Repository navigation
Export Crossplane managed-resource conditions as metrics (first increment of #2820) #2993
Description
🤖 Generated by the Agentic Engineer
First increment of #2820. The alerting rule cannot be written before the series
exists, so this child delivers only the metric source.
Evidence
Measured on the live cluster 2026-08-06, over repositories.repo.github.m.upbound.io:
- 20 managed resources;
Synced=Falseon 3,Synced=Trueon 17. - 3 resources report
Ready=TruewhileSynced=False— the exact silent state
Alert when a Crossplane managed resource stops reconciling (Ready=True hides Synced=False) #2820 describes, present right now and non-zero. - 60 condition entries in total (
Synced,Ready,LastAsyncOperation), every one
carrying a non-nullreason, and the value domain is exactlyTrue/False.
That gives the increment a live positive fixture (3) and a live negative one (17)
without constructing anything.
Scope
Repository only, deliberately. CustomResourceStateMetrics matches an exact
groupVersionKind — there is no wildcard and no categories: managed selector — so
each of the 16 managed-resource kinds must be listed individually. Starting with the
one kind that carries the observed failure proves the pipeline end to end before
committing to a list that will drift. Extending coverage is a separate child, and
until it lands the exporter's coverage is explicitly partial.
Acceptance criteria
-
crossplane_managed_resource_conditionis queryable incoroot-prometheus,
one series per (resource, condition), value 1 forTrueand 0 forFalse. -
Readyis exported alongsideSynced, so the Ready-True-while-Synced-False
pair is expressible as a single query. - Ships default-off (unreferenced component), so activation is a separate,
independently reversible change. - Read-only RBAC scoped to the exported kind, not
apiGroups: ["*"]. - Verified after activation by comparing the metric against a live
kubectlread: 3Synced=False, 17Synced=True.
Rough size: one Kustomize component, off-the-shelf images, no bespoke code.
Metadata
Metadata
Assignees
Labels
Type
Fields
Projects
- Status
Activity
coderabbitai commentedon Aug 6, 2026
🔗 Related PRs
#2445 - feat(kubescape): route runtime-detection alerts to Headlamp, Slack, and Coroot [merged]
#2459 - feat: deploy Kyverno Policy Reporter (UI + kyverno plugin) [merged]
#2635 - fix(deploy): reboot stale nodes so containerd adopts refreshed GHCR auth [merged]
#2794 - fix(opencost): restore usage metrics [merged]
#2830 - feat(ci): publish Kubescape posture findings to Code Scanning [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
devantler commentedon Aug 6, 2026
Duplicate of #2986, which was filed ~7 hours earlier and covers the same increment. I filed
this after checking #2820 for claims and branches but not for existing children — the
sub-issue list was the signal I skipped.
Consolidating on #2986: it is the canonical child, it is already linked under #2820 alongside
#2987 (the alert half), and its evidence is broader (109 managed resources across 7 API groups,
plus the finding that Coroot's cluster-agent exposes only
imageunderclusterAgent.kubeStateMetrics— noCustomResourceStatehook, which is exactly why aseparate kube-state-metrics is needed).
#2994 is re-pointed at #2986. Closing this as the duplicate; nothing is lost.