The Kubernetes source's transport layer had 9 distinct failure sites
that surfaced only as logs: LIST failure (with retry/backoff), WATCH
start failure, WATCH stream Error event, watch flap (close within 5s
of open), and namespace informer sync timeout — once for secrets, once
for configmaps. None had a corresponding metric, so an exporter that
was functionally up but operationally degraded (token rotation drift,
apiserver throttling, intermittent network) was invisible to ops.
Introduce x509_kube_transport_errors_total{source_name,resource,reason}
incremented at each of the 9 sites via a new Recorder interface on
k8s.Options. The interface keeps the source decoupled from
*registry.Registry; nil is valid (the unmetered path keeps the old
log-only behaviour) and tests plug a fake. main.go wires the actual
registry through.
Ship a paired KubeTransportErrors PrometheusRule alert (opt-in via
alertOnKubeTransportErrors, default true). docs/metrics.md documents
the new metric, the five reason codes, and cross-links the alert.
Same root cause as the passphraseKey fix: when resolveRef fails and
tryEmptyPassphrase is false, the parser was being called with an empty
passphrase, producing a misleading digest error.
resolveRef now returns bool; call sites propagate failure into
passphraseUnavailable using the relevant TryEmpty flag. Tests updated
to assert the new (correct) skip behavior and cover the tryEmpty:true
path that must still fall through.
When passphraseKey is configured but the key is absent from the Secret
and tryEmptyPassphrase is false, the parser was called with an empty
passphrase anyway, producing a misleading 'invalid digest' error. Now
the source emits a bad_passphrase bundle error directly, and the
preceding debug log already names the missing key.
Thread ctx through onSecret→fetchPassphrase (contextcheck); suppress
SHA-1 gosec warnings in jceksHMAC with nosec (protocol-mandated by
JKS/JCEKS wire format); drop dead skip initialiser in decodeJCEKS
(ineffassign); remove redundant int64 cast on UnixMilli (unconvert).
