use multiple secrets if scrape config exceeds K8s secret limit

[AndrewChubatiuk]

vmagent and vmsingle: use additional secrets if default scrape config size exceeds K8s secret limit. fixes #1048

---

Summary by cubic

Splits oversized scrape configs for vmagent/vmsingle into multiple gzip-compressed Secrets and loads overflow jobs via scrape_config_files. Adds config-reloader support to mirror and decompress watched files into an EmptyDir and clean up stale files.

• New Features

  • vmagent/vmsingle: When scrape config exceeds the 1MB Secret limit, overflow jobs are split using compressed-size-aware packing into extra Secrets (jobs.yaml). Pods mount a shared sc-files-out EmptyDir; config-reloader watches per-bucket raw Secret dirs and writes decompressed files to matching subdirs. The main config adds a scrape_config_files glob, and stale extra Secrets are removed automatically.
  • config-reloader: Added --target-dir paired with --watched-dir (counts must match). Detects gzip and decompresses. Copies files on init/start and on change, and removes orphaned files in the target.

• Bug Fixes

  • Ignore NotFound errors when updating child status conditions to avoid noisy failures during reconcile.

^{Written for commit 5af4c85. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 16 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[AndrewChubatiuk]

@cubic-ai-dev

[cubic-dev-ai]

@cubic-ai-dev

@AndrewChubatiuk I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

2 issues found across 17 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/controller/operator/factory/vmsingle/vmsingle.go">

<violation number="1" location="internal/controller/operator/factory/vmsingle/vmsingle.go:129">
P2: `prevDeploy` is always constructed with `extraConfigSecretCount=0`, even when the previous deployment had extra config secrets. This causes unnecessary deployment updates on every reconciliation for VMSingle instances with oversized scrape configs, as the prevDeploy/newDeploy comparison will always see a volume/mount diff.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: prevDeploy is always constructed with extraConfigSecretCount=0, even when the previous deployment had extra config secrets. This causes unnecessary deployment updates on every reconciliation for VMSingle instances with oversized scrape configs, as the prevDeploy/newDeploy comparison will always see a volume/mount diff.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/controller/operator/factory/vmsingle/vmsingle.go, line 129:

<comment>`prevDeploy` is always constructed with `extraConfigSecretCount=0`, even when the previous deployment had extra config secrets. This causes unnecessary deployment updates on every reconciliation for VMSingle instances with oversized scrape configs, as the prevDeploy/newDeploy comparison will always see a volume/mount diff.</comment>

<file context>
@@ -125,22 +126,22 @@ func CreateOrUpdate(ctx context.Context, cr *vmv1beta1.VMSingle, rclient client.
 	if prevCR != nil {
 		var err error
-		prevDeploy, err = newDeploy(ctx, prevCR)
+		prevDeploy, err = newDeploy(ctx, prevCR, 0)
 		if err != nil {
 			return fmt.Errorf("cannot generate prev deploy spec: %w", err)
</file context>