feat(cert-manager): Add KSM metrics for Challenge CRs

[vittico]

Configures kube-state-metrics to track acme.cert-manager.io/v1 Challenge Custom Resources. This is required for alert rules monitoring challenge queue saturation and stale challenges, as the native cert-manager challenge metrics are not available in the currently deployed versions.

Adds two metrics:

• certmanager_challenge_cr_created: Gauge tracking the creation timestamp.
• certmanager_challenge_cr_info: Info metric exposing the state label from status.state (e.g., pending, processing).

Also grants the kube-state-metrics ClusterRole get, list, watch access to challenges in the acme.cert-manager.io API group.

Related to: ROSAENG-3733

What type of PR is this?

(bug/feature/cleanup/documentation)

What this PR does / why we need it?

Which Jira/Github issue(s) this PR fixes?

Fixes #

Special notes for your reviewer:

Pre-checks (if applicable):

• Tested latest changes against a cluster

• Included documentation changes with PR

• If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with:

  matchExpressions:
  - key: api.openshift.com/fedramp
    operator: NotIn
    values: ["true"]

Summary by CodeRabbit

• New Features

  • Added support for collecting metrics from cert-manager Challenge resources, including creation time and current state.
  • Expanded kube-state-metrics coverage for snapshot-related resources.

• Bug Fixes

  • Updated snapshot metrics configuration to normalize the VolumeSnapshot metric definition.
  • Extended permissions so the metrics system can watch additional resource types for more complete data collection.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (3)

• hack/00-osd-managed-cluster-config-integration.yaml.tmpl is excluded by !hack/**
• hack/00-osd-managed-cluster-config-production.yaml.tmpl is excluded by !hack/**
• hack/00-osd-managed-cluster-config-stage.yaml.tmpl is excluded by !hack/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c7340fc2-ff9b-47ba-9ccb-4d7b8d551603

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Updates the kube-state-metrics ConfigMap to add a cert-manager Challenge custom-resource metric definition (created gauge and info state label) and fixes an existing VolumeSnapshot gauge path indentation. Extends the ClusterRole to grant get/list/watch on acme.cert-manager.io challenges and adds watch on VolumeSnapshots.

Changes

Cert-manager Challenge metrics and RBAC

Layer / File(s)	Summary
Challenge metric definitions deploy/hypershift-kube-state-metrics/025-configmap.yaml	Fixes indentation of the VolumeSnapshot created gauge path and adds a new certmanager_challenge_cr metric definition exposing a created gauge and an info metric with a state label from status.state.
RBAC permissions update deploy/hypershift-kube-state-metrics/040-clusterrole.yaml	Adds watch verb to the snapshot.storage.k8s.io rule and a new rule granting get/list/watch on acme.cert-manager.io challenges resources.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding kube-state-metrics support for cert-manager Challenge custom resources.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes YAML manifests; no Go test files or Ginkgo titles were added, and no dynamic test-title patterns were found.
Test Structure And Quality	✅ Passed	PR only changes kube-state-metrics YAML; no Ginkgo test files or test code are present/touched, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes kube-state-metrics YAML/RBAC; no Ginkgo/e2e test files or test declarations were added, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates kube-state-metrics YAML/RBAC; no new Ginkgo tests or node-topology assumptions were added, so SNO compatibility is not implicated.
Topology-Aware Scheduling Compatibility	✅ Passed	Only KSM ConfigMap and ClusterRole changed; no affinity, nodeSelector, topologySpreadConstraints, tolerations, or replica adjustments were introduced.
Ote Binary Stdout Contract	✅ Passed	PR only changes kube-state-metrics YAML manifests; no process-level binary code or stdout writes are introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only deployment YAML changed; no new Ginkgo e2e tests or IPv4/external-connectivity code was added.
No-Weak-Crypto	✅ Passed	Changes are YAML-only metrics/RBAC; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparisons found.
Container-Privileges	✅ Passed	The PR only changes a ConfigMap and ClusterRole; neither adds privileged/root/hostPID/hostNetwork/hostIPC/allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	No logging was added; the PR only updates kube-state-metrics YAML to expose Challenge metadata/state, with no secrets, tokens, PII, or hostnames.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@vittico: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[vittico]

/lgtm

[openshift-ci]

@vittico: you cannot LGTM your own PR.

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: eqrx, vittico
Once this PR has been reviewed and has the lgtm label, please assign joshbranham for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment