Skip to content

Add anonymous phone-home telemetry via CronJob #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
axon-agent wants to merge 2 commits into from
Closed

Add anonymous phone-home telemetry via CronJob #424

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
020aa05
Add anonymous phone-home telemetry via CronJob
gjkim42 Feb 23, 2026
90f8b2b
Address review feedback for telemetry package
gjkim42 Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions cmd/axon-controller/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,14 @@ import (
"k8s.io/client-go/kubernetes"
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/healthz"
"sigs.k8s.io/controller-runtime/pkg/log/zap"

axonv1alpha1 "github.com/axon-core/axon/api/v1alpha1"
"github.com/axon-core/axon/internal/controller"
"github.com/axon-core/axon/internal/githubapp"
"github.com/axon-core/axon/internal/telemetry"
)

var (
Expand Down Expand Up @@ -44,6 +46,8 @@ func main() {
var spawnerImagePullPolicy string
var tokenRefresherImage string
var tokenRefresherImagePullPolicy string
var telemetryReport bool
var telemetryEndpoint string

flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
Expand All @@ -62,6 +66,8 @@ func main() {
flag.StringVar(&spawnerImagePullPolicy, "spawner-image-pull-policy", "", "The image pull policy for spawner Deployments (e.g., Always, Never, IfNotPresent).")
flag.StringVar(&tokenRefresherImage, "token-refresher-image", controller.DefaultTokenRefresherImage, "The image to use for the token refresher sidecar.")
flag.StringVar(&tokenRefresherImagePullPolicy, "token-refresher-image-pull-policy", "", "The image pull policy for the token refresher sidecar (e.g., Always, Never, IfNotPresent).")
flag.BoolVar(&telemetryReport, "telemetry-report", false, "Run a one-shot telemetry report and exit.")
flag.StringVar(&telemetryEndpoint, "telemetry-endpoint", "https://telemetry.axon.dev/v1/report", "The endpoint to send telemetry reports to.")

opts := zap.Options{
Development: true,
Expand All @@ -71,6 +77,25 @@ func main() {

ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))

if telemetryReport {
cfg := ctrl.GetConfigOrDie()
c, err := client.New(cfg, client.Options{Scheme: scheme})
if err != nil {
setupLog.Error(err, "Unable to create client for telemetry")
os.Exit(1)
}
clientset, err := kubernetes.NewForConfig(cfg)
if err != nil {
setupLog.Error(err, "Unable to create clientset for telemetry")
os.Exit(1)
}
if err := telemetry.Run(ctrl.SetupSignalHandler(), c, clientset, telemetryEndpoint); err != nil {
setupLog.Error(err, "Telemetry report failed")
os.Exit(1)
}
os.Exit(0)
}

mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
Scheme: scheme,
HealthProbeBindAddress: probeAddr,
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ module github.com/axon-core/axon
go 1.25.0

require (
github.com/google/uuid v1.6.0
github.com/google/yamlfmt v0.21.0
github.com/onsi/ginkgo/v2 v2.27.2
github.com/onsi/gomega v1.38.3
Expand Down Expand Up @@ -44,7 +45,6 @@ require (
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
github.com/google/renameio/v2 v2.0.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
Expand Down
38 changes: 38 additions & 0 deletions install.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,3 +292,41 @@ spec:
requests:
cpu: 10m
memory: 64Mi
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: axon-telemetry
namespace: axon-system
labels:
app.kubernetes.io/name: axon
app.kubernetes.io/component: telemetry
spec:
schedule: "0 6 * * *"
concurrencyPolicy: Replace
successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1
jobTemplate:
spec:
backoffLimit: 3
template:
spec:
serviceAccountName: axon-controller
restartPolicy: OnFailure
containers:
- name: telemetry
image: gjkim42/axon-controller:latest
args:
- --telemetry-report
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 10m
memory: 32Mi
38 changes: 38 additions & 0 deletions internal/manifests/install.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,3 +292,41 @@ spec:
requests:
cpu: 10m
memory: 64Mi
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: axon-telemetry
namespace: axon-system
labels:
app.kubernetes.io/name: axon
app.kubernetes.io/component: telemetry
spec:
schedule: "0 6 * * *"
concurrencyPolicy: Replace
successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1
jobTemplate:
spec:
backoffLimit: 3
template:
spec:
serviceAccountName: axon-controller
Copy link

@cubic-dev-ai cubic-dev-ai bot Feb 23, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The telemetry CronJob runs under the controller ServiceAccount, which has broad write privileges (secrets, deployments, tasks). For least-privilege, use a dedicated ServiceAccount/Role with only the read permissions telemetry needs.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At internal/manifests/install.yaml, line 314:

<comment>The telemetry CronJob runs under the controller ServiceAccount, which has broad write privileges (secrets, deployments, tasks). For least-privilege, use a dedicated ServiceAccount/Role with only the read permissions telemetry needs.</comment>

<file context>
@@ -292,3 +292,41 @@ spec:
+      backoffLimit: 3
+      template:
+        spec:
+          serviceAccountName: axon-controller
+          restartPolicy: OnFailure
+          containers:
</file context>
Fix with Cubic

restartPolicy: OnFailure
containers:
- name: telemetry
image: gjkim42/axon-controller:latest
args:
- --telemetry-report
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 10m
memory: 32Mi
Loading