Policy Reporter Metrics

Policy Reporter metrcis are an optional feature and represents your PolicyReport and ClusterPolicyReport resources as gauge metrics with a customizable set of labels.

Enable Metrics

values.yaml

metrics:
  enabled: true

config.yaml

metrics:
  enabled: true

CLI

/policyreporter run -m

Database-related metrics are enabled separately with database.metrics: true.

Metrics Filter

To reduce the number of metric elements, it is possible to filter out results for metric processing. All available filters supporting wildcards and can be defined as include or exclude list.

Supported Filter

Filter	Description
kinds	Kind of the result resource
namespaces	Namespace of the result resource
policies	Policy of the result
severities	Severity of the result
sources	Source of the result
status	Status of the result

Example Filter configuration

metrics:
  enabled: true
  filter:
    namespaces:
      include: ["prod", "stage"]
    sources:
      include: ["Trivy*", "Kyverno"]
    status:
      exclude: ["skip"]
    kinds:
      exclude: ["Pod"]

Metrics customization

By default, the metrics have a very high cardinality and generate one entry per PolicyReportResult. In order to reduce the cardinality to the required minimum, it is possible to adjust the labels provided for all metrics.

Metric Modes

Policy Reporter ships with three different modes to control the metrics customization.

• detailed (default): provides all existing label information but has a high cardinality. Creates 1 metric per resource / policy / rule

• simple: provides a predefined subset of the available labels with a lower cardinality. Provides "namespace", "policy", "status", "severity", "category", "source"

• custom: provides the configured labels as list via the metrics.customLabels value. It supports all labels that are also available in the detailed mode and in addition message for the result message. See the API Reference for details.

Custom Mode special features

Besides the default set of labels available for custom mode it is also possible to append additional information like the result message, PolicyReport labels or PolicyReportResult properties as labels to the metrics.

Append PolicyReport Label

Use (Cluster)PolicyReport labels as additional metric labels in custom mode. Invalid label characters will be replaced with _.

Example

apiVersion: wgpolicyk8s.io/v1alpha2
kind: PolicyReport
metadata:
  labels:
    app: nginx
  name: cpol-disallow-host-path
  namespace: test

metrics:
  enabled: true
  mode: custom
  customLabels: ["status","label:app"]

# TYPE policy_report_result gauge
policy_report_result{app="nginx",status="pass"} 1
policy_report_result{app="",status="pass"} 1

---

Append PolicyReportResult Property

Use PolicyReportResult properties as additional metric labels in custom mode. Invalid label characters will be replaced with _.

Example

apiVersion: wgpolicyk8s.io/v1alpha2
kind: PolicyReport
  name: trivy-vuln-polr-nginx-5fbc65fff
  namespace: test
  ...
results:
- category: Vulnerability Scan
  message: 'apt: integer overflows and underflows while parsing .deb packages'
  policy: CVE-2020-27350
  properties:
    artifact.repository: library/nginx
    artifact.tag: "1.17"
    score: "5.7"

metrics:
  enabled: true
  mode: custom
  customLabels: ["property:score", "property:artifact.tag", "status"]

# TYPE policy_report_result gauge
policy_report_result{artifact_tag="1.17",score="5.7",status="pass"} 1
policy_report_result{artifact_tag="",score="",status="pass"} 1

API Reference

List of available metrics and available labels.

Database metrics

Policy Reporter exposes database metrics when database.metrics is enabled. They help to observe pool health, query latency, and write failures.

policy_reporter_database_errors_total

Counter: Total number of database errors.

Label	Description
operation	Database operation that failed
table	Database table involved in the failed operation
reason	Error reason, for example timeout, connection_refused, or unknown

database_connections

Gauge: Current number of open database connections.

database_max_open_connections

Gauge: Maximum number of open database connections.

database_idle_connections

Gauge: Current number of idle database connections.

database_max_idle_time_closed

Gauge: Number of connections closed because they exceeded the idle time limit.

database_max_idle_closed

Gauge: Number of connections closed because they exceeded the maximum idle limit.

database_max_lifetime_closed

Gauge: Number of connections closed because they exceeded the maximum lifetime.

database_in_use

Gauge: Number of connections currently in use.

database_wait_count

Gauge: Total number of waits for a free connection.

database_wait_duration

Gauge: Total time spent waiting for a free connection.

database_query_timing

Histogram: Timing of processed queries in milliseconds.

database metric labels

Database metrics share the labels database and system. The query histogram also includes operation and table.

cluster_policy_report_result

Gauge: Bye default one entry represents one result in a ClusterPolicyReport. Deleted results will also be removed from this metrics.

default set of labels

Label	Description
category	Category of the Result
kind	Kind of the result resource
name	Name of the result resource
policy	Policy of the result
report	Name of ClusterPolicyReport resource
rule	Rule of the result
severity	Severity of the result
source	Source of the result
status	Status of the result

policy_report_result

Gauge: Bye default one entry represents one result in a PolicyReport. Deleted results will also be removed from this metrics.

default set of labels

Label	Description
category	Category of the Result
kind	Kind of the result resource
name	Name of the result resource
namespace	Namespace of the result resource
policy	Policy of the result
report	Name of ClusterPolicyReport resource
rule	Rule of the result
severity	Severity of the result
source	Source of the result
status	Status of the result