feat: add metrics — fix cardinality bug, add outcome/adoption tracking

.github/workflows/codeql.yaml

@@ -0,0 +1,51 @@
+name: CodeQL
+on:
+  push:
+    branches:
+    - 'main'
+  pull_request:
+    branches:
+    - 'main'
+  schedule:
+  - cron: '21 3 * * 3'
+
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['go']
+
+    steps:
+    - name: checkout
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Set up Go
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      with:
+        go-version: 1.26.5
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Build
+      # Autobuild's heuristic only traced a fraction of the module (79 of 189 files per the
+      # code-scanning diagnostic). Build the whole module explicitly so CodeQL sees every package.
+      run: go build ./...
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      with:
+        category: "/language:${{ matrix.language }}"

.github/workflows/scorecard.yaml

@@ -0,0 +1,45 @@
+name: Scorecard supply-chain security
+on:
+  branch_protection_rule:
+  schedule:
+  - cron: '30 2 * * 1'
+  push:
+    branches:
+    - 'main'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+    - name: checkout
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+
+    - name: Run analysis
+      uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+      with:
+        results_file: results.sarif
+        results_format: sarif
+        publish_results: true
+
+    - name: Upload artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: SARIF file
+        path: results.sarif
+        retention-days: 5
+
+    - name: Upload to code-scanning
+      uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      with:
+        sarif_file: results.sarif

README.md

@@ -1,5 +1,6 @@
 [![CI](https://github.com/projectsveltos/event-manager/actions/workflows/main.yaml/badge.svg)](https://github.com/projectsveltos/event-manager/actions)
-[![Go Report Card](https://goreportcard.com/badge/github.com/projectsveltos/event-manager)](https://goreportcard.com/report/github.com/projectsveltos/event-manager)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/projectsveltos/event-manager/badge)](https://scorecard.dev/viewer/?uri=github.com/projectsveltos/event-manager)
+[![CodeQL](https://github.com/projectsveltos/event-manager/actions/workflows/codeql.yaml/badge.svg)](https://github.com/projectsveltos/event-manager/actions/workflows/codeql.yaml)
 [![Release](https://img.shields.io/github/v/release/projectsveltos/event-manager)](https://github.com/projectsveltos/event-manager/releases)
 [![License](https://img.shields.io/badge/license-Apache-blue.svg)](LICENSE)
 [![Slack](https://img.shields.io/badge/join%20slack-%23projectsveltos-brighteen)](https://join.slack.com/t/projectsveltos/shared_invite/zt-1hraownbr-W8NTs6LTimxLPB8Erj8Q6Q)
@@ -52,8 +53,8 @@ spec:
    value: fv
 ```
 
-Sveltos supports custom events written in [Lua](https://www.lua.org/). 
-Following EventSource instance again defines an Event as the creation/deletion of a Service with label *sveltos: fv* but using a Lua script. 
+Sveltos supports custom events written in [Lua](https://www.lua.org/).
+Following EventSource instance again defines an Event as the creation/deletion of a Service with label *sveltos: fv* but using a Lua script.
 
 ```yaml
 apiVersion: lib.projectsveltos.io/v1beta1
@@ -89,11 +90,11 @@ spec:
 
 Event manager is a Sveltos micro service in charge of deploying add-ons when certain events happen in managed clusters.
 
-## Contributing 
+## Contributing
 
 ❤️ Your contributions are always welcome! If you want to contribute, have questions, noticed any bug or want to get the latest project news, you can connect with us in the following ways:
 
-1. Open a bug/feature enhancement on github [![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectsveltos/addon-controller/issues)
+1. Open a bug/feature enhancement on github [![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectsveltos/event-manager/issues)
 2. Chat with us on the Slack in the #projectsveltos channel [![Slack](https://img.shields.io/badge/join%20slack-%23projectsveltos-brighteen)](https://join.slack.com/t/projectsveltos/shared_invite/zt-1hraownbr-W8NTs6LTimxLPB8Erj8Q6Q)
 3. [Contact Us](mailto:support@projectsveltos.io)
 

SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+## Supported Versions
+
+We release security fixes for the latest minor version. We encourage all users to stay on the latest release.
+
+| Version        | Supported          |
+|----------------|--------------------|
+| latest release | :white_check_mark: |
+| older releases | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+If you believe you have found a security vulnerability in any Sveltos repository, please report it responsibly by sending an email to:
+
+**support@projectsveltos.io**
+
+Please include as much of the following information as possible to help us understand and resolve the issue quickly:
+
+- A description of the vulnerability and its potential impact
+- The affected component(s) and version(s)
+- Step-by-step instructions to reproduce the issue
+- Any proof-of-concept or exploit code (if applicable)
+- Suggested remediation (if any)
+
+## Response Process
+
+- You will receive an acknowledgement within **2 business days**
+- We will investigate and keep you informed of our progress
+- Once the issue is confirmed, we will work on a fix and coordinate a release
+- We will publicly disclose the vulnerability after a fix is available, giving you credit unless you prefer to remain anonymous
+
+## Scope
+
+This policy covers all projects under the [projectsveltos](https://github.com/projectsveltos) GitHub organization.
+
+## Out of Scope
+
+- Vulnerabilities in dependencies (please report those to the upstream project)
+- Issues in non-production branches or unreleased code
+- Social engineering attacks
+
+## Thank You
+
+We appreciate responsible disclosure and the work of the security community in keeping Sveltos and its users safe.

config/rbac/kustomization.yaml

@@ -10,10 +10,10 @@ resources:
 # Comment the following 4 lines if you want to disable
 # the auth proxy (https://github.com/brancz/kube-rbac-proxy)
 # which protects your /metrics endpoint.
-# - auth_proxy_service.yaml
-# - auth_proxy_role.yaml
-# - auth_proxy_role_binding.yaml
-# - auth_proxy_client_clusterrole.yaml
+- auth_proxy_service.yaml
+- auth_proxy_role.yaml
+- auth_proxy_role_binding.yaml
+- auth_proxy_client_clusterrole.yaml
 # For each CRD, "Editor" and "Viewer" roles are scaffolded by
 # default, aiding admins in cluster management. Those roles are
 # not used by the Project itself. You can comment the following lines

controllers/eventreport_collection.go

@@ -840,6 +840,9 @@ func updateAllClusterProfiles(ctx context.Context, mgmtClient client.Client, clu
 			continue
 		}
 
+		trackMatchingResources(eventTriggers[i].Name, cluster.Namespace, cluster.Name, clusterType,
+			len(er.Spec.MatchingResources), l)
+
 		l.V(logs.LogDebug).Info("updating ClusterProfile")
 		err = updateClusterProfiles(ctx, mgmtClient, cluster.Namespace, cluster.Name, clusterType,
 			eventTriggers[i], er, l)

controllers/eventtrigger_controller.go

@@ -277,7 +277,9 @@ func (r *EventTriggerReconciler) reconcileNormal(
 
 	matchingCluster = append(matchingCluster, clusterSetClusters...)
 
-	eventTriggerScope.SetMatchingClusterRefs(removeDuplicates(matchingCluster))
+	matchingClusters := removeDuplicates(matchingCluster)
+	eventTriggerScope.SetMatchingClusterRefs(matchingClusters)
+	trackMatchingClusters(eventTriggerScope.EventTrigger.Name, len(matchingClusters), logger)
 
 	err = r.updateClusterInfo(ctx, eventTriggerScope)
 	if err != nil {

controllers/eventtrigger_deployer.go

@@ -161,6 +161,7 @@ func (r *EventTriggerReconciler) deployEventTrigger(ctx context.Context, eScope
 
 						allProcessed = false
 					}
+					r.trackClusterInfoOutcome(clusterInfo, resource.Name, l)
 				}
 			}
 		}
@@ -191,6 +192,27 @@ func (r *EventTriggerReconciler) deployEventTrigger(ctx context.Context, eScope
 	return nil
 }
 
+// trackClusterInfoOutcome records reconcile-outcome metrics for a terminal clusterInfo.Status. Non-terminal
+// statuses (Provisioning, Removing) are intentionally not tracked.
+func (r *EventTriggerReconciler) trackClusterInfoOutcome(clusterInfo *libsveltosv1beta1.ClusterInfo,
+	eventTriggerName string, logger logr.Logger) {
+
+	clusterType := clusterproxy.GetClusterType(&clusterInfo.Cluster)
+
+	switch clusterInfo.Status {
+	case libsveltosv1beta1.SveltosStatusProvisioned, libsveltosv1beta1.SveltosStatusRemoved:
+		trackReconcileOutcome(clusterInfo.Cluster.Namespace, clusterInfo.Cluster.Name, clusterType,
+			true, eventTriggerName, logger)
+		trackLastSuccess(clusterInfo.Cluster.Namespace, clusterInfo.Cluster.Name, clusterType,
+			time.Now(), eventTriggerName, logger)
+	case libsveltosv1beta1.SveltosStatusFailed, libsveltosv1beta1.SveltosStatusFailedNonRetriable:
+		trackReconcileOutcome(clusterInfo.Cluster.Namespace, clusterInfo.Cluster.Name, clusterType,
+			false, eventTriggerName, logger)
+	case libsveltosv1beta1.SveltosStatusProvisioning, libsveltosv1beta1.SveltosStatusRemoving:
+		// Non-terminal; nothing to track yet.
+	}
+}
+
 // undeployEventBasedAddon clean resources in managed clusters
 func (r *EventTriggerReconciler) undeployEventTrigger(ctx context.Context, eScope *scope.EventTriggerScope,
 	clusterInfo []libsveltosv1beta1.ClusterInfo, logger logr.Logger) error {
@@ -1412,35 +1434,37 @@ func updateClusterProfiles(ctx context.Context, c client.Client, clusterNamespac
 
 	if eventTrigger.Spec.OneForEvent {
 		logger.V(logs.LogDebug).Info("updating one clusterProfile per resource")
+		// Instantiate ConfigMap/Secrets from ConfigMapGenerator/SecretGenerator first: the
+		// ClusterProfile is created/updated only once the resources it may depend on are ready,
+		// so a generator failure does not leave behind a ClusterProfile for this reconcile pass.
+		fromGenerators, err = instantiateFromGeneratorsPerResource(ctx, c, eventTrigger, er, clusterNamespace,
+			clusterName, clusterType, logger)
+		if err != nil {
+			logger.V(logs.LogInfo).Error(err, "failed to instantiate from generators")
+			return err
+		}
 		clusterProfiles, err = instantiateOneClusterProfilePerResource(ctx, c, clusterNamespace, clusterName,
 			clusterType, eventTrigger, er, logger)
 		if err != nil {
 			logger.V(logs.LogInfo).Error(err,
 				"failed to create one clusterProfile instance per matching resource")
 			return err
 		}
-		// Instantiate ConfigMap/Secrets from ConfigMapGenerator/SecretGenerator
-		fromGenerators, err = instantiateFromGeneratorsPerResource(ctx, c, eventTrigger, er, clusterNamespace,
+	} else {
+		logger.V(logs.LogDebug).Info("updating one clusterProfile for all resources")
+		fromGenerators, err = instantiateFromGeneratorsPerAllResource(ctx, c, eventTrigger, er, clusterNamespace,
 			clusterName, clusterType, logger)
 		if err != nil {
 			logger.V(logs.LogInfo).Error(err, "failed to instantiate from generators")
 			return err
 		}
-	} else {
-		logger.V(logs.LogDebug).Info("updating one clusterProfile for all resources")
 		clusterProfiles, err = instantiateOneClusterProfilePerAllResource(ctx, c, clusterNamespace, clusterName,
 			clusterType, eventTrigger, er, logger)
 		if err != nil {
 			logger.V(logs.LogInfo).Error(err,
 				"failed to create one clusterProfile instance per matching resource")
 			return err
 		}
-		fromGenerators, err = instantiateFromGeneratorsPerAllResource(ctx, c, eventTrigger, er, clusterNamespace,
-			clusterName, clusterType, logger)
-		if err != nil {
-			logger.V(logs.LogInfo).Error(err, "failed to instantiate from generators")
-			return err
-		}
 	}
 
 	// ClusterProfiles created because of CloudEvents are removed when CloudEventAction is set to Delete.