Add anonymous phone-home telemetry via CronJob

[axon-agent]

Summary

• Adds a new internal/telemetry package with anonymous aggregate data collection and HTTP reporting
• Adds --telemetry-report and --telemetry-endpoint flags to the controller binary for one-shot telemetry mode
• Adds a daily CronJob (axon-telemetry) to install.yaml that runs the controller in one-shot mode
• Includes comprehensive unit tests for collection, sending, installation ID management, and source type extraction

Data collected (all anonymous aggregates, no PII):

• Task counts by type and phase
• Feature adoption (TaskSpawners, AgentConfigs, Workspaces, source types)
• Scale metrics (distinct namespaces)
• Usage totals (cost USD, input/output tokens)
• Installation ID (random UUID), Axon version, K8s version

Opt-out: Delete the CronJob (kubectl delete cronjob axon-telemetry -n axon-system) or remove it from install.yaml before applying.

Closes #390

Test plan

• make verify passes
• make test passes (including new telemetry unit tests)
• CI passes all checks
• Manual: run with --telemetry-report --telemetry-endpoint=http://localhost:8888 against a local cluster

🤖 Generated with Claude Code

---

Summary by cubic

Adds a daily CronJob that runs the controller in one-shot mode to send anonymous aggregate telemetry, addressing #390. Helps track feature adoption and scale without collecting PII.

• New Features

  • New internal/telemetry package to collect and post reports.
  • Controller flags: --telemetry-report and --telemetry-endpoint (default https://telemetry.axon.dev/v1/report).
  • CronJob axon-telemetry added to install.yaml, runs daily at 06:00 UTC.
  • Report includes task counts (by type/phase), feature usage (TaskSpawners, AgentConfigs, Workspaces, source types), namespaces, cost/tokens totals, Axon/K8s versions, and a random installation ID.
  • HTTP requests set User-Agent: axon-telemetry/ for server-side observability.
  • Comprehensive unit tests for collection, sending, ID management, and source type extraction.

• Migration

  • No action needed; CronJob is included in install.yaml.
  • Opt out by deleting the CronJob (kubectl delete cronjob axon-telemetry -n axon-system) or removing it from install.yaml.
  • To test or override the endpoint, run the controller with --telemetry-report --telemetry-endpoint=.

^{Written for commit 90f8b2b. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 6 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/manifests/install.yaml">

<violation number="1" location="internal/manifests/install.yaml:314">
P2: The telemetry CronJob runs under the controller ServiceAccount, which has broad write privileges (secrets, deployments, tasks). For least-privilege, use a dedicated ServiceAccount/Role with only the read permissions telemetry needs.</violation>
</file>

<file name="internal/telemetry/telemetry.go">

<violation number="1" location="internal/telemetry/telemetry.go:297">
P2: Handle a possible AlreadyExists race when creating the telemetry ConfigMap; otherwise concurrent runs can fail even though the ConfigMap was created by another instance.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: The telemetry CronJob runs under the controller ServiceAccount, which has broad write privileges (secrets, deployments, tasks). For least-privilege, use a dedicated ServiceAccount/Role with only the read permissions telemetry needs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/manifests/install.yaml, line 314:

<comment>The telemetry CronJob runs under the controller ServiceAccount, which has broad write privileges (secrets, deployments, tasks). For least-privilege, use a dedicated ServiceAccount/Role with only the read permissions telemetry needs.</comment>

<file context>
@@ -292,3 +292,41 @@ spec:
+      backoffLimit: 3
+      template:
+        spec:
+          serviceAccountName: axon-controller
+          restartPolicy: OnFailure
+          containers:
</file context>