add learning period label to TS CPs

[matthyx]

Summary by CodeRabbit

• New Features

  • Added a learning period duration label to container metadata.

• Chores

  • Updated dependency versions.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change adds a learning period tracking capability to the node-agent. It bumps a dependency version, computes a sniffing duration and stores it in shared container state, exposes this duration as a metadata label, and refactors label validation logic to apply overrides before final sanitization.

Changes

Cohort / File(s)	Summary
Dependency Update go.mod	Bumps github.com/kubescape/k8s-interface from v0.0.206 to v0.0.207.
Learning Period Integration pkg/containerprofilemanager/v1/lifecycle.go, pkg/objectcache/shared_container_data.go	Adds LearningPeriod field to WatchedContainerData struct, introduces formatDuration helper to format duration strings, and assigns computed sniffing duration to shared container state. Refactors label generation to apply overrides before single final sanitization pass (previously sanitized per-label).
Learning Period Tests pkg/objectcache/shared_container_data_test.go	Adds validation for new kubescape.io/learning-period metadata label in existing test scenarios and introduces Test_formatDuration unit test with table-driven subtests covering various duration inputs.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Fix: Update related kind labels and allow overriding #754: Modifies pkg/objectcache/shared_container_data.go to change GetLabels behavior and WatchedContainerData struct fields with label construction and sanitization logic.
• add new metadata to CPs #745: Updates pkg/objectcache/shared_container_data.go's GetLabels and label-generation logic, adding new metadata labels and refactoring label composition.

Suggested reviewers

• jnathangreeg

Poem

🐰 A learning period takes its place,
In containers' metadata space,
With durations formatted tight,
The sniffing time shines so bright,
A rabbit observes with delight! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'add learning period label to TS CPs' accurately describes the main change: adding a new LearningPeriod label to WatchedContainerData, which is directly reflected in the code modifications.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch learning-period-label

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.000	0.000	N/A
Peak CPU (cores)	0.000	0.000	N/A
Avg Memory (MiB)	0.000	0.000	N/A
Peak Memory (MiB)	0.000	0.000	N/A

Dedup Effectiveness

No data available.

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.159	0.154	-3.2%
Peak CPU (cores)	0.164	0.161	-1.9%
Avg Memory (MiB)	332.361	258.823	-22.1%
Peak Memory (MiB)	338.590	264.832	-21.8%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	1	0	0.0%
hardlink	6000	0	0.0%
http	1704	119455	98.6%
network	899	77938	98.9%
open	34498	621834	94.7%
symlink	6000	0	0.0%
syscall	982	1889	65.8%

Event Counters

Metric	BEFORE	AFTER
capability_counter	9	8
dns_counter	1468	1398
exec_counter	7346	7024
network_counter	96599	92334
open_counter	805808	768157
syscall_counter	3499	3502

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

pkg/objectcache/shared_container_data.go (1)

94-99: formatDuration works but is brittle to representation changes.

The two strings.Replace calls correctly compact time.Duration.String() output for the cases covered by Test_formatDuration (verified for 5m, 1h30m, 45s, 1h30s, 1h, and 0). However, it relies on the exact format of time.Duration.String() (e.g., it would also strip m0s from inside fractional-second strings like "1h0m0.5s" only partially). For the duration ranges this codebase uses (sniffing time in minutes/hours), this is acceptable — flagging only as a heads-up for future maintenance.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/objectcache/shared_container_data.go` around lines 94 - 99,
formatDuration currently massages time.Duration.String() output with brittle
string replacements (m0s/h0m) which can break for fractional seconds or
unexpected representations; update formatDuration to build the output from
duration components instead of post-processing the string: compute hours,
minutes and seconds (using d.Hours()/Minutes()/Seconds() or integer
division/modulo on d.Seconds()/time.Second) and format them conditionally (e.g.,
print hours if >0, minutes if >0, seconds otherwise) so outputs like "1h", "5m",
"1h30m", "45s", "1h30s", and "0s" are produced deterministically without relying
on time.Duration.String(). Ensure the logic lives in formatDuration and
preserves existing test cases.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/objectcache/shared_container_data.go`:
- Around line 104-107: The current loop applies watchedContainer.LabelOverrides
directly to labels which allows an invalid override to overwrite the base label
and later be dropped by sanitization; instead, validate each override entry
before applying it: iterate over watchedContainer.LabelOverrides, run the same
per-entry validation/sanitization logic used later (or a dedicated
isValidLabelValue check) and only set labels[k] = v when the override value is
valid; this preserves the original base label for keys whose overrides are
invalid and prevents losing keys during the later sanitization pass.

---

Nitpick comments:
In `@pkg/objectcache/shared_container_data.go`:
- Around line 94-99: formatDuration currently massages time.Duration.String()
output with brittle string replacements (m0s/h0m) which can break for fractional
seconds or unexpected representations; update formatDuration to build the output
from duration components instead of post-processing the string: compute hours,
minutes and seconds (using d.Hours()/Minutes()/Seconds() or integer
division/modulo on d.Seconds()/time.Second) and format them conditionally (e.g.,
print hours if >0, minutes if >0, seconds otherwise) so outputs like "1h", "5m",
"1h30m", "45s", "1h30s", and "0s" are produced deterministically without relying
on time.Duration.String(). Ensure the logic lives in formatDuration and
preserves existing test cases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 989fc585-c048-499a-94f8-387a3c256e64

📥 Commits

Reviewing files that changed from the base of the PR and between 4aefa65 and 93a5542.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• go.mod
• pkg/containerprofilemanager/v1/lifecycle.go
• pkg/objectcache/shared_container_data.go
• pkg/objectcache/shared_container_data_test.go

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Behavior change: invalid LabelOverrides now drop the base label too.

Previously, overrides were validated per-entry and invalid overrides were discarded so the underlying base label remained. With the single-pass sanitization at Lines 127–139, an invalid override value now first overwrites the base value at Line 106 and is then removed entirely at Line 137 — so the resulting label map is missing the key in cases where it would have kept the (valid) base value before.

If overrides are expected to be trusted/pre-validated this is fine; otherwise consider validating overrides before applying:

♻️ Suggested fix

 	// Apply label overrides
 	for k, v := range watchedContainer.LabelOverrides {
+		if v == "" || len(content.IsLabelValue(v)) != 0 {
+			continue
+		}
 		labels[k] = v
 	}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Apply label overrides
	for k, v := range watchedContainer.LabelOverrides {
	if v == "" {
	delete(labels, k)
	} else if errs := content.IsLabelValue(v); len(errs) != 0 {
	logger.L().Warning("GetLabels - label override value is not valid, skipping", helpers.String("key", k), helpers.String("value", v))
	delete(labels, k)
	} else {
	labels[k] = v
	}
	labels[k] = v
	}
	// Apply label overrides
	for k, v := range watchedContainer.LabelOverrides {
	if v == "" || len(content.IsLabelValue(v)) != 0 {
	continue
	}
	labels[k] = v
	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/objectcache/shared_container_data.go` around lines 104 - 107, The current
loop applies watchedContainer.LabelOverrides directly to labels which allows an
invalid override to overwrite the base label and later be dropped by
sanitization; instead, validate each override entry before applying it: iterate
over watchedContainer.LabelOverrides, run the same per-entry
validation/sanitization logic used later (or a dedicated isValidLabelValue
check) and only set labels[k] = v when the override value is valid; this
preserves the original base label for keys whose overrides are invalid and
prevents losing keys during the later sanitization pass.

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.157	0.161	+3.1%
Peak CPU (cores)	0.161	0.166	+3.0%
Avg Memory (MiB)	330.342	266.321	-19.4%
Peak Memory (MiB)	332.016	272.000	-18.1%

Dedup Effectiveness (AFTER only)

Event Type	Passed	Deduped	Ratio
capabilities	0	0	N/A
hardlink	6000	0	0.0%
http	1704	119456	98.6%
network	900	78000	98.9%
open	36214	619955	94.5%
symlink	6000	0	0.0%
syscall	974	1859	65.6%

Event Counters

Metric	BEFORE	AFTER
capability_counter	11	8
dns_counter	1441	1407
exec_counter	7209	7079
network_counter	94837	93050
open_counter	789222	776659
syscall_counter	3539	3462