[petruanica]

Description of the issue

The label tests know only the attribute denylist. The otelFilters label include lists and namespace filter remove data in other processors. An include entry that names a label inside a built-in prefix also makes the chart remove the rest of that prefix in a transform processor. On a cluster that uses these filters, the label tests report false failures. A customer can also choose to remove a protected label with an exclude, and the denylist test then fails.

Description of changes

• The label tests read the k8sattributes label rules and the namespace filter conditions from each agent's ConfigMap (label_extraction.go, namespace_filter.go). A label that no rule extracts must be absent. A pod in a namespace that the filter drops needs no series. ParseAttributeDenylist also reads the label exception transform (label_exception.go), by its statement shape. If an otelFilters include entry names a label or a longer prefix inside a built-in prefix, the chart renders this transform. It removes the labels under that prefix except the named entries, and the denylist still removes an exclude entry after it. NeverDeniedViolations also reports a never-denied attribute that the transform removes. The model cannot read every filter shape, for example a transform that removes or writes label attributes in another way. For such a shape, the subtest skips and names the processor and the reason (ErrFilterNotModeled). The tests read the rendered collector configuration, not the Helm values. ReconcileLabels and ReconcileObjects take a LabelExtraction in place of the label prefix.
• TestDenylistSparesNeverDeniedAttributes stays strict by default. OTEL_POD_LABEL_EXCLUDES and OTEL_NODE_LABEL_EXCLUDES (util/otelmetrics/host_types.go) declare the otelFilters.podLabels.exclude and otelFilters.nodeLabels.exclude patterns that a cluster was deployed with. The standard suite's TestMain prints them. The test logs the denylist entries that those patterns render to. It fails for every other entry that removes a never-denied attribute.

This is PR 4 of 4. It builds on PR 3.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

The unit tests in util/otelmetrics run without a cluster and pass with -race. They cover these areas:

• the label excludes variables, the denylist that the declared excludes render to, and the split of a denylist into declared excludes and chart entries
• label extraction rules, namespace filter conditions, and filter shapes that the model cannot read
• label reconciliation with extraction rules that leave out a label
• the label exception transform, on collector configurations that helm template rendered from aws-observability/helm-charts with otelFilters values (testdata/label_filters). The cases are a label and a longer prefix inside a built-in prefix, an exclude entry that removes a kept label, the default values without a transform, and changed transform shapes.

go vet -tags integration passes on util/otelmetrics and on every package under test/otel. gofmt reports nothing, and make compile passes.

The label tests ran against an EKS test cluster on this commit, with the chart from aws-observability/helm-charts main.

• With otelFilters.nodeLabels.include: ["*", "beta.kubernetes.io/arch"], the chart renders transform/cw_k8s_ci_v0_metrics_labels. TestNodeLabelsReachMetrics reads that transform from both agent configurations, expects beta.kubernetes.io/arch and no other beta.kubernetes.io/ label on each node, and passes on both paths. TestDenylistSparesNeverDeniedAttributes also passes.
• With the default values again, both tests pass and the model finds no transform.

PR Checklist

• Commits are squashed into a logical, reviewable set (one commit for a single change)
• Commits and PR description comply with Amazon internal guidelines
• make passes locally (build, unit tests, lint): make compile and make simple-lint, the targets that the build-check workflow runs, pass on this commit, and so do the util/otelmetrics unit tests with -race.
• All GitHub Actions checks on the PR are passing
• Integration test evidence: N/A for a GitHub Actions run, because this PR changes the test framework itself. The label tests ran against an EKS test cluster on this commit, see Tests.
• New or updated integration test coverage: N/A, this PR is the test change.
• Related PRs in any repo are linked in this description and link back to this PR, with any required merge or release order stated: this is PR 4 of 4. Merge it after fix(otelmetrics): return complete query results and honor Retry-After #792, test(otel): check node and pod labels, the attribute schema and KSM zones against the cluster #793 and test(otel): run the every-series checks on every node #794. The label filter model follows the otelFilters rendering of feat(chart): Add namespace filters for OTel Container Insights aws-observability/helm-charts#393, Integration Test - Implement the validation for metric value availability and duplicate EMF logs #394 and add macOS sonoma #395 (merged).
• New functionality has unit tests; bug fixes have a reproducing test
• Config translation changes include updated golden files: N/A, this PR changes no config translation.
• Breaking or customer-visible changes are called out in the PR description: N/A, this PR changes test code only.