default();
+        event.record(&mut event_fields);
+        if !event_fields.check_fields() {
+            return;
+        }
+
+        // calculate event types
+        let (k8s_event_type, pro_severity) = match *event.metadata().level() {
+            tracing::Level::ERROR => (
+                EventType::Warning,
+                if event_fields.critical.is_some_and(|v| v) {
+                    ProK8sSeverity::critical
+                } else {
+                    ProK8sSeverity::error
+                },
+            ),
+            tracing::Level::WARN => (EventType::Warning, ProK8sSeverity::warning),
+            tracing::Level::INFO => (EventType::Normal, ProK8sSeverity::info),
+            _ => (EventType::Normal, ProK8sSeverity::debug),
+        };
+
+        let tx = self.tx.read();
+
+        // write k8s event
+        if let Some(event) = event_fields.try_to_event(k8s_event_type) {
+            _ = tx
+                .send(TracingK8sEvent::K8sEvent {
+                    reference: span_fields.to_object(),
+                    event,
+                })
+                .inspect_err(|e| tracing::error!(debug=?e, "Failed to issue event on k8s event from tracing"));
+        }
+
+        // write/measure pro event
+        if let Some(label) = try_create_pro_label(&span_fields, &event_fields, pro_severity) {
+            self.metrics.read().as_ref().map(|metrics| {
+                metrics.measure(&label);
+            });
+
+            _ = tx.send(TracingK8sEvent::ProLabel { label }).inspect_err(
+                |e| tracing::error!(debug=?e, "Failed to issue event on prometheus label measure from tracing"),
+            );
+        }
+    }
+}
+
+#[derive(Clone, Default)]
+struct SpanFields {
+    name: Option<String>,
+    ns: Option<String>,
+    kind: Option<String>,
+    api: Option<String>,
+    uid: Option<String>,
+    version: Option<String>,
+    field_path: Option<String>,
+}
+
+impl SpanFields {
+    #[inline]
+    fn has_any_fields(&self) -> bool {
+        self.name.is_some()
+            || self.ns.is_some()
+            || self.kind.is_some()
+            || self.api.is_some()
+            || self.uid.is_some()
+            || self.version.is_some()
+            || self.field_path.is_some()
+    }
+
+    /// scope-independent (k8s/prometheus) field validation
+    fn check_fields(&self) -> bool {
+        self.name.is_some() && self.kind.is_some()
+    }
+
+    /// Never fails to `None` since no hard-requirements.
+    /// Custom field validation is at `check_fields`
+    fn to_object(&self) -> ObjectReference {
+        ObjectReference {
+            name: self.name.clone(),
+            kind: self.kind.clone(),
+            api_version: self.api.clone(),
+            namespace: self.ns.clone(),
+            resource_version: self.version.clone(),
+            uid: self.uid.clone(),
+            field_path: self.field_path.clone(),
+        }
+    }
+
+    fn under(&mut self, other: &Self) {
+        other.name.as_ref().map(|v| self.name.replace(v.clone()));
+        other.ns.as_ref().map(|v| self.ns.replace(v.clone()));
+        other.kind.as_ref().map(|v| self.kind.replace(v.clone()));
+        other.api.as_ref().map(|v| self.api.replace(v.clone()));
+        other.uid.as_ref().map(|v| self.uid.replace(v.clone()));
+        other.version.as_ref().map(|v| self.version.replace(v.clone()));
+        other.field_path.as_ref().map(|v| self.field_path.replace(v.clone()));
+    }
+
+    fn under_owned(&mut self, other: Self) {
+        other.name.map(|v| self.name.replace(v));
+        other.ns.map(|v| self.ns.replace(v));
+        other.kind.map(|v| self.kind.replace(v));
+        other.api.map(|v| self.api.replace(v));
+        other.uid.map(|v| self.uid.replace(v));
+        other.version.map(|v| self.version.replace(v));
+        other.field_path.map(|v| self.field_path.replace(v));
+    }
+}
+
+impl Visit for SpanFields {
+    fn record_str(&mut self, field: &tracing::field::Field, value: &str) {
+        match field.name() {
+            "k8s_name" => self.name = Some(value.to_string()),
+            "k8s_ns" => self.ns = Some(value.to_string()),
+            "k8s_kind" => self.kind = Some(value.to_string()),
+            "k8s_api" => self.api = Some(value.to_string()),
+            "k8s_uid" => self.uid = Some(value.to_string()),
+            "k8s_version" => self.version = Some(value.to_string()),
+            "k8s_field_path" => self.field_path = Some(value.to_string()),
+            _ => {}
+        }
+    }
+
+    fn record_debug(&mut self, _field: &tracing::field::Field, _value: &dyn std::fmt::Debug) {}
+}
+
+#[derive(Default, Clone)]
+struct EventFields {
+    /// Only for:
+    /// - prometheus label: force event severity to "critical". Only triggers on `ERROR` tracing level
+    critical: Option<bool>,
+    reason: Option<String>,
+    action: Option<String>,
+    message: Option<String>,
+}
+
+impl EventFields {
+    /// Scope independend custom field validation
+    fn check_fields(&self) -> bool {
+        self.reason.is_some() && self.action.is_some()
+    }
+
+    /// Return `None` if hard-requirements on fields not met.
+    /// Custom field validation is `check_fields`
+    fn try_to_event(&self, type_: EventType) -> Option<Event> {
+        Some(Event {
+            type_,
+            reason: self.reason.clone()?,
+            action: self.action.clone()?,
+            note: self.message.clone(),
+            secondary: None,
+        })
+    }
+}
+
+impl Visit for EventFields {
+    fn record_str(&mut self, field: &tracing::field::Field, value: &str) {
+        match field.name() {
+            "reason" => self.reason = Some(value.to_string()),
+            "action" => self.action = Some(value.to_string()),
+            "message" => self.message = Some(value.to_string()),
+            _ => {}
+        }
+    }
+
+    fn record_bool(&mut self, field: &tracing::field::Field, value: bool) {
+        match field.name() {
+            "critical" => self.critical = Some(value),
+            _ => {}
+        }
+    }
+
+    fn record_debug(&mut self, field: &tracing::field::Field, value: &dyn std::fmt::Debug) {
+        if field.name() == "message" {
+            self.message = Some(format!("{value:?}"));
+        }
+    }
+}
+
+/// Try to create ProK8sLabel from provided fields.
+/// Returns `None` if hard requirements on fields are not satisfied.
+/// Custom field validation is done on `SpanFields`/`EventFields` level with `check_fields`
+fn try_create_pro_label(
+    span_fields: &SpanFields,
+    event_fields: &EventFields,
+    severity: ProK8sSeverity,
+) -> Option<ProLabel> {
+    Some(ProLabel::K8s(ProK8sLabel {
+        severity,
+        reason: event_fields.reason.clone()?,
+        name: span_fields.name.clone()?,
+        kind: span_fields.kind.clone()?,
+        namespace: span_fields.ns.clone(),
+    }))
+}

kuyaseg-controller/src/utils/mod.rs

@@ -0,0 +1 @@
+

rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "nightly-2026-05-10"
+components = []

rustfmt.toml

@@ -0,0 +1,5 @@
+imports_layout="Vertical"
+imports_granularity="Module"
+group_imports="StdExternalCrate"
+merge_imports=true
+max_width=120