Feature/splunk observability scaler #6192

sschimper-splunk · 2024-09-26T08:20:20Z

With this pull request, I would like to add a new custom KEDA scaler that interacts with the Splunk Observability Cloud Platform. It is able to query metrics from Splunk Observability Cloud and scale a deployment according to a predefined target value.

As for now, I do not have the created a pull request to update the Helm chart, becasue I did not think it necessary. However, my knowledge about Helm charts is admittedly limited, and I am happy to fix this in hindsight if that is necessary.
Thank you.

Checklist

When introducing a new scaler, I agree with the scaling governance policy
I have verified that my change is according to the deprecations & breaking changes policy
Tests have been added
Changelog has been updated and is aligned with our changelog requirements
[N/A] A PR is opened to update our Helm chart (repo) (if applicable, ie. when deployment manifests are modified)
A PR is opened to update the documentation on (repo) (if applicable) -> Documentation for custom KEDA scaler for Splunk Observability Cloud keda-docs#1477
Commits are signed with Developer Certificate of Origin (DCO - learn more)

Relates to:

Initial proposal, Fixes #6190
Pull request containing the documentation on this scaler: #1477

… in hindsight Signed-off-by: Sebastian Schimper <[email protected]>

Signed-off-by: Sebastian Schimper <[email protected]>

tests/scalers/splunk_observability_test/splunk_observability_test.go

Signed-off-by: Sebastian Schimper <[email protected]>

circa10a · 2024-09-26T14:25:35Z

The only files we should be changing under pkg/ in this PR is scalers/ and scaling/. We should remove the other changes introduced.

tests/scalers/splunk_observability_test/splunk_observability_test.go

pkg/scalers/splunk_observability_scaler.go

tests/scalers/splunk_observability_test/splunk_observability_test.go

circa10a · 2024-10-10T17:04:36Z

We should probably set this PR to WIP/Draft state

zroubalik

Thanks for the contribution! could of points

helm update is not needed
please fix DCO

go.mod

pkg/metricsservice/api/metrics.pb.go

pkg/scalers/splunk_observability_scaler.go

tests/scalers/splunk_observability_test/splunk_observability_test.go

sschimper-splunk · 2024-10-21T09:03:05Z

Thank you for reviewing, @zroubalik. I will work during the next days on fixing the things pointed out.

zroubalik

Thank you for reviewing, @zroubalik. I will work during the next days on fixing the things pointed out.

@sschimper-splunk any updates here please? We will cut a new release Nov 7, so if you want this included in KEDA 2.16 we should resolve this asap. If you don't have we can release this in the following release, not a problem :)

sschimper-splunk · 2024-11-06T06:42:17Z

Hi @zroubalik,
thanks for the heads-up. Unfortunately, I will not be ready for the new release on November 7th, and I ask you to go ahead without this Splunk Observability Scaler.
I work towards being ready for the next release after November 7th. Apologies if I slowed things down.

Signed-off-by: Sebastian Schimper <[email protected]>

…files touched.

semgrep-app · 2024-12-17T12:44:33Z

tests/scalers/rabbitmq/rabbitmq_queue_http_auth/rabbitmq_queue_http_auth_test.go

+	password                  = fmt.Sprintf("%s-password", testName)
+	vhost                     = "/"
+	NoAuthConnectionString    = fmt.Sprintf("http://rabbitmq.%s.svc.cluster.local", rmqNamespace)
+	connectionString          = fmt.Sprintf("amqp://%s:%s@rabbitmq.%s.svc.cluster.local", user, password, rmqNamespace)


Semgrep identified an issue in your code:

Semgrep found a possible database connection string built with string concatenation. Check for proper encoding/escaping of components to prevent parse errors and injection vulnerabilities.

To resolve this comment:

No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Leave a nosemgrep comment directly above or at the end of line 38 like so // nosemgrep: kedacore.db-connection-string

Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-app · 2024-12-17T12:44:34Z

tests/scalers/rabbitmq/rabbitmq_queue_amqp_auth/rabbitmq_queue_amqp_auth_test.go

+	password                  = fmt.Sprintf("%s-password", testName)
+	vhost                     = "/"
+	NoAuthConnectionString    = fmt.Sprintf("amqp://rabbitmq.%s.svc.cluster.local", rmqNamespace)
+	connectionString          = fmt.Sprintf("amqp://%s:%s@rabbitmq.%s.svc.cluster.local", user, password, rmqNamespace)


Semgrep identified an issue in your code:

Semgrep found a possible database connection string built with string concatenation. Check for proper encoding/escaping of components to prevent parse errors and injection vulnerabilities.

To resolve this comment:

No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Leave a nosemgrep comment directly above or at the end of line 38 like so // nosemgrep: kedacore.db-connection-string

Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-app · 2024-12-17T12:44:35Z

pkg/scalers/github_runner_scaler_test.go

@@ -186,7 +195,7 @@ func apiStubHandler(hasRateLeft bool, exceeds30Repos bool) *httptest.Server {
 			w.WriteHeader(http.StatusForbidden)
 		}
 		if strings.HasSuffix(r.URL.String(), "jobs") {
-			_, _ = w.Write([]byte(testGhWFJobResponse))
+			_, _ = w.Write([]byte(jobResponse))


Semgrep identified a blocking 🔴 issue in your code:

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

To resolve this comment:

No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Leave a nosemgrep comment directly above or at the end of line 198 like so // nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter

Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-app · 2024-12-17T12:44:36Z

Semgrep found 1 no-direct-write-to-responsewriter finding:

pkg/scalers/azure_pipelines_scaler_test.go
- L345 - Triage

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

_{Ignore this finding from no-direct-write-to-responsewriter}

circa10a · 2024-12-17T16:31:33Z

Somehow the diff now shows 4400+ files changed

sschimper-splunk added 2 commits September 26, 2024 09:37

one commit on feature/splunk-observability-scaler to sign off commits…

ce352d0

… in hindsight Signed-off-by: Sebastian Schimper <[email protected]>

updated changelog accordingly

0f9052f

Signed-off-by: Sebastian Schimper <[email protected]>

sschimper-splunk requested a review from a team as a code owner September 26, 2024 08:20

semgrep-app bot reviewed Sep 26, 2024

View reviewed changes

tests/scalers/splunk_observability_test/splunk_observability_test.go Outdated Show resolved Hide resolved

corrected mistakes detected in Github workflow

62d6ef9

Signed-off-by: Sebastian Schimper <[email protected]>

circa10a reviewed Sep 26, 2024

View reviewed changes

resolved further feedback from PR kedacore#6192

1cbc128

zroubalik reviewed Oct 18, 2024

View reviewed changes

zroubalik reviewed Nov 5, 2024

View reviewed changes

sschimper-splunk mentioned this pull request Nov 28, 2024

Support Splunk Observability Cloud scaler #6190

Open

sschimper-splunk added 3 commits December 13, 2024 12:06

resolved further feedback from PR kedacore#6192

b4c0b3a

Signed-off-by: Sebastian Schimper <[email protected]>

re-setup the project with just the scaler, scaler test, and e2e test …

cd95abe

…files touched.

commiting after resolving merge conflict from pull

c1cc17e

semgrep-app bot reviewed Dec 17, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/splunk observability scaler #6192

Feature/splunk observability scaler #6192

sschimper-splunk commented Sep 26, 2024 •

edited by zroubalik

Loading

circa10a commented Sep 26, 2024

circa10a commented Oct 10, 2024

zroubalik left a comment

sschimper-splunk commented Oct 21, 2024

zroubalik left a comment

sschimper-splunk commented Nov 6, 2024

semgrep-app bot Dec 17, 2024

semgrep-app bot Dec 17, 2024

semgrep-app bot Dec 17, 2024

semgrep-app bot commented Dec 17, 2024

circa10a commented Dec 17, 2024

Feature/splunk observability scaler #6192

Are you sure you want to change the base?

Feature/splunk observability scaler #6192

Conversation

sschimper-splunk commented Sep 26, 2024 • edited by zroubalik Loading

Checklist

circa10a commented Sep 26, 2024

circa10a commented Oct 10, 2024

zroubalik left a comment

Choose a reason for hiding this comment

sschimper-splunk commented Oct 21, 2024

zroubalik left a comment

Choose a reason for hiding this comment

sschimper-splunk commented Nov 6, 2024

semgrep-app bot Dec 17, 2024

Choose a reason for hiding this comment

semgrep-app bot Dec 17, 2024

Choose a reason for hiding this comment

semgrep-app bot Dec 17, 2024

Choose a reason for hiding this comment

semgrep-app bot commented Dec 17, 2024

circa10a commented Dec 17, 2024

sschimper-splunk commented Sep 26, 2024 •

edited by zroubalik

Loading